perf(storage): hash CSR shards on write instead of reading them back (#1384)

[DecisionNerd]

Summary

The last remaining read-back-to-hash in the encode publish path. write_csr_shard wrote each bounded CSR shard, then read the whole file back to hash it (codec::read + sha256_hex), doubling the shard's device I/O on the publish-side critical path. That violates #1384's accepted decision 1: no pass reads data back in order to hash it.

Now each shard is encoded once into memory (shards are admission-bounded, ≤1M entries), the exact bytes that land on disk are preflight-verified and SHA-256'd, and the file is written once. The recorded digest is identical to what the read-back produced, so receipts, shard-set reuse and manifest naming are unchanged.

Refusals are preserved, not moved

• Digest still names the shard. CAS install re-derives the digest while streaming the copy and refuses a mismatch; shard reads preflight against the manifest before Arrow decodes anything (fix(storage): compress bounded CSR shards with authenticated decode limits #1205 bounds intact).
• The admission bound moved earlier. codec::admit_encoded_len applies the same encoded_limit before any byte reaches the filesystem instead of after the read-back.
• Preflight still runs — on the in-memory bytes, before the write, at zero I/O cost.
• The observe(storage): read_path_scan attributes 579 KB of a 6.4 GB hop query; the adjacency rebuild bypasses the counters #1449 read-attribution line is gone because the read is gone; the shard write is still recorded.

What remains read-back on purpose

Small JSON controls (per-index .csr.json, adjacency manifest) are still verified by read-back in encode_adjacency — kilobytes against gigabytes, and an independent on-disk check of the shard digest chain. The 45 GB shape_consume_reauthentication row in the retained baseline is the whole shaping region under a legacy phase name (its reads are the partitioner's real data movement), not authentication; that accounting note feeds #1384's boundary ledger.

Validation

• TMPDIR=<ext4> cargo test -p graphforge-storage --lib: 1,277 passed, 0 failed (includes the adjacency determinism and portable-import publish paths; the 3 tests that fail under the default tmpfs /tmp fail identically on the pristine base — the documented GF_UNSUPPORTED_FILESYSTEM admission).
• cargo fmt --all -- --check clean; cargo clippy --workspace -- -D warnings passes.
• cargo test -p graphforge-benchmark-certify compiles clean against the changed API.

Refs #1384

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: CurateLabs/graphforge/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 125fae19-9908-4815-a25c-14eafbeea28f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}