fix(sync): keep the import history across logout and import in linear time

[mohamede1945]

Stacked on #323 (wiring), then #322 (engine) and the integration tests. Port step 3 of 5.

Summary

Moves the importer and reset onto the new engine, and fixes S14: logout no longer clears the import history.

S14: keep the import history across logout

• The bug: deleteAllData cleared import_history. A tracked re-import after logout could then bring back legacy items the user had deleted while signed in, and push them as new creates on the next login (IMP-10).
• iOS flow (checked in quran-ios):
  • LegacyDataImportCoordinator imports with trackHistory = true on the 3.1.0 upgrade, on every launch and on every CloudKit change.
  • logoutFromQuranCom() calls disable() before logging out, which turns legacy import off permanently.
  • Android doesn't track history.
• Decision: keep the history across logout. It records what this device's legacy data has already brought in, and logout doesn't change that.
• Why not tie it to the account: that wouldn't fix IMP-10. An import that runs after logout has no account.
• Side benefits:
  • A late import that was queued before the reset only adds legacy items that were never handled.
  • A re-import can't leak legacy data into another account (TEST-PLAN C4).
• Trade-offs:
  • An import still pending at logout is discarded with the other unsynced changes.
  • If the first login after the upgrade is a throwaway account, the legacy data stays in that account.
  • A reinstall or a second device upgrading still re-imports from CloudKit. That isn't a regression. A possible follow-up is an account-scoped "legacy imported" marker.

Import performance

• The note creation-time nudge is now batched (NoteStore.batch() / CreationTimes). 20,000 notes sharing one time take about 0.3 s, down from about 15 s, and pick the same times as single inserts.
• New index collection_ayah(sura, ayah): 20,000 memberships or highlights import in about 0.5 s, down from about 3 s.
• Atomicity: the whole import is one transaction across both SQLDelight databases (one shared driver).

Reset and sync state (pinned by tests)

• The wipe is one transaction: user data, sync_item/sync_meta (token, account, outbox, failures) and an epoch bump. A sync that started before the reset can't commit afterwards.
• An import writes user data rows only, never sync state. So the engine's "token but no account ⇒ wipe" rule can't trip because of an import.
• New scenarios:
  • LIFE-08 variant: logout while the GET is held.
  • IMP-11: an import made while a POST is held is pushed by the next sync.
  • IMP-04 now pins exactly what a restore (deleteExisting) pushes.

Tests

• ./gradlew allTests --continue passes on every module and target:
  • persistence: 179 JVM, 187 iOS;
  • sync-pipelines: 299 JVM.
• The integration suite passed 3 runs in a row. Only S4 (NOTE-12, the iOS Note ranges model, step 5) remains as a knownIssue.
• Each commit builds on its own.
• Reviewed by a separate reviewer, who verified the iOS import flow in quran-ios. Its two test nits are addressed in the last commit.

API

• deleteAllData() no longer clears the import history; the README now says so.
• PersistenceResetRepositoryImpl takes only SyncV2Database. It's internal to DI and hidden from ObjC.

🤖 Generated with Claude Code

Cleanup (rebased 2026-10-14)

• Removed 4 comments that carried private issue tags.