feat(runtime-host): establish protocol and admission foundations

[M4n5ter]

English

Context

This PR establishes the protocol/dispatcher and root-admission foundation required by the Runtime Host Session-core migration tracked in #1167.

The Host is still non-serving in production; this PR does not switch any Desktop, TUI, CLI, or Headless entrypoint.

What changes

Closed operation protocol

• Split the operation catalog into typed domain specifications with exact input, output, error, lifecycle-availability, and command/query contracts.
• Decode requests, responses, and handler outcomes against the same closed catalog. Unknown operations, undeclared errors, extra fields, malformed handler outcomes, and incomplete or duplicate handler composition fail closed.
• Keep host.status available during bootstrap/recovery while ready-only operations return the existing typed host_not_ready failure.
• Remove the unused retry/admission metadata instead of carrying fields with no consumer or recovery contract. The Kernel now consumes only the lifecycle availability and command mode that affect behavior.
• Keep the unreleased wire protocol at v0; there is no production compatibility surface yet.

Root admission authority

• Extract a shared SessionAdmissionGate: operations for one Session serialize, while different Sessions remain independent.
• Give each durable root-Turn admission an explicit previousRootTurnId. Recovery reconstructs one linear chain from predecessor facts instead of inferring order from timestamps, and rejects missing predecessors, multiple roots, branches, or disconnected cycles.
• Make RootAdmissionOwner the single in-Epoch owner of recovered admission identity and the current chain tip. It advances only after the Store returns a valid durable result.
• If a durable write may have committed before reporting failure, poison that Session for the rest of the Host Epoch. Queued successors fail before touching the Store; a new Host Epoch recovers the canonical chain from disk. This avoids extending a stale tip into sibling admissions without introducing a general recovery mechanism.

The experimental root-admission record moves to schema version 2 for the predecessor fact. This is a storage-record schema, separate from the v0 wire protocol, and no compatibility layer is added for non-production state.

Session-store shutdown completion

After the SQLite Session metadata migration in #1373, SessionStore.close() is asynchronous and idempotent: it waits for the already-started metadata import to settle before closing SQLite. Runtime Host, Desktop, and CLI shutdown paths await that completion, so owner teardown cannot race the import.

Evidence

Coverage includes closed catalog and handler composition, bootstrap-versus-ready dispatch, two real Clients racing one Session, response loss followed by Host restart, same-millisecond ordering, malformed durable graphs, a real Store that commits an admission and then throws, and a real JSONL-to-SQLite import immediately followed by close.

Storage passes 443 tests with one existing Windows-only skip; Runtime Host passes all 72 tests. The full workspace typecheck, affected Biome checks, and git diff --check also pass.

Scope

This foundation intentionally does not add Message, canonical projection, continuity, Interaction, automation/goal ownership, production surface wiring, or the M4 stale-Host activation gate. Those remain in their owning slices after this prerequisite.

Part of #1167. Related to #853.

简体中文

背景

本 PR 建立 Runtime Host Session core 迁移所需的 protocol/dispatcher 与 root-admission foundation，整体由 #1167 跟踪。

Runtime Host 仍未进入 production serving，本 PR 不切换 Desktop、TUI、CLI 或 Headless 的任何入口。

改动内容

封闭 operation protocol

• 将 operation catalog 拆成带有精确 input、output、error、lifecycle availability 与 command/query 契约的 typed domain specification。
• request、response 与 handler outcome 共用同一份封闭 catalog 解码。未知 operation、未声明 error、多余字段、畸形 handler outcome，以及缺失或重复的 handler composition 都会 fail closed。
• host.status 在 bootstrap/recovery 阶段仍可使用；仅 ready 可用的 operation 继续返回已有的 typed host_not_ready failure。
• 删除没有消费者和恢复契约的 retry/admission 元数据，不保留空语义字段。Kernel 只消费真正影响行为的 lifecycle availability 与 command mode。
• wire protocol 保持未发布的 v0；当前还不存在 production compatibility surface。

Root admission authority

• 提取共享的 SessionAdmissionGate：同一个 Session 的 operation 串行执行，不同 Session 之间保持独立。
• 每条 durable root-Turn admission 显式记录 previousRootTurnId。恢复时根据 predecessor fact 重建唯一线性链，不再根据时间戳推断顺序；missing predecessor、multiple roots、branch 和 disconnected cycle 都会被拒绝。
• RootAdmissionOwner 成为单个 Host Epoch 内 recovered admission identity 与当前 chain tip 的唯一 owner。只有 Store 返回有效 durable result 后才推进 tip。
• 如果 durable write 可能已经 commit、但随后报告失败，则在本 Host Epoch 内 poison 该 Session。已经排队的 successor 会在触碰 Store 前失败；新 Host Epoch 再从磁盘恢复 canonical chain。这样可以避免沿 stale tip 写出 sibling admission，也无需引入通用恢复机制。

实验性的 root-admission 持久记录因 predecessor fact 升至 schema version 2。它是存储记录 schema，与 v0 wire protocol 相互独立；非生产状态不增加兼容层。

Session Store 关闭完成语义

#1373 将 Session metadata 迁移到 SQLite 后，SessionStore.close() 改为异步且幂等：它会先等待已经启动的 metadata import settle，再关闭 SQLite。Runtime Host、Desktop 与 CLI 的 shutdown 路径都会等待该 completion，避免 owner teardown 与 import 竞态。

验证证据

覆盖范围包括封闭 catalog 与 handler composition、bootstrap/ready dispatch、两个真实 Client 竞争同一个 Session、response 丢失后重启 Host、同毫秒顺序、畸形 durable graph、真实 Store 先 commit admission 再抛错，以及真实 JSONL-to-SQLite import 后立即 close。

Storage 通过 443 项测试，另有 1 项既有 Windows-only skip；Runtime Host 72 项全部通过。全 workspace typecheck、受影响文件的 Biome check 与 git diff --check 也均通过。

范围

本 foundation 刻意不加入 Message、canonical projection、continuity、Interaction、automation/goal ownership、production surface wiring 或 M4 stale-Host activation gate。这些内容会在该前置合并后，随各自所属 slice 推进。

属于 #1167；关联 #853。

[likun666661]

Reviewed the protocol/dispatcher and root-admission changes.

The closed operation catalog now consistently validates requests, responses, declared errors, and handler composition, while lifecycle availability is enforced during recovery. The SessionAdmissionGate, explicit predecessor chain, and RootAdmissionOwner establish a coherent per-session serialization and fail-closed recovery model, including ambiguous post-commit failures.

The change remains properly scoped to non-serving foundation work. CI is green, and the targeted Storage and Runtime Host tests cover concurrency, restart recovery, malformed durable graphs, and response-loss retry semantics.

