fix(core): ack only observations the store kept

Exchange::accept enqueued a pending ack whenever
!(duplicate && addressed && released) held, even when the backend
store.insert returned Err (store full / backend error). On Err the
released flag computed to false, so an ack was still enqueued: a
receiver that did not keep the message acked it. For an addressed
offer that releases the sender's custody for a message nobody holds;
for a broadcast it fires a false confidence event at the sender.

Gate the ack enqueue on res.is_ok(): enqueue only when the store
actually retained the observation. The existing released-holder
exception still applies among kept copies. No bounce is recorded on
Err (already the case).

Adds a unit test exercising a capped store (StoreError::Full) for
both a broadcast and an addressed offer, and a tines-sim property
that drives custody with CappedStore-backed nodes and asserts the
"at least one holder" invariant still holds when stores fill.

tines-sim/src/capped.rs

@@ -0,0 +1,83 @@
+//! A [`Store`] that delegates to a [`MemStore`] but rejects `insert` with
+//! [`StoreError::Full`] once it has held `capacity` observations.
+//!
+//! `MemStore` is unbounded, so it never fills; this wrapper lets the simulator
+//! exercise the full-store custody path (F1): a receiver whose store is full
+//! must not ack a received observation, or custody is released for a message
+//! nobody holds.
+
+use tines_core::{MemStore, Observation, ObservationId, Store, StoreError, Tick, TrimPolicy};
+
+/// A capacity-bounded [`Store`]: delegates to a [`MemStore`] but returns
+/// `StoreError::Full` on `insert` once `capacity` observations are held.
+pub struct CappedStore {
+    capacity: usize,
+    inner: MemStore,
+}
+
+impl CappedStore {
+    /// A capped store holding at most `capacity` observations.
+    pub fn new(capacity: usize) -> Self {
+        Self {
+            capacity,
+            inner: MemStore::new(),
+        }
+    }
+}
+
+impl Default for CappedStore {
+    fn default() -> Self {
+        // Small enough that a node filling up on received observations rejects
+        // later inserts, which is what drives the full-store ack path.
+        Self::new(8)
+    }
+}
+
+impl Store for CappedStore {
+    fn insert(&mut self, obs: Observation, now: Tick) -> Result<bool, StoreError> {
+        if self.inner.len() >= self.capacity {
+            return Err(StoreError::Full);
+        }
+        self.inner.insert(obs, now)
+    }
+
+    fn contains(&self, id: &ObservationId) -> bool {
+        self.inner.contains(id)
+    }
+
+    fn get(&self, id: &ObservationId, now: Tick) -> Option<Observation> {
+        self.inner.get(id, now)
+    }
+
+    fn len(&self) -> usize {
+        self.inner.len()
+    }
+
+    fn for_each_id(&self, f: &mut dyn FnMut(&ObservationId)) {
+        self.inner.for_each_id(f)
+    }
+
+    fn for_each_broadcast_id(&self, f: &mut dyn FnMut(&ObservationId)) {
+        self.inner.for_each_broadcast_id(f)
+    }
+
+    fn for_each_addressed_id(&self, f: &mut dyn FnMut(&ObservationId)) {
+        self.inner.for_each_addressed_id(f)
+    }
+
+    fn release(&mut self, id: &ObservationId) {
+        self.inner.release(id)
+    }
+
+    fn is_released(&self, id: &ObservationId) -> bool {
+        self.inner.is_released(id)
+    }
+
+    fn for_each_topic(&self, prefix: &[u8], now: Tick, f: &mut dyn FnMut(&Observation)) {
+        self.inner.for_each_topic(prefix, now, f)
+    }
+
+    fn trim(&mut self, policy: &TrimPolicy, now: Tick) -> usize {
+        self.inner.trim(policy, now)
+    }
+}