feat(storage): preserve session continuity at scale

[JAORMX]

Summary

• keep JSONL current snapshots bounded and crash-safe while preserving v1 reads
• add indexed, bounded session inventory across memory, JSONL, Redis, gRPC, and progressive mecatui loading
• add explicit legacy adoption, storage health, resumable migration, safe cleanup, retention, and maintenance UX
• harden maintenance with cross-process family locks, leases, fenced Redis migration, exact index coverage, and distributed child liveness

Verification

• task lint
• task test
• task docs
• task ac-trace-strict
• task site:build
• go run ./cmd/mecademo
• final multi-axis panel review: no Critical/High regressions

Closes #583
Closes #586
Closes #587
Closes #588
Closes #589
Closes #590
Closes #591
Closes #592
Closes #593
Closes #594
Closes #595
Closes #596

[jhrozek]

Post-panel-review fixes (12 commits)

Ran a full multi-agent panel review (Spec/Standards/Domain axes) over this PR, then addressed everything actionable. Summary of what changed and why:

Ship-blockers

• 42a4854b fix(proto): harness.proto's ServerCapabilities.manual_dream (already shipped on main) and the new storage_health field both landed on wire field 19. Real wire-compat break — a mismatched client/server pair would misread one field as the other. Restored manual_dream = 19, moved storage_health to 23. Verified with buf breaking --against main (now clean).
• 81df4a01 fix(grpcdriver): SessionMetadataCursor's new generation/scope/continuation fields were required non-empty on both sides whenever a cursor was present, with no version negotiation — breaking pagination against any peer that predates these fields (both directions). Added legacyOrBoundCursorFields (accept all-empty or all-non-empty, reject a partial mix); a version-skewed peer now degrades to a pagination restart instead of a hard reject.
• 9eeabfb2 test(retention): PlanAutomaticRetention was a same-package passthrough to PlanManualRetention with zero production callers — the real automatic sweep calls sessionretention.Plan directly. The AC5.5 "parity" test called the same function under two names and asserted it equals itself, so it could never catch real divergence. Deleted the dead shim; added a genuine cross-check that drives the real childGC.sweep and compares its output to the manual planner over the same pre-sweep data.

Judgement calls

• 5a4a9f5b docs(server): PlanSessionCleanup and 9 sibling migration/health/cleanup methods were classified KindCallerOwned with rationale implying per-principal data scoping, when they're actually store-wide admin-authority operations gated by an allowlist. The access control itself was already sound — only the self-documentation was misleading. Rewrote the rationale strings; documented the management-authority sub-case on KindCallerOwned (a genuinely separate AccessKind would need its own ADR per 0212's closed taxonomy — not done here).
• d28324e7 docs(redisstore): Two comment-only additions: the four owner-index Lua scripts build keys by string concatenation instead of declaring them in KEYS[] (fine for single-node Redis, a real blocker for a future Cluster upgrade), and the exact-coverage proof depends on an unenforced invariant (every mutator of the metadata sorted sets must bump the rebuild generation, or be a reviewed exemption).

Mechanical/reuse dedup (5 commits)

b228e80b/1a660bb9/e477789d/3fec87f5/3c58ee46 — ~10 findings from the code-duplication pass: a hand-rolled base64.EncodedLen, a session-metadata sort comparator and an owner-scope hash each duplicated 3x, a duplicated durable-write helper, hardcoded suffix literals instead of existing constants, a duplicated Redis result-decoder, an unstable sort.Slice where the sibling code already used the correct slices.SortStableFunc, mecatui reinventing an existing scrollWindow helper and a duplicate byte formatter, and two small ID-generator/duration-parser dedups. No behavior change except where explicitly noted (mecatui's scroll became cursor-centered to match its sibling pickers, and storage panels render decimal MB instead of binary MiB — both intentional, not incidental).

One regression surfaced and fixed during this dedup pass (caught by an independent review, not by CI): writeInventoryFileWithPattern started delegating to the store's fault-injectable snapshot ops instead of the fault-injection-free default, which broke 3 crash-safety tests and misclassified disk-full migration errors as backend_failure instead of insufficient_space. Fixed in b228e80b before it ever reached this state.

Correctness/coverage gaps found by the panel review

• 7bb3352d fix(port): PaginateSessionMetadataBound computed its cursor-restart "generation" by JSON-marshalling and SHA-256-hashing the entire filtered row set on every page call — O(total rows) per page instead of O(page size), violating AC2.1 on memstore (the one adapter using this helper; jsonlstore/redisstore each already have their own real counters). Now takes the caller's own cheap monotonic generation signal; memstore added a real counter bumped on Save/Delete.
• 05659b56 test(storeconformance): port.SessionMigrationStore had no shared cross-adapter conformance suite (unlike the other optional capabilities), despite both jsonlstore and redisstore implementing it independently — real risk of behavioral drift neither adapter's own tests would catch. Added RunSessionMigration (acquisition gating, cross-acquisition exclusion, tampered-fingerprint handling, job round-tripping) and wired it into both adapters.

Verification

Every commit above passed its own targeted tests plus a full go build ./... && go vet ./... (both modules) and gofmt -l . sweep at the time it landed. Two independent Opus review passes were run over the fixes (one over the ship-blockers/judgement-calls batch, one over the mechanical-fix batch) before anything was committed. Also manually smoke-tested the storage-continuity feature end-to-end offline against a real on-disk jsonlstore (session creation, generation-bound pagination across pages, storage health, and an authorized cleanup plan→apply cycle) outside the automated suite.