P4.3: Classifier — sliding/idle expiry without rotation

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P4

Goal

Fire a finding when a session or refresh handler resets a TTL/Max-Age on each use (sliding expiry) but no rotation evidence is linked.

Acceptance criteria

• sliding_expiry_without_rotation_review fires when:
  • a handler updates a TTL/Max-Age value on each request (evidenced by repeated assignments or framework-default sliding-session config)
  • no rotation evidence is linked from the lifecycle linker
• Review-required.

New check IDs

• sliding_expiry_without_rotation_review

Files touched

• crates/sessionscope-classifier/src/lifecycle.rs

Fixture expectations

• Negative: sliding session middleware enabled, no rotate calls.
• Positive: sliding session with session.regenerate() or session.cycle_key() calls present.
• False-positive: fixed-expiry sessions (no fire).

Audit-then-decide

• Category: lifecycle_gap, severity low.
• Feed into the consolidated P4.8 audit.

Doc-update checklist

• docs/USAGE.md check catalog.
• docs/COVERAGE_MATRIX.md row.
• CHANGELOG.md unreleased entry.

[bjcorder]

Implemented in ff6d451.

Summary:

• Added sliding_expiry_without_rotation_review lifecycle classification for rolling/sliding TTL or Max-Age evidence without linked session/refresh rotation evidence.
• Added classifier helpers for sliding-expiry evidence and rotation evidence using existing lifecycle paths and detector IDs.
• Added positive, rotation-control, and fixed-expiry Express fixtures plus focused fixture tests.
• Updated the check catalog, coverage matrix, and changelog entry for the new check.

Validation:

• cargo fmt --check — passed
• cargo test -q -p sessionscope-classifier sliding — passed
• cargo test -q -p sessionscope-testing sliding_expiry — passed
• cargo test -q -p sessionscope-testing fixed_expiry — passed
• cargo test -q -p sessionscope-testing — passed

Notes / follow-ups:

• None