[SunSi12138]

Implements #333.

Scope

This PR is now restacked directly on dev after #332 landed.

• Base: dev@7472542155f440837740e7ee4061abf91981b1dd
• Final exact head: 33eaf66147509bb508f51a2b5200f9216a7b1354
• Final diff: 16 files
• Supports Global / Contract / Method rate add/remove/reconfigure/algorithm replacement while preserving consumed quota/debt/history.
• Partition selector/options/rate/concurrency migration remains explicitly unsupported and transactionally rejected.

Implementation

• Adds SharpLink-owned mutable rate runtime state with separate logical scope identity, immutable policy generations, and shared lineage/history.
• Preserves TokenBucket debt/cadence, FixedWindow epoch/consumption, and SlidingWindow history where shape permits; algorithm replacement uses conservative transition barriers.
• Old queued waiters and retained leases stay bound to captured source generations; late grants conservatively charge the current target lineage.
• TokenBucket carried debt and target-owned debt share one replenishment-credit ledger so elapsed target credit cannot be spent twice.
• Candidate preparation is non-mutating; transitions commit only after the lifecycle writer verifies the exact source generation.
• Remove/re-add creates fresh state while Disable/Enable reuses only the latest compatible published lineage.
• Existing outer admission queue accounting remains the only queue-capacity authority.

Restack compatibility

The direct-to-dev restack preserves already-landed #332 semantics while retaining #333's rate-state model:

• preserves the current six-field SharpLinkAdmissionContext boundary;
• preserves AdmissionPartitionEntry owner/exact-once release/idle-reclaim semantics;
• combines the current partition owner with [Server][DynamicAdmission] Preserve rate state across runtime updates #333's _timeProvider-aware rate runtime creation;
• preserves current admission concurrency/version, queue/deadline, generation publication, and reclamation behavior;
• no temporary restack workflow is present in the final 16-file diff.

Review fixes

All three historical P1 review threads are resolved:

1. accumulated legacy TokenBucket debt cannot collapse onto a one-permit horizon;
2. the current rate-lineage anchor survives while historical states can still late-grant;
3. one TokenBucket replenishment interval cannot repay both carried and target-owned debt.

Exact-head validation

Exact head: 33eaf66147509bb508f51a2b5200f9216a7b1354.

• PR Quick 33031925362: completed / success.
• CodeQL 33031925214: completed / success.
• Codec Padding Security Evidence 33031925202: completed / success.
• Formatting: pass.
• Debug + Release builds: pass, 0 warnings / 0 errors.
• Unit Tests: 1,308 passed / 0 failed / 0 skipped.
• Generator Tests: 133 passed / 0 failed / 0 skipped.
• Load Test Tests: 60 passed / 0 failed / 0 skipped.
• Integration Tests: 412 passed / 0 failed / 0 skipped.
• Total managed tests: 1,913 passed / 0 failed / 0 skipped.
• NativeAOT shared-memory / transport / topology / pre-credit smokes: pass.
• Pack, SDK/package metadata/symbol/dependency checks, package smoke and Oneway demo: pass.
• Load Smoke: c=1 18,280.34 QPS, c=4 74,523.24 QPS, 0 failures.
• Chaos Smoke: 770267 successes, 164464 injected faults, 0 unexpected, 0 client/server errors, 0 unobserved; retained memory 1498968 -> 1055080 (-29.61%).
• Codec/browser compatibility: final attempt passes. The first Windows ARM64 browser-to-desktop raw-layout append saw hosted-runner SDK identity 10.0.110 vs verifier 10.0.111; its 40/40 safe fixtures had 0 blocking failures. Rerunning failed jobs regenerated consistent evidence and the full PR Quick workflow completed successfully.

Ready to merge.

[SunSi12138]

Re-reviewed exact head 5856422666373ae596ce4920c7b7159d98d199bc. The two prior P1s are addressed by the tests-first fixes, and exact-head PR Quick 32846203932 is green. One remaining P1 exists in the structural-replacement TokenBucket carry model: carried transition debt and target-owned token debt currently consume the same elapsed replenishment time independently, so a barrier expiry can still expose quota that the target's intervening grants already consumed.

[SunSi12138]

Re-reviewed exact head 46c1285d25b8445d26d050256e8ad590859b541b against #333. The third P1 is fixed: TokenBucket carry and target-owned debt now share one replenishment-credit ledger, the deterministic target-traffic regression covers the previous double-spend counterexample, and the two earlier P1 fixes remain intact. I did not find any remaining P1/P2 in the reviewed slice. Exact-head PR Quick 32866292921 is green across all gates. Clean at this head.