[hamzakargin]

• keys::Batches: one open batch per tenant, generation and shard, rotated after 1,024 seals, 60 s or a day change; batch id = first message key; the wrap seals a random batch key to the day public key; every batch key enters a bounded delivery cache that answers only its own tenant and generation and is never overwritten by another owner.
• Ring::unwrap: local wrap check, single call per tenant, generation, shard and batch, a joining call with another wrap is refused; faults Gone and Bad.
• Node::sealing(&draft, shard) takes a new message id and seals HEAD (one seal over length, envelope and headers), the body (inline or chunks) and slices, each item once.
• Node::opener checks the wrap's generation, shard and day against the head and opens each item under its own label.
• HEAD stores the wrap before the sealed bytes; the clear head carries the wrap day.
• sched::Keys joins the key source and batch keys; Keyring implements it.

Part of #129