I found no blocking issues. Approved.

[M4n5ter]

English

Context

This PR establishes the protocol/dispatcher and root-admission foundation required by the Runtime Host Session-core migration tracked in #1167.

The Host is still non-serving in production; this PR does not switch any Desktop, TUI, CLI, or Headless entrypoint.

What changes

Closed operation protocol

• Split the operation catalog into typed domain specifications with exact input, output, error, lifecycle-availability, and command/query contracts.
• Decode requests, responses, and handler outcomes against the same closed catalog. Unknown operations, undeclared errors, extra fields, malformed handler outcomes, and incomplete or duplicate handler composition fail closed.
• Keep host.status available during bootstrap/recovery while ready-only operations return the existing typed host_not_ready failure.
• Remove the unused retry/admission metadata instead of carrying fields with no consumer or recovery contract. The Kernel now consumes only the lifecycle availability and command mode that affect behavior.
• Keep the unreleased wire protocol at v0; there is no production compatibility surface yet.

Root admission authority

• Extract a shared SessionAdmissionGate: operations for one Session serialize, while different Sessions remain independent.
• Give each durable root-Turn admission an explicit previousRootTurnId. Recovery reconstructs one linear chain from predecessor facts instead of inferring order from timestamps, and rejects missing predecessors, multiple roots, branches, or disconnected cycles.
• Make RootAdmissionOwner the single in-Epoch owner of recovered admission identity and the current chain tip. It advances only after the Store returns a valid durable result.
• If a durable write may have committed before reporting failure, poison that Session for the rest of the Host Epoch. Queued successors fail before touching the Store; a new Host Epoch recovers the canonical chain from disk. This avoids extending a stale tip into sibling admissions without introducing a general recovery mechanism.

The experimental root-admission record moves to schema version 2 for the predecessor fact. This is a storage-record schema, separate from the v0 wire protocol, and no compatibility layer is added for non-production state.

Session-store shutdown completion

After the SQLite Session metadata migration in #1373, SessionStore.close() is asynchronous and idempotent: it waits for the already-started metadata import to settle before closing SQLite. Runtime Host, Desktop, and CLI shutdown paths await that completion, so owner teardown cannot race the import.

Evidence

Coverage includes closed catalog and handler composition, bootstrap-versus-ready dispatch, two real Clients racing one Session, response loss followed by Host restart, same-millisecond ordering, malformed durable graphs, a real Store that commits an admission and then throws, and a real JSONL-to-SQLite import immediately followed by close.

Storage passes 443 tests with one existing Windows-only skip; Runtime Host passes all 72 tests. The full workspace typecheck, affected Biome checks, and git diff --check also pass.

Scope

This foundation intentionally does not add Message, canonical projection, continuity, Interaction, automation/goal ownership, production surface wiring, or the M4 stale-Host activation gate. Those remain in their owning slices after this prerequisite.

Part of #1167. Related to #853.

简体中文

背景

本 PR 建立 Runtime Host Session core 迁移所需的 protocol/dispatcher 与 root-admission foundation，整体由 #1167 跟踪。

Runtime Host 仍未进入 production serving，本 PR 不切换 Desktop、TUI、CLI 或 Headless 的任何入口。

改动内容

封闭 operation protocol

• 将 operation catalog 拆成带有精确 input、output、error、lifecycle availability 与 command/query 契约的 typed domain specification。
• request、response 与 handler outcome 共用同一份封闭 catalog 解码。未知 operation、未声明 error、多余字段、畸形 handler outcome，以及缺失或重复的 handler composition 都会 fail closed。
• host.status 在 bootstrap/recovery 阶段仍可使用；仅 ready 可用的 operation 继续返回已有的 typed host_not_ready failure。
• 删除没有消费者和恢复契约的 retry/admission 元数据，不保留空语义字段。Kernel 只消费真正影响行为的 lifecycle availability 与 command mode。
• wire protocol 保持未发布的 v0；当前还不存在 production compatibility surface。

Root admission authority

• 提取共享的 SessionAdmissionGate：同一个 Session 的 operation 串行执行，不同 Session 之间保持独立。
• 每条 durable root-Turn admission 显式记录 previousRootTurnId。恢复时根据 predecessor fact 重建唯一线性链，不再根据时间戳推断顺序；missing predecessor、multiple roots、branch 和 disconnected cycle 都会被拒绝。
• RootAdmissionOwner 成为单个 Host Epoch 内 recovered admission identity 与当前 chain tip 的唯一 owner。只有 Store 返回有效 durable result 后才推进 tip。
• 如果 durable write 可能已经 commit、但随后报告失败，则在本 Host Epoch 内 poison 该 Session。已经排队的 successor 会在触碰 Store 前失败；新 Host Epoch 再从磁盘恢复 canonical chain。这样可以避免沿 stale tip 写出 sibling admission，也无需引入通用恢复机制。

实验性的 root-admission 持久记录因 predecessor fact 升至 schema version 2。它是存储记录 schema，与 v0 wire protocol 相互独立；非生产状态不增加兼容层。

Session Store 关闭完成语义

#1373 将 Session metadata 迁移到 SQLite 后，SessionStore.close() 改为异步且幂等：它会先等待已经启动的 metadata import settle，再关闭 SQLite。Runtime Host、Desktop 与 CLI 的 shutdown 路径都会等待该 completion，避免 owner teardown 与 import 竞态。

验证证据

覆盖范围包括封闭 catalog 与 handler composition、bootstrap/ready dispatch、两个真实 Client 竞争同一个 Session、response 丢失后重启 Host、同毫秒顺序、畸形 durable graph、真实 Store 先 commit admission 再抛错，以及真实 JSONL-to-SQLite import 后立即 close。

Storage 通过 443 项测试，另有 1 项既有 Windows-only skip；Runtime Host 72 项全部通过。全 workspace typecheck、受影响文件的 Biome check 与 git diff --check 也均通过。

范围

本 foundation 刻意不加入 Message、canonical projection、continuity、Interaction、automation/goal ownership、production surface wiring 或 M4 stale-Host activation gate。这些内容会在该前置合并后，随各自所属 slice 推进。

属于 #1167；关联 #853。

[likun666661]

Reviewed the protocol/dispatcher and root-admission changes.

The closed operation catalog now consistently validates requests, responses, declared errors, and handler composition, while lifecycle availability is enforced during recovery. The SessionAdmissionGate, explicit predecessor chain, and RootAdmissionOwner establish a coherent per-session serialization and fail-closed recovery model, including ambiguous post-commit failures.

The change remains properly scoped to non-serving foundation work. CI is green, and the targeted Storage and Runtime Host tests cover concurrency, restart recovery, malformed durable graphs, and response-loss retry semantics.

