fix(session-net): qualify persistent mTLS reuse on current main

[VerifiedOrganic]

Refs #695.

Current-main successor

This is the clean successor requested for the stale #695 work. It starts at the exact current SDK main and contains no stale qualification-branch, #704, or #715 ancestry:

• base: f2ed1181c85540cc01ea0b4611fa3620891375fd
• base tree: 945ceab3870d2c1d2d1396aff29e819288fce76a
• head: 5f69c9bd1383a0b1efbb2c453fd5e2df50183bc6
• head tree: 404390bf1b67e3971302fba59fb6e9c612381206
• merge-base: exact base; divergence from origin/main: 0/5
• five direct successor commits; zero merge commits
• all five commits have valid Git ED25519 signatures from the same verified signing key

Current main was not a supersession: #710 fixed authenticated server idle-lane reuse and #711 added receipt reconciliation, but neither supplies the remaining persistent-consumer freshness, reconnect serialization, correlation, effect-boundary, or cancellation properties below.

Generic SDK correction

The bounded delta preserves tenant-scoped mTLS, live peer SPIFFE identity, the exact consumer ALPN/Hello/scope authority, fixed request/watch capacity, fair admission, and mutation no-replay behavior. It adds only generic transport behavior:

• rolling prewarm of every configured request/watch lane through fresh DNS/TCP/TLS/Hello, preserving healthy refreshed/unprocessed siblings after partial failure;
• one pool-wide serialized cold-recovery lane and coalesced bounded backoff shared by request, watch, and prewarm paths, while warm calls bypass it;
• direct credential/material supersession of blocked resolver/TCP/TLS/Hello setup without deadline wait or stale cooldown, retaining the serialized permit until losing I/O is destroyed;
• ordinary same-authority lifecycle failure retains its required shared cooldown;
• revision-5 composite correlation (NonZeroU32 plus fresh UUID nonce), exact full-response matching, and fail-closed future/duplicate/unknown response handling;
• authoritative below-TLS ciphertext-write observation: zero lower writes is NotTransmitted; any positive lower write is ambiguous and is never automatically replayed;
• peer EOF/pipelining cancellation of pending server execute/watch setup; and
• schema-bound, redaction-safe tracked evidence that remains explicitly incomplete.

No ePDG policy is introduced. No cluster, ePDG repository, or latency-bearing workload was touched.

Preserved RED / GREEN evidence

Eight focused regressions preserve the causal RED observations and are tracked in docs/qualification-695-persistent-consumer.md:

1. rolling prewarm: resolver calls 2, required 4;
2. 12 concurrent cold callers: peak resolver setups 12, required 1;
3. pre-staged future response: typed Rejected(Unavailable), required OutcomeUnknown;
4. lone direct reauthentication: resolver calls 1, required 2 without advancing paused time;
5. adapter-only plaintext buffering: MayHaveWritten, required NotTransmitted;
6. stale setup: old-epoch admission remained pending, required immediate Superseded;
7. same-authority lifecycle failure: immediate readmission, required shared cooldown; and
8. superseded setup: fresh admission while losing I/O was blocked in Drop, required admission only after I/O destruction.

The exact corrected head is GREEN on:

cargo test -p opc-session-net --all-features --lib
  279 passed; 0 failed

cargo test -p opc-session-net --all-features \
  --test persistent_consumer_protocol \
  --test persistent_consumer_boundaries \
  --test persistent_consumer_transport
  boundaries 7; protocol 26; transport 30; all passed

cargo test -p opc-session-testkit --all-features --test qualification_profile
  19 passed; 0 failed

cargo clippy --workspace --all-features --all-targets -- -D warnings
  passed

RUSTDOCFLAGS='-D warnings' cargo doc --workspace --all-features --no-deps
  passed

cargo check --workspace --no-default-features
cargo check --workspace
  passed

cargo deny check advisories bans licenses sources
  passed (configured duplicate/unmatched-allowance warnings only)

cargo fmt --all -- --check
git diff --check
  passed

The v8 schema SHA-256 is 5e3becf5094f3e222b94799e0fb7b6b77c3398aeabae743fc65b409c4cd4adfd; its exact-head test binds compiled revision 5. The schema requires experimental=true and qualification_complete=false.

Independent exact-head review

Three independent reviewers inspected the immutable head/tree and returned SHIP:

• concurrency: P0/P1/P2 = 0/0/0;
• identity/authority/ambiguity: 0/0/0; and
• complete transport ship review: 0/0/0.

They independently verified ancestry, all five signatures, reconnect permit/cooldown ordering, mTLS/SPIFFE/scope authority, write ambiguity, correlation isolation, bounds/fairness, cancellation/shutdown, redaction, and the focused test counts.

