Question: correlate pending reads with one-use epochs

Draft
TE
6d ago
+439-0

The pending-question ledger needs a native one-use correlation primitive for asynchronous attach/watch replies. This pure prerequisite binds relay tokens to a recovery epoch and refuses replay, cancellation, duplicate, bounded-overflow, and pre-gap tokens.

Native AcpmuxRequestIds supplies connection-unique monotonically increasing relay tokens. The map consumes each issue once; it permits explicit reissue of a retired integer and is not a permanent retired-token defense.

The helper creates no question membership, person identity, nonce, gesture ticket, or renderer authority. The dependent ledger remains responsible for requiring an acknowledged unfiltered watch, validating the complete current request, retiring stale peer/session state, and rechecking currentness at consumption.

Base prerequisite: validator branch lane/nx-question-validator-1028 at 0812231ec3dae1b370726bbd530fb4a5b0f73b8a (feat-cmux-next base 8424d05bf9324f6f60a8f0c7c40b01f8a3e085b9).
Head: ab9124d2e998b8443489850394334b21d17983aa.
Diff over validator prerequisite: 84 added lines in two files.

Validation:

  • git diff --check and python3 scripts/cmux-next/prepush-gate.py pass at this exact head.
  • The capacity source fixture now fills all 256 distinct entries before testing overflow, redemption, and reissue; this corrects the prior static-review finding.
  • Source-only regressions were committed first as c7781201758; native compilation and tests are UNVERIFIED under Swift HOLD26809. No executed red/green result is claimed.
  • Intended fleet command after release: swift test --package-path Packages/macOS/CmuxNext --filter AcpmuxQuestionReadEpochsTests.

This remains a draft prerequisite. No merge is requested.

Agent session: agent session