Sesh continuous ingestion needs a real session-change contract

Reusable ingestion boundary learned while tracing Sesh on 2026-09-07: a per-message private-object store must not be adapted by inventing one session-level Storage object. A safe session indexer should enumerate scoped changes with a durable (updated_at, stable_id) keyset cursor and observable delete/revoke tombstones, then assemble exact authorized content through the source's session-read operation. Offset-paginated session listing is adequate for a bounded frozen backfill, but a polling watch over it cannot prove it caught concurrent appends or removals. Provenance: live Coding Sessions schema/tool contract plus source ingest and Sesh adapter code inspection; no transcript content or credentials included.