Qualification status and downstream ordering

This PR is the required generic correction and tracked non-latency evidence, not false closure evidence for #695. No real networked three-voter production-mTLS latency run was performed in this successor. The historical bounded distribution in the evidence document is explicitly synthetic and non-gating. Issue #695 must remain open until the real three-voter production-mTLS topology proves its full connection/bound/failure/rotation contract and warm p99/p99.9 SLO with bounded raw samples.

This head intentionally binds consumer transport revision 5 to the existing /1 ALPN with no downgrade fallback. Later #704/#715 and #707 work must start from the normal merge of this PR and reconcile their additive ALPN/protocol families in crates/opc-session-net/src/consumer.rs; they must not replay stale bulk history.

[VerifiedOrganic]

Independent exact-head review record for 5f69c9bd1383a0b1efbb2c453fd5e2df50183bc6 (tree 404390bf1b67e3971302fba59fb6e9c612381206) over required base f2ed1181c85540cc01ea0b4611fa3620891375fd (tree 945ceab3870d2c1d2d1396aff29e819288fce76a):

• concurrency review: SHIP, P0/P1/P2 = 0/0/0
• transport/no-replay review: SHIP, P0/P1/P2 = 0/0/0
• authority/ambiguity/redaction review: SHIP, P0/P1/P2 = 0/0/0

Provenance review found five direct signed additive commits, no merge commits, exact merge-base f2ed1181c85540cc01ea0b4611fa3620891375fd, and valid ED25519 signatures throughout.

The reviews independently checked rolling fresh prewarm; one-wide reconnect admission and stale-epoch cooldown suppression; same-authority cooldown retention; resolver/TCP/TLS/Hello setup cancellation ordering; mTLS, exact ALPN/Hello revision, SPIFFE identity and scope revalidation; unpredictable sequence+UUID correlations; late/duplicate/unknown/wrong-family response rejection; exact below-TLS positive-write accounting; no replay after MayHaveWritten; immutable mutation body/ID across permitted attempts; peer-EOF and caller-cancellation safety; and fixed-label redaction.

Independent focused results included: library 279/279, protocol 26/26, boundaries 7/7, transport 30/30, qualification profile 19/19, formatting/diff check, warning-denied all-feature/all-target Clippy, docs, feature surfaces, and cargo-deny.

Compatibility caveat: revision 5 intentionally has no mixed-revision downgrade and requires a coordinated drained cutover.

This review does not claim the outstanding real networked three-voter production-mTLS latency/failure/rotation qualification. The tracked v8 object remains experimental=true and qualification_complete=false; issue #695 must remain open until that separate acceptance evidence exists.

[VerifiedOrganic]

Independent exact server-merge review: SHIP; P0/P1/P2 = 0/0/0.

Reviewed immutable composition:

• server merge b63140f84b0774c2f0821988cf3b50791a98171f
• tree 2be68eae758accbbf95781e17a7d0cc8eda1bf6b
• parents: normally merged SDK main 549efe523be4461845ac1ac6c72759107b591e65 and signed fix(session-net): qualify persistent mTLS reuse on current main #716 head 5f69c9bd1383a0b1efbb2c453fd5e2df50183bc6
• merge-base: required source base f2ed1181c85540cc01ea0b4611fa3620891375fd

The reviewer verified whole-delta stable patch IDs in both directions: #716 base-to-source equals updated-main-to-merge, and #714 base-to-main equals #716-source-to-merge. That includes both overlapping files. The merge tree contains no conflict markers, and every #716 production/concurrency file is byte-identical to the previously reviewed source object.

Focused checks on the exact merged tree:

• qualification profile: 19 passed, 0 failed
• stateless revision/mTLS test: 1 passed, 0 failed
• reconnect permit-transfer regression: 1 passed, 0 failed

No composition correction is required. No latency, cluster, or ePDG workload was run.

[VerifiedOrganic]

Normal merge complete:

• merge 7a6a1f003801811867c31275bbaae6c410868399
• tree 2be68eae758accbbf95781e17a7d0cc8eda1bf6b
• parents 549efe523be4461845ac1ac6c72759107b591e65 and signed source head 5f69c9bd1383a0b1efbb2c453fd5e2df50183bc6
• exact updated-main merge-ref run: 38/38 checks passed
• source branch retained

The redaction-safe landed evidence, exact 16-file list, fixed bounds, raw synthetic distribution, and unresolved real production qualification are recorded on #695. #695 remains open because no real networked three-voter production-mTLS latency/failure/rotation gate was run; the v8 schema remains explicitly qualification_complete=false.