feat(controller): Phase F — CostModel workload_cost + Schema unique_keys CSE legality

[zzylol]

Summary

Per design.md §6 core::cost (line ~997) and Schema flow (line ~425) — the workload-level cost-model entry point + the load-bearing consumer of Schema::unique_keys. Phase A/B/D shipped the typed types, the L3 IR DAG with Schema::unique_keys, and the language wrap; Phase F is what makes unique_keys "load-bearing" and what credits shared sub-DAGs in the bundled cost (the proof point that the design's reuse-aware planning is reachable from the existing IR).

• planner::cost_model::workload_cost — walks the L3 IR DAG (intent_algebra::QueryExpr) post-order, memoises by LetBinding name, credits each shared producer once across consumers. Returns WorkloadCost { total_dollars, per_root_breakdown, reused_savings }. The reused_savings field exposes the gap between the bundled total and the naive sum-over-roots (design.md §6 line ~1023).
• intent_algebra::schema::cse_reuse_is_legal — gatekeeper. Two QueryExpr::Ref consumers may share a producer only when the producer's output schema has at least one unique_keys set and the consumer count is ≥ 2. The proof point that Schema::unique_keys is load-bearing per design.md §6 line ~1356.
• intent_algebra::cse::dedupe_subtrees — basic implementation of the workload-level CSE pass. Detects shared Aggregate children across ≥2 roots, gates on cse_reuse_is_legal, hoists into a LetBinding. Full alpha-equivalence + nested-CSE algorithm is downstream.

design.md grows two "Implementation status" subsections (one under core::cost, one under the Schema flow table) describing what shipped vs. what's deferred (per-plan latency split, ReusedComponent enumeration, schema-equivalent-but-not-identical sub-tree merging).

Files touched

Strictly within the spec's allow-list:

• controller/src/planner/cost_model.rs — extended with workload_cost, WorkloadCost, WorkloadCostPlan, per-node cost primitives, 7 tests.
• controller/src/intent_algebra/schema.rs — extended with cse_reuse_is_legal, CseError, 4 new tests.
• controller/src/intent_algebra/cse.rs — new. dedupe_subtrees, CseWorkloadPlan, 4 tests.
• controller/src/intent_algebra/mod.rs — mod cse; + re-exports for the new public surface.
• controller/docs/design.md — Implementation-status subsections under core::cost and Schema flow; Phase F entry in the Phase B implementation-status section.

Untouched (per spec): sketch_algebra/, intent_algebra/{agg_intent,query_expr,lower}.rs, types_v2.rs, query_language/, language_logical_plan/, planner/{rules,stage_split}.rs, analyzer.rs, replan.rs, opamp/, query_parser/, types.rs, config/*, anything outside controller/.

Test plan

15 unit tests added:

• planner::cost_model::workload_cost_tests (7) — single-root degenerate, two-roots-no-sharing, two-roots-shared-window-credits-once (the design.md batched-queries example), three-roots-two-share-partial, three-roots-all-share, unused-binding-zero-savings, unresolved-ref-errors.
• intent_algebra::schema::tests (4 new) — cse_reuse_legal_when_unique_keys_set, cse_reuse_illegal_when_unique_keys_empty, cse_reuse_rejects_single_consumer, cse_reuse_consumer_check_precedes_unique_key_check.
• intent_algebra::cse::tests (4) — dedupe_subtrees_empty_input, dedupe_subtrees_single_root_passthrough, dedupe_subtrees_basic (design.md batched-queries example), dedupe_subtrees_no_shared_subexpr.

Verification

• cargo build --release -p controller — clean (132 warnings, same as origin/main).
• cargo clippy --release --bin controller -- -D warnings — same 162 errors as origin/main baseline; Phase F adds zero new clippy errors. (All 162 are pre-existing in unmodified files: algebra/directory.rs, types.rs, etc.)
• No docker activity. Sweep on PID 2862786 untouched.
• No submodule pointer drift.

Note on cargo test status

The controller's cargo test target was already broken at origin/main (post-#275): nine data_sink field-init errors in src/config/agent.rs, src/config/asapquery_backend.rs, src/config/precompute.rs, and src/main.rs test code. This is the pre-existing baseline blocker explicitly called out in the orchestrator spec (controller/src/config/* — pre-existing test baseline blocker, separate fix in flight #28). Phase F's tests are written and reviewed for logical correctness; they will run green once #28 unblocks the test target.

cargo build --release and cargo clippy --release --bin controller are clean of any new Phase F warnings or errors — confirmed by stashing the diff and rerunning baseline (same 132 build warnings / 162 clippy errors).

🤖 Generated with Claude Code