Prevent oversized Card activation results from falsely claiming machine delivery

[KimGLee]

Problem

K13/19 requires a Runtime Card activation payload to enter a worker's execution context before that worker may be called running. The current MCP path labels an admission result machine-delivered before the result leaves the server, however, so the label proves only server return and MCP-session binding.

A live host measurement exposed the gap: the server returned a complete 231,164-byte activation result and every content hash matched, but the host externalized the oversized result and exposed only a 2KB preview to the model. The admission receipt still claimed machine delivery. No production gate could observe that divergence.

This is broader than one host or one oversized Card. The activation protocol silently assumes that a host will inline an arbitrarily large tool result, while host transports are entitled to impose independent per-result limits.

Required Core boundary

The Core protocol must:

• freeze a compact activation-piece manifest at admission instead of embedding all Card and startup-readback bytes in one result;
• deliver one whole, content-addressed file per result under a protocol-owned serialized-envelope byte budget;
• re-read and compare each piece with its frozen SHA-256 immediately before delivery;
• distinguish admission preparation and host-session binding from earned delivery completion;
• treat a nonce acknowledgement as only one part of delivery evidence, alongside the frozen server hash and a current conformant Host Adapter registration;
• bind all acknowledgements for one attempt to the same assignment, execution context, Bundle hash and delivery attempt, without transfer across reassignment or resume contexts;
• preserve queued -> open as Queue admission and move the delivery-complete predicate to Assignment running eligibility;
• retain the truthful CLI/unbound degraded path without claiming machine-enforced Card delivery;
• preserve producer-era replay for sealed v1/v2 activation evidence.

Acceptance criteria

• Admission emits a compact frozen piece manifest and does not claim completed delivery.
• Every serialized activation-piece result is measured against an explicit protocol constant before return.
• Oversized pieces and source drift fail closed before partial activation.
• Host conformance requires both a passing at-budget inline control and a demonstrably externalized over-budget negative control.
• Acknowledgement set equality and same-context bindings are machine-validated.
• Current Queue admission recompiles the frozen Bundle without re-coupling Queue state to execution-context state.
• Direct CLI admission remains supported as degraded.
• Compiled interface, capability and host-configuration projections remain byte-current.
• Focused activation, MCP, Queue-transition and Host-conformance tests pass, together with the repository verification suite.

Scope boundary

This issue closes the Core-ready protocol and primitive implementation. It does not claim that the Roadmap's Reference Execution Runtime or durable Assignment State implementation already exists. D-008 remains open at the Runtime/Host layer until an adapter enforces delivered -> running using these primitives.

Implementation: #131