Stateful Capability Leases for Zero-Trust Cyber-Physical Defense in Distributed Energy Edge Networks

A valid credential can allow a compromised application to sustain harmful control actions after zero-trust admission. We develop stateful capability leases that account for command amplitude and duration, preserve consumed authority across renewals, and transfer control to a protected fallback at expiration. The analysis bounds cumulative command exposure and stale authority, relates review capacity to authorization freshness, and provides a conditional physical-invariance result. Nonlinear four-region feeder experiments examine an in-memory ledger with an affine physical filter. Over twelve pairs of six-hour campaigns, the local and matched central ledgers contained all unauthorized-power goals given at a budget chosen; risk-adaptive and short-lease approaches contained only three. Median aligned direction attack minus clean energy expenditure dropped from 2.3965 to 0.1231 kWh as compared with role-based access. The ledger containment range is [0.608, 1] at 95% confidence level. Local placement modestly improved partition service, while regional withdrawal restricted benign service. Higher budgets made possible successful attacks despite proper accounting and nonlinear stresses demonstrated remaining shared-power contract violations. In a discrete-event authorization experiment, synchronization increased the p99 reauthentication delay from 0.249 to 3.645 s under equivalent light cost hypothesis.