I found no blocking issues. Approved.

[M4n5ter]

English

Context

This PR establishes the protocol/dispatcher and root-admission foundation required by the Runtime Host Session-core migration tracked in #1167.

The Host is still non-serving in production; this PR does not switch any Desktop, TUI, CLI, or Headless entrypoint.

What changes

Closed operation protocol

• Split the operation catalog into typed domain specifications with exact input, output, error, lifecycle-availability, and command/query contracts.
• Decode requests, responses, and handler outcomes against the same closed catalog. Unknown operations, undeclared errors, extra fields, malformed handler outcomes, and incomplete or duplicate handler composition fail closed.
• Keep host.status available during bootstrap/recovery while ready-only operations return the existing typed host_not_ready failure.
• Remove the unused retry/admission metadata instead of carrying fields with no consumer or recovery contract. The Kernel now consumes only the lifecycle availability and command mode that affect behavior.
• Keep the unreleased wire protocol at v0; there is no production compatibility surface yet.

Root admission authority

• Extract a shared SessionAdmissionGate: operations for one Session serialize, while different Sessions remain independent.
• Give each durable root-Turn admission an explicit previousRootTurnId. Recovery reconstructs one linear chain from predecessor facts instead of inferring order from timestamps, and rejects missing predecessors, multiple roots, branches, or disconnected cycles.
• Make RootAdmissionOwner the single in-Epoch owner of recovered admission identity and the current chain tip. It advances only after the Store returns a valid durable result.
• If a durable write may have committed before reporting failure, poison that Session for the rest of the Host Epoch. Queued successors fail before touching the Store; a new Host Epoch recovers the canonical chain from disk. This avoids extending a stale tip into sibling admissions without introducing a general recovery mechanism.

The experimental root-admission record moves to schema version 2 for the predecessor fact. This is a storage-record schema, separate from the v0 wire protocol, and no compatibility layer is added for non-production state.

Session-store shutdown completion

After the SQLite Session metadata migration in #1373, SessionStore.close() is asynchronous and idempotent: it waits for the already-started metadata import to settle before closing SQLite. Runtime Host, Desktop, and CLI shutdown paths await that completion, so owner teardown cannot race the import.

Evidence

Coverage includes closed catalog and handler composition, bootstrap-versus-ready dispatch, two real Clients racing one Session, response loss followed by Host restart, same-millisecond ordering, malformed durable graphs, a real Store that commits an admission and then throws, and a real JSONL-to-SQLite import immediately followed by close.

Storage passes 443 tests with one existing Windows-only skip; Runtime Host passes all 72 tests. The full workspace typecheck, affected Biome checks, and git diff --check also pass.

Scope

This foundation intentionally does not add Message, canonical projection, continuity, Interaction, automation/goal ownership, production surface wiring, or the M4 stale-Host activation gate. Those remain in their owning slices after this prerequisite.

Part of #1167. Related to #853.

简体中文

背景

本 PR 建立 Runtime Host Session core 迁移所需的 protocol/dispatcher 与 root-admission foundation，整体由 #1167 跟踪。

Runtime Host 仍未进入 production serving，本 PR 不切换 Desktop、TUI、CLI 或 Headless 的任何入口。

改动内容

封闭 operation protocol

• 将 operation catalog 拆成带有精确 input、output、error、lifecycle availability 与 command/query 契约的 typed domain specification。
• request、response 与 handler outcome 共用同一份封闭 catalog 解码。未知 operation、未声明 error、多余字段、畸形 handler outcome，以及缺失或重复的 handler composition 都会 fail closed。
• host.status 在 bootstrap/recovery 阶段仍可使用；仅 ready 可用的 operation 继续返回已有的 typed host_not_ready failure。
• 删除没有消费者和恢复契约的 retry/admission 元数据，不保留空语义字段。Kernel 只消费真正影响行为的 lifecycle availability 与 command mode。
• wire protocol 保持未发布的 v0；当前还不存在 production compatibility surface。

Root admission authority

• 提取共享的 SessionAdmissionGate：同一个 Session 的 operation 串行执行，不同 Session 之间保持独立。
• 每条 durable root-Turn admission 显式记录 previousRootTurnId。恢复时根据 predecessor fact 重建唯一线性链，不再根据时间戳推断顺序；missing predecessor、multiple roots、branch 和 disconnected cycle 都会被拒绝。
• RootAdmissionOwner 成为单个 Host Epoch 内 recovered admission identity 与当前 chain tip 的唯一 owner。只有 Store 返回有效 durable result 后才推进 tip。
• 如果 durable write 可能已经 commit、但随后报告失败，则在本 Host Epoch 内 poison 该 Session。已经排队的 successor 会在触碰 Store 前失败；新 Host Epoch 再从磁盘恢复 canonical chain。这样可以避免沿 stale tip 写出 sibling admission，也无需引入通用恢复机制。

实验性的 root-admission 持久记录因 predecessor fact 升至 schema version 2。它是存储记录 schema，与 v0 wire protocol 相互独立；非生产状态不增加兼容层。

Session Store 关闭完成语义

#1373 将 Session metadata 迁移到 SQLite 后，SessionStore.close() 改为异步且幂等：它会先等待已经启动的 metadata import settle，再关闭 SQLite。Runtime Host、Desktop 与 CLI 的 shutdown 路径都会等待该 completion，避免 owner teardown 与 import 竞态。

验证证据

覆盖范围包括封闭 catalog 与 handler composition、bootstrap/ready dispatch、两个真实 Client 竞争同一个 Session、response 丢失后重启 Host、同毫秒顺序、畸形 durable graph、真实 Store 先 commit admission 再抛错，以及真实 JSONL-to-SQLite import 后立即 close。

Storage 通过 443 项测试，另有 1 项既有 Windows-only skip；Runtime Host 72 项全部通过。全 workspace typecheck、受影响文件的 Biome check 与 git diff --check 也均通过。

范围

本 foundation 刻意不加入 Message、canonical projection、continuity、Interaction、automation/goal ownership、production surface wiring 或 M4 stale-Host activation gate。这些内容会在该前置合并后，随各自所属 slice 推进。

属于 #1167；关联 #853。

[likun666661]

Reviewed the protocol/dispatcher and root-admission changes.

The closed operation catalog now consistently validates requests, responses, declared errors, and handler composition, while lifecycle availability is enforced during recovery. The SessionAdmissionGate, explicit predecessor chain, and RootAdmissionOwner establish a coherent per-session serialization and fail-closed recovery model, including ambiguous post-commit failures.

The change remains properly scoped to non-serving foundation work. CI is green, and the targeted Storage and Runtime Host tests cover concurrency, restart recovery, malformed durable graphs, and response-loss retry semantics.

