Promote Host Coordinator + Runtime Supervisor + attached runsc as the product
architecture in the specification, and extend the TLA+ model with generation-scoped
identities, multi-role durable intent, network readiness, prepared-lower lease, and
connectivity-helper ownership. TLC-checked; trim product prose that the model now owns.
Add a TLC-checked invariant requiring any Host Coordinator process record to belong to a non-absent, lock-held Domain. Include the invariant in the aggregate safety operator and remove journal-only markers from protocol model comments so the model remains grounded in product vocabulary.
Add SessionCoordinatorPresent aliases, HC protocol-face naming, and abstract
durable intent/path-mismatch refuse invariants for FM1/FM4/FM5. TLC green at
395837 generated / 110013 distinct / depth 49.
- Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`.
- Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths.
- Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery.
- Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
Overhaul the architectural specification (specification.md) and reorganize
the developer journals to incorporate the new Domain Anchor model. This scopes
sandbox container names, lockfiles, control sockets, and State Anchor persistent
overlay filesystem layers to unique (agent, workspace) hash pairings.
- Add Domain Anchor and Domain Root definitions to glossary and expansion tokens.
- Specify the Ephemeral Session Coordinator pattern with hold-to-bind locking.
- Document Git Sentry nested read-only mount layout replacing the legacy Git Shadow.
- Renamed and reorganized research sub-journals, embedding executable Python logic in-place.
- Include `redb` for embedded transactional state.
