fix(move): read the host left behind until every contact has followed - #6

Why

A move tells each contact the new address in a lane notice inside the session. Until a contact applies that notice, it keeps appending to the old host on the old lane. Nothing read the old host after the move, so whatever contacts wrote there in the meantime was lost:

• A contact that was offline flushed its queue before it fetched the notice, so all of that queue went to the old host and was lost.
• A contact that was online lost what it sent while the notice was in flight.
• A move made during a commit race could not settle. The winner's commit went to the loser's old lane, so the loser never saw it.

What

Engine

• Previous inbox. On a move, the device keeps the old host's deployment, its cursor there, and each conversation's old inbound lane. Together these are the previous inbox, persisted with the deployment.
• Reading the old host. Each sync, and a 5-minute poll, reads the old host under a sync key of its own (previous:{device}), so that host has its own cursor, dedup set and quarantine. Records there route to their conversations by the old lanes and go through the ordinary inbound path. They are never acknowledged at that host; they expire there on their own.
• End of the drain. Reading stops once every conversation's peer has been seen at the new host and the old host has nothing left, or after Δ (30 days).
• On the contact's side. Applying a lane notice readdresses whatever is still queued on the old lane to the new one, and restarts its retries. A message that could not reach a host already gone then goes to the new one.

Platforms

• The profile and the CLI driver keep the replaced credential when a credential for another runtime is installed. They pick the credential a request names by its runtime id.
• The desktop refreshes the kept credential at the old host when it nears expiry.

Ledgers. No new request or event kind: reading the old host reuses GetHead and FetchMessages, and there is no new emission site.

Tests

• a_move_goes_on_reading_the_host_it_left. Bob reads his old host under its own credential and takes Alice's message on the old lane, with no ack sent there. When Alice applies the notice, her queued envelope moves to the new lane.
• the_old_host_is_read_until_every_peer_has_followed. The drain ends once the peer has written to the new host and the old host is read to its end.
• a_lane_moved_during_a_race_is_announced_after_the_rebuild. A move made during a race settles, and the winner follows the loser's new lane. This test was moved out of fix(direct): open items from the client's spec, and the KeyPackage pool count route #5, where it could not pass without this change.

Not verified locally

There is no Rust toolchain on this machine; CI is the first build.

🤖 Generated with Claude Code