feat: durable message lifecycle from admission to execution - #3721

Summary

This is the first end-to-end durable message lifecycle PR built from main, replacing Draft PR #3633 without cherry-picking or continuing its patch series.

The contract is simple: once turn.message.submit accepts a message, a Host crash must not lose it, revive it after settlement, or execute it twice.

submit
  |
  v
Accepted (draft; admission authority only)
  +-- retract / Stop before handoff --> Cancelled (no history)
  |
  +-- durable root-source or steering proof
        |
        v
      atomic transcript materialization + HandedOff
        +-- terminal Stop -------------> Cancelled (history retained)
        |
        +-- downstream provider-request proof --> Executed

These are durable classifications, not an independent provider state machine. queued, leased, and in_flight remain reconstructible Host-memory projections.

First-principles ownership

• message_admissions is the sole durable authority for an accepted draft, including canonical content, edit, reorder, promotion, retract, and lifecycle classification.
• Accepted queued messages do not appear in transcript or catalog preview. Retracting one therefore only settles it as Cancelled; no append-only history must be deleted or repaired.
• RootAdmissionOwner owns the durable Root execution contract and source-message proof.
• One SQLite handoff operation materializes canonical transcript rows in final execution order and advances Accepted -> HandedOff in the same transaction.
• An immediately admitted root already has transcript identity from the atomic Root admission composition; handoff validates that exact row and advances lifecycle without creating a duplicate.
• A multi-message successor has userMessageId = null and keeps its individual sourceMessages; Runtime does not invent an aggregate transcript message.
• HostMessageCoordinator owns only the reconstructible queue projection and the shared proof classifier/settlement path. Normal completion and restart recovery call the same owner.
• Executed requires a provider-request proof downstream of the admitted Root contract.
• Durable Session capability binding is derived from the durable Root execution contract, not a restart-volatile marker.
• RuntimeKernel no longer owns queue state, leasing, folding, retract, fallback authority, or a second root-message materialization path.

Crash-cut behavior

1. Before canonical admission: no accepted message or transcript row exists.
2. After queued admission, before handoff proof: exactly one Accepted draft exists and transcript has zero rows for it.
3. After Root admission, before activation: the durable Root contract proves exact source identities; handoff materializes each source once under the target Turn.
4. After handoff: recovery sees HandedOff plus its transcript identity and never puts it back in the queue.
5. After a downstream provider request: recovery settles Executed and never replays it.
6. A retract or interrupt before handoff settles Cancelled without history. Terminal cancellation after handoff retains history.

Scope

Included: atomic admission/root transcript composition, canonical Skill admission, edit/reorder/promotion/retract, ordered successor handoff, proof-driven settlement, restart recovery, size boundaries, durable capability derivation, and removal of old Runtime queue/transcript authority.

Excluded: CLI/Desktop projection refactors and Side Conversation UI/hooks.

Verification

Only affected tests were run locally; the full repository suite was not run locally.

• Exact pushed head: 48b162326.
• Builds passed: @maka/storage and @maka/runtime-host.
• SQLite metadata tests: 53 passed.
• SQLite SessionStore tests: 22 passed.
• Root coordinator tests: 50 passed.
• Canonical projection, message coordinator, real Runtime Host/UDS message and queue suites passed.
• Fault coverage includes canonical Skill failure before Root admission, real SQLite reorder plus restart, Accepted-draft retract and interrupt with zero transcript rows, queue-admission Host crash, admitted Root without a Run, ordered multi-source successor handoff, immediate-root transcript validation, and transcript de-duplication.
• Exact-head CI run 32806065640 passed, including Runtime Host tests and installed CLI release-candidate validation.

Review follow-up

• Fixed real reorder permutations by validating identity membership and persisting the requested order transactionally.
• Removed the doubled raw/prepared admission envelope; durable admission stores one canonical content value plus the submitted digest.
• Moved Skill preparation and rejection ahead of admission, closing raw /skill replay and rejected phantom-history paths.
• Removed eager Accepted transcript/catalog mirroring and the separate transcript-rebind operation.
• Collapsed transcript materialization and HandedOff into one SQLite transaction owned by the proof-driven lifecycle settlement path.

AI use

This PR was implemented with Codex assistance. The design, repository decisions, code changes, affected-test selection, review of Draft PR #3633 as evidence, adversarial review, simplification audit, and verification were directed and checked against the repository's durable authorities and production composition.