fix(session-store): add nonabsorbing fenced history v2

[VerifiedOrganic]

Refs #702
Refs #696
Downstream: https://github.com/VerifiedOrganic/epdg/issues/181

Scope

This PR removes the singleton absorbing-history ceiling through a versioned SDK contract. V1 remains wire- and behavior-compatible with its frozen 4,096-entry permanent ledger. V2 adds a durable epoch lifecycle with deterministic retirement/reclamation, irreversible replay floors, and a writable successor epoch.

This is generic SDK state/consensus behavior. It does not contain an ePDG product pin, product hot-path composition, synthetic evidence substitution, or the separate failure matrix.

Frozen candidate

• head: 3db6f92c4c03badd818e691dbe876e430df88d2c
• tree: 580678beb2f4947e373f785ca09edcdf30f15610
• parent: 5e2204ec24ec689ed660d736b9f152f3999e5708
• GitHub SSH signature verification: verified=true, reason=valid
• DCO trailer: present
• merge state: clean and mergeable
• hosted checks: rerunning on this exact documentation-correction head; the unchanged source parent was all green

Capacity and compatibility contract

• one active V2 epoch admits 131,072 unique bindings
• one active plus seven retained replay epochs retain 1,048,576 V2 identities
• the separate frozen V1 ledger retains 4,096 identities
• combined bounded replay envelope: 1,052,672 identities
• a full epoch admits its last legal binding and rejects one-over without visible mutation; a successor opens immediately while a retained replay slot is free, while the eight-epoch bound blocks a ninth until the oldest eligible replay epoch is reclaimed in deterministic 1,024-row batches with the active epoch remaining writable
• exact replay and same-ID/different-body conflict semantics survive physical reclamation
• current voters must unanimously advertise the exact V2 profile; incompatible current or prospective voters fail closed
• snapshot, restart, follower apply, topology-certificate rotation, backend limits, and retained profile all carry the V2 lifecycle explicitly; older readers fail closed

The architectural cause was the frozen V1 singleton ledger: correct replay protection had no lifecycle, so every successful unique transition consumed one permanent slot and the 4,097th was terminally HistoryFull. V2 fixes that cause without weakening V1.

Evidence and gates

The unchanged source lineage completed this real three-voter fixed durable-quorum OpenRaft/SQLite historical capacity qualification; it is supporting evidence, while the authoritative eight-epoch/1,010,000-operation qualification is tracked separately:

Authoritative gate status: FAILED CLOSED. The byte-identical session-store runner failed after 5,547.97s when a paced public V2 batch exhausted exact-consensus reconciliation with quorum unavailable, before any sustained/burst phase summary. Root-cause correction and a clean rerun are required; the historical workload below is not a substitute./

• 131,072 epoch-1 bindings committed
• request 131,073 rejected without mutation
• all 131,072 retired entries reclaimed
• a successor-epoch transition committed
• delayed exact replay and same-ID/different-body conflict checks passed before, during, and after reclamation
• committed=131073, reclaimed=131072, transient_exact_retries=2214
• database envelope 2,182,756,256 bytes; snapshot envelope 2,077,053,072 bytes
• wall time 2:57:18; peak RSS 308,544 KiB; CPU 260%
• command: cargo test --locked -p opc-session-store --test fenced_transition_v2_qualification --all-features sustained_131073_unique_v2_transitions_bind_exact_epoch_capacity -- --ignored --exact --nocapture
• log SHA-256: 910c98af114164cbee5ce740fab69708aef4f0713d6db847280c6af44040afe4; complete output is preserved in the PR comments

Focused V1/V2 store, SQLite, snapshot/recovery, OpenRaft, revision-4 mTLS transport, migration, capability/profile, maintenance-reselection, conflict, and mutation tests passed. Format, diff check, warnings-denied Clippy, and all hosted CI/security/platform checks reported green on the unchanged source parent. The exact documentation-correction head is rerunning hosted gates./ Independent capacity/compatibility review found no remaining P0/P1/P2 in this slice.

Downstream limit

This capacity evidence is real, but it is not the final ePDG issue #181 acceptance artifact. The final 50,000 retained/active, 1,000 actor, 960,000 attach production-mTLS run must occur only after this contract, the bounded managed-provider network/SVID contract, and the downstream ePDG hot-path consumer are normally landed.

[VerifiedOrganic]

Exact-head 131,073-transition qualification output for cc9ac896858d64bc6f6a5424b094fb361a57caea (SHA-256 910c98af114164cbee5ce740fab69708aef4f0713d6db847280c6af44040afe4):

    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.13s
     Running tests/fenced_transition_v2_qualification.rs (target/debug/deps/fenced_transition_v2_qualification-1201dbbedd163c8b)

running 1 test
test sustained_131073_unique_v2_transitions_bind_exact_epoch_capacity has been running for over 60 seconds
sdk-702 v2 qualification: elapsed=10637.198982802s committed=131073 reclaimed=131072 transient_exact_retries=2214 db_bytes=2182756256 snapshot_bytes=2077053072
test sustained_131073_unique_v2_transitions_bind_exact_epoch_capacity ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 3 filtered out; finished in 10637.78s

