FW-69b: extract RestartSessionStore (session store + restart-id allocator)

[boggspa]

FW-69b: extract RestartSessionStore (session store + restart-id allocator)

Step 5 of FW-64, store half — completes FW-69 (FW-69a was the journal). Behaviour-preserving,
no atomicity/ordering change.

What

Lifts the per-GUID session persistence (sessions_ map) and the restart-id allocator
(nextRestartId_) out of the coordinator into Audio/Protocols/Backends/RestartSessionStore.hpp
(class RestartSessionStore, namespace ASFW::Audio::Backends). The four former members
LoadSession / StoreSession / GetSession / AllocateRestartId become thin forwarders.

Lock-borrowing — same pattern as the merged FW-68 gate

sessions_ is read/mutated inside four multi-domain single-lock critical sections that also
touch the clock-request maps and the operation gate: RequestClockConfig, ClearSession,
TryConsumePendingClockRequest, CompleteClockRequest (plus IsRestartEpochCurrent's own hold).
A store owning its own lock would split those atomic sections. So — exactly as DuplexOperationGate
does — the store borrows the coordinator's lock_ (via IOLock** = &lock_, never owns one)
and exposes two tiers:

• self-locking LoadSession/StoreSession/GetSession/AllocateRestartId — reproduce the
  former members for standalone callers;
• lock-held FindSessionLocked (const + non-const, returns DiceRestartSession*/nullptr) and
  EraseSessionLocked — called by the multi-domain holds while already holding lock_, so each
  keeps one uninterrupted IOLockLock/IOLockUnlock span.

IsRestartEpochCurrent/ClearSession/RequestClockConfig/TryConsume/CompleteClockRequest keep
their exact lock structure and swap the inline sessions_.find/sessions_.erase for the *Locked
accessors. The FindSessionLocked pointer is used only within its lock hold and sessions_ is not
mutated under it, so it's exactly equivalent to the former sessionIt->second iterator use.

Atomicity — verified at the diff level

Host tests stub IOLock to a no-op, so in-hold atomicity can't be functionally tested — but it's
verifiable by inspection, and the diff makes it mechanical:

• 0 IOLock lines added, 8 removed — exactly the 4 forwarder'd store methods' lock+unlock. The
  five in-hold conversions touch zero lock lines. Every critical section keeps its span; the
  *Locked accessors contain no locking (no double-lock), and no self-locking method is ever called
  while lock_ is held (no deadlock).

RestartSessionStore is a class with in-class (implicitly inline) members, so no ODR hazard.

Tests

New RestartSessionStoreTests — 9 tests: load-miss → default{.guid}; store/load/get round-trip;
get-miss → nullopt; guid==0 guards; AllocateRestartId monotonic from 1; null-lock short-circuit +
fresh-read-each-call; FindSessionLocked mutate-in-place visible via the self-locking read; find-miss
→ nullptr + erase; const overload. The coordinator's 20 integration tests exercise the in-hold paths.

(A future nicety, not in this behaviour-preserving slice: an instrumented IOLock test double could
machine-check "exactly one hold per multi-domain section" across the whole cluster, rather than by
diff review. Happy to add it as a separate change if useful.)

Verification

• RestartSessionStoreTests: 9/9
• DiceDuplexRestartCoordinatorTests: still 20/20 (unchanged)
• Full host suite: 1203/1203 (was 1194 + 9)

🤖 Generated with Claude Code