I found no blocking issues. Approved.

[M4n5ter]

English

Context

This PR establishes the protocol/dispatcher and root-admission foundation required by the Runtime Host Session-core migration tracked in #1167.

The Host is still non-serving in production; this PR does not switch any Desktop, TUI, CLI, or Headless entrypoint.

What changes

Closed operation protocol

• Split the operation catalog into typed domain specifications with exact input, output, error, lifecycle-availability, and command/query contracts.
• Decode requests, responses, and handler outcomes against the same closed catalog. Unknown operations, undeclared errors, extra fields, malformed handler outcomes, and incomplete or duplicate handler composition fail closed.
• Keep host.status available during bootstrap/recovery while ready-only operations return the existing typed host_not_ready failure.
• Remove the unused retry/admission metadata instead of carrying fields with no consumer or recovery contract. The Kernel now consumes only the lifecycle availability and command mode that affect behavior.
• Keep the unreleased wire protocol at v0; there is no production compatibility surface yet.

Root admission authority

• Extract a shared SessionAdmissionGate: operations for one Session serialize, while different Sessions remain independent.
• Give each durable root-Turn admission an explicit previousRootTurnId. Recovery reconstructs one linear chain from predecessor facts instead of inferring order from timestamps, and rejects missing predecessors, multiple roots, branches, or disconnected cycles.
• Make RootAdmissionOwner the single in-Epoch owner of recovered admission identity and the current chain tip. It advances only after the Store returns a valid durable result.
• If a durable write may have committed before reporting failure, poison that Session for the rest of the Host Epoch. Queued successors fail before touching the Store; a new Host Epoch recovers the canonical chain from disk. This avoids extending a stale tip into sibling admissions without introducing a general recovery mechanism.

The experimental root-admission record moves to schema version 2 for the predecessor fact. This is a storage-record schema, separate from the v0 wire protocol, and no compatibility layer is added for non-production state.

Session-store shutdown completion

After the SQLite Session metadata migration in #1373, SessionStore.close() is asynchronous and idempotent: it waits for the already-started metadata import to settle before closing SQLite. Runtime Host, Desktop, and CLI shutdown paths await that completion, so owner teardown cannot race the import.

Evidence

Coverage includes closed catalog and handler composition, bootstrap-versus-ready dispatch, two real Clients racing one Session, response loss followed by Host restart, same-millisecond ordering, malformed durable graphs, a real Store that commits an admission and then throws, and a real JSONL-to-SQLite import immediately followed by close.

Storage passes 443 tests with one existing Windows-only skip; Runtime Host passes all 72 tests. The full workspace typecheck, affected Biome checks, and git diff --check also pass.

Scope

This foundation intentionally does not add Message, canonical projection, continuity, Interaction, automation/goal ownership, production surface wiring, or the M4 stale-Host activation gate. Those remain in their owning slices after this prerequisite.

Part of #1167. Related to #853.

简体中文

背景

本 PR 建立 Runtime Host Session core 迁移所需的 protocol/dispatcher 与 root-admission foundation，整体由 #1167 跟踪。

Runtime Host 仍未进入 production serving，本 PR 不切换 Desktop、TUI、CLI 或 Headless 的任何入口。

改动内容

封闭 operation protocol

• 将 operation catalog 拆成带有精确 input、output、error、lifecycle availability 与 command/query 契约的 typed domain specification。
• request、response 与 handler outcome 共用同一份封闭 catalog 解码。未知 operation、未声明 error、多余字段、畸形 handler outcome，以及缺失或重复的 handler composition 都会 fail closed。
• host.status 在 bootstrap/recovery 阶段仍可使用；仅 ready 可用的 operation 继续返回已有的 typed host_not_ready failure。
• 删除没有消费者和恢复契约的 retry/admission 元数据，不保留空语义字段。Kernel 只消费真正影响行为的 lifecycle availability 与 command mode。
• wire protocol 保持未发布的 v0；当前还不存在 production compatibility surface。

Root admission authority

• 提取共享的 SessionAdmissionGate：同一个 Session 的 operation 串行执行，不同 Session 之间保持独立。
• 每条 durable root-Turn admission 显式记录 previousRootTurnId。恢复时根据 predecessor fact 重建唯一线性链，不再根据时间戳推断顺序；missing predecessor、multiple roots、branch 和 disconnected cycle 都会被拒绝。
• RootAdmissionOwner 成为单个 Host Epoch 内 recovered admission identity 与当前 chain tip 的唯一 owner。只有 Store 返回有效 durable result 后才推进 tip。
• 如果 durable write 可能已经 commit、但随后报告失败，则在本 Host Epoch 内 poison 该 Session。已经排队的 successor 会在触碰 Store 前失败；新 Host Epoch 再从磁盘恢复 canonical chain。这样可以避免沿 stale tip 写出 sibling admission，也无需引入通用恢复机制。

实验性的 root-admission 持久记录因 predecessor fact 升至 schema version 2。它是存储记录 schema，与 v0 wire protocol 相互独立；非生产状态不增加兼容层。

Session Store 关闭完成语义

#1373 将 Session metadata 迁移到 SQLite 后，SessionStore.close() 改为异步且幂等：它会先等待已经启动的 metadata import settle，再关闭 SQLite。Runtime Host、Desktop 与 CLI 的 shutdown 路径都会等待该 completion，避免 owner teardown 与 import 竞态。

验证证据

覆盖范围包括封闭 catalog 与 handler composition、bootstrap/ready dispatch、两个真实 Client 竞争同一个 Session、response 丢失后重启 Host、同毫秒顺序、畸形 durable graph、真实 Store 先 commit admission 再抛错，以及真实 JSONL-to-SQLite import 后立即 close。

Storage 通过 443 项测试，另有 1 项既有 Windows-only skip；Runtime Host 72 项全部通过。全 workspace typecheck、受影响文件的 Biome check 与 git diff --check 也均通过。

范围

本 foundation 刻意不加入 Message、canonical projection、continuity、Interaction、automation/goal ownership、production surface wiring 或 M4 stale-Host activation gate。这些内容会在该前置合并后，随各自所属 slice 推进。

属于 #1167；关联 #853。

[likun666661]

Reviewed the protocol/dispatcher and root-admission changes.

The closed operation catalog now consistently validates requests, responses, declared errors, and handler composition, while lifecycle availability is enforced during recovery. The SessionAdmissionGate, explicit predecessor chain, and RootAdmissionOwner establish a coherent per-session serialization and fail-closed recovery model, including ambiguous post-commit failures.

The change remains properly scoped to non-serving foundation work. CI is green, and the targeted Storage and Runtime Host tests cover concurrency, restart recovery, malformed durable graphs, and response-loss retry semantics.

