Pipelined standing-query evaluations: bring 100-session write→delta p99 under 100 ms #238

Follow-up to #232 (shared parameterized views, plan cache, join-planner fix).

Problem

At 100 sessions on the voice-agent pack (1 receipt/s per session, make bench-sessions), #232 brings server CPU from 23.6 cores (saturated) to about 1.8, and write→delta p50 from 736 ms to 40–53 ms. The p99 still swings from 74 to 136 ms across runs, so the 100 ms voice budget is not met reliably. The before/after tables at 1/10/25/50/100/200 sessions are in the PR description.

The tail is structural. A view has at most one evaluation in flight (src/protocol/subscription/views.rs). Under continuous commits, the shared rounds run back to back. A commit that lands during a round waits for that round, then for the next one, which reads the newest snapshot, so the worst case is about two rounds. A round costs 25–35 ms at 100 sessions and grows with the receipt history. Host noise from other lanes makes it worse.

Two measured alternatives did not move the tail enough:

• running the independent rules of a level in parallel saved ~15%: the levels are deep and claim dominates;
• removing the per-step yield_now in the single-worker timely loops showed no measurable difference.

Proposal

Pipeline evaluations per view, or per family of parameterized views. A relevant commit starts a new evaluation even while one is in flight, as long as publications stay in revision order. A delta then waits about one round, not two. To design:

• Ordering. Publish only in revision order, and drop a result overtaken by a newer published revision.
• Pending changes. Track them per evaluation, so a follow-up never loses a change.
• Bounds. Limit evaluations in flight per view or family, for example 2–3, to bound CPU.
• Contracts to keep. Read-your-writes on attach, error and retry semantics, and the coalescing window.

Acceptance

• make bench-sessions SESSIONS_ARGS="--sessions 100 --load-secs 60 --max-delta-p99-ms 100" passes on a quiet host, with CPU far below the compute permits.
• make perf-gate shows no regression.
• The existing standing-query tests and the parameterized oracle test (tests/standing_query_tests/parameterized.rs) pass.