Function load_derived 

pub fn load_derived(
    db: &mut QueryDb,
    snapshot_sha256: [u8; 32],
    path: &Path,
    workspace_root: &Path,
) -> Result<LoadOutcome, LoadError>

Load a derived file at path into a pristine [QueryDb].

Staged-validation + infallible-commit contract (spec §5.7)

1. Path validation happens before any file IO.
2. All fallible work (file open, header decode, magic/version check, SHA match, entry stream decode) runs in the validation phase and returns Err(...) without touching the DB.
3. Once all entries are staged successfully, [QueryDb::commit_staged_load] is called. That function is infallible by construction — it contains no ?, no Result-bearing call, and no map_err.
4. After commit, cold_load_allowed is flipped to false to prevent a second load from overwriting the committed state.

Errors

• LoadError::PathSafety — path fails workspace validation.
• LoadError::NotFound — file does not exist (ENOENT).
• LoadError::Io — other IO errors.
• LoadError::Corrupt — magic mismatch, version mismatch, or truncated entry stream.
• LoadError::StaleSnapshot — SHA-256 in the header doesn’t match snapshot_sha256.
• LoadError::AlreadyLoaded — a successful load has already been applied to db.