	Command being timed: "cargo test --locked -p opc-session-store --test fenced_transition_v2_qualification --all-features sustained_131073_unique_v2_transitions_bind_exact_epoch_capacity -- --ignored --exact --nocapture"
	User time (seconds): 26949.75
	System time (seconds): 811.43
	Percent of CPU this job got: 260%
	Elapsed (wall clock) time (h:mm:ss or m:ss): 2:57:18
	Average shared text size (kbytes): 0
	Average unshared data size (kbytes): 0
	Average stack size (kbytes): 0
	Average total size (kbytes): 0
	Maximum resident set size (kbytes): 308544
	Average resident set size (kbytes): 0
	Major (requiring I/O) page faults: 0
	Minor (reclaiming a frame) page faults: 561701
	Voluntary context switches: 110327553
	Involuntary context switches: 79566
	Swaps: 0
	File system inputs: 0
	File system outputs: 87737648
	Socket messages sent: 0
	Socket messages received: 0
	Signals delivered: 0
	Page size (bytes): 4096
	Exit status: 0

[VerifiedOrganic]

ePDG #181 integration blocker found during the production final-attach audit:

The V2 history work here is required, but the current StatelessSessionConsumerClient::execute_v2 path establishes a fresh revision-4 connection and PersistentSessionConsumerClient has no V2 execution surface. The downstream production contract requires V2 execute/status/history operations over prewarmed, fixed-width, least-authority mTLS request lanes with bounded FIFO/fair admission, NotTransmitted versus OutcomeUnknown, same-ID reconciliation, readiness, and setup/reuse/backpressure diagnostics. Hot V2 operations must add zero DNS/TCP/TLS/Hello setup when a warm lane is available.

The separate generic final-attach atomicity requirement is now tracked as #707. It must land after this history lifecycle, without an ePDG-local consensus/storage substitute.

Downstream will consume only a normally merged, current-head-qualified SDK commit and will retain the exact SDK-first pin/docs/consumer landing order.

[VerifiedOrganic]

Frozen-head peer review: APPROVE

• head: 3db6f92c4c03badd818e691dbe876e430df88d2c
• tree: 580678beb2f4947e373f785ca09edcdf30f15610
• P0/P1/P2: none
• prior documentation finding is closed: free-slot successor rotation is immediate; at eight epochs only the oldest eligible replay epoch is reclaimed while the active epoch remains writable
• authoritative release contract is the 1,010,000-operation/eight-epoch workload; the 131,074-attempt artifact is explicitly historical
• capacity and logical-byte arithmetic verified; every newly cited symbol resolves
• scope is exactly two documentation files over parent 5e2204ec24ec689ed660d736b9f152f3999e5708

Review limitation: static frozen-tree review. Local focused store tests and hosted gates are tracked independently; this review is not the downstream ePDG issue #181 acceptance artifact.

[VerifiedOrganic]

Exact-head local gate checkpoint for 3db6f92c4c03badd818e691dbe876e430df88d2c / tree 580678beb2f4947e373f785ca09edcdf30f15610:

• fenced_transition_v2_capacity_opens_successor_and_bounds_eight_exact_epochs: PASS (1/1, 462.12s)
• fenced_transition_v2_floor_reclaims_oldest_while_successor_remains_writable: PASS (1/1, 797.18s)
• fenced_transition_v2_post_reclaim_deletion_keeps_retired_and_conflict_closed: PASS (1/1, 172.47s)
• cargo fmt --all --check: PASS
• git diff --check: PASS
• exact hosted heavy-1 command reproduced locally: PASS (2/2, 246.27s)

The hosted heavy-1 shard is presently red on the unchanged multiprocess mTLS test command. This is not being waived or hidden: the full hosted log will be inspected after the workflow closes, then the failed shard will be rerun only if the evidence confirms an isolated runner failure. The authoritative 1,010,000-operation release qualification is still running and has not yet been claimed as passed.

[VerifiedOrganic]

Authoritative release qualification result: FAIL CLOSED

• runner head: 58e1c487cfd8f3616d19ea1d17646e14469a64d4
• runner crates/opc-session-store tree: df882feeae209235a17c80dfa40429184e1e09aa
• PR fix(session-store): add nonabsorbing fenced history v2 #704 exact-head crates/opc-session-store tree: df882feeae209235a17c80dfa40429184e1e09aa (byte-identical)
• command: cargo test --locked -p opc-session-store --test fenced_transition_v2_qualification --all-features release_1010000_operation_successor_scale_is_bounded_and_recoverable -- --ignored --exact --nocapture
• elapsed: 5,547.97s
• failure: paced bounded V2 batch: BackendUnavailable("session consensus quorum is unavailable") at fenced_transition_v2_qualification.rs:1720
• no sustained/burst phase summary had emitted before failure

This does not pass the authoritative 1,010,000-operation/eight-epoch release gate, and the historical 131,074-attempt artifact is not being substituted. A bounded root-cause review is determining whether the first defect is retry observability, leader/quorum lifecycle, or the public V2 batch/storage path. No timeout, retry count, load target, or validator is being relaxed.