[W5.12] libp2p/host: the keepalive probe, the peerstore limits, and the limiting policies #93

Unit W5.12 of docs/PLAN.md. The row lands with this unit's pull request.

Root docs/ARCHITECTURE.md §9 lists three host gaps that the implementation "must close" (lines 1055 to 1066), and W5.6 left them open. They are the keepalive probe (delta 2), the peerstore limits and TTLs (delta 3), and the limiting gater and resource manager (delta 4).

What the code holds today

• Delta 2 is closed for yamux sessions only. Mux.yamux starts Yamux.Session.new with its defaults: a 30 s keepalive and Clock.system (Yamux/Session.lean, lines 63 and 64). A ping with no pong ends the session (Tests/Yamux.lean, lines 495 to 521 and 1193 to 1226), accept answers none, and the host's serveSession marks the entry dead (Host/Swarm.lean, lines 329 to 333). mplex ([W5.10] libp2p/mux: the mplex Muxer value #90) has no ping frame, so an mplex session to a dead peer stays live.
• The host cannot set the keepalive or its clock. Yamux/Constants.lean line 103 says "The host owns the keepalive policy", but Core.Muxer.open takes the role, the connection, and the leftover only. The host's Config.clock never reaches a session, so no host test can advance the keepalive, against root §3.1 ("a clock that the test advances").
• No host test retires a silent session. Tests/Host.lean checks markDead on the pure table only.
• Deltas 3 and 4 have no code. The peerstore dedups at add and keeps no limit or TTL. The gater and the resource manager have the permissive and denying doubles only.

The docs this unit corrects

• packages/libp2p/host/docs/ARCHITECTURE.md, contract 9 ("Peerstore limits and TTLs stay deferred") and contract 10 ("The keepalive probe stays open"), which contradict the root "must close"; contract 10 is also false for yamux sessions;
• the lines that move delta 3 and delta 4 to later work (lines 65, 77, and 171 of the same file);
• root docs/PLAN.md: a new W5.12 row.

Definition of done

• The host passes its clock, and its keepalive policy, to every muxer session. This changes the frozen Muxer seam, and the change needs organiser approval on this issue first.
• A host probe retires a session whose muxer has no keepalive, as root §9 delta 2 names it ("a keepalive or identity probe"). The choice of probe records what go, rust, js, and nim do.
• A host test retires a silent peer's session on the test clock, for yamux and for the probe.
• The peerstore holds a per-peer address limit and a TTL, with tests on the test clock (delta 3).
• A limiting gater and resource manager enforce stream count, buffered bytes, and a memory ceiling per peer and per connection, behind the existing seams (delta 4), with tests.
• lake build --wfail, lake test, the suite with LEAN_NUM_THREADS=1, and scripts/lint-imports.sh are green. No sorry, no build warnings.

Depends on

• [W5.6] libp2p/host: host, swarm, peerstore, dedup #19 (W5.6), merged, and [SEAM] W5.6 host: the mock connections of #61 #70 (PR refactor(host): run the upgrade and stream selection on the real negotiate #86): the host on the real negotiate.
• [W5.10] libp2p/mux: the mplex Muxer value #90 (W5.10) for the mplex case of the probe.

Ground rules

• Comment claim to take the issue.
• Target the hackathon26 branch.
• The license-acceptance line of the PR description stays ticked; commits carry no AI co-author trailers.
• Prose register everywhere: CLAUDE.md, "Writing Style".