[ragnorc]

Why

#1090 binds one storage provider to a graph handle, so its control objects and Lance reads all go to the target's endpoint with its credentials. Five re-reads still opened __manifest, tables or the graph index without the handle's session. On a process whose ambient AWS_* settings name another endpoint, those requests went there instead.

Pointing the ambient endpoints at a recording decoy, unmodified main sent 52 requests to it. With unsigned requests and conditional puts disabled in the ambient environment as well, the workload failed at the first @card mutate.

What

Each re-read now uses the handle's bound session or adapter:

Re-read	Stray requests with the fix reverted
The @card cardinality check's live re-read before publish	6 × LIST __manifest/_versions/; the mutate fails
Branch delete's identifier check	LIST __manifest/_versions/; the delete fails
Snapshots built without a manifest dataset (merge bases, commit-addressed reads, change-feed pages, proposals, collector views)	HEAD of a table's detached manifest; the merge fails
Historical CSR reads	1 × GET __graph_index/csr-current.bin
Lance's create_branch, which probes the new branch on a default session in Lance 13	12 × LIST tree/<branch>/_versions/; the branch create fails

The session-less ManifestCoordinator openers now compile only in test builds, so a production caller cannot reach the ambient store again. A check of the CLI and server, as releases build them, fails with E0599 when main's session-less re-read is put back. That is why they leave forbidden_apis' public read-surface registry.

A unit test also pins the change feed's branch-head re-prove to a fresh session. Pointed at the data session, its cache hits go from 1 to 9.

Already correct on main, so not changed here: Azure option capture, the S3 option classes and the proxy refusal.

Tests

• crates/omnigraph/tests/bound_storage.rs (new) puts two recording forwarders in front of RustFS and points a child process's ambient endpoints at them. It requires zero decoy requests through writes, reads, the cardinality re-read, a racing publish, a three-way merge, branch create and delete, historical and commit-addressed reads, the change feed, export, optimize and cleanup. It is enrolled in the RustFS job as the required cell bound_handle_never_reaches_the_ambient_endpoint.
• Each fix reverted alone turns it red, with the counts above.
• Touched packages with failpoint features: 3263 passed. RustFS suites: 125 passed, including bound_storage, lance_surface_guards, s3_cluster and s3_storage::.
• The DST storage-cost golden is unchanged. Both clippy graphs with -D warnings, fmt, check-docs, typos, check-agents-md and check-ci-cells pass.

docs/dev/lance.md gains a "Bound branch create" fence row, checked against Lance 13; testing.md and architecture.md name the owner. One changelog.d note is included.