Add the lock-owned transactional Domain Store

docs/schema.md

@@ -386,8 +386,8 @@ classDiagram
 `durable_decision` and `session_phase` contain values defined by the application
 protocol model. This schema records them without redefining either state machine.
 Each store carries its own schema identity and version. The current Domain Store
-identity is `lazaret-domain-store-v2` with version `2`. Domain Store v1 metadata
-dispatches only to legacy migration handling; it is never decoded as v2. The
+identity is `lazaret-domain-store-v1` with version `1`. Unknown, unversioned,
+older, and newer metadata refuses before any row is interpreted. The
 Storage Catalog remains `lazaret-storage-catalog-v1` with version `1`.
 
 ### Host process identity and staged ownership
@@ -407,17 +407,9 @@ classDiagram
         start_time_ticks
     }
 
-    class LegacyUnverifiedProcessIdentityV1 {
-        <<serialized>>
-        host_pid
-        start_time_ticks
-    }
-
     class HostProcessIdentity {
         <<serialized>>
-        <<union>>
-        PidfsV1
-        LegacyUnverifiedV1
+        identity
     }
 
     class PersistedHostProcessOwnership {
@@ -467,8 +459,7 @@ classDiagram
     }
 
     PidfsProcessIdentityV1 --> PidfsProcessAuthorityV1 : authority
-    HostProcessIdentity --> PidfsProcessIdentityV1 : PidfsV1
-    HostProcessIdentity --> LegacyUnverifiedProcessIdentityV1 : LegacyUnverifiedV1
+    HostProcessIdentity --> PidfsProcessIdentityV1 : current authority
     PersistedHostProcessOwnership --> PidfsProcessIdentityV1 : Staged
     PersistedHostProcessOwnership --> HostProcessIdentity : Committed
     StagedProcessOwnership --> ProcessOwnershipMessageVersion
@@ -490,11 +481,8 @@ Every persisted host-process edge uses `PersistedHostProcessOwnership`.
 contains only a current pidfs identity. It is positive authority for exact
 same-handle cleanup and `PidfsRecoveryMatch`, including bootstrap recovery, but
 cannot satisfy readiness, publication, dependent-resource creation, or
-adoption. `Committed` may contain a current pidfs identity or a
-legacy-unverified v1 PID/start-only value. Only committed current pidfs
-ownership is serviceable; the legacy variant always refuses positive process
-action. There is no observation-based conversion from legacy data to
-`PidfsProcessIdentityV1`.
+adoption. `Committed` contains the current pidfs identity and is the only
+serviceable process-ownership phase.
 
 Participant `Intent` and `ReleaseIntent` may retain any process-slot phase.
 Every active participant state and Session Terminal `Running` requires current