Add the lock-owned transactional Domain Store

docs/specification.md

@@ -406,9 +406,8 @@ broker performs this sequence:
 
 Every durable host-process slot is exactly `Unassigned`,
 `Staged(PidfsProcessIdentityV1)`, or `Committed(HostProcessIdentity)`. Only a
-current pidfs identity may be staged. A committed legacy-unverified identity is
-retained only for migration and refusal. Current staged and committed identity
-both authorize exact matched cleanup; only committed current ownership may
+current pidfs identity may be staged or committed. Current staged and committed
+identity both authorize exact matched cleanup; only committed ownership may
 satisfy an active role, readiness, publication, or adoption.
 
 A role-bound Participant is first committed as bare `Intent` with no ownership
@@ -419,8 +418,8 @@ Within Intent, optional fields move only absent-to-present. A newly acquired
 child slot moves only `Unassigned` to `Staged` to the exact same current
 identity in `Committed`. An already committed current owner or supervising
 process may enter a newly created dependent-role snapshot directly, but that
-recorded identity then remains immutable. Legacy data cannot use this
-existing-process rule. Recorded evidence cannot be replaced or cleared.
+recorded identity then remains immutable. Recorded evidence cannot be replaced
+or cleared.
 The direct existing-process edges are Network RS, Helper RS, Sandbox HC, and
 Session Terminal HC. State Anchor daemon, Git-routing daemon, Helper process,
 Sandbox RS, attached runsc, and Session Terminal exec client are acquired child
@@ -436,7 +435,7 @@ The active Participant pairs are `prepared_lower=LeaseHeld`,
 role-required physical evidence and current committed pidfs ownership in every
 required process slot. `SessionTerminal=Running` likewise requires its
 container, PTY, guest identity, and current committed HC and exec-client slots.
-Staged, unassigned, or legacy process ownership cannot satisfy either boundary.
+Staged or unassigned process ownership cannot satisfy either boundary.
 Network readiness evidence must also name the enclosing generation and match
 its policy, fingerprint, namespace, and committed RS identity internally.
 
@@ -474,13 +473,6 @@ timing assumptions.
 7. Use that same matched pidfd for every action. An action-time `ESRCH` or
    observation failure refuses without numeric fallback.
 
-Domain Store v1 PID/start-only values dispatch to
-`LegacyUnverifiedProcessIdentityV1`. They cannot be observed, converted, or
-infallibly migrated into positive authority. They refuse live process action
-until reboot, independently proven absence, or explicit operator resolution
-allows the ordinary recovery state machine to reconcile the surrounding record.
-Boot mismatch fences all old pidfs authority before PID lookup.
-
 The contract accepts two residual assumptions: Linux boot-ID collision is
 operationally negligible but not mathematically impossible, and the Linux 6.9+
 boot-monotonic 64-bit pidfs inode counter does not wrap during one boot. Codecs
@@ -802,8 +794,8 @@ document, never a half-applied generation decision.
 
 Protocol durable decision vocabulary, multi-role intent, and mismatch refuse are
 defined by the protocol model. The product store encodes that generation document
-in typed tables under a schema/db version (unknown newer versions fail closed
-until an explicit Host Coordinator migration), including generation identity,
+in typed tables under a schema/db version (unknown versions fail closed before
+row interpretation), including generation identity,
 minted runtime component IDs, and participant ownership material (for example
 prepared-artifact ID, staged or committed pidfs process ownership, mount
 identity, and network readiness fingerprint).
@@ -880,11 +872,10 @@ bootstrap recovery may advance it to release intent. These rules make every
 interrupted release conservative and prevent a mounted State Anchor from
 becoming unleased.
 
-Store version acceptance occurs before physical resource inspection. The
-Domain Store v1-to-v2 migration preserves every PID/start-only value as
-legacy-unverified and never observes it into pidfs authority. Migration steps
-create and validate destination rows in one redb transaction and update the
-version last. Future versions follow the same fail-closed ordering.
+Store version acceptance occurs before row interpretation or physical resource
+inspection. The first product Domain Store identity is
+`lazaret-domain-store-v1` at version `1`; unversioned, unknown, older, and newer
+metadata refuses without fallback.
 
 Files not represented in the upper layer follow the selected base image. Files,
 directories, and whiteouts recorded in the upper layer remain authoritative when