Merge validated session fix and refresh graph cache evidence

Author: Coding-Dev-Tools

BENCHMARKS.md

@@ -94,14 +94,14 @@ interpretation and do not count as additional benchmark-quality gains.
 ### Public numeric evidence registry
 
 Every exact public aggregate retained below comes from the checked-in, public-safe
-[`offline-fixtures-v113.json`](docs/benchmark-evidence/offline-fixtures-v113.json) artifact. Its
+[`offline-fixtures-v115.json`](docs/benchmark-evidence/offline-fixtures-v115.json) artifact. Its
 SHA-256 is
-`7c36af2ac3a0e1338987eddf27160879012cd9d2c834fd348268f420d14a7761`, also recorded in the
+`4d2cd6be29324597f0b201f8c0bd753173be69d24a274dff570c95c0db6ae629`, also recorded in the
 adjacent `.sha256` file. The artifact contains no raw questions, answers, prompts, customer data,
 or per-record content fingerprints.
 
 The fixture-suite digest is
-`cbbfd2b6dde7737f9c8c3417111c4c4804bd280e313f1a0e4a435076fc6bb517`. The artifact defines
+`ddf3b70d426441a364ef02967f98454435ca045c3840e1c4b81ba05ab7f139bb`. The artifact defines
 the digest algorithm and records the SHA-256 of every suite and dataset file. Each evidence ID
 also binds its exact command through `sha256(UTF-8 exact command)`:
 
@@ -123,10 +123,10 @@ Historical LoCoMo, graph, handoff, consolidation, and security figures remain pr
 source artifacts but are omitted from the current chart until each has a matching immutable,
 public-safe artifact. The chart labels coding outcomes, external datasets, and operational
 capacity as pending evaluation tracks rather than implying scores. Regenerate it with
-`python scripts/render_benchmark_report.py --report docs/benchmark-evidence/offline-fixtures-v113.json --output docs/images/context-efficiency.svg` after selecting the report to publish.
+`python scripts/render_benchmark_report.py --report docs/benchmark-evidence/offline-fixtures-v115.json --output docs/images/context-efficiency.svg` after selecting the report to publish.
 
 The companion examples are also generated from that artifact with
-`python -m scripts.render_benchmark_examples --report docs/benchmark-evidence/offline-fixtures-v113.json --output docs/images/evidence-backed-agent-examples.svg`.
+`python -m scripts.render_benchmark_examples --report docs/benchmark-evidence/offline-fixtures-v115.json --output docs/images/evidence-backed-agent-examples.svg`.
 The historical-to-executable mapping is in
 [`docs/BENCHMARK_CHANGE_COVERAGE.md`](docs/BENCHMARK_CHANGE_COVERAGE.md).
 

README.md

@@ -84,9 +84,9 @@ neither is an end-to-end question-answer score. Coding outcomes, external datase
 operational capacity remain separate pending evaluation tracks until their artifacts are selected.
 
 These values are evidence IDs `offline-chunking` and `offline-performance` in
-[`offline-fixtures-v113.json`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/docs/benchmark-evidence/offline-fixtures-v113.json),
+[`offline-fixtures-v115.json`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/docs/benchmark-evidence/offline-fixtures-v115.json),
 SHA-256
-`7c36af2ac3a0e1338987eddf27160879012cd9d2c834fd348268f420d14a7761`.
+`4d2cd6be29324597f0b201f8c0bd753173be69d24a274dff570c95c0db6ae629`.
 [`BENCHMARKS.md`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/BENCHMARKS.md#public-numeric-evidence-registry)
 records the matching suite digest, exact commands, and per-command config digests. The offline
 fixture registry intentionally excludes external, model-dependent, consolidation, productivity,

docs/benchmark-evidence/offline-fixtures-v114.json

@@ -0,0 +1 @@
+40188db31e07680e1c886ecec8ed523c6237858f0d5c63ef3159251c63538970  offline-fixtures-v114.json

docs/benchmark-evidence/offline-fixtures-v114.json.sha256

@@ -0,0 +1 @@
+4d2cd6be29324597f0b201f8c0bd753173be69d24a274dff570c95c0db6ae629  offline-fixtures-v115.json

docs/benchmark-evidence/offline-fixtures-v115.json

@@ -1150,9 +1150,22 @@ def access_for_workspace(
                 status=409,
                 refresh_unusable=True,
             )
-        response_subject = _validated_token_subject(
-            body.get("token_subject") or token_subject
-        )
+        # Older control planes omit this field. A supplied value, however, must
+        # exactly preserve the already validated subject of the consumed family.
+        response_subject = body.get("token_subject", token_subject)
+        if response_subject != token_subject:
+            try:
+                _mark_refresh_unusable(saved, refresh)
+            except (OSError, RuntimeError):
+                # Retirement fences the credential in-process before attempting
+                # persistence; a write fault cannot make this a replayable outage.
+                pass
+            raise CloudSessionError(
+                "Engraphis Cloud returned an invalid session subject, so the rotated "
+                "credential could not be saved. Connect this installation again.",
+                status=409,
+                refresh_unusable=True,
+            )
         updated = dict(saved)
         updated.update({
             "schema": "engraphis-cloud-session/v1",

docs/benchmark-evidence/offline-fixtures-v115.json.sha256

@@ -33,8 +33,8 @@
 
 
 ROOT = Path(__file__).resolve().parents[1]
-PUBLIC_OFFLINE_ARTIFACT = "offline-fixtures-v113.json"
-PUBLIC_OFFLINE_SHA = "7c36af2ac3a0e1338987eddf27160879012cd9d2c834fd348268f420d14a7761"
+PUBLIC_OFFLINE_ARTIFACT = "offline-fixtures-v115.json"
+PUBLIC_OFFLINE_SHA = "4d2cd6be29324597f0b201f8c0bd753173be69d24a274dff570c95c0db6ae629"
 
 
 @pytest.fixture(scope="module")