Make workspace authoring converge through immutable Nix candidates

Coordinate registered resource edits bottom-up into retained exact remote sources.
Use one Nix-owned source graph for provisional checking, template publication,
explicit baseline upgrades and host activation; retain independent runtime pins.

Add scoped contract inspection, historical recovery, derived worklists, crash-safe
locks, named dependency adoption and plain-QX structural editing. Repair TODO
ownership and template instantiation, and document the supported agent workflow.

Validated with protocol and command suites, real jj/Nix convergence and cache
checks, TS/React installed-command acceptance, and fresh TODO first-edit acceptance.
No live deployment or public publication performed. Props projection generation
and a one-command rich feature generator remain explicitly outside this delivery.

test/authoring-worklist.test.ts

@@ -0,0 +1,45 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import {execFile as callback} from "node:child_process";
+import {promisify} from "node:util";
+import {authoringWorklist} from "../src/capability-language/authoring-worklist.js";
+import {checkRecordName} from "../src/capability-language/authoring-check.js";
+import {checkerIdentity, snapshotCommit} from "../src/capability-language/checked-build.js";
+const execFile = promisify(callback);
+
+test("worklist grows and clears from current source, dependency and checker observations", async context => {
+  const workbench = await fs.mkdtemp(path.join(os.tmpdir(), "qx-worklist-test-"));
+  context.after(() => fs.rm(workbench, {recursive: true, force: true}));
+  const root = path.join(workbench, "root"), provider = path.join(workbench, "resources/Base");
+  await fs.mkdir(root); await fs.mkdir(provider, {recursive: true});
+  await fs.mkdir(path.join(workbench, ".quixos/checks"), {recursive: true});
+  const header = `quixos-lock version 1 { quixos source { repository "https://example.test/quixos"; commit "${"a".repeat(40)}"; }`;
+  for (const directory of [root, provider]) await execFile("jj", ["git", "init", "--colocate", directory]);
+  await fs.writeFile(path.join(provider, "interface.qx"), 'interface Base id "interface:base" revision "interface:base@1" {}');
+  await fs.writeFile(path.join(provider, "quixos.lock"), `${header} }`);
+  const baseCommit = await snapshotCommit(provider);
+  await fs.writeFile(path.join(root, "workspace.qx"), `workspace Test id "workspace:test" revision "workspace:test@1" commit "${"b".repeat(40)}" { import interface Base; }`);
+  await fs.writeFile(path.join(root, "quixos.lock"), `${header} interface Base source { repository "https://example.test/base"; commit "${baseCommit}"; } }`);
+  const rootCommit = await snapshotCommit(root);
+  await fs.writeFile(path.join(workbench, ".quixos/resource-graph.json"), JSON.stringify({resources: [
+    {kind: "interface", directory: provider, source: {resolver: "git", repository: "https://example.test/base", commit: baseCommit}},
+  ]}));
+  assert.equal((await authoringWorklist(workbench)).worklist.filter(entry => entry.phase === "unchecked").length, 2);
+  const remember = (directory: string, commit: string, checker = checkerIdentity()) => fs.writeFile(
+    path.join(workbench, ".quixos/checks", checkRecordName(directory)), JSON.stringify({commit, checker, phase: "checked", blockers: []}));
+  await remember("root", rootCommit); await remember("resources/Base", baseCommit);
+  assert.deepEqual((await authoringWorklist(workbench)).worklist, []);
+  await fs.writeFile(path.join(provider, "interface.qx"), "interface broken {{{");
+  const broken = await authoringWorklist(workbench);
+  assert.ok(broken.worklist.some(entry => entry.directory === "resources/Base" && entry.phase === "syntax" && /historical/.test(entry.message)));
+  assert.ok(broken.worklist.some(entry => entry.directory === "root" && entry.phase === "dependency"));
+  await fs.writeFile(path.join(provider, "interface.qx"), 'interface Base id "interface:base" revision "interface:base@1" {}');
+  assert.deepEqual((await authoringWorklist(workbench)).worklist, []);
+  await remember("resources/Base", baseCommit, "old-checker");
+  assert.ok((await authoringWorklist(workbench)).worklist.some(entry => /checker changed/.test(entry.message)));
+  await fs.writeFile(path.join(workbench, ".quixos/checks", checkRecordName("resources/Base")), JSON.stringify({phase: "publication", blockers: ["source retention unavailable"]}));
+  assert.ok((await authoringWorklist(workbench)).worklist.some(entry => entry.phase === "publication" && /source retention/.test(entry.message)));
+});