refactor(pipeline): PR#7 slice 9 -- extract identity_migration.rs (issue #67 hotspot split, final slice)

Move-only extraction of the D4 CallSite-identity migration from
pipeline.rs into the new pipeline/identity_migration.rs:
needs_call_site_identity_baseline, record_call_site_identity_migration_status,
rebuild_call_site_identity_baseline.

Visibility: same sibling-module pattern as slice 8. driver.rs (a sibling
of identity_migration.rs, not an ancestor) calls
needs_call_site_identity_baseline/rebuild_call_site_identity_baseline from
reindex_changed_cancellable/reindex_paths, so both are pub(super) here;
pipeline.rs pulls them back in via a plain `use identity_migration::{...}`
that driver.rs's existing `use super::{...}` block already reaches
unchanged, same ancestor-reexport-cascade confirmed working in slice 8 --
no driver.rs edit needed. record_call_site_identity_migration_status stays
plain private (its only caller moved with it). Verified via callers()
before the move: real callers of the two pub(super) functions are exactly
driver.rs::reindex_changed_cancellable/reindex_paths (2 sites each).

Reverse dependency: rebuild_call_site_identity_baseline calls
run_indexing_pipeline_cancellable (driver.rs, pub since slice 7) --
identity_migration.rs pulls it in via `use super::driver::
run_indexing_pipeline_cancellable`, along with PipelineOutcome/
ReindexOutcome (also pub in driver.rs). ReindexSummary/GraphMode/now_secs
stay in pipeline.rs (not moved), pulled in via `super::` as usual.

This completes PR#7's pipeline.rs split (issue #67): the file now holds
only shared struct/type/const definitions, the 9 mod + import/re-export
blocks, now_secs/signature_returns_option_or_result, and the untouched
#[cfg(test)] mod tests block (never split out across all 9 slices).
pipeline.rs itself: 6032 lines (post-slice-6) -> 5462 (post-slice-7) ->
now well under half its original size across cache.rs/identity_migration.rs
plus the 7 prior slices' modules.

Also fixes two now-genuinely-unused top-level imports this slice's removal
exposed: `use rusqlite::Connection;` (only the #[cfg(test)] mod tests block
still needs it via `use super::*;` now that every non-test Connection use
has moved out -- narrowed to #[cfg(test)]) and `use std::path::Path;`
(zero remaining real, non-string-literal uses after this move -- removed
outright).

Verified: cargo build -p calm-core clean (both lib and --tests profiles),
cargo clippy -p calm-core --all-targets 100% clean, cargo test -p calm-core
1247 passed/0 failed/12 ignored including both
golden_equivalence_{continued,incremental}_vs_fresh_across_mutation_rounds,
cargo fmt clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

crates/calm-core/src/indexer/pipeline.rs

@@ -1,6 +1,6 @@
+#[cfg(test)]
 use rusqlite::Connection;
 use std::collections::{HashMap, HashSet};
-use std::path::Path;
 
 use crate::indexer::chunker::CodeChunk;
 use crate::indexer::parser::ParsedSymbol;
@@ -403,175 +403,23 @@ pub struct ResolutionMaps {
     go: crate::indexer::go_module::GoModule,
 }
 