I found no blocking issues. Approved.

[M4n5ter]

English

Context

This PR establishes the protocol/dispatcher and root-admission foundation required by the Runtime Host Session-core migration tracked in #1167.

The Host is still non-serving in production; this PR does not switch any Desktop, TUI, CLI, or Headless entrypoint.

What changes

Closed operation protocol

• Split the operation catalog into typed domain specifications with exact input, output, error, lifecycle-availability, and command/query contracts.
• Decode requests, responses, and handler outcomes against the same closed catalog. Unknown operations, undeclared errors, extra fields, malformed handler outcomes, and incomplete or duplicate handler composition fail closed.
• Keep host.status available during bootstrap/recovery while ready-only operations return the existing typed host_not_ready failure.
• Remove the unused retry/admission metadata instead of carrying fields with no consumer or recovery contract. The Kernel now consumes only the lifecycle availability and command mode that affect behavior.
• Keep the unreleased wire protocol at v0; there is no production compatibility surface yet.

Root admission authority

• Extract a shared SessionAdmissionGate: operations for one Session serialize, while different Sessions remain independent.
• Give each durable root-Turn admission an explicit previousRootTurnId. Recovery reconstructs one linear chain from predecessor facts instead of inferring order from timestamps, and rejects missing predecessors, multiple roots, branches, or disconnected cycles.
• Make RootAdmissionOwner the single in-Epoch owner of recovered admission identity and the current chain tip. It advances only after the Store returns a valid durable result.
• If a durable write may have committed before reporting failure, poison that Session for the rest of the Host Epoch. Queued successors fail before touching the Store; a new Host Epoch recovers the canonical chain from disk. This avoids extending a stale tip into sibling admissions without introducing a general recovery mechanism.

The experimental root-admission record moves to schema version 2 for the predecessor fact. This is a storage-record schema, separate from the v0 wire protocol, and no compatibility layer is added for non-production state.

Session-store shutdown completion

After the SQLite Session metadata migration in #1373, SessionStore.close() is asynchronous and idempotent: it waits for the already-started metadata import to settle before closing SQLite. Runtime Host, Desktop, and CLI shutdown paths await that completion, so owner teardown cannot race the import.

Evidence

Coverage includes closed catalog and handler composition, bootstrap-versus-ready dispatch, two real Clients racing one Session, response loss followed by Host restart, same-millisecond ordering, malformed durable graphs, a real Store that commits an admission and then throws, and a real JSONL-to-SQLite import immediately followed by close.

Storage passes 443 tests with one existing Windows-only skip; Runtime Host passes all 72 tests. The full workspace typecheck, affected Biome checks, and git diff --check also pass.

Scope

This foundation intentionally does not add Message, canonical projection, continuity, Interaction, automation/goal ownership, production surface wiring, or the M4 stale-Host activation gate. Those remain in their owning slices after this prerequisite.

Part of #1167. Related to #853.

简体中文

背景

本 PR 建立 Runtime Host Session core 迁移所需的 protocol/dispatcher 与 root-admission foundation，整体由 #1167 跟踪。

Runtime Host 仍未进入 production serving，本 PR 不切换 Desktop、TUI、CLI 或 Headless 的任何入口。

改动内容

封闭 operation protocol

• 将 operation catalog 拆成带有精确 input、output、error、lifecycle availability 与 command/query 契约的 typed domain specification。
• request、response 与 handler outcome 共用同一份封闭 catalog 解码。未知 operation、未声明 error、多余字段、畸形 handler outcome，以及缺失或重复的 handler composition 都会 fail closed。
• host.status 在 bootstrap/recovery 阶段仍可使用；仅 ready 可用的 operation 继续返回已有的 typed host_not_ready failure。
• 删除没有消费者和恢复契约的 retry/admission 元数据，不保留空语义字段。Kernel 只消费真正影响行为的 lifecycle availability 与 command mode。
• wire protocol 保持未发布的 v0；当前还不存在 production compatibility surface。

Root admission authority

• 提取共享的 SessionAdmissionGate：同一个 Session 的 operation 串行执行，不同 Session 之间保持独立。
• 每条 durable root-Turn admission 显式记录 previousRootTurnId。恢复时根据 predecessor fact 重建唯一线性链，不再根据时间戳推断顺序；missing predecessor、multiple roots、branch 和 disconnected cycle 都会被拒绝。
• RootAdmissionOwner 成为单个 Host Epoch 内 recovered admission identity 与当前 chain tip 的唯一 owner。只有 Store 返回有效 durable result 后才推进 tip。
• 如果 durable write 可能已经 commit、但随后报告失败，则在本 Host Epoch 内 poison 该 Session。已经排队的 successor 会在触碰 Store 前失败；新 Host Epoch 再从磁盘恢复 canonical chain。这样可以避免沿 stale tip 写出 sibling admission，也无需引入通用恢复机制。

实验性的 root-admission 持久记录因 predecessor fact 升至 schema version 2。它是存储记录 schema，与 v0 wire protocol 相互独立；非生产状态不增加兼容层。

Session Store 关闭完成语义

#1373 将 Session metadata 迁移到 SQLite 后，SessionStore.close() 改为异步且幂等：它会先等待已经启动的 metadata import settle，再关闭 SQLite。Runtime Host、Desktop 与 CLI 的 shutdown 路径都会等待该 completion，避免 owner teardown 与 import 竞态。

验证证据

覆盖范围包括封闭 catalog 与 handler composition、bootstrap/ready dispatch、两个真实 Client 竞争同一个 Session、response 丢失后重启 Host、同毫秒顺序、畸形 durable graph、真实 Store 先 commit admission 再抛错，以及真实 JSONL-to-SQLite import 后立即 close。

Storage 通过 443 项测试，另有 1 项既有 Windows-only skip；Runtime Host 72 项全部通过。全 workspace typecheck、受影响文件的 Biome check 与 git diff --check 也均通过。

范围

本 foundation 刻意不加入 Message、canonical projection、continuity、Interaction、automation/goal ownership、production surface wiring 或 M4 stale-Host activation gate。这些内容会在该前置合并后，随各自所属 slice 推进。

属于 #1167；关联 #853。

[likun666661]

Reviewed the protocol/dispatcher and root-admission changes.

The closed operation catalog now consistently validates requests, responses, declared errors, and handler composition, while lifecycle availability is enforced during recovery. The SessionAdmissionGate, explicit predecessor chain, and RootAdmissionOwner establish a coherent per-session serialization and fail-closed recovery model, including ambiguous post-commit failures.

The change remains properly scoped to non-serving foundation work. CI is green, and the targeted Storage and Runtime Host tests cover concurrency, restart recovery, malformed durable graphs, and response-loss retry semantics.

