[v0.4] Sync completeness, source epochs and recoverable partial imports #38

Tracks #31. Target: v0.4 — Static graph → Change investigation.

Problem

The current plugin protocol may keep records written before an interrupted sync. Investigations must not confuse partially ingested data with complete source coverage.

Scope

• Track per-source sync-run IDs, start/end, status (complete/partial/failed/cancelled), cursor and mapper version.
• Mark evidence and findings with the source epoch/completeness they rely on.
• Make full-sync removals contingent on a verified complete enumerated source; preserve idempotent stable-ID merge behavior.
• Define recovery/resume/retry handling for interrupted imports, avoiding silent "all clear" interpretations.
• Surface coverage warnings in CLI, UI and generated investigation reports.

Acceptance criteria

• Plugin failure mid-stream is visible as partial/failed with affected source IDs.
• A partial sync does not produce false confirmed deletions or "no exposure" conclusions.
• Repeated completed full/incremental syncs remain deterministic and idempotent.
• Fixtures test cancellation, duplicate IDs, missing edge endpoints, changed cursors and source disappearance.
• No secrets or raw credentials written to sync logs.

Out of scope: generic distributed exactly-once ingestion.