keep-state: harden cluster replication (outbox, manifest, payload binding)

[kwsantiago]

Hardening for keep-state cross-node replication: signed cluster manifest/epoch (relay-omission + TOFU-rollback detection), persistent outbox, bounded publish channel + resend, table/record binding into the encrypted payload, and rejected-event log-flood dedup.

This groups several tracked sub-tasks; break out individual PRs as you tackle them.

[kwsantiago]

Progress + dispositions (researched):

Shipped (concrete gaps):

• Persistent delete-tombstones (keep-state: persist delete-tombstones so revoked records reach standbys after a crash #860): a crash between row-removal and tombstone-publish could leave a revoked key/descriptor/relay-config live on a standby. Deletes now persist a tombstone atomically with the row removal, seeded on restart, cleared on relay-accept.
• Rejected-event log-flood throttle (keep-state: throttle replicated-event rejection logs to prevent relay log-flood #861): an untrusted relay streaming stale/future/malformed events could flood the consumer logs; each rejection outcome is now rate-limited with a suppressed-count.

Bounded channel + resend — already implemented (coalescing map bounded by record count + requeue with backoff on NoRelayAccepted/transport error). No change needed.

Table/record binding into the encrypted payload (item 4) — researched; design is ready but DEFERRED for a rollout decision. Findings: (1) for the declared untrusted-relay model this is already prevented (the signed d-tag + event.verify() + author check bind table+record; a relay lacking the cluster key cannot re-frame a ciphertext under a different d-tag). (2) The residual is a confused-deputy against a cluster-key-holder-without-vault-password who could reshuffle existing vault ciphertexts between slots, because the at-rest AEAD uses empty AAD. Fix: bind keep-atrest-v1:<table>\0<backend key> as AEAD associated data on the three replicable tables (keys/descriptors/relay_configs; secrets stay excluded). encrypt_with_aad/decrypt_with_aad already exist; the binding travels through replication implicitly (AAD is recomputed from the slot on each side, so a shuffled ciphertext fails Poly1305 on the standby). Migration: a one-shot re-encrypt of the three small tables + a per-vault replicable_aad_bound completion flag, all in one atomic write_atomic transaction (crash-safe, idempotent), run post-unlock (the DEK is unavailable to the schema-migration framework). rotation.rs must be updated in lockstep or it bricks bound rows. Blocker (why deferred): the security benefit requires REJECTING empty-AAD, which is a mixed-version-cluster flag-day: an upgraded node would reject a not-yet-upgraded peer's records, stalling replication. This needs an operator-coordinated rollout gate (all nodes upgraded before rejection is enabled); shipping it without that risks an availability regression. Half-shipping (bind but still accept empty-AAD) is a downgrade oracle with no security benefit, so it is not worth landing alone.

Signed cluster manifest/epoch (item 1) — design-heavy protocol work (manifest contents, epoch counter, per-d-tag completeness proof, liveness assumptions) for relay-omission + first-sync-TOFU detection, which the module already flags as its known gap. Tracked for a dedicated design pass.