refactor(runtime-host): establish durable host architecture

[M4n5ter]

English

Summary

This PR establishes Runtime Host as the single online owner of Runtime execution and its durable State Root.

• Replace central lifecycle wiring with Domain Modules that own handlers, recovery, drain, close, and connection cleanup.
• Introduce one Hosted Execution authority for root admission, identity, stop, terminal reconciliation, settlement, and restart recovery.
• Make Run Composition an immutable, auditable pre-dispatch contract for prompt, tools, policy, and provider options.
• Add durable Goal authority and make Session retirement remove Goal state atomically.
• Split context, interactive turn, turn control, Goal execution, and Agent Graph execution out of the Root Turn coordinator.
• Make Host composition identity explicit and fail deterministic incompatibility without repeated Candidate launches.

Architecture

• Host Kernel owns State Root ownership, transport, connection authority, residency, drain, and shutdown.
• Host Composition owns static assembly and phased lifecycle.
• Domain Modules own business handlers and resources.
• Hosted Execution owns root execution lifecycle.
• Run Composer owns the immutable provider-dispatch basis.

Architecture documents:

• Runtime Host architecture — English
• Runtime Host architecture — 简体中文

Integration cleanup

This branch also incorporates the Runtime Host work that landed while the refactor was in progress:

• Reconnects are pinned to Host Epoch and composition identity; only operation-spec queries can be replayed after connection loss.
• Client Capability owns provider trust and connection lifecycle; Automation recovery rechecks the durable provider prerequisite before dispatch.
• Graph Stop suppresses supervisor wakes, stops only the exact graph-owned Root Turn, then converges the graph driver and operators. Graph ownership follows effective Graph/Swarm orchestration, including safe-boundary continuations.
• Session retirement reconciles orphaned graph Sessions before recovery snapshots and drains accepted cleanup before dependent stores close.
• CLI capability providers require the expected State Root and canonical Interactive composition identity.

Impact

• Runtime Host status and diagnostics expose canonical composition identity and actual Domain Module ownership.
• Desktop and CLI Clients use the canonical Candidate launch, reconnect, and mismatch contracts.
• Operational-state migration adds durable Goal authority through the existing SQLite migration path.
• Host restart, Session retirement, late execution settlement, and Client disconnect converge from durable facts.
• The central Root Turn coordinator is substantially smaller and no longer owns unrelated protocol responsibilities.

Validation

• npm test — all workspace tests passed on the latest origin/main
• Runtime — 3318 passed, 9 skipped
• Runtime Host — 839/839 passed
• npm run build
• npm run typecheck
• npm run lint
• npm run format:check
• git diff --check

The branch received parallel reviews across Host kernel and connection lifecycle, Hosted Execution, Domain coordinators, Run Composition, storage authority, reconnect behavior, Graph Stop integration, tests, and maintainability. Confirmed crash-recovery, retirement, close-order, composition-election, and test-reliability findings are included here.

Context

This is the consolidation PR for the Runtime Host direction tracked by #2522. It includes and aligns the work from #2591, #2603, #2618, #2625, and #2626.

简体中文

摘要

本 PR 将 Runtime Host 建立为 Runtime execution 及其 durable State Root 的唯一在线 owner。

• 用真正拥有 handlers、recovery、drain、close 与 connection cleanup 的 Domain Modules 取代中央 lifecycle wiring。
• 使用一套 Hosted Execution authority 统一 root admission、identity、stop、terminal reconciliation、settlement 与 restart recovery。
• 将 Run Composition 建立为覆盖 prompt、tools、policy 与 provider options 的 immutable、可审计 pre-dispatch contract。
• 增加 durable Goal authority，并让 Session retirement 原子删除 Goal state。
• 将 context、interactive turn、turn control、Goal execution 与 Agent Graph execution 从 Root Turn coordinator 中拆出。
• 显式固定 Host composition identity，并让确定性 incompatibility 直接失败，不再反复启动无法获胜的 Candidate。

架构

• Host Kernel 拥有 State Root ownership、transport、connection authority、residency、drain 与 shutdown。
• Host Composition 拥有静态装配与分阶段 lifecycle。
• Domain Modules 拥有业务 handlers 与 resources。
• Hosted Execution 拥有 root execution lifecycle。
• Run Composer 拥有 immutable provider-dispatch basis。

架构文档：

• Runtime Host architecture — English
• Runtime Host architecture — 简体中文

集成收口

本分支同时吸收并校正了重构期间合入的 Runtime Host 工作：

• Reconnect 固定 Host Epoch 与 composition identity；连接丢失后只有 operation spec 定义的 query 才允许 replay。
• Client Capability 统一拥有 provider trust 与 connection lifecycle；Automation recovery 在 dispatch 前重新检查 durable provider prerequisite。
• Graph Stop 先抑制 supervisor wakes，只停止属于该 graph 的 exact Root Turn，再收敛 graph driver 与 operators。Graph ownership 来自 effective Graph/Swarm orchestration，也覆盖 safe-boundary continuation。
• Session retirement 在捕获 recovery snapshot 前 reconcile orphaned graph Sessions，并在依赖 Store 关闭前 drain 已接收 cleanup。
• CLI capability provider 强制固定 expected State Root 与 canonical Interactive composition identity。

影响

• Runtime Host status 与 diagnostics 公开 canonical composition identity 和实际 Domain Module ownership。
• Desktop 与 CLI Clients 使用统一的 Candidate launch、reconnect 与 mismatch contracts。
• Operational-state migration 通过现有 SQLite migration path 增加 durable Goal authority。
• Host restart、Session retirement、late execution settlement 与 Client disconnect 从 durable facts 收敛。
• 中央 Root Turn coordinator 显著缩小，不再拥有无关的 protocol responsibilities。

验证

• npm test — 在最新 origin/main 上全部 workspace tests 通过
• Runtime — 3318 passed，9 skipped
• Runtime Host — 839/839 passed
• npm run build
• npm run typecheck
• npm run lint
• npm run format:check
• git diff --check

本分支并行审查了 Host kernel 与 connection lifecycle、Hosted Execution、Domain coordinators、Run Composition、storage authority、reconnect behavior、Graph Stop integration、tests 与 maintainability。确认的 crash recovery、retirement、close order、composition election 与 test reliability 问题均已纳入本 PR。

上下文

本 PR 是 #2522 Runtime Host 方向的整合 PR，并吸收、统一了 #2591、#2603、#2618、#2625 与 #2626 的工作。