Enable v9 Caveats and expiring Relationships

[theronic]

V9 evaluates qualifier-backed Caveats and exclusive expiry across checks, lookups, counts, cursors, and Relationship inspection. Detailed reads retain conditional permissions and residual context; Boolean checks and default lookups/counts return definite grants. An expired ban can reveal a grant without a database write.

Qualified writes atomically publish both endpoint references, schema and Relation fences, endpoint identity guards, qualifier cleanup, and caller-composed application data. Native and externally constructed connections support inert preparation and pure snapshot transaction planning. Ordinary no-op writes preserve the database basis; bounded object cleanup replans on certified contention.

Point, collection, rendered-page, and checkpoint reuse checks temporal certificates. Live cursors require restart outside their certified interval; explicit snapshots retain historical time. Bundled backends use exact-basis qualified answer reuse because arbitrary native writers cannot establish qualifier immutability from Relation stamps alone.

All 43 Phase 3 tasks are complete. Qualified serving is enabled by default, the engine epoch is 9, continuation semantic ABI is 3, and coordinated build metadata targets 9.0.0-SNAPSHOT. The five-element Relationship storage ABI remains 9. Datalevin remains excluded from Maven release eligibility until its fork artifact is published.

Validation against the activated default:

• Fresh JVM battery: 1,431 tests / 149,296 assertions; zero failures/errors.
• Full Datalevin module: 67 tests / 8,172 assertions; zero failures/errors.
• Advanced ClojureScript: 783 tests / 110,321 assertions; zero failures/errors.
• Foundation: 82 verified obligations and 35,148 assertions. Qualified gate: 71 obligations, 607,016 assertions, and 108 killed production controls.
• Historical counterexample replay: 71 tests / 18,228 assertions; registered mutation controls: 3 tests / 176 assertions; generated Java boundaries: 52 tests / 18,280 assertions.
• Public source closure: 115 roots, 2,940 reachable definitions, zero forbidden matches. Strict OpenSpec validation and the executable Caveat/expiry example pass.
• Five-module v9 build, dependency audit, clean local Maven installation, and cold-consumer smoke tests pass.
• Isolated four-backend performance matrix: all 24 reports and all 1,440 fixed-budget comparisons pass. Raw samples, source hashes, numeric limits, and CSV results are committed under docs/benchmarks/results/qualified-authorization-2026-09-05/. Budgets were not relaxed.

The full legacy JVM battery and affected Datalevin contracts were also checked before changing the default. The migration, result/error, cache/cursor, clock, and pinned-time guides describe the final contract. The acceptance crosswalk is in formal/qualified/acceptance.md.

The final CI correction adds bounded CAS-contention retries for DataScript and Datahike's prepared writers, with deterministic interleaving and terminal-error tests. Generated-authority verification passes 9 heavy tests / 574 assertions and 625 correctness tests / 117,495 assertions; the affected writer suites pass 17 tests / 7,256 assertions. The unrelated-commit benchmark now enforces v9's deliberate exact-basis fallback while retaining the v8 managed-hit expectation under its compatibility binding.