Projection-cache predecessor recovery and Session-format binding (session_projcache v3-v6 → v7)

DomainSpec.compatibleVersions (new, optional): the domain owner declares "records stored under these older versions are also readable under the current record schemas" (typically by declaring the fields old records lack as optional). defineDomain validates each entry as a non-negative integer below the current version; descriptorOf projects the set onto the backend KvUnitDescriptor.

json backend per-record reads accept version stamps in "current ∪ compatibleVersions"; anything outside the set is still discarded as foreign. The write path always stamps the current version (the first checkpoint after reading an old record naturally advances it). The single layout stays exact-version.

Legacy-bootstrap version gate (the actual bug fix): the old whole-unit file's unit.version must fall inside the accepted set to be migrated; otherwise the file is left alone and the unit reads empty — stamping records the owner never vouched for turns a discardable stale cache into hard schema failures at the domain layer.

The projcache domain declares version: 7, compatibleVersions: [3, 4, 5, 6], and the format and lineage identity fields are optional in the stored schema so vouched-for predecessor records can open. Current writes always include all three fields.

Identity matching is stricter than structural admission: an absent formatVersion never matches a current Session, so predecessor rows cannot seed a projection and refold from the authoritative log. Once the format matches, identityMatches normalizes absent lineage to unseeded (?? false / ?? 0): exact for an unseeded session, while a seeded expectation fails the match. Poisoned v5 homes therefore boot safely, but their unbound rows are not exposed as current values.

Schema-validation backstop: invalidRecords: 'backup-and-skip' (declared by this domain only). A stored record that still fails to parse beyond read compatibility no longer refuses the whole domain: the domain layer calls the backend's KvUnit.backupRecord (json per-record implementation = rename the document to <key>.json.bak.<YYYYMMDDHHmm>, bytes kept, never read again), prints the concrete failure with logger.error (domain, table, key, destination, zod cause), and continues the open with the record absent; the next cold read rebuilds and rewrites that session's cache. The policy is an explicit per-domain declaration and the default stays fail-loud — other domains still refuse the whole load on invalid stored data, and a backend without backupRecord (single layout, row stores) also falls back to fail-loud. Naming history: quarantine → backup-and-skip (user ruling: the word must carry both "back up" and "skip", sharing its root with the .bak suffix; skip-backup was rejected because the CLI --skip-X convention reads it as "do not back up"). For this domain it supersedes the reset/destroy recovery path of the 2026-07-28 storage recovery proposal, which stays live for authoritative and whole-medium damage.

A predecessor title is a listing hint, not a fold shortcut: Session-list startup remains metadata/cache-only and never opens cold log bodies. The log header is authoritative; a lifecycle-matching checkpoint is a durable-prefix witness that may lag but cannot lead the log. cachedPredecessorTitle therefore exposes only a predecessor title row that still passes the current title unit's stateVersion and schema. Both adjacent Session-format edges preserve title text. The hint carries the stored title row's own watermark as asOfSeq; because a cardinality-changing log migration can remap that coordinate, the Session list labels the block kind: 'cached' and the client never compares it with the connected Session's seqs (listing identity and cached rows). Other predecessor rows remain hidden, and hydratePrepared/coldSnapshot retain strict format identity, because normalizers can change values such as blank or lastPromptAt even when storage is physically consistent.

DomainSpec.compatibleVersions（新增，可选）：域 owner 声明"这些旧版本的存量记录在当前记录 schema 下也可读"（典型手段：新增字段标 optional）。defineDomain 校验各项为小于当前 version 的非负整数；descriptorOf 透传到后端 KvUnitDescriptor。

json 后端 per-record 读：接受"当前版本 ∪ compatibleVersions"内的版本戳，集合外照旧视为 foreign 丢弃；写路径永远戳当前版本（读到旧记录后的下一次 checkpoint 自然把它推进到当前版本）。single 布局维持 exact-version 不变。

legacy bootstrap 版本把关（bug 修复本体）：旧单文件的 unit.version 必须落在接受集合内才迁移，否则视为空 unit 留在原地——为 owner 未背书的记录打当前版本戳，会把"可丢弃的过期缓存"变成 domain 层的 schema 硬失败。

projcache 域声明 version: 7, compatibleVersions: [3, 4, 5, 6]；存储 schema 中的格式与 lineage identity 字段均为 optional，使 owner 背书的前代记录可以打开。当前写入始终包含这三个字段。

identity 匹配比结构准入更严格：缺失 formatVersion 的记录绝不匹配当前 Session，因此前代行不能播种投影，而会从权威日志重新折叠。格式匹配后，identityMatches 才把缺失 lineage 归一化为 unseeded（?? false / ?? 0）：对 unseeded 会话精确，对 seeded 期望则匹配失败。v5 投毒 home 因而可以安全启动，但其未绑定行不会作为当前值暴露。

schema 校验兜底：invalidRecords: 'backup-and-skip'（仅本域声明）。读兼容之外仍然解析失败的存量记录不再让整个域拒开：domain 层调用后端的 KvUnit.backupRecord（json per-record 实现＝把文档改名为 <key>.json.bak.<YYYYMMDDHHmm>，字节留档、不再被读取），用 logger.error 打印具体失败信息（域名、表、键、移动去向、zod 失败原因），随后当该记录不存在继续启动；下一次冷读会重建并重写该会话的缓存。该策略是域级显式声明，缺省仍为 fail-loud——其他业务域的存量数据校验失败照旧整域拒载；后端没有 backupRecord 能力（single 布局、行存储）时也回退 fail-loud。命名沿革：quarantine → backup-and-skip（用户裁决：词要同时含"备份"与"跳过"两义，且与 .bak 后缀同源；skip-backup 因 CLI --skip-X 惯例存在"不备份"反读而弃用）。对本域而言，该策略取代了 2026-07-28 存储恢复提案中 reset/destroy 的恢复途径；该提案对权威介质与整介质损坏仍然有效。

predecessor title 是列表 hint，而不是 fold shortcut：Session list 启动保持 metadata/cache-only，绝不打开冷 log body。log header 是权威来源；生命周期匹配的 checkpoint 是 durable prefix witness，可以落后但不能领先日志。因此 cachedPredecessorTitle 只公开仍通过当前 title unit stateVersion 与 schema 的 predecessor title row。两条相邻 Session format edge 都保留 title 文本。该 hint 的 asOfSeq 是存储 title row 自己的水位；因为改变日志事件数量的迁移会重新映射该坐标，Session list 把该 block 标为 kind: 'cached'，客户端不会拿它与建连 Session 的 seq 比较（只读面按 lifecycle 身份匹配与 cached 行）。其他 predecessor row 继续隐藏，hydratePrepared/coldSnapshot 仍要求严格格式 identity，因为即使物理存储一致，normalizer 仍可能改变 blank 或 lastPromptAt 等值。