refactor(upgrade): route plan/check/apply through in-repo Core (P6)

[Drswith]

Summary

P6 first knife: route quantex upgrade / qtx upgrade plan, check, and apply through an in-repo Core self-upgrade engine with a thin CLI projection. Domain planning, providers, binary replacement, and locks stay in src/self. The published quantex-core SDK does not gain upgrade(). Frozen 1.x contracts are unchanged, including --channel. Changelog framing is internal.

Before / after path map

Before (P5 main):

command-contract/handlers.ts
  → src/commands/upgrade.ts
    → src/services/self-upgrade-production.ts
      → src/self/application.ts
        → src/self planSelfUpgrade / upgradeSelf

After:

command-contract/handlers.ts
  → src/commands/upgrade.ts          (JSON/human projection, frozen error mapping)
    → src/services/self-upgrade-production.ts
         (CLI context, cancellation, runtime ports, src/self port binding)
      → src/core/self-upgrade-executor.ts   (plan/check/apply orchestration)
        → src/self planSelfUpgrade / upgradeSelf

Apply moved with plan/check because it is the same invocation (executeCoreSelfUpgrade plans first and mutates only when status is update-available and neither --check nor dry-run). Splitting apply would have created a second engine.

DELETE vs KEEP

Module	Result	Proof
src/self/application.ts	DELETE	Orchestration relocated to src/core/self-upgrade-executor.ts. Zero remaining importers.
src/core/self-upgrade-production.ts	not added	Would import src/self and fail test/architecture/core-boundary.test.ts.
src/services/self-upgrade-production.ts	KEEP	Still differential: CLI context + src/self port injection into Core. Importer: src/commands/upgrade.ts.
src/self domain (planning, facts, providers, binary, lock, recovery, registry, persistence)	KEEP	Still differential; production bridge calls them.
src/commands/upgrade.ts	KEEP	Thin projector; frozen JSON/human/error mapping unchanged.

Contract freeze checklist

• Structured codes from fix(upgrade): return NETWORK_ERROR when latest version cannot be resolved #700: NETWORK_ERROR, MANUAL_ACTION_REQUIRED
• UPGRADE_FAILED mapping unchanged
• Aliases: command name upgrade only; binaries qtx / quantex
• --json envelope and data fields unchanged
• --json does not expose engine / route
• --check still exit 1 with status update-available and no mutation
• --channel still forwards stable / beta into planning; JSON data.channel matches
• Unknown --channel values stay rejected at option resolution (no new error shape)
• --check --channel and dry-run --channel stay plan-only
• Dry-run still DRY_RUN warning, no mutation
• State schema v2 unchanged
• Same packages/binaries, 1.x line (not 2.x)
• Published SDK has no upgrade() method
• YAML / release-core.yml / protect-main untouched
• Shelved OpenSpec changes untouched
• Did not fold config / capabilities / commands / schema

Linked Artifacts

• OpenSpec: cli-core-upgrade-p6

Validation

• bun run memory:check
• bun run lint
• bun run format:check
• bun run typecheck
• bun run test (upgrade/ownership/architecture plus full suite)

Release Intent

• Release: not applicable - internal Core routing with frozen CLI contracts including --channel

Release Summary

BEGIN_COMMIT_OVERRIDE
refactor(upgrade): route CLI upgrade through in-repo Core

Move plan, check, and apply orchestration for quantex upgrade / qtx upgrade
into an in-repo Core engine behind the frozen CLI contract, including --channel.
The published quantex-core SDK does not gain an upgrade method.
END_COMMIT_OVERRIDE

Docs Updated

• openspec/...
• README.md / README.zh-CN.md / packages/core/README.md

Scope Check

• I did not add a new ad hoc root-level Markdown file.
• I updated the relevant issue, ADR, spec, runbook, or captured the missing doc work as follow-up.
• I did not silently expand project scope without recording it explicitly.

Closure Check

• Working tree was clean after commit.
• Branch was pushed and this PR is the active delivery artifact.
• OpenSpec change is still active until this merge (archive closure after merge when complete).
• Release is not applicable - internal changelog; frozen CLI contracts including --channel.

Notes

Core executor is generic over the self-upgrade plan/result so src/core/** stays free of src/self imports. Product-path files under src/ keep classify on the full ubuntu/windows/macos test matrix. Squash framing is refactor so this knife stays an internal improvement and does not independently bump 1.x.