Implement workspace evolution, migrations, and runtime continuity

Enable evolution by default for source-backed workspaces. Add stable
conformance ownership, semantic-major review, candidate typechecking,
and durable fenced cutover with explicit migrations and forward recovery.

Independently supervise package runtimes so unchanged resource owners keep
their processes and connections across cutover. Add scoped invocation
authority, resource sessions, and typed callback rebinding.

Wire opaque object references through generated bindings and RPCs. Add
canonical relationship sets, keyed maps, and ordered lists with scoped
transactional mutations, revision checks, and inverse consistency. Support
planned cascade deletion, protection, tombstones, and lifecycle foundations.

Add journaled structural edits, package/function/migration scaffolding,
managed repository creation, and resumable bottom-up dependency pin
publication. Document lifetime boundaries, revision pinning, prototype
compatibility policy, commands, and deferred work.

Validate with 210 tests, user-systemd process/connection continuity,
generated-package TypeScript checks, and Nix host/protocol checks.
TTL handoff, physical reclamation, general multi-step migrations, and
root-systemd migration isolation acceptance remain deferred.

test/bindings.test.mjs

@@ -1,15 +1,52 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import { referenceFromWire } from "../dist/references.js";
 import { bindQxHandler, decodeQxValue, encodeQxValue, jsToProtoValue, liveValue, protoValueToJs } from "../dist/index.js";
 const scalar = (name) => ({ kind: "scalar", name });
 const unit = { kind: "builtin", name: "unit" };
+test("typed sessions rebind ports and cancellation to each acquired invocation", async () => {
+  const first = new AbortController(), second = new AbortController();
+  let closed = false;
+  const context = (value, signal) => ({objectId: referenceFromWire("obj:owner"), inputProto: {}, signal,
+    state: () => ({live: async () => liveValue(jsToProtoValue(value))})});
+  const raw = {...context(1n, first.signal), openSession: async () => ({id: "session:test",
+    run: (work) => work(context(2n, second.signal)), close: async () => {closed = true;}})};
+  const handler = bindQxHandler({inputType: unit, outputType: unit, ports: {counter: {kind: "state", id: "counter", valueType: scalar("int64"), primitives: ["read"]}}}, async (bound) => {
+    assert.equal(bound.signal, first.signal);
+    const session = await bound.openSession();
+    await session.run(async (next) => {
+      assert.equal(next.signal, second.signal);
+      assert.equal(await next.ports.counter.get(), 2n);
+      assert.equal(next.openSession, undefined);
+    });
+    await session.close();
+  }, {});
+  await handler(raw);
+  assert.equal(closed, true);
+});
 test("binding codecs round trip nested bytes, 64-bit integers, nulls, and references", () => {
   const values = [[scalar("int64"), -(2n ** 63n)], [scalar("uint64"), 2n ** 64n - 1n],
     [scalar("bytes"), new Uint8Array([0, 255])],
     [{ kind: "list", value: { kind: "optional", value: scalar("int64") } }, [null, 2n ** 60n]],
-    [{ kind: "object-ref", expectation: { kind: "atom", atomId: "thing" } }, "obj:thing"]];
+    [{ kind: "object-ref", expectation: { kind: "atom", atomId: "thing" } }, referenceFromWire("obj:thing")]];
   for (const [type, value] of values) assert.deepEqual(decodeQxValue(type, encodeQxValue(type, value, {}), {}), value);
 });
+
+test("opaque references pass declared RPC boundaries but cannot enter ordinary data", () => {
+  const reference = referenceFromWire("obj:thing");
+  const type = {kind: "object-ref", expectation: {kind: "atom", atomId: "thing"}};
+  const roundtrip = decodeQxValue(type, encodeQxValue(type, reference, {}), {});
+  assert.equal(reference.equals(roundtrip), true);
+  assert.equal(reference.equals(referenceFromWire("obj:other")), false);
+  assert.throws(() => JSON.stringify({nested: [reference]}), /cannot be serialized/);
+  assert.throws(() => String(reference), /cannot be coerced/);
+  assert.throws(() => encodeQxValue(type, "obj:thing", {}), /opaque/);
+  assert.throws(() => encodeQxValue(scalar("string"), reference, {}), /Managed references/);
+  const message = {kind: "message", descriptorId: "Payload"};
+  assert.throws(() => encodeQxValue(message, {nested: reference}, {Payload: {encode: jsToProtoValue}}), /Managed references/);
+  assert.throws(() => encodeQxValue(message, {}, {Payload: {encode: () => jsToProtoValue(reference)}}), /Managed references/);
+  assert.throws(() => decodeQxValue(message, jsToProtoValue(reference), {Payload: {decode: () => ({})}}), /Managed references/);
+});
 test("typed state and interface ports preserve declared values and exact operation IDs", async () => {
   const spec = { inputType: scalar("int64"), outputType: scalar("bytes"), ports: {
     data: { kind: "state", id: "state-id", valueType: scalar("int64"), primitives: ["read", "write"] },