I found no blocking issues. Approved.

[M4n5ter]

English

Context

This PR establishes the protocol/dispatcher and root-admission foundation required by the Runtime Host Session-core migration tracked in #1167.

The Host is still non-serving in production; this PR does not switch any Desktop, TUI, CLI, or Headless entrypoint.

What changes

Closed operation protocol

• Split the operation catalog into typed domain specifications with exact input, output, error, lifecycle-availability, and command/query contracts.
• Decode requests, responses, and handler outcomes against the same closed catalog. Unknown operations, undeclared errors, extra fields, malformed handler outcomes, and incomplete or duplicate handler composition fail closed.
• Keep host.status available during bootstrap/recovery while ready-only operations return the existing typed host_not_ready failure.
• Remove the unused retry/admission metadata instead of carrying fields with no consumer or recovery contract. The Kernel now consumes only the lifecycle availability and command mode that affect behavior.
• Keep the unreleased wire protocol at v0; there is no production compatibility surface yet.

Root admission authority

• Extract a shared SessionAdmissionGate: operations for one Session serialize, while different Sessions remain independent.
• Give each durable root-Turn admission an explicit previousRootTurnId. Recovery reconstructs one linear chain from predecessor facts instead of inferring order from timestamps, and rejects missing predecessors, multiple roots, branches, or disconnected cycles.
• Make RootAdmissionOwner the single in-Epoch owner of recovered admission identity and the current chain tip. It advances only after the Store returns a valid durable result.
• If a durable write may have committed before reporting failure, poison that Session for the rest of the Host Epoch. Queued successors fail before touching the Store; a new Host Epoch recovers the canonical chain from disk. This avoids extending a stale tip into sibling admissions without introducing a general recovery mechanism.

The experimental root-admission record moves to schema version 2 for the predecessor fact. This is a storage-record schema, separate from the v0 wire protocol, and no compatibility layer is added for non-production state.

Session-store shutdown completion

After the SQLite Session metadata migration in #1373, SessionStore.close() is asynchronous and idempotent: it waits for the already-started metadata import to settle before closing SQLite. Runtime Host, Desktop, and CLI shutdown paths await that completion, so owner teardown cannot race the import.

Evidence

Coverage includes closed catalog and handler composition, bootstrap-versus-ready dispatch, two real Clients racing one Session, response loss followed by Host restart, same-millisecond ordering, malformed durable graphs, a real Store that commits an admission and then throws, and a real JSONL-to-SQLite import immediately followed by close.

Storage passes 443 tests with one existing Windows-only skip; Runtime Host passes all 72 tests. The full workspace typecheck, affected Biome checks, and git diff --check also pass.

Scope

This foundation intentionally does not add Message, canonical projection, continuity, Interaction, automation/goal ownership, production surface wiring, or the M4 stale-Host activation gate. Those remain in their owning slices after this prerequisite.

Part of #1167. Related to #853.

简体中文

背景

本 PR 建立 Runtime Host Session core 迁移所需的 protocol/dispatcher 与 root-admission foundation，整体由 #1167 跟踪。

Runtime Host 仍未进入 production serving，本 PR 不切换 Desktop、TUI、CLI 或 Headless 的任何入口。

改动内容

封闭 operation protocol

• 将 operation catalog 拆成带有精确 input、output、error、lifecycle availability 与 command/query 契约的 typed domain specification。
• request、response 与 handler outcome 共用同一份封闭 catalog 解码。未知 operation、未声明 error、多余字段、畸形 handler outcome，以及缺失或重复的 handler composition 都会 fail closed。
• host.status 在 bootstrap/recovery 阶段仍可使用；仅 ready 可用的 operation 继续返回已有的 typed host_not_ready failure。
• 删除没有消费者和恢复契约的 retry/admission 元数据，不保留空语义字段。Kernel 只消费真正影响行为的 lifecycle availability 与 command mode。
• wire protocol 保持未发布的 v0；当前还不存在 production compatibility surface。

Root admission authority

• 提取共享的 SessionAdmissionGate：同一个 Session 的 operation 串行执行，不同 Session 之间保持独立。
• 每条 durable root-Turn admission 显式记录 previousRootTurnId。恢复时根据 predecessor fact 重建唯一线性链，不再根据时间戳推断顺序；missing predecessor、multiple roots、branch 和 disconnected cycle 都会被拒绝。
• RootAdmissionOwner 成为单个 Host Epoch 内 recovered admission identity 与当前 chain tip 的唯一 owner。只有 Store 返回有效 durable result 后才推进 tip。
• 如果 durable write 可能已经 commit、但随后报告失败，则在本 Host Epoch 内 poison 该 Session。已经排队的 successor 会在触碰 Store 前失败；新 Host Epoch 再从磁盘恢复 canonical chain。这样可以避免沿 stale tip 写出 sibling admission，也无需引入通用恢复机制。

实验性的 root-admission 持久记录因 predecessor fact 升至 schema version 2。它是存储记录 schema，与 v0 wire protocol 相互独立；非生产状态不增加兼容层。

Session Store 关闭完成语义

#1373 将 Session metadata 迁移到 SQLite 后，SessionStore.close() 改为异步且幂等：它会先等待已经启动的 metadata import settle，再关闭 SQLite。Runtime Host、Desktop 与 CLI 的 shutdown 路径都会等待该 completion，避免 owner teardown 与 import 竞态。

验证证据

覆盖范围包括封闭 catalog 与 handler composition、bootstrap/ready dispatch、两个真实 Client 竞争同一个 Session、response 丢失后重启 Host、同毫秒顺序、畸形 durable graph、真实 Store 先 commit admission 再抛错，以及真实 JSONL-to-SQLite import 后立即 close。

Storage 通过 443 项测试，另有 1 项既有 Windows-only skip；Runtime Host 72 项全部通过。全 workspace typecheck、受影响文件的 Biome check 与 git diff --check 也均通过。

范围

本 foundation 刻意不加入 Message、canonical projection、continuity、Interaction、automation/goal ownership、production surface wiring 或 M4 stale-Host activation gate。这些内容会在该前置合并后，随各自所属 slice 推进。

属于 #1167；关联 #853。

[likun666661]

Reviewed the protocol/dispatcher and root-admission changes.

The closed operation catalog now consistently validates requests, responses, declared errors, and handler composition, while lifecycle availability is enforced during recovery. The SessionAdmissionGate, explicit predecessor chain, and RootAdmissionOwner establish a coherent per-session serialization and fail-closed recovery model, including ambiguous post-commit failures.

The change remains properly scoped to non-serving foundation work. CI is green, and the targeted Storage and Runtime Host tests cover concurrency, restart recovery, malformed durable graphs, and response-loss retry semantics.

I found no blocking issues. Approved.

