feat(runtime): establish managed mutation lifecycle authority

[zhiiw]

Primary invariant

From a managed Write/Edit T1 until a trusted terminal state, one workspace instance has exactly one durable mutation owner. A successful tool outcome, successor workspace fact, version projection, and canonical head are committed atomically; after managed T1, Runtime never silently falls back to generic T2.

Ownership and atomic boundaries

• SQLite owns immutable T1, the cross-process reservation, accepted successor facts, and disposable head projections.
• Runtime owns the one-shot operation capability and one bounded immutable strict-JSON result snapshot.
• T1 plus reservation is one BEGIN IMMEDIATE transaction.
• Success outcome plus successor fact plus projections plus head advancement is one transaction.
• Reserved workspace facts remain unavailable to generic append APIs.

Failure and rollback

• A failure before or inside T1 rolls back the whole admission.
• A failure after T1 but before a trusted terminal keeps the reservation and fails closed.
• A failure inside successor commit rolls back outcome, successor, projections, and head together.
• A lost response after commit converges through immutable exact retry; it does not rewrite generic T2.
• Projections rebuild from RuntimeEvents; corruption fails closed.

Scope

This PR combines the former extraction slices for successor authority, durable reservation, and Runtime settlement because together they prove one managed mutation lifecycle invariant. It deliberately does not add Git candidate capture, filesystem mutation, Runtime Host composition, or Desktop/CLI enablement.

The branch was rebuilt directly on current upstream/main. It spans schema and runtime protocol, but not Host lifecycle or platform filesystem I/O.

Verification

• Core full suite: 659 passed.
• Focused Core/Storage/Runtime authority suite: 116 passed, including real child-process crash/reopen and real multiprocess reservation contention.
• ToolRuntime durable-boundary suite: 39 passed, including retained callback, detached execution, mutable alias, strict-JSON, byte-budget, and generic-T2 fallback attacks.
• Builds: @maka/core, @maka/storage, and @maka/runtime passed.
• git diff --check passed.
• The broader Windows Storage/Runtime runs were not used as merge evidence: they include unrelated existing platform/shell failures and were stopped after the affected suites had passed.

中文说明

主要不变量

从 managed Write/Edit 的 T1 到可信终态，同一个 workspace instance 只能有一个 durable mutation owner。成功工具结果、successor workspace fact、version projection 和 canonical head 必须在同一个事务中全部可见或全部不可见；managed T1 以后 Runtime 禁止静默回退 generic T2。

Owner 与原子边界

• SQLite 拥有 immutable T1、跨进程 reservation、accepted successor fact 和可重建 head projection。
• Runtime 拥有一次性 operation capability，以及一次有界 strict-JSON traversal 生成的不可变结果快照。
• T1 与 reservation 在同一个 BEGIN IMMEDIATE transaction 中提交。
• success outcome、successor fact、projection 与 head advancement 在另一个单事务中提交。
• generic append API 无权写 reserved workspace fact。

失败与回滚

• T1 前或事务内失败：整组回滚。
• T1 后、可信终态前失败：保留 reservation 并 fail closed。
• successor transaction 内失败：outcome、successor、projection、head 全部回滚。
• commit 后响应丢失：根据 immutable facts exact retry，不重写 generic T2。
• projection 可从 RuntimeEvents 重建；corruption 一律 fail closed。

范围

这个 PR 合并旧的 successor authority、durable reservation 和 Runtime settlement 三个 extraction slices，因为它们共同证明一个 mutation lifecycle 不变量。它不包含 Git candidate、文件写入、Runtime Host composition 或 Desktop/CLI 开关。

分支直接从最新 upstream/main 重建，只跨 schema 与 runtime protocol，没有跨 Host lifecycle 或平台文件 I/O。

验证

• Core 全量：659 passed。
• Core/Storage/Runtime 定向 authority 套件：116 passed，包含真实进程 kill/reopen 和真实多进程 reservation 竞争。
• ToolRuntime durable boundary：39 passed，覆盖 retained callback、detached execution、mutable alias、strict JSON、byte budget 与 generic T2 fallback 攻击。
• @maka/core、@maka/storage、@maka/runtime 构建通过。
• git diff --check 通过。
• 更广的 Windows Storage/Runtime 套件包含与本 PR 无关的既有平台/终端失败，因此没有拿它们冒充本 PR 的合并证据；受影响套件通过后已停止长测。

[zhiiw]

The required CI check is now green on cf63fb9.

The first run exposed two issues, both fixed at their actual owner boundary:

• Runtime terminal classification: the refactor retained only the durable isError bit and used it for live status, which collapsed subagent aborted into error. Live status now continues to use the full canonical terminal classifier, while the durable envelope keeps its boolean error representation.
• Legacy schema fixture rewind: the schema-4 tests synthesize an old database by rewinding a current one. They did not remove the new schema-14 reservation table, so migration attempted to create an artifact a real schema-4 database cannot contain. The rewind now removes that table before setting user_version=4.

Verification after the fix:

• The four original failing tests pass.
• The related recovery and managed-mutation suites pass 122/122.
• The full required CI check passes in 7m49s.

中文说明

required CI 已在 cf63fb9 全绿。

首轮 CI 暴露了两个问题，并且都在真正的 owner 边界修复：

• Runtime terminal classification：重构后只保留 durable isError 位并误用于 live status，导致 subagent 的 aborted 被压成 error。现在 live status 继续使用完整 canonical classifier，durable envelope 仍保留布尔 error 表示。
• legacy schema fixture rewind：schema-4 测试通过把当前数据库倒带来构造旧库，但漏删 schema-14 新增的 reservation table，迁移因此重复建表；真实 schema-4 库不会存在这张表。现在在设置 user_version=4 前会删除它。

修复后：

• 原始 4 条失败测试全部通过；
• 相关 recovery/managed-mutation 套件 122/122 通过；
• required CI 全量通过，用时 7m49s。