test/invocations.test.mjs

@@ -0,0 +1,15 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createInvocationRegistry } from "../dist/invocations.js";
+
+test("cancel requests do not acknowledge execution completion or allow replay", () => {
+  const registry = createInvocationRegistry();
+  const execution = registry.begin("call-1");
+  assert.equal(registry.cancel("call-1").state, "cancellation-requested");
+  assert.equal(execution.signal.aborted, true);
+  assert.equal(registry.status("call-1").state, "cancellation-requested");
+  execution.finish();
+  assert.equal(registry.status("call-1").state, "completed");
+  assert.throws(() => registry.begin("call-1"), /already used/);
+  assert.equal(registry.status("missing").state, "unknown");
+});

test/migration.test.mjs

@@ -0,0 +1,24 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {createMigrationContext, migrationObjectId} from "../dist/migration.js";
+test("migration context offers restricted ports and deterministic helper identities", () => {
+  const input = {schemaVersion: 1, executionId: "operation:transition", exportId: "migrate", ports: [
+    {name: "old", binding: "slot:name", view: "old", access: ["read"], states: [{objectId: "obj:one", value: "Alice"}]},
+    {name: "new", binding: "slot:name", view: "new", access: ["write"]}, {name: "newRead", binding: "slot:name", view: "new", access: ["read"]},
+    {name: "helpers", binding: "atom:helper", view: "new", access: ["create"]},
+  ]};
+  const {context, result} = createMigrationContext(input);
+  assert.equal(context.read("old", "obj:one"), "Alice");
+  assert.throws(() => context.write("old", "obj:one", "Bob"), /does not grant/);
+  assert.throws(() => context.read("new", "obj:one"), /does not grant/);
+  context.write("new", "obj:one", "Alice");
+  assert.equal(context.read("newRead", "obj:one"), "Alice");
+  context.write("new", "obj:one", "Bob");
+  assert.equal(context.read("newRead", "obj:one"), "Bob");
+  assert.equal(context.read("old", "obj:one"), "Alice");
+  const helper = context.create("helpers", "one");
+  assert.equal(helper, migrationObjectId(input.executionId, "helpers", "one"));
+  assert.equal(context.create("helpers", "one"), helper);
+  assert.equal(result().creates.length, 1);
+  assert.deepEqual(input.ports[0].states, [{objectId: "obj:one", value: "Alice"}]);
+});

test/relationships.test.mjs

@@ -0,0 +1,27 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {relationshipMap, relationshipList, relationshipSet} from "../dist/index.js";
+import {referenceFromWire} from "../dist/references.js";
+test("relationship helpers preserve handles and require explicit collection revisions", async () => {
+  let current = {revision: 0n, entries: []}, serial = 0;
+  const port = {collection: async () => ({revision: current.revision, entries: current.entries.map((entry) => ({...entry}))}),
+    replace: async (entries, revision) => {
+      assert.equal(revision, current.revision);
+      current = {revision: revision + 1n, entries: entries.map((entry) => ({...entry, edgeId: entry.edgeId ?? `edge:${++serial}`}))};
+      return port.collection();
+    }};
+  const a = referenceFromWire("obj:a"), b = referenceFromWire("obj:b");
+  const map = relationshipMap(port);
+  await map.set("a1", a, 0n);
+  assert.equal((await map.get("a1")).value.equals(a), true);
+  await assert.rejects(() => map.set("b1", b, 0n), /STALE_COLLECTION/);
+  await map.delete("a1", 1n);
+  const list = relationshipList(port);
+  const inserted = await list.insert(0, a, 2n);
+  await list.insert(1, b, 3n);
+  const moved = await list.move(inserted.entries[0].edgeId, 1, 4n);
+  assert.equal(moved.entries[1].target.equals(a), true);
+  const set = relationshipSet(port);
+  const unchanged = await set.add(referenceFromWire("obj:a"), 5n);
+  assert.equal(unchanged.revision, 5n);
+});

test/runtime.test.mjs

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import http from "node:http";
 import test from "node:test";
+import { referenceFromWire } from "../dist/references.js";
 import { create } from "@bufbuild/protobuf";
 import { createClient } from "@connectrpc/connect";
 import { connectNodeAdapter, createConnectTransport } from "@connectrpc/connect-node";
@@ -45,12 +46,12 @@ const listen = async (routes) => {
 test("generic values preserve nested values and object references", () => {
   const value = jsToProtoValue({
     title: "A task",
-    target: { $quixosRef: "obj:target" },
+    target: referenceFromWire("obj:target"),
     tags: ["one", "two"],
   });
   assert.deepEqual(protoValueToJs(value), {
     title: "A task",
-    target: "obj:target",
+    target: referenceFromWire("obj:target"),
     tags: ["one", "two"],
   });
 });