[haolpku]

Hybrid retrieval currently fails when query embeddings or vector queries experience transient outages, and robustness experiments cannot separate retry, degradation, and rebuild costs. This change adds opt-in BM25 fallback on the same filtered snapshot, shared bounded retries and query deadlines, and structured recovery diagnostics. Invalid requests, authentication failures, and missing local data continue to propagate as errors.

Workspace builds now expose per-attempt reuse, compute, materialization, timing, and provider-reported usage metrics. A reproducible experiment CLI compares no recovery, retry, and fallback policies and tests checkpoint/publication recovery using actual child-process interruption. Fixture outputs are explicitly labeled smoke tests; they do not establish model answer quality or paper benchmark results.

Validation:

• Full local suite including plugin tests: 363 passed, 95 skipped (optional providers / external services unavailable locally).
• Package compilation and real SQLite demo verification passed.
• CLI smoke tests cover paired fault schedules, filtered/historical reads, bounded retries, and process-exit recovery with logical snapshot equivalence.
• GitHub CI runs Python 3.11/3.12, optional versioning providers, MySQL/Dolt integration, and installed-wheel smoke checks.

Details and live experiment commands: docs/READ_RECOVERY.md.