[Tristan-Stoltz-ERC]

Summary

Stacked on #2862. Implements an explicit controller-generation fence and makes stale-epoch event acceptance a non-compensatory benchmark violation.

Implementation

• Adds ControllerEpoch and EpochFencedOutcomeLedger in epoch_fence.rs.
• Epoch generations must be nonzero and strictly monotonic; same-generation and backward advances fail closed.
• Submission registration and event ingestion require the supplied epoch to equal the current epoch.
• Events from prior epochs are rejected before the underlying lifecycle ledger can mutate.
• A current-epoch event cannot complete a request that was registered in an earlier epoch, even if the controller reused the same ticket string.
• Request IDs remain globally reserved across epochs; capacity is global and restarts do not evict tombstones.
• Native ticket strings can be reused only as epoch-scoped identities; prior-epoch tickets/events remain invalid.
• Epoch-specific ledgers are created lazily, so repeated empty restarts do not grow memory independently of the configured request capacity.
• Prior-epoch requests without a terminal outcome remain explicitly unresolved, rather than being silently declared complete.
• Adds 12 focused tests, including a deterministic 256-request corpus across 16 controller generations that asserts all 240 prior-generation event attempts are rejected after fifteen restarts.
• Adds docs/research/ROBOTICS_CONTROLLER_EPOCH_FENCING_V0_1.md with the supervisor contract and remaining durability/authentication limitations.
• Extends the paired-recovery scorer so any accepted stale-epoch event contributes to the hard-gate violation count; adds a regression test showing performance gains cannot clear that gate.
• Updates the preregistered recovery protocol and scenario manifest to explicitly include epoch rollback/store unavailability and stale-event acceptance.

Required integration contract

The supervisor must provide a restart-safe, authoritative generation and attach it to each native ticket and event. This module deliberately does not claim to persist that generation, authenticate the event source, coordinate multi-process failover, or physically stop old commands. It is an in-memory enforcement layer whose callers must supply a trustworthy epoch.

Validation

• Current exact PR head: 2e591b7
• Exact-head CI run: https://github.com/Luminous-Dynamics/symtropy/actions/runs/40896051588 (queued, not passed).
• The 12 epoch-fence tests and 10 scorer tests are authored but have not been executed locally because this environment has no Cargo/Rust/rustfmt toolchain.
• No HIL/physical safety, durable anti-replay, or SOTA-performance claim is made.

Related: #2828, #2836, #2852, #2860, #2862.