Verify extraction provenance and prune semantic staging before inference

crates/searchi-service/src/store.rs

@@ -305,10 +305,15 @@ impl Store {
 
     #[cfg(test)]
     pub(crate) fn activate(&mut self, generation: i64) -> Result<()> {
-        self.activate_revision(generation, None)
+        self.activate_revision(generation, None, || Ok(()))
     }
 
-    fn activate_revision(&mut self, generation: i64, revision: Option<i64>) -> Result<()> {
+    fn activate_revision(
+        &mut self,
+        generation: i64,
+        revision: Option<i64>,
+        validate_sources: impl FnOnce() -> Result<()>,
+    ) -> Result<()> {
         // A failed graph build or serialization leaves the old generation active.
         let ann = self.build_ann(generation)?;
         let length = ann.serialized_length();
@@ -319,6 +324,10 @@ impl Store {
         let mut serialized = vec![0_u8; length];
         ann.save_to_buffer(&mut serialized)?;
         let checksum = format!("{:x}", Sha256::digest(&serialized));
+        // Hashing/probing sources can be slow: run after graph preparation but
+        // before acquiring the write transaction. The revision check below
+        // still closes races with indexed changes after this validation.
+        validate_sources()?;
         let transaction = self
             .connection
             .transaction_with_behavior(rusqlite::TransactionBehavior::Immediate)?;