[plainprogrammer]

Closes #228. Refs #218 (rulings 1 and 2).

What changes

• Sessions expire after 30 days unused. A session whose stamp (sessions.last_used_at) is 30 days old or more is no session: a collector's GET is redirected to sign-in with the page kept, a non-GET is redirected and changes nothing, an open catalog page is shown as to a visitor. The request writes nothing and the response removes the cookie. No absolute lifetime.
• Use is recorded about once a day. Any request that resolves the session counts; it writes the stamp only when it is 24 hours old or more (or later than now), and sets the cookie again for 30 days. The cookie is no longer permanent.
• A nightly job deletes expired sessions. Session::SweepJob (sweep_sessions, 4:10 am, development and production), batches of 1,000, one at a time (limits_concurrency), retries SQLite3::BusyException and ActiveRecord::StatementTimeout. The database cascades each session's bulk selection and Undo.
• sessions.ip_address and user_agent are dropped, with their values. Three migrations (add the stamp, backfill it with the upgrade's time so nobody is signed out, drop the columns and make the stamp NOT NULL), all without a transaction, because SQLite rebuilds sessions and the rebuild would otherwise cascade-delete bulk selections and Undo records. A migration spec proves a session, its selection, mark and Undo survive down and up.
• Spec 049 (approved at Gate A; plan approved at Gate B), the tenancy area doc (States, Named constants, Decisions, Accepted limits, shared Accounts and sessions: six behaviours no spec describes #218 lines), three lessons.

Ruling made during review

The daily stamp write on a GET could turn a request into a 500 if SQLite stays busy past its timeout. Authentication#record_use_of now rescues ActiveRecord::StatementTimeout and SQLite3::BusyException, logs one line and skips the stamp and the new cookie. It only skips the stamp: expiry is decided before it, so the sign-in decision is untouched. Two examples in spec/requests/session_expiry_spec.rb (red first, with the exception propagating).

Verification

• Pre-push hook (the full bin/ci) passed on ee9ba43; the suite has 2,873 examples at the earlier head (bin/rspec --dry-run).
• Implementation review (Mode B, Opus): SPEC-ALIGNED, recorded in docs/specs/049-session-idle-expiry/verification.md; its major finding is the ruling above, its test gaps are closed.
• Export format: no change, no version change (sessions stays "Left out"); spec/backup_guards_spec.rb green.

CI and what is left

• CI run on the head ee9ba43: RSpec shards 1-4, checks, ci and both image jobs (amd64 and arm64, which run the upgrade smoke test and its backup leg for AC-4.5 and AC-4.7) all pass: https://github.com/plainprogrammer/Collector/actions/runs/42666064698
• After the merge: distill-feature retires plan.md.

🤖 Generated with Claude Code