test(smoke): prove C2 semantic live + fix #166 restore timeout + staging debris sweep

[unforced]

Summary

Two bundled items, both in scripts/smoke-staging.ts territory:

1. Semantic live-smoke coverage (C2, merged rc.90, deployed to staging)

C2 ships embed-on-write via the DO alarm + near_text/semantic on REST/MCP, powered by live Workers AI bge-m3 — which vitest-workerd cannot exercise (documented residual in PR #170's own body: "What only a live smoke can prove"). This PR closes that gap:

• New staging-only test hook POST /vault/<name>/__test/embed-run (workers/vault/src/vault-do.ts) — mirrors __test/transcribe-run exactly: loops drainEmbeddingsOnce() (the same private method the DO alarm calls) until the queue reports nothing left or a 10-wake bound is hit, so the smoke can drive the embedding drain deterministically instead of waiting on the real alarm's async fire. 404 in production and under vitest (ENVIRONMENT !== "staging").
• scripts/smoke-prod.ts pins the same 404 posture (mirrors the existing __test/transcribe-run pin).
• New smoke-staging.ts section 18b (after voice, before the mock-upgrade E2E): creates a note with distinctive, paraphrasable content in the arrival vault ("kayak paddle return policy"), drains the queue via __test/embed-run, then queries GET /api/notes?semantic=true&near_text=<paraphrase with zero shared keywords> and asserts the note ranks in the top 3 by meaning. Also asserts the landing's embeddings: {enabled} capability and that the response never comes back semantic_unavailable or carries an embeddings_pending warning (proving the drain fully caught the vault up).

Honesty note (as requested): these semantic smoke steps get their first real run on the next staging deploy — this PR cannot itself prove they pass against live bge-m3 inference, only that they typecheck and don't collide with the existing 332-test workers/vault suite (which still passes unchanged, no live inference under the pool).

2. cloud#166 — the snapshot-restore smoke timeout

Root-caused as debris growth (staging at ~140 smoke-created vaults) making the section's round trip (snapshot sweep → R2 → new-vault DO import) slow enough to cross an implicit client-side fetch timeout, 2 consecutive runs.

• scripts/smoke-staging.ts §17: every fetch in the restore round-trip section now carries an explicit AbortSignal.timeout(120_000) (2 min) — replacing whatever implicit default was being hit with a generous, self-documenting budget for a genuinely heavy round trip.
• New scripts/staging-sweep.ts: operator-run debris sweep. Deletes the D1 vaults ownership row for vaults matching the smoke's own throwaway prefixes (box-, imp-, arrive-, tierbox-, mockbox-, enforcebox-) older than a configurable cutoff (default 1 day), dry-run by default (--yes to apply). Never wired into CI/deploy — pure operator lever. Structurally staging-only: no TARGET=prod escape hatch exists at all (unlike backfill-plans.ts/set-operator-role.ts), plus a defense-in-depth assertion on the hardcoded D1 database name. Never touches the literal demo vault. Documented limitation: there is no vault-teardown verb anywhere in this codebase (DELETE /account/vaults/:name is still a 501 stub), so this frees the D1 ownership row only — the underlying DO storage + any R2 attachments are left orphaned but harmless (hibernated, near-zero cost, unreachable once unowned).

rc.90 → rc.91.

Test plan

• cd workers/vault && bun run typecheck — clean
• cd workers/vault && bun x vitest run — 332 passed | 1 todo (unchanged from PR feat(vault-do): semantic search via Workers AI — embed-on-write drain + near_text (C2) #170's 329+1 baseline plus 3 from main having moved; the new __test/embed-run route has no dedicated unit test — it's a thin loop over the already-unit-tested drainEmbeddingsOnce, same coverage posture as __test/transcribe-run)
• Root bun run typecheck — clean
• Root bun run test — 153 passed (unchanged)
• workers/identity — untouched by this PR, not re-run
• New/touched scripts/*.ts sanity-typechecked against the repo's actual tsconfig compiler options (scripts/ isn't in the root tsconfig's include, so it isn't part of any CI gate today) — zero new errors; the handful of pre-existing unknown-JSON warnings elsewhere in smoke-staging.ts/smoke-prod.ts are untouched lines, not part of this diff
• Live staging run — the semantic smoke section (18b) and the cloud#166 timeout fix both need a real staging deploy to prove out; recommend running bash scripts/deploy-staging.sh + bun scripts/smoke-staging.ts before considering this done, and bun scripts/staging-sweep.ts (dry-run first) to actually clear the current ~140-vault debris

Do not merge — reviewer pending.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XLZtmuSs1RirWGMGyCB1QB