Views cutover steps C to G, landed together

benchmarks/aft-search/slice-descriptors/land-views-c-base-references.json

@@ -0,0 +1,8 @@
+{
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "slice_class": "non_ranking",
+  "fixtures": [
+    "harness-goldens"
+  ]
+}

benchmarks/aft-search/slice-descriptors/land-views-c2-v3-publication.json

@@ -0,0 +1,8 @@
+{
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "slice_class": "non_ranking",
+  "fixtures": [
+    "harness-goldens"
+  ]
+}

benchmarks/aft-search/slice-descriptors/land-views-e-legacy-imports.json

@@ -0,0 +1,8 @@
+{
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "slice_class": "non_ranking",
+  "fixtures": [
+    "harness-goldens"
+  ]
+}

benchmarks/aft-search/slice-descriptors/land-views-f-lexical-routing.json

@@ -0,0 +1,15 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/tests/integration/tool_call_parity_test.rs",
+    "crates/aft/src/search_index.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs",
+    "crates/aft/src/commands/semantic_search/exact_lane.rs"
+  ],
+  "slices": [
+    "views-f-lexical-routing"
+  ],
+  "note": "Views-on lexical acquisition projects verified v3 payloads into the existing read-only query engine. Views are default-off, so the benchmark runs the views-off path, whose acquisition, scoring, fusion, admission and paging are unchanged; ranked rows must remain byte-identical to the committed reference."
+}

benchmarks/aft-search/slice-descriptors/land-views-g-donors-callgraph.json

@@ -0,0 +1,15 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/tests/integration/tool_call_parity_test.rs",
+    "crates/aft/src/search_index.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs",
+    "crates/aft/src/commands/semantic_search/exact_lane.rs"
+  ],
+  "slices": [
+    "views-g-donors-callgraph"
+  ],
+  "note": "Views-on call-graph reads route through the checkout's v3 view with sealed base donors. Step G touches no ranking-fence file; the fence files in this diff come from step F below it in the stack. Views are default-off, so the benchmark runs the views-off path and ranked rows must remain byte-identical to the committed reference."
+}

benchmarks/aft-search/slice-descriptors/land-views-steps-c-to-g.json

@@ -0,0 +1,15 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/tests/integration/tool_call_parity_test.rs",
+    "crates/aft/src/search_index.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs",
+    "crates/aft/src/commands/semantic_search/exact_lane.rs"
+  ],
+  "slices": [
+    "views-steps-c-to-g"
+  ],
+  "note": "Views cutover steps C, C part 2, E, D, F, tree-proven bases and G landed as one PR (each reviewed and gated on its own stacked PR, #997-#1026). Fence hits come from step F (lexical routing through views) and G (call-graph routing); with views off every route is unchanged, so ranked rows must stay byte-identical to the committed reference. The views-on parity tests compare grep, glob and search answers against the legacy index."
+}

benchmarks/aft-search/slice-descriptors/land-views-tree-proven-bases.json

@@ -0,0 +1,8 @@
+{
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "slice_class": "non_ranking",
+  "fixtures": [
+    "harness-goldens"
+  ]
+}

crates/aft/src/blob_store/v2.rs

@@ -44,6 +44,9 @@ pub const STORE_SCHEMA_VERSION: i64 = 1;
 /// Payload encoding version of trigram blobs. Bumping it must also change the
 /// trigram policy fingerprint, because that fingerprint is part of every key.
 pub const TRIGRAM_PAYLOAD_SCHEMA: u32 = 1;
+/// Layout of a v3 symbol-plane payload (`views::symbol_store`). The symbol
+/// plane exists only in v3; no v2 store is ever opened for it.
+pub const SYMBOL_PAYLOAD_SCHEMA: u32 = 1;
 
 const STORE_SCHEMA: &str = r#"
 CREATE TABLE IF NOT EXISTS store_meta (
@@ -84,24 +87,37 @@ pub enum FamilyPlane {
     Trigram,
     Semantic,
     Callgraph,
+    /// Parsed symbols of one file, keyed by content, language and the
+    /// extraction schema. A v3-only plane: it has no manifest readiness and
+    /// no v2 store, so it is deliberately absent from [`Self::ALL`], which
+    /// the manifest, v2 GC, eviction and per-entry code iterate. The v3
+    /// plane-row sweep covers it through [`Self::V3_STORES`].
+    Symbol,
 }
 
