Add the lock-owned transactional Domain Store

docs/schema.md

@@ -386,8 +386,8 @@ classDiagram
 `durable_decision` and `session_phase` contain values defined by the application
 protocol model. This schema records them without redefining either state machine.
 Each store carries its own schema identity and version. The current Domain Store
-identity is `lazaret-domain-store-v2` with version `2`. Domain Store v1 metadata
-dispatches only to legacy migration handling; it is never decoded as v2. The
+identity is `lazaret-domain-store-v1` with version `1`. Unknown, unversioned,
+older, and newer metadata refuses before any row is interpreted. The
 Storage Catalog remains `lazaret-storage-catalog-v1` with version `1`.
 
 ### Host process identity and staged ownership
@@ -407,17 +407,9 @@ classDiagram
         start_time_ticks
     }
 
-    class LegacyUnverifiedProcessIdentityV1 {
-        <<serialized>>
-        host_pid
-        start_time_ticks
-    }
-
     class HostProcessIdentity {
         <<serialized>>
-        <<union>>
-        PidfsV1
-        LegacyUnverifiedV1
+        identity
     }
 
     class PersistedHostProcessOwnership {
@@ -467,8 +459,7 @@ classDiagram
     }
 
     PidfsProcessIdentityV1 --> PidfsProcessAuthorityV1 : authority
-    HostProcessIdentity --> PidfsProcessIdentityV1 : PidfsV1
-    HostProcessIdentity --> LegacyUnverifiedProcessIdentityV1 : LegacyUnverifiedV1
+    HostProcessIdentity --> PidfsProcessIdentityV1 : current authority
     PersistedHostProcessOwnership --> PidfsProcessIdentityV1 : Staged
     PersistedHostProcessOwnership --> HostProcessIdentity : Committed
     StagedProcessOwnership --> ProcessOwnershipMessageVersion
@@ -490,11 +481,8 @@ Every persisted host-process edge uses `PersistedHostProcessOwnership`.
 contains only a current pidfs identity. It is positive authority for exact
 same-handle cleanup and `PidfsRecoveryMatch`, including bootstrap recovery, but
 cannot satisfy readiness, publication, dependent-resource creation, or
-adoption. `Committed` may contain a current pidfs identity or a
-legacy-unverified v1 PID/start-only value. Only committed current pidfs
-ownership is serviceable; the legacy variant always refuses positive process
-action. There is no observation-based conversion from legacy data to
-`PidfsProcessIdentityV1`.
+adoption. `Committed` contains the current pidfs identity and is the only
+serviceable process-ownership phase.
 
 Participant `Intent` and `ReleaseIntent` may retain any process-slot phase.
 Every active participant state and Session Terminal `Running` requires current

docs/specification.md

@@ -406,9 +406,8 @@ broker performs this sequence:
 
 Every durable host-process slot is exactly `Unassigned`,
 `Staged(PidfsProcessIdentityV1)`, or `Committed(HostProcessIdentity)`. Only a
-current pidfs identity may be staged. A committed legacy-unverified identity is
-retained only for migration and refusal. Current staged and committed identity
-both authorize exact matched cleanup; only committed current ownership may
+current pidfs identity may be staged or committed. Current staged and committed
+identity both authorize exact matched cleanup; only committed ownership may
 satisfy an active role, readiness, publication, or adoption.
 
 A role-bound Participant is first committed as bare `Intent` with no ownership
@@ -419,8 +418,8 @@ Within Intent, optional fields move only absent-to-present. A newly acquired
 child slot moves only `Unassigned` to `Staged` to the exact same current
 identity in `Committed`. An already committed current owner or supervising
 process may enter a newly created dependent-role snapshot directly, but that
-recorded identity then remains immutable. Legacy data cannot use this
-existing-process rule. Recorded evidence cannot be replaced or cleared.
+recorded identity then remains immutable. Recorded evidence cannot be replaced
+or cleared.
 The direct existing-process edges are Network RS, Helper RS, Sandbox HC, and
 Session Terminal HC. State Anchor daemon, Git-routing daemon, Helper process,
 Sandbox RS, attached runsc, and Session Terminal exec client are acquired child
@@ -436,7 +435,7 @@ The active Participant pairs are `prepared_lower=LeaseHeld`,
 role-required physical evidence and current committed pidfs ownership in every
 required process slot. `SessionTerminal=Running` likewise requires its
 container, PTY, guest identity, and current committed HC and exec-client slots.
-Staged, unassigned, or legacy process ownership cannot satisfy either boundary.
+Staged or unassigned process ownership cannot satisfy either boundary.
 Network readiness evidence must also name the enclosing generation and match
 its policy, fingerprint, namespace, and committed RS identity internally.
 
@@ -474,13 +473,6 @@ timing assumptions.
 7. Use that same matched pidfd for every action. An action-time `ESRCH` or
    observation failure refuses without numeric fallback.
 
-Domain Store v1 PID/start-only values dispatch to
-`LegacyUnverifiedProcessIdentityV1`. They cannot be observed, converted, or
-infallibly migrated into positive authority. They refuse live process action
-until reboot, independently proven absence, or explicit operator resolution
-allows the ordinary recovery state machine to reconcile the surrounding record.
-Boot mismatch fences all old pidfs authority before PID lookup.
-
 The contract accepts two residual assumptions: Linux boot-ID collision is
 operationally negligible but not mathematically impossible, and the Linux 6.9+
 boot-monotonic 64-bit pidfs inode counter does not wrap during one boot. Codecs
@@ -802,8 +794,8 @@ document, never a half-applied generation decision.
 
 Protocol durable decision vocabulary, multi-role intent, and mismatch refuse are
 defined by the protocol model. The product store encodes that generation document
-in typed tables under a schema/db version (unknown newer versions fail closed
-until an explicit Host Coordinator migration), including generation identity,
+in typed tables under a schema/db version (unknown versions fail closed before
+row interpretation), including generation identity,
 minted runtime component IDs, and participant ownership material (for example
 prepared-artifact ID, staged or committed pidfs process ownership, mount
 identity, and network readiness fingerprint).
@@ -880,11 +872,10 @@ bootstrap recovery may advance it to release intent. These rules make every
 interrupted release conservative and prevent a mounted State Anchor from
 becoming unleased.
 
-Store version acceptance occurs before physical resource inspection. The
-Domain Store v1-to-v2 migration preserves every PID/start-only value as
-legacy-unverified and never observes it into pidfs authority. Migration steps
-create and validate destination rows in one redb transaction and update the
-version last. Future versions follow the same fail-closed ordering.
+Store version acceptance occurs before row interpretation or physical resource
+inspection. The first product Domain Store identity is
+`lazaret-domain-store-v1` at version `1`; unversioned, unknown, older, and newer
+metadata refuses without fallback.
 
 Files not represented in the upper layer follow the selected base image. Files,
 directories, and whiteouts recorded in the upper layer remain authoritative when