Implement workspace evolution, migrations, and runtime continuity

Enable evolution by default for source-backed workspaces. Add stable
conformance ownership, semantic-major review, candidate typechecking,
and durable fenced cutover with explicit migrations and forward recovery.

Independently supervise package runtimes so unchanged resource owners keep
their processes and connections across cutover. Add scoped invocation
authority, resource sessions, and typed callback rebinding.

Wire opaque object references through generated bindings and RPCs. Add
canonical relationship sets, keyed maps, and ordered lists with scoped
transactional mutations, revision checks, and inverse consistency. Support
planned cascade deletion, protection, tombstones, and lifecycle foundations.

Add journaled structural edits, package/function/migration scaffolding,
managed repository creation, and resumable bottom-up dependency pin
publication. Document lifetime boundaries, revision pinning, prototype
compatibility policy, commands, and deferred work.

Validate with 210 tests, user-systemd process/connection continuity,
generated-package TypeScript checks, and Nix host/protocol checks.
TTL handoff, physical reclamation, general multi-step migrations, and
root-systemd migration isolation acceptance remain deferred.

test/evolution.test.ts

@@ -0,0 +1,98 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { capabilityId as id, valueType, validateWorkspaceRevision } from "../src/capability-model/index.js";
+import { contentDigest, planEvolution, runtimeContracts, storageContracts } from "../src/capability-model/evolution.js";
+import { capabilityFixtureSource, capabilityResourceSources, compileCapabilityFixture, makeValidCapabilityWorkspace } from "./fixtures/capability-model.js";
+
+test("QX carries stable conformance IDs and implementation semantic majors", () => {
+  const result = compileCapabilityFixture({
+    workspace: capabilityFixtureSource.replace("conform Project as Named {", 'conform Project as Named id "conformance:project:named" semantic-major 3 {'),
+    todo: capabilityResourceSources.todo.replace('revision "package:todo-runtime@1" {', 'revision "package:todo-runtime@1" semantic-major 2 {'),
+  });
+  assert.ok(result.ok, JSON.stringify(result));
+  assert.equal(result.workspace.conformances[0]!.id, "conformance:project:named");
+  assert.equal(result.workspace.conformances[0]!.semanticMajor, 3);
+  assert.equal(result.workspace.packageImports[0]!.semanticMajor, 2);
+});
+
+test("invalid majors and duplicate owner identities are rejected", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  workspace.packageImports[0]!.semanticMajor = 0;
+  workspace.conformances[0]!.semanticMajor = 1.5;
+  workspace.conformances[0]!.id = id.conformance("same");
+  workspace.conformances[1]!.id = id.conformance("same");
+  const issues = validateWorkspaceRevision(workspace);
+  assert.equal(issues.filter((entry) => entry.code === "invalid-semantic-major").length, 2);
+  assert.ok(issues.some((entry) => entry.code === "duplicate-conformance-id"));
+});
+
+test("hashing is canonical and rejects values outside the persisted JSON contract", () => {
+  assert.equal(contentDigest({ z: 1, a: { y: 3, b: 2 } }), contentDigest({ a: { b: 2, y: 3 }, z: 1 }));
+  assert.notEqual(contentDigest([1, 2]), contentDigest([2, 1]));
+  assert.throws(() => contentDigest(NaN));
+  assert.throws(() => contentDigest(new Date()));
+});
+
+test("a workspace root change and display names do not restart package runtimes", () => {
+  const before = makeValidCapabilityWorkspace();
+  const after = structuredClone(before);
+  after.id = id.workspaceRevision("next");
+  after.sourceRootCommit = "f".repeat(40);
+  after.atoms[0]!.displayName = "Renamed";
+  after.sharedAttachments[0]!.displayName = "Renamed storage";
+  after.conformances.reverse();
+  after.interfaceImports.reverse();
+  const report = planEvolution(before, after, { allowLegacy: true });
+  assert.deepEqual(report.runtimeActions.map((entry) => entry.action), ["keep"]);
+  assert.deepEqual(report.storageChanges, []);
+  assert.deepEqual(report.packageChecks, []);
+});
+
+test("consumer changes preserve unrelated resource owners", () => {
+  const before = makeValidCapabilityWorkspace();
+  before.packageImports.push({ packageId: id.package("package:resource-owner"), revisionId: id.packageRevision("package:resource-owner@1"),
+    displayName: "ResourceOwner", source: { repository: "https://example.org/owner.git", commit: "a".repeat(40) },
+    exports: [{ kind: "function", id: id.packageExport("export:owner:ping"), displayName: "ping", inputType: valueType.unit, outputType: valueType.unit, dependencyPorts: [] }] });
+  const after = structuredClone(before);
+  after.packageImports[0]!.source.commit = "e".repeat(40);
+  const actions = planEvolution(before, after, { allowLegacy: true }).runtimeActions;
+  assert.equal(actions.find((entry) => entry.groupId === "package:resource-owner")!.action, "keep");
+  assert.equal(actions.find((entry) => entry.groupId === "package:todo-runtime")!.action, "replace");
+});
+
+test("storage defaults and ownership changes invalidate consumers without requiring a major", () => {
+  const before = makeValidCapabilityWorkspace();
+  const after = structuredClone(before);
+  const slot = after.sharedAttachments[0]!;
+  assert.equal(slot.kind, "state");
+  if (slot.kind === "state") slot.defaultValue = "Different default";
+  const report = planEvolution(before, after, { allowLegacy: true });
+  assert.equal(report.storageChanges.length, 1);
+  assert.equal(report.runtimeActions[0]!.action, "replace");
+  assert.deepEqual(report.reviews, []);
+  assert.notDeepEqual(storageContracts(before), storageContracts(after));
+});
+
+test("semantic review receipts cover exact consumer/provider contracts", () => {
+  const before = makeValidCapabilityWorkspace();
+  before.conformances[0]!.id = id.conformance("conformance:project:named");
+  const after = structuredClone(before);
+  after.conformances[0]!.semanticMajor = 2;
+  const report = planEvolution(before, after, { allowLegacy: true });
+  assert.equal(report.reviews.length, 1);
+  assert.equal(report.reviews[0]!.accepted, false);
+  const receipt = { requirementDigest: report.reviews[0]!.requirementDigest, decision: "accepted-unchanged" as const,
+    rationale: "Reviewed the semantic change against summary behavior", agentId: "workspace-agent" };
+  assert.equal(planEvolution(before, after, { allowLegacy: true, reviews: [receipt] }).reviews[0]!.accepted, true);
+  after.packageImports[0]!.source.commit = "f".repeat(40);
+  assert.equal(planEvolution(before, after, { allowLegacy: true, reviews: [receipt] }).reviews[0]!.accepted, false);
+});
+
+test("evolution enrollment is explicit and never erases legacy ownership", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  const report = planEvolution(workspace, workspace);
+  assert.ok(report.blockers.some((entry) => entry.includes("workspace-shared")));
+  assert.ok(report.blockers.some((entry) => entry.includes("authored ID")));
+  assert.equal(runtimeContracts(workspace).length, 1);
+  assert.throws(() => planEvolution(workspace, { ...workspace, workspaceId: id.workspace("other") }), /different workspace/);
+});