Enforce durable state facet ownership

[bigboateng]

Summary

• classify every durable state field as installation, program, control, or product state
• define kernel-owned read and write policies for every transition class
• reject native, repository-program, and recovery commits that change an unowned facet
• bind changed facets into journals, receipts, events, and the public SDK

Control boundary

The kernel now checks:

ChangedFacets(before, after) ⊆ AllowedWriteFacets(transition)

Repository programs cannot grant themselves installation or program ownership. Recovery can replay only the facet set validated for the interrupted transition. New durable fields fail closed until they receive an explicit owner.

Verification

• 30 Python repository contract tests
• 204 complete sharded Go tests
• go test -race ./...
• go vet ./...
• go build ./...
• release-note validation
• git diff --check

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.98

The patch breaks compatibility with existing durable journals and can emit an inaccurate recovery fact. Model-level verification is recommended for recovery facet accuracy across every interruption point and reachability of recovery from previous-version pending states.

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.98

The facet enforcement is internally consistent for current-version transactions, but the durable protocol bump makes existing repositories' journals unreadable and can fail only after a new effect has occurred. Model-level verification is recommended before merge after fixing compatibility, specifically to check whether any new facet refusal can enter a recovery zero-progress cycle.