Maven virtual: deferred follow-ups (S30)

Context

Deferred follow-ups from the Maven virtual spec — S30, authored under #284 (closed). These are out of scope for the closed-beta MVP; each needs a design before implementation. Confirm scope before starting any item.

This is the Maven counterpart of the npm (#266) and container (#264) follow-up trackers. S30 points its Follow-ups entries here.

S30 — Maven virtual

  • A virtual-owned merged-metadata cache, if the per-read merge proves measurable on the hot path. It would let a virtual metadata read serve a stored merged document with its own validity window, at the cost of an invalidation path tracking N upstreams. The trigger is a query, not a judgement: gitlab_artifact_registry_maven_virtual_merge_duration_seconds against the request duration for the same operation.
  • ADR-007 amendment in the handbook repository for the four items S30's Data Model lists: the (namespace_id, upstream_repository_id) reverse index, the ON DELETE action on every foreign key, the range and length CHECK constraints on rule_type / target_field / pattern / position, and the correction of DEFERRABLE INITIALLY DEFERRED from an index clause to a constraint clause.
  • Group-level plugin metadata merge. S30 merges <versioning> documents and serves a <plugins> document from its lowest-position holder unmerged. Merging plugin-prefix mappings across upstreams (union by <prefix>, position breaks conflicts) is possible but has no closed-beta consumer.
  • Coalescing the resolution phase, not only the Fetch. S13's single-flight covers Fetch, but Phase 2 probes and the merge's per-position revalidations are not coalesced across concurrent reads, so a cold-cache spike across C concurrent reads against M remote upstreams can issue up to C×M upstream requests. gitlab_artifact_registry_maven_virtual_probes_total is the signal that says whether it needs closing.
  • An S14 amendment committing its maven_remote_* metrics and its maven_remote_proxy event to firing for a leg the virtual resolver drives, not only for a standalone remote read. Until it lands, a remote leg's revalidation and fetch are covered by S30's own family and by positions[], and S14's instruments cannot be assumed to describe virtual traffic.