[fix][dioxide] coordinate concurrent ISNs across processes and durable retries

[fengjy73]

Root cause

Dioxide tx.compose reads the default ISN but does not reserve it. Concurrent unordered Relayer sessions can sign different business submissions with the same account/ISN. A plugin-local lock cannot protect multiple plugin instances, processes or Python writers.

Changes

• Shared MySQL account allocation and durable signed-transaction journal with unique constraints, explicit ISN, checkpoint/counter-regression protection and uint32 bounds.
• Stable UCP + target-domain submission identity carried in an optional internal gRPC field. Other chain plugins retain their existing default SPI behavior.
• Same operation reuses the stored hash or exact signed bytes after an uncertain broadcast; no body-based deduplication or unsafe database-outage fallback.
• Python coordinator follows the same SQL/locking protocol. No private keys are stored in MySQL.
• Cross-process SDP query mailbox lock; synchronous wait requires the full relay tree, including embedded invocation success. Return the native transaction hash, not a synthetic SHA-256 of the hash string.
• Deployment/recovery instructions. No regulatory contracts, Dioxide2 plugin, historical replay, or production credentials included.

Validation

Java 8 coordinator tests (8), Python tests (10, including 128 mixed-process allocations, pre/post-sign crash recovery and shared-mailbox isolation), Dioxide finality/full RPC JSON tests (7), stable submission identity test, Java 8 Relayer package and Java 21 Dioxide/Plugin Server packages pass.

The ICT deployment validated 128 fresh Mychain→Dioxide messages and real interleaving across two Dioxide plugins (ISN 306/307/308/309 assigned by alternating plugins). At 2026-09-04 21:29 CST all 227 allocated production ISNs are unique and FINALIZED; a repeated Python operation retains its original hash. See ICT rollout.

The separately identified Ethereum/PTC log-index blocker has been fixed and deployed independently (upstream PR #84). All 96 ordinary Ethereum→Dioxide messages now complete; the original 93 pending UCPs retain byte-identical raw_message data, have 93 unique target ISNs, and execute each body once. No source replay or validator bypass. Native Dioxide SDP V2/V3 and Mychain ordinary-mode combinations are not claimed: the current Dioxide contracts remain V1, and existing Mychain global monitoring policy was not changed.

Relay-group traversal now preserves groupHash:index and does not inspect unrelated sibling business failures; selecting JSON members never mutates the cached group. Rollout requires the compatible SPI, Plugin Server, Relayer and plugin together. Missing Dioxide submission IDs deliberately fail closed. Coordination data must never be discarded during rollback.

Final follow-up: all four new Ethereum collector canaries completed (2 ordinary, 2 regulated), PTC100%, exact target payload once; independent FISCO receipts confirm the regulated path. The final coordination journal contains 229 unique ISNs (181–409), all FINALIZED. No source replay or finality-policy change.