Fence session ownership epochs before CRDT peers can write offline

[forkwright]

Finding

Dioptron requires one exclusive writer for a session while also promising partition-tolerant CRDT synchronization that preserves both forks. The design does not define an authority epoch or fencing mechanism that prevents a stale owner from continuing to write after handoff.

Evidence

• docs/requirements.md:22-28 requires exclusive ownership, explicit handoff, and revocation.
• docs/tenancy-and-lifecycle.md:33-39 carries the exclusive-owner model into tenant/device lifecycle.
• docs/decisions.md:18-19 says CRDT synchronization preserves both forks across partitions.
• docs/topology.md:53-57 calls handoff atomic but does not define the mechanism that makes it atomic.

A CRDT can reconcile data conflicts; it cannot decide which partition retained write authority. Without a monotonically increasing ownership epoch, both the former and new owner can produce apparently authoritative mutations during a partition.

Why this matters

This is a split-brain authority defect, not an eventual-consistency detail. Revocation and handoff are unenforceable offline, stale writes can reappear after reconnect, and the system cannot truthfully claim one exclusive owner.

Required mechanism

• Assign every ownership handoff a monotonically increasing epoch/fencing token.
• Require that token on every session mutation and reject stale epochs.
• Define the single authority or quorum that commits a handoff.
• Preserve stale offline work only as an explicit non-authoritative fork requiring reconciliation.
• Add partition → handoff → stale write → rejoin tests proving the old owner cannot mutate authoritative state.