Bug: Bound durable startup benchmark batches

[smiggleworth]

Type

Bug

Linked issue

Fixes #165

Summary

Write benchmark documents in bounded 10,000-row storage batches during unmeasured fixture setup so representative durable fixtures remain recoverable under Midge's WAL decompression limit.

User/operator impact

The 100k startup benchmark can shut down and reopen its durable fixture instead of aborting canonical evidence with an oversized WAL record.

Current and expected behavior

Canonical run 32521755392 submitted all 100k documents in one put_documents call. On reopen, WAL recovery rejected a legitimate 81,283,353-byte LZ4 output against the 67,108,864-byte limit. Fixture setup now uses multiple existing atomic calls; measured reopen behavior and product-side Midge API/atomicity remain unchanged.

Scope

One benchmark fixture helper and one focused source contract. No runtime source, storage format, public API, query behavior, threshold, or validator changes. The touched legacy fixture file remains below the 1,000-line limit at 990 lines.

Evidence and support status

Red:

• Canonical run 32521755392 failed startup_reopen/100k at WAL recovery.
• should_bound_durable_benchmark_document_write_batches failed on current main because no bound or batched loop existed.

Green:

• The focused contract passes.
• The exact 100k durable startup owner passes shutdown/reopen with one diagnostic sample.
• Its artifact records 100,000 result rows, zero failed operations, zero leaked workers, and a 4.71-second measured reopen. The single sample is diagnostic-only and is not a performance claim.

Validation

• cargo build --locked --bin cassie passed.
• RUST_TEST_THREADS=1 cargo test --locked passed.
• cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::pedantic passed.
• cargo fmt --all -- --check passed.
• cntryl-tools validate-tests -f tests/benchmark_startup_recovery_contract.rs passed (1/1).
• cargo bench --locked --bench tier3_system_startup -- --workload startup_reopen --profile smoke --samples 1 --warmup-samples 0 passed against the native-disk profile.

Acceptance criteria

• Prevent unbounded durable benchmark document batches with red/green coverage.
• Keep batching outside measured reopen and preserve 100k cardinality/boundary checks.
• Prove the exact 100k durable startup owner reopens successfully.
• Pass the complete required local ladder.
• Pass exact-head backend CI.
• Complete self-review.
• Squash merge and issue readback are complete.
• Rerun final-main canonical evidence after merge.

Status

Ready for review at exact head a706e34616a71666f23aee003805efac1a95985e. Benchmark-fixture setup only; no product runtime behavior change.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.