Two more clusters lifted out of the engine, both defined by latches whose only
correctness property is that they move together:
- TokenExpiryGuard owns the five flags (state, logged, notified, cancelDone,
closeOnly) that make each consequence of an expired StandX token happen once
per episode and re-arm when a fresh token arrives. evaluate() returns a
decision instead of a bare boolean, so the tick reads what it means.
- IsolatedMarginGuard owns the single in-flight switch promise that stops
concurrent ticks from stacking margin-mode change requests, plus the
poll-until-confirmed loop.
Both were previously reachable only through a live adapter; they now have 22
unit tests between them, covering the latch reset across a token renewal, the
cancel retry after a failure, unknown-order treated as success, and the
concurrent-tick sharing of one margin switch.
Confirm cadence kept at 500ms x 10 to match the engine's original constants.
271 pass; tsc and oxlint clean. Engine 1939 -> 1826 lines.
