Keep protected user operations safe through broker replacement

Outcome

An operator can restart, replace, or eventually scale the protected authority broker without crossing user/workload boundaries or replaying an external operation that may already have occurred.

For an in-flight protected operation, the system either resumes from durable, correctly owned state or returns a clear unavailable/ambiguous outcome and requires an explicit next action.

Proposed approach

Persist and fence the broker state that cannot remain process-local: workload-to-logical-session ownership, authorization attachments, callback correlation and receipts, refresh/disconnect/tombstone generations, route/profile generation, and operation state (prepared, dispatched, completed, or unknown).

A durable operation record distinguishes definitely-not-dispatched (eligible for a carefully authorized retry), completed, and possibly-dispatched (ambiguous; never auto-replay). Every recovery revalidates owner, workload, grant, policy, and target binding.

Not in this issue

Claiming arbitrary upstream mutations are exactly once, inventing a new authority model, returning credentials to Mecatl, or fallback service identity.

Dependencies

The initial remote protected-operation broker baseline (#1562) and external-action authority semantics (#1564).

Proof

• Replacement after attachment expiry never reuses a logical session across workloads.
• Replacement during callback handling commits one callback claim and one transition.
• Replacement during refresh cannot resurrect a disconnected/revoked credential generation.
• Replacement after provider dispatch but before response never sends the operation twice.
• A broker outage is explicit and safe; it never performs an ownerless/fallback operation.

No files or tests are named. Start by reading dependencies #1562 and #1564, then trace the broker's process-local state and recovery paths. Done means the listed replacement scenarios preserve ownership and generations, avoid automatic replay after possible dispatch, and report outages explicitly.