fix(storage,node): path-ancestor & shared-stamp fixes + node hardening batch

[chefsale]

Two storage-crate correctness/hardening fixes plus a batch of node-crate review findings. Two independent commits — split easily if a reviewer prefers separate PRs.

Storage (commit f10467f)

Path::is_ancestor_of never compared the final segment (correctness)

is_ancestor_of iterated only the byte offsets between segments, so it never compared the ancestor candidate's deepest segment:

Path::new("::root::wrong").is_ancestor_of(&Path::new("::root::node::leaf"))  // returned true

Second latent hole: a single-segment path has an empty offsets, so the loop never ran and it returned true for any deeper path. is_descendant_of inherited both. Fixed by comparing all of self's depth() + 1 segments as a true prefix via segments().zip(...), with regression tests. (No production callers today — a latent landmine in a public API.)

Unify the local Shared stamp authority rule (hardening)

Local-write authorization for Shared entities lived in two hand-rolled copies with divergent rules (save_raw: stored ∪ claimed; delete: stored only). Extracted a single authorize_local_shared_stamp helper so the rule can't drift. Behavior-preserving: in the delete path metadata is loaded fresh from the index, so its writers already are the stored set and the union collapses to the same check.

Node review-finding batch (commit df1a289)

Medium

• Reservoir bias (utils.rs): choose_stream consumed the first item before enumerate(), so Algorithm R over-weighted later elements (and a single-item stream matched anything). Now enumerates the whole stream — replacement prob 1/(idx+1).
• Unbounded mailbox (network_event_processor.rs): do_send ignored NodeManager's mailbox capacity, so draining the bounded source channel grew the mailbox without limit. Now bounds the mailbox (set_mailbox_capacity) and forwards via try_send + bounded retry, dropping with a counter only under sustained overload (shutdown still flushes best-effort via do_send). Highest-impact change in the batch — the intended tradeoff is dropping-with-visibility over unbounded growth; periodic sync reconciles anything dropped.
• Heartbeat sync storm (heartbeat.rs): the "peer is ahead" branch spawned a sync every heartbeat, so N ahead peers → N syncs/30s. Added a per-context debounce (a context-wide sync serves every peer).
• Unbounded peer-keyed maps (heartbeat.rs, readiness.rs): divergence_streak, the new behind_sync, and last_probe_response_at now TTL-evict during their ticks so they can't grow on peer churn.
• God future (namespace.rs): the ~200-line governance-delta spawned future is decomposed into a NamespaceDeltaApply context with run() / on_applied().

Low

• Blob integrity (blobs.rs): verify stored_blob_id == requested blob_id (content hash) before reporting success; discard mismatched content.
• Receiver backfill cap (namespace.rs / sync/mod.rs): enforce MAX_BACKFILL_OPS on the receiver, not just the responder (shared const), so a misbehaving peer can't drive unbounded apply work.
• Error swallow (subscriptions.rs): has_context(...).unwrap_or_default() treated store errors as "no context"; now logs and bails.
• Retry backoff (namespace.rs): bounded exponential backoff between namespace parent-pull peer attempts.
• Log floods (network_event_channel.rs): lock-free time throttle on the capacity/backpressure warnings.
• Hardcoded config (run.rs / constants.rs): channel capacities named in constants.rs instead of scattered magic numbers. (Named constants, not runtime-tunable knobs — runtime config would be a larger follow-up.)

Testing

• cargo test -p calimero-storage --lib — 669 passed.
• cargo test -p calimero-node --lib — 431 passed.
• clippy -D warnings + rustfmt clean on both crates.

🤖 Generated with Claude Code

[meroreviewer]

🤖 MeroReviewer

Reviewed by 1 agents | Quality score: 85% | Review time: 66.3s

---

✅ No Issues Found

All agents reviewed the code and found no issues. LGTM! 🎉

---

_{🤖 Generated by MeroReviewer | Review ID: review-cd59540c}

[meroreviewer]

Documentation Review

The following documentation may need updates based on the changes in this PR:

• 🟡 architecture/crates/node.html: Files matching crates/node/** were changed but architecture/crates/node.html was not updated (per source_to_docs_mapping).
• 🟡 architecture/crates/sync.html: Files matching crates/node/** were changed but architecture/crates/sync.html was not updated (per source_to_docs_mapping).
• 🟡 architecture/migrations.html: Files matching crates/storage/** were changed but architecture/migrations.html was not updated (per source_to_docs_mapping).
• 🟡 architecture/storage-schema.html: Files matching crates/storage/** were changed but architecture/storage-schema.html was not updated (per source_to_docs_mapping).

[meroreviewer]

🤖 AI Code Reviewer

Reviewed by 1 agents | Quality score: 85% | Review time: 240.0s

---

✅ No Issues Found

All agents reviewed the code and found no issues. LGTM! 🎉

---

_{🤖 Generated by AI Code Reviewer | Review ID: review-22acd7ad}

[meroreviewer]

🤖 AI Code Reviewer

Reviewed by 3 agents | Quality score: 85% | Review time: 481.7s

💡 1 suggestions. See inline comments.

---

_{🤖 Generated by AI Code Reviewer | Review ID: review-ac6dc130}

[meroreviewer]

💡 Unifying save/delete Shared-stamp authorization adds a redundant index read on the delete path

remove_child_from_inner loads metadata (and therefore the current stored writer set) from the index just a few lines above, then calls Self::authorize_local_shared_stamp(child_id, claimed) where claimed is literally that same stored writer set. But authorize_local_shared_stamp (interface.rs:3548) unconditionally re-fetches <Index<S>>::get_metadata(id) to compute stored_has_executor. On the delete path this second fetch is provably redundant — claimed already is the stored set, so stored_has_executor == claimed.contains_key(&executor) always. This adds an extra index/DB lookup to every local delete of a Shared entity that the pre-refactor code did not have (it only did stored.contains_key(&executor) inline).

Suggested fix:

Add a variant (or an `Option<&BTreeMap<..>>` pre-fetched-stored parameter) to `authorize_local_shared_stamp` that lets the delete-path caller pass the already-loaded stored writer set directly instead of triggering another `Index::get_metadata` call, e.g. `authorize_local_shared_stamp_from_stored(claimed, claimed)` or an internal helper that skips the fetch when the caller already knows stored == claimed.

[chefsale]

Addressed in ae0b7b9: added a stored: Option<&BTreeMap<..>> param to authorize_local_shared_stamp. The delete path passes its already-loaded writers (Some(claimed)) so it skips the second Index::get_metadata; the save path passes None and still looks stored up (its claimed is the incoming action's set, not stored). Single authority rule preserved, redundant read gone.

[meroreviewer]

🤖 AI Code Reviewer

Reviewed by 3 agents | Quality score: 95% | Review time: 573.5s

---

✅ No Issues Found

All agents reviewed the code and found no issues. LGTM! 🎉

---

_{🤖 Generated by AI Code Reviewer | Review ID: review-719e016b}

[meroreviewer]

🤖 AI Code Reviewer

Reviewed by 3 agents | Quality score: 95% | Review time: 199.9s

---

✅ No Issues Found

All agents reviewed the code and found no issues. LGTM! 🎉

---

_{🤖 Generated by AI Code Reviewer | Review ID: review-37d4dfc9}