core: make compiled programs the sole session-generation owner

[lemone112]

Summary

• Make CompiledProgram the sole strong owner of immutable ProgramEpochV1; every ProgramSessionPlan holds only Weak.
• Pin the exact owner generation at the start of Session::update. A dropped or replaced generation returns typed SessionUpdateError::OwnerExpired before observation admission, raw-head/lifecycle mutation, composition, or evaluator work.
• Keep re-entrant replacement transactional: the in-flight update finishes on its pinned generation; the next update deterministically expires.
• Keep Session-owned schema, bindings, and workspace separate from owner-owned executable graph/evaluator; owner pin/drop and expired failure remain allocation-free.
• Rebind the point-support source proof to the two changed cone files without changing claims, algebra, or the Q55 dependency.

Scope

• Exactly 9 files stacked on core: quarantine unsupported Display P3 promises #452 (8391d227…), +367/-65.
• No composition.rs, lib.rs, constraints/*, compatibility fallback, or package wrapper change.
• New wrappers must retain the compiled owner separately and map OwnerExpired explicitly.

Regression coverage

• Drop owner with one or two sessions; replace compiled generation.
• Expiry precedence before admission, composition, and evaluation, checked with call counters.
• Re-entrant replacement, retry/state preservation, and a source scan preventing hidden strong-owner regrowth.

Verification

• Rust 1.96 cargo test -p labcolors-core
• Rust 1.96 clippy --all-targets -- -D warnings
• rustfmt check for all seven touched Rust files
• point-support canonical verifier replay
• proof semantic diff limited to payload, closure, point_support, session, and verifier hashes
• exact-head GitHub CI (7/7 jobs, including WASM and Node 22)
• exact-head Native Swift conformance
• CodeRabbit

This is a stacked draft. Review only against agent/p3-promise-hard-delete; do not merge independently.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ebfb9e16-c71f-4a8a-b50a-8d173f4b0d4e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/weak-session-owner

---

_{Comment @coderabbitai help to get the list of available commands.}

[lemone112]

Superseded by the reviewed cumulative squash merge #465 (24fd1f4). The lower stacked branch was intentionally not merged on its own because its intermediate head was not the safe terminal public boundary.