Persist accepted-world identity for hermetic managed tests

[zhiiw]

Summary

This change gives hermetic managed test observations a durable Runtime boundary. Before T1, the dispatch now freezes the exact accepted Git world, workspace epoch, explicit test-file identities, verified toolchain identity, execution profile, and replay-safe effect class. Runtime owns a linear one-shot operation capability and one bounded immutable provider-result snapshot; the Host cannot replace the live result or retain the operation past terminal settlement.

No SQLite schema or second projection is introduced. Existing commitToolPrepared() and commitToolOutcome() remain the only T1/T2 writers, and reopen/rebuild continue through the strict RuntimeEvent decoder and tool-ledger scanner.

Primary invariant

A managed Node test may cross T1 only when its accepted world, input files, toolchain, execution profile, and replay policy are frozen; after T1, exactly one Runtime-owned operation and one immutable provider value can reach T2, with no fallback to Bash, PATH tools, or an unfrozen profile.

Ownership and atomic boundary

• Core owns the exact versioned dispatch grammar and fixed profile digest.
• Runtime owns operation lifetime and provider-result identity.
• The toolchain authority derives an identity digest from re-verified executable and entrypoint bytes plus the frozen release profile.
• SQLite owns the existing atomic call+dispatch T1 and response T2 transactions.
• The next stacked slice will own Host admission from opaque accepted-world and toolchain capabilities.

Failures before T1 leave no durable tool operation. Failures after T1 settle through an error T2 or the later exact-boundary recovery owner; immutable RuntimeEvents are never deleted as rollback. Malformed identity or causal order fails closed.

Verification

• Core RuntimeEvent decoder: 24/24
• Runtime durable boundary: 45/45
• SQLite Runtime store: 55/55, including real file reopen
• Runtime Host toolchain authority: 2/2
• Core, Storage, and Runtime Host typechecks: passed
• Biome and git diff --check: passed

The full Runtime typecheck still reports the pre-existing mixed Zod v3/v4 resolution errors in archive-read-tool.ts, builtin-tools.ts, and shell-tools.ts; this change adds no new Runtime TypeScript diagnostic.

This remains Draft until Host admission, a real production consumer, production-shaped helper/Host kill-and-reopen coverage, and enforcing Linux/macOS/Windows sandbox evidence land.

中文说明

摘要

本提交为 hermetic managed test observation 建立 durable Runtime 边界。T1 以前，dispatch 会冻结 exact accepted Git world、workspace epoch、显式测试文件 identity、经过验证的 toolchain identity、execution profile 和 replay-safe effect class。Runtime 独占一次性的线性 operation capability 和唯一一份有界 immutable provider result；Host 不能替换实时结果，也不能在终态后继续调用 operation。

没有新增 SQLite schema 或第二套 projection。现有 commitToolPrepared() / commitToolOutcome() 仍是唯一 T1/T2 writer；reopen/rebuild 继续经过 strict RuntimeEvent decoder 和 tool-ledger scanner。

主要不变量

Managed Node test 只有在 accepted world、输入文件、toolchain、execution profile 和 replay policy 已经冻结时才能跨越 T1；T1 后只能有一个 Runtime-owned operation 和一个 immutable provider value 到达 T2，禁止回退到 Bash、PATH tool 或未冻结 profile。

Owner 与原子边界

• Core 拥有精确、版本化的 dispatch grammar 和固定 profile digest。
• Runtime 拥有 operation 生命周期与 provider result identity。
• Toolchain authority 从重新验证的 executable/entrypoint bytes 与冻结 release profile 派生 identity digest。
• SQLite 继续拥有现有 call+dispatch T1 与 response T2 原子事务。
• 下一个 stacked slice 将从 accepted-world/toolchain opaque capability 组合 Host admission。

T1 前失败不留下 durable tool operation。T1 后失败只能写 error T2，或由后续 exact-boundary recovery owner 收敛；不能删除 immutable RuntimeEvents 伪装回滚。任何 identity 或因果顺序损坏都 fail closed。

验证

• Core RuntimeEvent decoder：24/24
• Runtime durable boundary：45/45
• SQLite Runtime store：55/55，包含真实文件 reopen
• Runtime Host toolchain authority：2/2
• Core、Storage、Runtime Host typecheck：通过
• Biome 与 git diff --check：通过

Runtime 全量 typecheck 仍只有既有的 Zod v3/v4 混装问题，位于 archive-read-tool.ts、builtin-tools.ts 和 shell-tools.ts；本提交没有新增 Runtime TypeScript 错误。

在 Host admission、真实生产 consumer、production-shaped helper/Host kill-and-reopen，以及 Linux/macOS/Windows enforcing sandbox 证据完成前，本 PR 保持 Draft。