persist: kv compare-and-swap + create-only put + 11 tests

kv.sx: persist/kv-cas sets a key only if its current value equals expected,
else returns {:conflict :expected :actual}; persist/kv-put-new is create-only.
The kv analogue of log append-expect — atomic current-state for sessions, acl
grants, stock counts. 133/133.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/persist-on-sx.md

@@ -42,7 +42,7 @@ read models (feeds, indices, audit logs) update incrementally.
 
 ## Status (rolling)
 
-`bash lib/persist/conformance.sh` → **122/122** (Phases 1–4 complete + extensions)
+`bash lib/persist/conformance.sh` → **133/133** (Phases 1–4 complete + extensions)
 
 ## Ground rules
 
@@ -150,11 +150,20 @@ over an in-process disk (the mock-IO harness).
   O(1) read. The consumer-facing read-model abstraction (feed indices, audit
   rollups, search counters).
 
+- [x] `kv.sx` CAS — `persist/kv-cas` (compare-and-swap) + `persist/kv-put-new`
+  (create-only): atomic current-state updates, conflict as a real value (kv
+  analogue of log `append-expect`). For sessions, acl grants, stock counts.
+
 ## Consumers (post-foundation, not in scope here)
 feed/-log, flow store, mod/audit, search index, acl grants, identity sessions all
 become `persist` log or kv. Track each migration in that subsystem's plan.
 
 ## Progress log
+- **Ext: kv compare-and-swap (133/133).** `persist/kv-cas` sets a key only if
+  its current value equals expected, else returns `{:conflict :expected
+  :actual}`; `persist/kv-put-new` is create-only. The kv analogue of log
+  `append-expect` — atomic current-state for sessions/acl/stock. 11 tests incl.
+  racer + retry + durable backend.
 - **Ext: materialized views (122/122).** `view.sx` — `persist/view` bundles
   stream + step + seed + snapshot name; `view-attach` subscribes it to a hub so
   every publish refreshes the snapshot incrementally; `view-peek` is then an