[M4n5ter]

English

Context

This PR establishes the protocol/dispatcher and root-admission foundation required by the Runtime Host Session-core migration tracked in #1167.

The Host is still non-serving in production; this PR does not switch any Desktop, TUI, CLI, or Headless entrypoint.

What changes

Closed operation protocol

• Split the operation catalog into typed domain specifications with exact input, output, error, lifecycle-availability, and command/query contracts.
• Decode requests, responses, and handler outcomes against the same closed catalog. Unknown operations, undeclared errors, extra fields, malformed handler outcomes, and incomplete or duplicate handler composition fail closed.
• Keep host.status available during bootstrap/recovery while ready-only operations return the existing typed host_not_ready failure.
• Remove the unused retry/admission metadata instead of carrying fields with no consumer or recovery contract. The Kernel now consumes only the lifecycle availability and command mode that affect behavior.
• Keep the unreleased wire protocol at v0; there is no production compatibility surface yet.

Root admission authority

• Extract a shared SessionAdmissionGate: operations for one Session serialize, while different Sessions remain independent.
• Give each durable root-Turn admission an explicit previousRootTurnId. Recovery reconstructs one linear chain from predecessor facts instead of inferring order from timestamps, and rejects missing predecessors, multiple roots, branches, or disconnected cycles.
• Make RootAdmissionOwner the single in-Epoch owner of recovered admission identity and the current chain tip. It advances only after the Store returns a valid durable result.
• If a durable write may have committed before reporting failure, poison that Session for the rest of the Host Epoch. Queued successors fail before touching the Store; a new Host Epoch recovers the canonical chain from disk. This avoids extending a stale tip into sibling admissions without introducing a general recovery mechanism.

The experimental root-admission record moves to schema version 2 for the predecessor fact. This is a storage-record schema, separate from the v0 wire protocol, and no compatibility layer is added for non-production state.

Session-store shutdown completion

After the SQLite Session metadata migration in #1373, SessionStore.close() is asynchronous and idempotent: it waits for the already-started metadata import to settle before closing SQLite. Runtime Host, Desktop, and CLI shutdown paths await that completion, so owner teardown cannot race the import.

Evidence

Coverage includes closed catalog and handler composition, bootstrap-versus-ready dispatch, two real Clients racing one Session, response loss followed by Host restart, same-millisecond ordering, malformed durable graphs, a real Store that commits an admission and then throws, and a real JSONL-to-SQLite import immediately followed by close.

Storage passes 443 tests with one existing Windows-only skip; Runtime Host passes all 72 tests. The full workspace typecheck, affected Biome checks, and git diff --check also pass.

Scope

This foundation intentionally does not add Message, canonical projection, continuity, Interaction, automation/goal ownership, production surface wiring, or the M4 stale-Host activation gate. Those remain in their owning slices after this prerequisite.

Part of #1167. Related to #853.

简体中文

背景

本 PR 建立 Runtime Host Session core 迁移所需的 protocol/dispatcher 与 root-admission foundation，整体由 #1167 跟踪。

Runtime Host 仍未进入 production serving，本 PR 不切换 Desktop、TUI、CLI 或 Headless 的任何入口。

改动内容

封闭 operation protocol

• 将 operation catalog 拆成带有精确 input、output、error、lifecycle availability 与 command/query 契约的 typed domain specification。
• request、response 与 handler outcome 共用同一份封闭 catalog 解码。未知 operation、未声明 error、多余字段、畸形 handler outcome，以及缺失或重复的 handler composition 都会 fail closed。
• host.status 在 bootstrap/recovery 阶段仍可使用；仅 ready 可用的 operation 继续返回已有的 typed host_not_ready failure。
• 删除没有消费者和恢复契约的 retry/admission 元数据，不保留空语义字段。Kernel 只消费真正影响行为的 lifecycle availability 与 command mode。
• wire protocol 保持未发布的 v0；当前还不存在 production compatibility surface。

Root admission authority

• 提取共享的 SessionAdmissionGate：同一个 Session 的 operation 串行执行，不同 Session 之间保持独立。
• 每条 durable root-Turn admission 显式记录 previousRootTurnId。恢复时根据 predecessor fact 重建唯一线性链，不再根据时间戳推断顺序；missing predecessor、multiple roots、branch 和 disconnected cycle 都会被拒绝。
• RootAdmissionOwner 成为单个 Host Epoch 内 recovered admission identity 与当前 chain tip 的唯一 owner。只有 Store 返回有效 durable result 后才推进 tip。
• 如果 durable write 可能已经 commit、但随后报告失败，则在本 Host Epoch 内 poison 该 Session。已经排队的 successor 会在触碰 Store 前失败；新 Host Epoch 再从磁盘恢复 canonical chain。这样可以避免沿 stale tip 写出 sibling admission，也无需引入通用恢复机制。

实验性的 root-admission 持久记录因 predecessor fact 升至 schema version 2。它是存储记录 schema，与 v0 wire protocol 相互独立；非生产状态不增加兼容层。

Session Store 关闭完成语义

#1373 将 Session metadata 迁移到 SQLite 后，SessionStore.close() 改为异步且幂等：它会先等待已经启动的 metadata import settle，再关闭 SQLite。Runtime Host、Desktop 与 CLI 的 shutdown 路径都会等待该 completion，避免 owner teardown 与 import 竞态。

验证证据

覆盖范围包括封闭 catalog 与 handler composition、bootstrap/ready dispatch、两个真实 Client 竞争同一个 Session、response 丢失后重启 Host、同毫秒顺序、畸形 durable graph、真实 Store 先 commit admission 再抛错，以及真实 JSONL-to-SQLite import 后立即 close。

Storage 通过 443 项测试，另有 1 项既有 Windows-only skip；Runtime Host 72 项全部通过。全 workspace typecheck、受影响文件的 Biome check 与 git diff --check 也均通过。

范围

本 foundation 刻意不加入 Message、canonical projection、continuity、Interaction、automation/goal ownership、production surface wiring 或 M4 stale-Host activation gate。这些内容会在该前置合并后，随各自所属 slice 推进。

属于 #1167；关联 #853。

[likun666661]

Reviewed the protocol/dispatcher and root-admission changes.

The closed operation catalog now consistently validates requests, responses, declared errors, and handler composition, while lifecycle availability is enforced during recovery. The SessionAdmissionGate, explicit predecessor chain, and RootAdmissionOwner establish a coherent per-session serialization and fail-closed recovery model, including ambiguous post-commit failures.

The change remains properly scoped to non-serving foundation work. CI is green, and the targeted Storage and Runtime Host tests cover concurrency, restart recovery, malformed durable graphs, and response-loss retry semantics.

I found no blocking issues. Approved.

