Complete stable protocol transition plans

[AndriGitDev]

Summary

• Adds eleven bounded typed commit plans covering prekey publication, pairwise send/receive, handshake and receipt processing, group send/receive/state, attachment staging/state, and maintenance.
• Moves group membership, authority, chain announcements, fan-out, attachments, missing ranges, edits, polls, roles, ephemeral state, scheduled activation, call signalling, backup restore initialization, media reconciliation, and deferred paths onto transaction-oriented writes where applicable.
• Enforces ownership invariants: every advanced sender chain retains its ciphertext consequence, every advanced receiver chain retains its accepted plaintext/control consequence, and every consumed one-time prekey establishes its exact session.
• Adds a stable-module source guard against direct session, group, history, delivery, queue, replay, ephemeral, and media setter sequences.
• Adds the complete transition inventory and updates the release evidence ledger while keeping ADR-0028 Proposed.

Why

Several Alpha paths still advanced or destroyed cryptographic and stateful material across separate SQLite autocommits. A stop or storage failure between those writes could separate a chain step from its only ciphertext, accepted plaintext, delivery ownership, replay marker, deferred acknowledgement, or presentation consequence.

Each logical transition now validates detached before/after state and commits its durable consequences in one bounded BEGIN IMMEDIATE transaction. Transport, filesystem export, call presentation, UI callbacks, and event delivery remain after commit. A sealed presentation marker provides deterministic snapshot recovery if the process stops after commit but before notification.

Failure and restart evidence

The restart matrix covers every plan kind before and after transaction start, each numbered statement, commit, candidate cryptography, live-memory replacement, and event delivery. It also covers:

• maximum stable-v1 group fan-out: 63 remote accounts × 8 devices = 504 copies;
• partial carrier handoff followed by restart;
• duplicate and reordered deferred input;
• disk-full, constraint, duplicate-index, and full-quota failures;
• scheduled activation with no pre-commit transport or presentation;
• presentation marker recovery;
• duplicate attachment chunks, exact missing ranges, interrupted files, and media reconciliation;
• backup replacement phases and fresh-secret initialization.

Scope boundaries

ADR-0028 remains Proposed. Open P0 boundaries are linked-device authority/sync pending ADR-0026, first-contact admission pending ADR-0030, crash-safe initial profile creation, leased relay custody pending ADR-0032, independent review, and supported-platform sudden-power-loss qualification. Live call/media state remains intentionally process-local; ratchet-protected call signalling is covered.

Intentionally excluded P2 paths are live video, groups above 64 accounts, advanced moderation, high-bandwidth media, additional delay-tolerant carriers, federation, richer optional discovery/wake services, and later governance expansion.

Verification

Passed locally:

• cargo fmt --all -- --check
• python3 scripts/check-docs.py
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test -p kult-node --all-features
• cargo test -p kult-store --all-features
• cargo build -p kult-crypto -p kult-protocol --no-default-features
• core and desktop cargo deny check
• smoke execution of all 22 crypto/protocol fuzz targets under Rust nightly
• 100,000-row and 1,000,000-row store-scale gates; the million-row run completed migration in 152,190 ms, unlock in 10,617 ms, page in 387 µs, edit in 4,568 µs, delete in 1,107 µs, with 74,055,680-byte peak memory and a 525,672,864-byte database
• full workspace excluding environment-denied daemon socket and multicast cases; the remaining daemon library/binary tests passed with those exact cases skipped

Local environment limits:

• multicast and Unix-domain socket creation return EPERM;
• Linux desktop WebKit/GTK development packages are unavailable;
• Gradle and Swift are unavailable;
• local fuzz smoke disabled LeakSanitizer leak detection because ptrace prevents its /proc inspection.

The hosted PR checks cover the full workspace, MSRV, Windows storage, Linux desktop, dependency policy, normal 60-second fuzz runs, Android core/app, and iOS core/app cells. Keep this PR in draft until those results are reviewed.

Hosted results

Final head df0d2dd992fb4cd60cfd2c4a4135af01c504e46e passed:

• CI run 215: full workspace, Rust 1.88, Windows storage, Linux desktop, dependency policy, Android core/app, iOS core/app, and all 22 fuzz targets at 60 seconds each;
• container run 37: successful image build.

The PR remains draft pending review of the documented P0 boundaries.