feat: bind job events to command leases

README.md

@@ -2,7 +2,7 @@
 
 Source-of-truth protobuf contract for Archive Control clients and the Titan
 control daemon. Implementations exchange canonical protobuf JSON as one text
-message per WebSocket frame.
+message per WebSocket frame. The current incompatible protocol major is `2`.
 
 Upstream: `cabbage/archive-control-proto`
 
@@ -29,14 +29,16 @@ Upstream: `cabbage/archive-control-proto`
 3. A server command is delivered at least once. Clients durably deduplicate
    `command_id` and return `DUPLICATE` for a replayed accepted command.
 4. `CommandAck` means durable acceptance, not operation completion.
-5. Job events have monotonically increasing global per-job sequences. A command
-   carries the accepted sequence base and grants one client the event-writer
-   lease; a gap requires `JobSnapshot` reconciliation before further
-   destructive transitions.
+5. Job events have monotonically increasing global per-job sequences and name
+   the durable command that owns them. Control verifies the reporting client,
+   command cursor, and permitted state transition. A gap or conflict requires
+   authoritative `ReconcileJobCommand` processing before further destructive
+   transitions.
 6. UUIDs use lowercase canonical text. Info hashes use validated lowercase hex.
 7. `SelectionSet.ranges` are inclusive, sorted, non-overlapping, and coalesced.
-8. Receivers ignore unknown JSON fields for compatible minor versions. They
-   reject an unknown required command/job operation.
+8. Receivers reject a different protocol major. Within major `2`, they ignore
+   unknown JSON fields only for compatible minor versions and reject an unknown
+   required command/job operation.
 9. Published field numbers and enum values are never reused. Removed values are
    reserved in the change that removes them.
 10. Implementations cap an envelope at the negotiated maximum and keep streamed