#114 fix(session-erasure): map the pipeline's unsupported_storage refusal to a static 503

Summary

The history pipeline now answers an erase it cannot perform with its current storage or ingest state with an authenticated 503 {"error":"unsupported_storage","feature":"session_erase"}. Repeating that request cannot succeed, so Control must not describe it as retryable.

• On an upstream 503 only, Control now reads the error body (bounded to 4096 bytes, reader cancelled on every path) and, when both fields match exactly, returns a static 503 session_erasure_unsupported_storage with the fixed message This session cannot be erased with the current storage or ingest configuration. and no retry hint. Both the erase request and the verification read share this mapping.
• Everything else keeps the existing static 503 session_erasure_unavailable: other codes, wrong or missing feature, malformed, empty, non-object or oversized bodies, read failures, other 5xx and network errors. 501 stays not_implemented.
• No upstream text or identifiers are echoed and the upstream Retry-After is not forwarded. The two-field error shape is unchanged.
• docs/session-erasure.md and both 503 descriptions in openapi.yaml list the new code.

Source only. The feature stays default-off; no deployment, flag or permission change is implied.

Tests

New test in test/session-erasure.test.ts covering the DELETE and the verification GET, the exact recognised refusal with an upstream Retry-After header, provider text alongside the exact shape, wrong feature / missing feature / wrong case / other codes / array / string / non-JSON / empty / oversized bodies, 501 with the same body, and 500 with the same body. The existing table test (too_many_owners and {} still session_erasure_unavailable) is unchanged.

Local checks on the PR head (layered-heavy, one worker): npm run typecheck exit 0; test/session-erasure.test.ts 13 tests, 13 pass, 0 fail, 0 cancelled.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Maps the history pipeline's unsupported_storage refusal to a static, non-retryable 503 so Control stops describing an unretryable erase as retryable.

• On an upstream 503 only, Control reads the body (bounded to 4096 bytes, reader cancelled on every path) and, when both error and feature fields match exactly, returns 503 session_erasure_unsupported_storage with a fixed message, no retry hint, and no forwarded Retry-After — on both the erase request and the verification read.
• Everything else (other codes, wrong or missing feature, malformed or oversized bodies, read failures, other 5xx) stays session_erasure_unavailable; 501 stays not_implemented.
• No upstream text or identifiers are echoed, and the two-field error shape is unchanged.
• docs/session-erasure.md and both 503 descriptions in openapi.yaml list the new code.