Tempo session clients lack managed lifecycle controls for delegated voucher signers

[mh-yu]

Description

TIP-1034 intentionally keeps a channel's authorizedSigner valid until the channel closes and documents that compromise can expose the channel deposit. mppx follows that contract and provides a local maxDeposit limit and manual channel closure.

The client does not provide a managed policy for retiring an open delegated-signer channel after a configured age or idle period, or for replacing it as part of signer rotation. Applications must track that lifecycle and coordinate close-and-reopen themselves. This is a request for optional SDK lifecycle support, not an implementation defect.

Impact

Applications using delegated hot signers must implement channel retirement consistently. If that integration is omitted, the SDK continues reusing the open channel and the signer's compromise window remains open. The channel deposit still bounds the financial exposure.

Expected behavior

Applications would benefit from optional SDK-managed channel retirement and signer rotation policies that preserve the existing TIP-1034 wire format.

Steps to reproduce

1. Create a SessionManager with a delegated signer and maxDeposit. Its configuration exposes deposit and account controls but no channel age, idle-expiry, or rotation policy at src/tempo/session/client/SessionManager.ts:968-994.
2. Make a paid request. Channel opening selects the account's effective authorizedSigner and commits it to the descriptor at src/tempo/session/client/ChannelOps.ts:239-275.
3. Keep the channel idle beyond the application's intended signer lifetime, then make another request with the same account. The credential planner reuses an opened channel whenever the account still matches its descriptor at src/tempo/session/client/CredentialState.ts:628-659; it performs no age or idle-time check.
4. Observe that lifecycle enforcement must be implemented by the application. The public API provides manual close() at src/tempo/session/client/SessionManager.ts:67-87, implemented at src/tempo/session/client/SessionManager.ts:898-925, but no automatic retirement or close-and-reopen rotation policy.