[scbrown]

Whole-session accounting snapshots currently refuse sessions attributed to more than eight work items. This adds an explicit opt-in path that stages disjoint request parts, then selects a sealed generation with a small marker. The existing path remains the default.

The producer enforces the shared C/A write cadence, 64 KiB/40-record part limits, 2 KiB marker limit, hourly and aggregate staging bounds, pending-before-send, exact readback and no uncertain-write retry. One-response readers validate identities, term kinds, counts, attribution and complete-set digests, excluding legacy data. Consumer attempts are bounded to one per five minutes. Retained generations block further staging until governed retention frees the slot; nothing is deleted.

The exact proposal 42 contract and approved proposal 43 attribution amendment are retained in source. This does not accept/load either proposal, enroll a runtime policy, publish production data or satisfy production-size load acceptance.

Validation: 41 focused controls passed under the HOME guard; the native private-store protocol passed staging/activation, reassignment with old-graph exclusion, consumer cadence refusal and the retention fence. A budget-bypass sabotage failed as expected. The exact committed full suite is running; hosted checks and one independent post-green source review remain required.

Demo (actual transcript, private fixture):

Input: 12 requests attributed to 12 work items.
Before (6cff934): OperatorAction; publication refused; network calls=0.
After: one selected complete generation, 12 exact request records.
Correction: new owner selected; old 12-record graph still present and excluded.
Next generation: retention gate refuses with zero requests.

Reproduce the source controls with python3 -m unittest discover -s tests -p 'test_usage_generation_*.py' -v using the repository's CI dependencies. The native demonstration uses the same source with an isolated server and injected private tick clock. It is a transcript, not a recording (no terminal recorder installed), and is not a production-size performance result.

Rollback: pause publication and retain the generation-aware reader, pending bodies, receipts and graphs. Do not resume the legacy publisher concurrently or delete data. Runtime enrollment still requires profile deployment/readback, real-shaped production-copy replay, the load gate and the matched after-watch.