 impl FamilyPlane {
+    /// The planes a manifest entry, a v2 family store and the v2 GC know.
+    /// Never add [`Self::Symbol`] here: `EntryPlanes::get_mut` has no field
+    /// for it and panics.
     pub const ALL: [Self; 3] = [Self::Trigram, Self::Semantic, Self::Callgraph];
+    /// Every plane that can have a store under `blobs/v3/<family>/`.
+    pub const V3_STORES: [Self; 4] = [Self::Trigram, Self::Semantic, Self::Callgraph, Self::Symbol];
 
     pub const fn as_str(self) -> &'static str {
         match self {
             Self::Trigram => "trigram",
             Self::Semantic => "semantic",
             Self::Callgraph => "callgraph",
+            Self::Symbol => "symbol",
         }
     }
 
-    const fn payload_schema(self) -> u32 {
+    pub(crate) const fn payload_schema(self) -> u32 {
         match self {
             Self::Trigram => TRIGRAM_PAYLOAD_SCHEMA,
             Self::Semantic => crate::blob_store::SEMANTIC_PAYLOAD_SCHEMA,
             Self::Callgraph => crate::blob_store::CALLGRAPH_PAYLOAD_SCHEMA,
+            Self::Symbol => SYMBOL_PAYLOAD_SCHEMA,
         }
     }
 }
@@ -347,6 +363,7 @@ pub type StoreResult<T> = Result<T, StoreError>;
 pub struct StoreWriteAccess {
     storage: PathBuf,
     family: String,
+    legacy_allowed: bool,
 }
 
 impl StoreWriteAccess {
@@ -355,12 +372,20 @@ impl StoreWriteAccess {
         Self {
             storage: storage.to_path_buf(),
             family: family.to_owned(),
+            legacy_allowed: true,
         }
     }
 
     pub fn storage(&self) -> &Path {
         &self.storage
     }
+    pub(crate) fn v3_only(storage: &Path, family: &str) -> Self {
+        Self {
+            storage: storage.to_path_buf(),
+            family: family.to_owned(),
+            legacy_allowed: false,
+        }
+    }
 
     pub fn family(&self) -> &str {
         &self.family
@@ -426,6 +451,11 @@ pub struct FamilyStoreReader {
 impl FamilyStore {
     /// Opens (creating when absent) `<storage>/blobs/v2/<family>/<plane>.sqlite`.
     pub fn open(access: &StoreWriteAccess, plane: FamilyPlane) -> StoreResult<Self> {
+        if !access.legacy_allowed {
+            return Err(StoreError::InvalidFamily(
+                "v3-only registration cannot open a v2 writer".into(),
+            ));
+        }
         let path = plane_path(&access.storage, &access.family, plane)?;
         if let Some(parent) = path.parent() {
             crate::private_storage::open_dir(&access.storage, parent)?;
@@ -1892,6 +1922,20 @@ mod tests {
         .family_key()
     }
 
+    #[test]
+    fn symbol_is_not_a_manifest_plane() {
+        // `EntryPlanes::get_mut` panics for Symbol because a manifest entry
+        // has no symbol state. That panic is unreachable only while every
+        // list the manifest, v2 store, GC, eviction and per-entry code
+        // iterates (`FamilyPlane::ALL`) excludes the v3-only symbol plane.
+        assert!(!FamilyPlane::ALL.contains(&FamilyPlane::Symbol));
+        assert!(FamilyPlane::V3_STORES.contains(&FamilyPlane::Symbol));
+        for plane in FamilyPlane::ALL {
+            assert!(FamilyPlane::V3_STORES.contains(&plane));
+        }
+        assert_eq!(FamilyPlane::Symbol.as_str(), "symbol");
+    }
+
     #[test]
     fn a_conflicting_payload_for_one_key_is_rejected_and_the_stored_payload_is_kept() {
         let dir = tempfile::tempdir().unwrap();