fix(hotblocks): enforce finalized fork floor

[mo4islona]

Summary

Closes GAP-22 and GAP-42 — four ways a fork could replace the finalized prefix or park the dataset on the 60-second retry loop for good.

Resolution position. insert_fork replaces whole chunks, so fin + 1 is not a representable position when finality falls inside one: clamping there wedges the commit. Resolution now stops at the stored chunk boundary, which may sit at or below fin, and the finalized prefix is guarded on the write path instead — a replacement reaching that low is admitted only if it spans fin and reproduces every block up to it, hash for hash (Tx::validate_finalized_prefix). Comparing only fin's own hash admits a source that rewrites the interior; payload equality is out of reach by construction (INV-13 Scope).

Reaching fin at all. That guard only recovers if the replay gets back up to fin, which was left as an assumption about the flush triggers. The 200k-row bound can cut the replayed chunk one block short, and every retry repeats the identical cut. Rollback::reach_at_least now carries fin to the ingest, which withholds a chunk until it covers that block.

A trim inside a replay. A retention trim landing between fork resolution and its commit leaves a rollback aimed at a window that no longer exists. retain now reports whether the head survived instead of leaving the caller to predict it, the ingest restarts when it did not, and a replacement starting below the first stored chunk is refused at commit. A push repeating the current floor is answered before the trim runs — reading the verdict off an empty window would restart an ingest the call never touched, once per push.

The finality report itself. It is a header the source hands over, not a block it served, and it anchors both the guard above and every later compute_rollback. Where it names a height the committed chunk carries, the chunk decides (WP-8); a height the chunk skips is ignored rather than refused — refusing would park a slot-numbered dataset on an honest report.

Observability

UnapplicableFork::reason is now a metric slug on a cause label: the class alone did not say which refusal fired, and a stale-ingest refusal that clears itself on the next epoch read exactly like a source rewriting finalized history. A withheld replay is counted only where a flush is attempted, which a source stopping below the floor never reaches, so the pending floor is also level-readable (ingest_flush_floor, set at fork resolution).

A compaction-invalidated physical rollback boundary is now classified as stale_rollback_boundary instead of other / unspecified. The stale replacement remains atomic, and resolution against the current layout goes one chunk deeper.

Also in here

• Unrelated, folded in: the query slot is released before its caller is woken, so a caller woken in between can no longer be refused admission for a query that already finished.
• Normative spec changes are in the diff: WP-6/WP-8, INV-13 Scope, INV-14, FM-OP-6, OB-9, and the living conformance matrix (GAP-22/42 closed, GAP-43 filed).

Known limits

• Nothing caps how long a replay may withhold (GAP-43). The pending floor is visible; the escape is not automatic.
• A data-availability mask change inside a replayed finalized range stops the ingest loudly (FM-OP-6: out of scope, operator-sequenced).
• A compaction-invalidated rollback boundary self-heals on the next epoch; immediate in-epoch re-resolution remains future work.
• The trim-inside-replay race has no black-box script — driving SET-RETENTION into the replay window needs a harness retention client and deterministic control of the replay's duration. Both damaging outcomes are covered by unit tests.

Test plan

Write-controller and ingest regressions cover finalized-prefix integrity, a second fork while replay is withheld, finality advancing before the first replay flush, and compaction consuming a resolved boundary. The five black-box ct4_finality scenarios now assert an actual new /stream request and the exact stored boundary used as resume_from, so a silent full-window replay no longer passes as recovery.

• cargo test -p sqd-hotblocks -p sqd-storage -p sqd-hotblocks-harness
• cargo clippy -p sqd-hotblocks -p sqd-storage --all-targets -- -D clippy::correctness
• cargo +nightly fmt --all -- --check