[M4n5ter]

English

Context

This PR establishes the protocol/dispatcher and root-admission foundation required by the Runtime Host Session-core migration tracked in #1167.

The Host is still non-serving in production; this PR does not switch any Desktop, TUI, CLI, or Headless entrypoint.

What changes

Closed operation protocol

• Split the operation catalog into typed domain specifications with exact input, output, error, lifecycle-availability, and command/query contracts.
• Decode requests, responses, and handler outcomes against the same closed catalog. Unknown operations, undeclared errors, extra fields, malformed handler outcomes, and incomplete or duplicate handler composition fail closed.
• Keep host.status available during bootstrap/recovery while ready-only operations return the existing typed host_not_ready failure.
• Remove the unused retry/admission metadata instead of carrying fields with no consumer or recovery contract. The Kernel now consumes only the lifecycle availability and command mode that affect behavior.
• Keep the unreleased wire protocol at v0; there is no production compatibility surface yet.

Root admission authority

• Extract a shared SessionAdmissionGate: operations for one Session serialize, while different Sessions remain independent.
• Give each durable root-Turn admission an explicit previousRootTurnId. Recovery reconstructs one linear chain from predecessor facts instead of inferring order from timestamps, and rejects missing predecessors, multiple roots, branches, or disconnected cycles.
• Make RootAdmissionOwner the single in-Epoch owner of recovered admission identity and the current chain tip. It advances only after the Store returns a valid durable result.
• If a durable write may have committed before reporting failure, poison that Session for the rest of the Host Epoch. Queued successors fail before touching the Store; a new Host Epoch recovers the canonical chain from disk. This avoids extending a stale tip into sibling admissions without introducing a general recovery mechanism.

The experimental root-admission record moves to schema version 2 for the predecessor fact. This is a storage-record schema, separate from the v0 wire protocol, and no compatibility layer is added for non-production state.

Session-store shutdown completion

After the SQLite Session metadata migration in #1373, SessionStore.close() is asynchronous and idempotent: it waits for the already-started metadata import to settle before closing SQLite. Runtime Host, Desktop, and CLI shutdown paths await that completion, so owner teardown cannot race the import.

Evidence

Coverage includes closed catalog and handler composition, bootstrap-versus-ready dispatch, two real Clients racing one Session, response loss followed by Host restart, same-millisecond ordering, malformed durable graphs, a real Store that commits an admission and then throws, and a real JSONL-to-SQLite import immediately followed by close.

Storage passes 443 tests with one existing Windows-only skip; Runtime Host passes all 72 tests. The full workspace typecheck, affected Biome checks, and git diff --check also pass.

Scope

This foundation intentionally does not add Message, canonical projection, continuity, Interaction, automation/goal ownership, production surface wiring, or the M4 stale-Host activation gate. Those remain in their owning slices after this prerequisite.

Part of #1167. Related to #853.

简体中文

背景

本 PR 建立 Runtime Host Session core 迁移所需的 protocol/dispatcher 与 root-admission foundation，整体由 #1167 跟踪。

Runtime Host 仍未进入 production serving，本 PR 不切换 Desktop、TUI、CLI 或 Headless 的任何入口。

改动内容

封闭 operation protocol

• 将 operation catalog 拆成带有精确 input、output、error、lifecycle availability 与 command/query 契约的 typed domain specification。
• request、response 与 handler outcome 共用同一份封闭 catalog 解码。未知 operation、未声明 error、多余字段、畸形 handler outcome，以及缺失或重复的 handler composition 都会 fail closed。
• host.status 在 bootstrap/recovery 阶段仍可使用；仅 ready 可用的 operation 继续返回已有的 typed host_not_ready failure。
• 删除没有消费者和恢复契约的 retry/admission 元数据，不保留空语义字段。Kernel 只消费真正影响行为的 lifecycle availability 与 command mode。
• wire protocol 保持未发布的 v0；当前还不存在 production compatibility surface。

Root admission authority

• 提取共享的 SessionAdmissionGate：同一个 Session 的 operation 串行执行，不同 Session 之间保持独立。
• 每条 durable root-Turn admission 显式记录 previousRootTurnId。恢复时根据 predecessor fact 重建唯一线性链，不再根据时间戳推断顺序；missing predecessor、multiple roots、branch 和 disconnected cycle 都会被拒绝。
• RootAdmissionOwner 成为单个 Host Epoch 内 recovered admission identity 与当前 chain tip 的唯一 owner。只有 Store 返回有效 durable result 后才推进 tip。
• 如果 durable write 可能已经 commit、但随后报告失败，则在本 Host Epoch 内 poison 该 Session。已经排队的 successor 会在触碰 Store 前失败；新 Host Epoch 再从磁盘恢复 canonical chain。这样可以避免沿 stale tip 写出 sibling admission，也无需引入通用恢复机制。

实验性的 root-admission 持久记录因 predecessor fact 升至 schema version 2。它是存储记录 schema，与 v0 wire protocol 相互独立；非生产状态不增加兼容层。

Session Store 关闭完成语义

#1373 将 Session metadata 迁移到 SQLite 后，SessionStore.close() 改为异步且幂等：它会先等待已经启动的 metadata import settle，再关闭 SQLite。Runtime Host、Desktop 与 CLI 的 shutdown 路径都会等待该 completion，避免 owner teardown 与 import 竞态。

验证证据

覆盖范围包括封闭 catalog 与 handler composition、bootstrap/ready dispatch、两个真实 Client 竞争同一个 Session、response 丢失后重启 Host、同毫秒顺序、畸形 durable graph、真实 Store 先 commit admission 再抛错，以及真实 JSONL-to-SQLite import 后立即 close。

Storage 通过 443 项测试，另有 1 项既有 Windows-only skip；Runtime Host 72 项全部通过。全 workspace typecheck、受影响文件的 Biome check 与 git diff --check 也均通过。

范围

本 foundation 刻意不加入 Message、canonical projection、continuity、Interaction、automation/goal ownership、production surface wiring 或 M4 stale-Host activation gate。这些内容会在该前置合并后，随各自所属 slice 推进。

属于 #1167；关联 #853。

[likun666661]

Reviewed the protocol/dispatcher and root-admission changes.

The closed operation catalog now consistently validates requests, responses, declared errors, and handler composition, while lifecycle availability is enforced during recovery. The SessionAdmissionGate, explicit predecessor chain, and RootAdmissionOwner establish a coherent per-session serialization and fail-closed recovery model, including ambiguous post-commit failures.

The change remains properly scoped to non-serving foundation work. CI is green, and the targeted Storage and Runtime Host tests cover concurrency, restart recovery, malformed durable graphs, and response-loss retry semantics.

I found no blocking issues. Approved.