[Danceiny]

Refs #674

A1.3 of the AaaS charter: the one way to a tenant's ledger. A replica asks a router for a tenant, and gets back a handle that is bound to that tenant and that proves the lease on every call. It lives outside the kernel and is not wired into a runtime path. state-ledger.ts and the kernel manifest are untouched, and no dependency is added.

Stacked on #679 (the base of this PR is its branch, so the diff shows only A1.3). When the stack below it merges I rebase onto main and retarget; there is nothing to decide in between.

What it adds (ts/src/tenant-state/)

• TenantRouter.openTenant(organization, ledgerTenant). It acquires the lease, restores the ledger from the newest verified copy, and returns a handle. Concurrent opens share one acquisition. A tenant another replica owns fails with LeaseHeldError, whose record names the owner, so the deployment layer of A3 can forward to it. An id outside the fixed format is refused before any store or file is touched.
• A tenant-bound handle. No method takes a tenant id. run and runAsync acknowledge a write only if the lease is provably held before the work and after it. The ledger the handle exposes is a guarded view: every call proves the lease first, and so does every statement, transaction and iterator made earlier, so a long-lived consumer such as a booking runtime is stopped the same way. A write applied locally but not acknowledged is harmless, because a later owner restores from the durable copy and local files never survive.
• Handoff. A graceful handoff drains in-flight work, flushes a final snapshot and releases the lease, and the next owner starts at once with every write. If the flush fails, the tenant keeps serving and keeps its lease, because releasing would hand the next owner an older copy. A crash loses only the writes after the last snapshot, which is the declared RPO. Abandon, forget, background renewal, periodic snapshots and a router close are covered too, and events carry only the organization and the HMAC tenant id.

A defect the tests found in my first design. I first made the guard a Proxy over the better-sqlite3 objects. A test that built a transaction while the lease held and used it after the fence showed the flaw: better-sqlite3 gives those objects read-only, non-configurable properties, among them a raw database handle. A Proxy has to return those unchanged, so it either throws on access or leaks the unguarded database. The guard now builds purpose-made facades for statements and transactions and does not pass the raw database on.

One deviation from the RFC, flagged. RFC §4.6 lists an epoch guard in kv for two replicas that share one file by mistake. I did not build it. The lease already ends a second writer, a restore replaces the file by atomic rename so the older writer is left holding an unlinked file, and a guard checked on every write would have to live in the kernel. I changed the RFC row to say what is built. If you want the detection-only version instead (a row written at open and re-read at each renewal), say so.

Evidence on 70cadae026dd22a955a1242d63331ea414efd505 (local Node v26.9.0)

• cd ts && npx tsx scripts/tenant-state-router-tests.ts: exit 0, 21 checks (run-all §91). Two of them use real timers: background renewal across more than two lease terms, and periodic snapshots.
• Mutation check: I broke 23 guards one at a time (every layer of the guard, the check after a write, the drain, the final flush, the wait for in-flight work, keeping a tenant after a failed flush, ending the handle on loss, reuse and sharing of opens, giving the lease back after a failed restore, abandon, router close, and snapshot serialization). The suite went red every time. The first run let the transaction case through, which is how the defect above came to light.
• tsc --noEmit, smoke.ts, g5-guard.ts, kernel-manifest-gate.ts: exit 0, with a zero-diff kernel manifest. The A1.1 and A1.2 suites still pass.
• Full scripts/run-all-tests.sh on this commit: ALL SUITES GREEN, exit 0. CI runs it again on Node 22 and 24.
• docs i18n and readability, run-all wiring test: OK. The code map has a row in both languages, and the RFC row is changed in both.

Not in this PR. The multi-process fault-injection drill and the #275 closure are A1.4. Minimal E2E: N/A, since nothing is wired into a runtime path.

Review ask. The deviation above is the one thing that needs your call. Everything else follows the accepted RFC.