Protect PRISM submits during current-tip fanout

[Anatolie]

Why

PRISM makes a new tip globally current before its replacement job reaches every socket. During the incident, current-tip client coverage remained at 0% for 13–83 seconds. Miners on slow or blocked sockets kept submitting the exact job they had received, but those shares were rejected as stale or unknown; 177 of 6,408 post-deploy rejects (2.76%) fell into those categories.

Stale grace deliberately remains zero. Broadening it would make unrelated old jobs eligible and would change accounting semantics beyond this fanout failure mode.

What changed

• Adds a disabled-by-default, per-connection transition lease for only the exact prior job successfully delivered to that connection. Authority is bound to the connection and authorization generation, job ID, old and new tip/generation, and the job's template, payout, and difficulty context.
• Applies an absolute, non-sliding expiry and a per-connection retained-state cap. Successful replacement delivery revokes the prior lease; disconnect, reauthorization, rapid tip churn, failed fanout, and superseded fanout cannot retain unbounded authority.
• Reuses the share-submission boundaries from Extract PRISM share submission #77. Prior-tip transition work is share-only and can never enter current block-candidate, outbox, or block-submission paths.
• Preserves duplicate detection, difficulty validation, Vardiff accounting, durable share append, and payout behavior. An accepted transition share is counted once under credit_policy=fanout-transition and carries a strict receipt in audit bundle v1.2.
• Adds explicit expired/revoked rejection reasons, lifecycle and retained-state metrics, rollout documentation, and focused coverage for blocked clients, expiry, rapid B→C→D tips, reconnect/job-ID reuse, duplicates, high-difficulty old work, and memory bounds.

Expected outcome

When enabled, a blocked client can receive credit for its exact delivered job only until its replacement is delivered or the absolute lease expires. Clients that receive the replacement switch immediately. This should remove stale/unknown rejects caused solely by incomplete fanout without enabling general previous-tip credit, accepting guessed or reused jobs, or risking an old-tip block candidate.

Merging alone does not change runtime accounting because the lease defaults to disabled.

Configuration

Safe source defaults:

PRISM_STRATUM_FANOUT_TRANSITION_LEASE_SECONDS=0
PRISM_STRATUM_FANOUT_TRANSITION_MAX_JOBS_PER_CONNECTION=1

After the ledger schema and all v1.2 audit consumers are qualified, the intended deployment values are:

PRISM_STRATUM_STALE_GRACE_SECONDS=0
PRISM_STRATUM_FANOUT_TRANSITION_LEASE_SECONDS=120
PRISM_STRATUM_FANOUT_TRANSITION_MAX_JOBS_PER_CONNECTION=1

Monitor after merge

• Current-tip client coverage, fanout completion time, and socket delivery failures.
• Stale/unknown reject rate alongside transition-lease-expired and transition-lease-revoked.
• qbit_prism_fanout_transition_credited_shares_total, active leases, retained entries, and lifecycle events; retained state should fall after fanout/churn, while capacity_evicted indicates cap pressure.
• Ledger append errors, duplicate rates, Vardiff and payout reconciliation, and audit bundle v1.2 verification failures.
• Block-candidate and submission logs to confirm transition shares remain share-only.

Validation

• Full Python suite: 1,238 tests passed.
• Focused transition and ledger suite: 132 tests passed.
• cargo test --locked --workspace --all-targets passed.
• Formatting, compile, and diff checks passed.
• Live PostgreSQL integration was not run because neither a Docker daemon nor local PostgreSQL binaries were available; schema and ledger behavior are covered by unit tests.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}