feat(runtime-host): coordinate local owner transfer

[me2seeks]

Summary

Add the local-process owner-transfer transaction on top of #3767.

The transaction stages and verifies the exact target before durable intent, then holds the one deployment-authority lock across revision CAS, exact observed-Host cutover, State Root writer release, target activation, Ready verification, and owner commit. A retry re-observes reality: it can recognize the same transaction-scoped target after a caller crash, while post-retirement failures remain truthfully transferring instead of claiming rollback.

An active_work refusal is the only automatic rollback path, and its adapter contract guarantees retirement never began and the previous owner remains runnable. Target staging failures and stale owner confirmations do not retire a Host.

This PR deliberately adds no second deployment journal or lock, no PID/HostEpoch/version authority, no ordinary connectOrSpawn replacement policy, and no remote Client mutation path. Source-specific Desktop, installed CLI, and managed-service adapters remain separate follow-up slices because their launch and supervisor evidence genuinely differ.

Refs #3231
Refs #3709

简体中文摘要

在 #3767 的 durable owner record 之上增加本地进程 owner transfer transaction。

Transaction 先 stage 并验证精确 target，再用唯一的 deployment-authority lock 串行完成 revision CAS、精确 observed Host cutover、State Root writer 释放、target 启动、Ready 验证和 owner commit。Crash 后不会从 PID 或 HostEpoch 续跑，而是重新观察现实；如果本次 transaction 的精确 target 已经在运行，则只重验 Ready 并 commit，不会重复 retirement 或 launch。

只有 Host 因 active work 拒绝、且 adapter 保证 retirement 尚未开始时，才自动恢复旧 owner。Staging 失败或 stale confirmation 都不会 retirement Host。

本 PR 不增加第二份 deployment journal 或第二把 authority lock，不把 version/epoch 当 owner，不把 replacement policy 塞回普通 connectOrSpawn，也不允许 remote Client 修改 Host。Desktop、installed CLI 与 managed service 的 adapter 因 launch/supervisor 证据不同，留作独立后续切片。

Review focus

• Rebased onto the feat(runtime-host): add durable local deployment ownership #3767 merge commit daa5c69a6; the diff against main now contains only the transfer transaction.
• Verify that adapter implementations can prove target_present with a transaction-scoped launch fence or managed deployment evidence, never version alone.
• Verify lock ordering remains owner authority first, then any source-specific supervisor/deployment lock.

Verification

• Current-main @maka/core and @maka/storage builds — passed.
• Focused TypeScript compilation — passed.
• Focused owner and transfer suites — 28 passed, 0 failed.
• Scoped Biome and git diff --check — passed.
• Fresh hosted CI is running on the rebased head.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex designed and implemented the transaction seam, recovery semantics, and tests under user direction. The commit includes a Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

Update on dd4756a89d:

No blocking issues. The delta since 9323f816 limits to account-local authority resolution, descriptor-safe record reads, temp cleanup, and fsynced private directories; transfer state machine unchanged.

Checks on dd4756a89d — code GO.

简体中文

该头未发现阻断。

[me2seeks]

Rebased this dependent change onto #3767 head 3b0a50b62; new head is ba6944d4b.

The durability review on #3767 also exposed a dependent recovery issue here. Recovery now replays the exact begin_transfer / commit_transfer transition instead of treating read + match as proof that a namespace mutation is durable. The already-committed entry path also calls apply, so it must pass the same idempotent unchanged durability barrier before returning completed.

A fault-injection regression covers commit-directory-sync failure followed by a failed confirmation barrier and a later successful recovery. Combined owner/transfer focused tests pass 27/27 locally. The native focused jobs are green on Windows and macOS.

The Linux test failure is the same current-main #3784 compile regression documented on #3767, not an increment introduced here.

简体中文

已重基到 #3767 最新 head。恢复流程不再用 read + match 代替持久化确认，而是重放精确 transition；即使已经看到目标 owner，也必须通过同一个 unchanged durability barrier 才返回完成。故障注入回归已覆盖，合并 focused tests 为 27/27，Windows/macOS 原生门禁均绿色。

Generated-by: Codex

[Astro-Han]

I reviewed this head and found no blocking issues.

Transfer correctly holds deployment-authority lock across begin/CAS, cutover, writer release, activation, Ready verification and commit; commit-unknown paths replay via re-observation and keep transferring on any phase failure; rollback only for active_work when adapter guarantees retirement has not started.

No P0-P3 actionable; hosted test and owner checks are SUCCESS on this head.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 45b27f9, no P0-P3, hosted checks SUCCESS.