-/// Whether an existing database still contains CallSites whose line-only
-/// identity predates D4. Incremental indexing cannot repair these rows because
-/// their file hashes are unchanged, so it must take the full transactional
-/// baseline path instead of reporting a no-op.
-fn needs_call_site_identity_baseline(conn: &Connection) -> rusqlite::Result<bool> {
-    conn.query_row(
-        "SELECT EXISTS(
-             SELECT 1 FROM call_sites
-             WHERE identity_version < 2
-                OR callee_start_byte IS NULL
-                OR callee_end_byte IS NULL
-         )",
-        [],
-        |row| row.get::<_, i64>(0),
-    )
-    .map(|exists| exists != 0)
-}
-
-/// Update D4's diagnostic-only migration status.  It is intentionally outside
-/// the graph transaction: a failed/cancelled baseline must preserve the old
-/// graph while still leaving a useful reason for operators.
-fn record_call_site_identity_migration_status(
-    conn: &Connection,
-    status: &str,
-    failure_reason: Option<&str>,
-    metrics: Option<(i64, i64, i64, Option<i64>)>,
-) -> rusqlite::Result<()> {
-    let now = now_secs();
-    let (started_at, completed_at, failed_at) = match status {
-        "running" => (Some(now), None, None),
-        "baseline_ready" => (None, Some(now), None),
-        "failed" => (None, None, Some(now)),
-        _ => (None, None, None),
-    };
-    let (duration_ms, rows_rebuilt, busy_retries, graph_generation) = metrics
-        .map(
-            |(duration_ms, rows_rebuilt, busy_retries, graph_generation)| {
-                (
-                    Some(duration_ms),
-                    Some(rows_rebuilt),
-                    Some(busy_retries),
-                    graph_generation,
-                )
-            },
-        )
-        .unwrap_or((None, None, None, None));
-    conn.execute(
-        "INSERT INTO identity_migration_state
-            (id, target_version, status, started_at, completed_at, failed_at, failure_reason,
-             duration_ms, rows_rebuilt, busy_retries, graph_generation)
-         VALUES (1, 2, ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
-         ON CONFLICT(id) DO UPDATE SET
-             target_version = excluded.target_version,
-             status = excluded.status,
-             started_at = CASE WHEN excluded.status = 'running'
-                               THEN excluded.started_at
-                               ELSE identity_migration_state.started_at END,
-             completed_at = excluded.completed_at,
-             failed_at = excluded.failed_at,
-             failure_reason = excluded.failure_reason,
-             duration_ms = COALESCE(excluded.duration_ms, identity_migration_state.duration_ms),
-             rows_rebuilt = COALESCE(excluded.rows_rebuilt, identity_migration_state.rows_rebuilt),
-             busy_retries = COALESCE(excluded.busy_retries, identity_migration_state.busy_retries),
-             graph_generation = COALESCE(excluded.graph_generation, identity_migration_state.graph_generation)",
-        rusqlite::params![
-            status,
-            started_at,
-            completed_at,
-            failed_at,
-            failure_reason,
-            duration_ms,
-            rows_rebuilt,
-            busy_retries,
-            graph_generation,
-        ],
-    )?;
-    Ok(())
-}
-
-/// Run the one-time D4 baseline through the normal full-pipeline transaction.
-/// Both incremental entry points must share this path: an unchanged source hash
-/// cannot prove its persisted CallSite identity is current.
-fn rebuild_call_site_identity_baseline(
-    conn: &mut Connection,
-    project_root: &Path,
-    cancel: &dyn Fn() -> bool,
-) -> rusqlite::Result<ReindexOutcome> {
-    let started = std::time::Instant::now();
-    tracing::info!("D4 CallSite identity migration detected — forcing a full baseline reparse");
-    let phase = std::sync::Arc::new(std::sync::RwLock::new(crate::types::IndexingPhase::Parsing));
-    if let Err(error) = record_call_site_identity_migration_status(conn, "running", None, None) {
-        tracing::warn!(%error, "could not record D4 CallSite identity migration start");
-    }
-
-    match run_indexing_pipeline_cancellable(conn, project_root, phase, cancel) {
-        Ok(PipelineOutcome::Completed) => {
-            let rebuilt_files: usize =
-                conn.query_row("SELECT COUNT(*) FROM file_index", [], |row| {
-                    row.get::<_, i64>(0)
-                })? as usize;
-            if let Err(error) = record_call_site_identity_migration_status(
-                conn,
-                "baseline_ready",
-                None,
-                Some((
-                    started.elapsed().as_millis().try_into().unwrap_or(i64::MAX),
-                    rebuilt_files.try_into().unwrap_or(i64::MAX),
-                    0,
-                    conn.query_row(
-                        "SELECT generation FROM graph_generation_state WHERE id = 1",
-                        [],
-                        |row| row.get(0),
-                    )
-                    .ok(),
-                )),
-            ) {
-                tracing::warn!(%error, "could not record D4 CallSite identity migration completion");
-            }
-            Ok(ReindexOutcome::Completed(ReindexSummary {
-                changed: rebuilt_files,
-                graph_mode: GraphMode::FullFallback("call_site_identity_v2".to_string()),
-                ..ReindexSummary::default()
-            }))
-        }
-        Ok(PipelineOutcome::Cancelled) => {
-            if let Err(error) = record_call_site_identity_migration_status(
-                conn,
-                "failed",
-                Some("baseline cancelled"),
-                Some((
-                    started.elapsed().as_millis().try_into().unwrap_or(i64::MAX),
-                    0,
-                    0,
-                    conn.query_row(
-                        "SELECT generation FROM graph_generation_state WHERE id = 1",
-                        [],
-                        |row| row.get(0),
-                    )
-                    .ok(),
-                )),
-            ) {
-                tracing::warn!(%error, "could not record cancelled D4 CallSite identity migration");
-            }
-            Ok(ReindexOutcome::Cancelled)
-        }
-        Err(error) => {
-            let failure_reason = error.to_string();
-            if let Err(status_error) = record_call_site_identity_migration_status(
-                conn,
-                "failed",
-                Some(&failure_reason),
-                Some((
-                    started.elapsed().as_millis().try_into().unwrap_or(i64::MAX),
-                    0,
-                    0,
-                    conn.query_row(
-                        "SELECT generation FROM graph_generation_state WHERE id = 1",
-                        [],
-                        |row| row.get(0),
-                    )
-                    .ok(),
-                )),
-            ) {
-                tracing::warn!(%status_error, "could not record failed D4 CallSite identity migration");
-            }
-            Err(error)
-        }
-    }
-}
+// PR#7 slice 9 (final slice): move-only extraction of the D4 CallSite-
+// identity migration (detection predicate, diagnostic-status recorder,
+// one-time full-baseline reparse) into pipeline/identity_migration.rs
+// (issue #67 hotspot split). needs_call_site_identity_baseline/
+// rebuild_call_site_identity_baseline are pub(super) there since driver.rs
+// -- a sibling of identity_migration.rs, not a descendant -- calls both;
+// verified via callers() before the move that real callers are exactly
+// driver.rs::reindex_changed_cancellable/reindex_paths (2 sites each).
+// record_call_site_identity_migration_status stays plain private (its only
+// caller, rebuild_call_site_identity_baseline, moved with it).
+//
+// This completes pipeline.rs's PR#7 split: only shared struct/type/const
+// definitions, the 9 mod + import/re-export blocks, now_secs/
+// signature_returns_option_or_result, and the untouched #[cfg(test)] mod
+// tests block remain below.
+mod identity_migration;
+use identity_migration::{needs_call_site_identity_baseline, rebuild_call_site_identity_baseline};
 
 #[cfg(test)]
 mod tests {