Stacked hard cut: shared observations and generic joint selection

[lemone112]

Non-mergeable stacked draft for #419

This PR remains intentionally draft and non-mergeable. It is an executable hard-cut stack, not terminal completion of #419; only the final integration head may land.

Current exact head: d4a5f38f4fa902ea22b5aefa6b6a7a88ec5862c9.

What this head changes

• Core now has exactly one revision-bound runtime owner: sealed, monomorphized Session<Plan> with Waiting | Ready | Stale | Failed.
• Point-support and generic Program are compiled plans under that runtime, not separate runtimes, adapters, aliases, or compatibility façades.
• CompiledProgram is reusable: it and every instantiated Session strongly share one immutable Rc<ProgramEpoch>; each Session owns independent fallibly-created bindings and workspace. There is no Weak, expiry branch, replace/dispose owner, or history chain.
• Session owns the immutable canonical observation schema and performs the only raw admission + lifecycle commit transaction.
• Verified/Violation evidence is sealed and must expose its observation. Before commit, Session checks exact stream, revision, and Rc backing identity; detached evidence fails atomically.
• Program evaluates every unique admitted physical case × every canonical constraint without violation short-circuiting. Reports are complete and case-major/constraint-ID ordered.
• Report-only violations do not block Ready; any hard violation withholds all outputs.
• Program outputs are authored emitted Paints, not visible composites, and are exposed only after the complete hard matrix passes.
• Point-support now uses the same Session contract, keeps prebound surface ordinals, releases validation scratch before later compile allocations, and zips prevalidated plan columns on execution.
• Structural gates reject a second Session owner and the removed PointSupportSession, ProgramExpired, ObservationStreamBinding, Weak, adapter, and client/UI vocabulary.

Client/Core boundary

PairFill, PairLabel, Glow, Material, Ladder, Primary, and Danger are client/Lab UI semantics. They do not belong in Core and receive no compatibility layer. Client declarations eventually lower once into generic Paints, Surfaces, Occurrences, observation domains, and typed constraints.

“All backgrounds” means every finite admitted/certified scenario in the declared domain. It never means an unobserved universe.

This Program slice is still explicitly encoded-sRGB8 point transport. It does not claim the final LCS observation/evidence model or the public C7c product cut.

Deliberate limits

• Fresh observed revisions allocate revision/report receipts; graph bindings/workspace are reused. This head does not claim whole-update zero allocation.
• Explicit cardinality and try_reserve paths map their own failures, but Rc::new, some compiler collections, and global allocator failure are not recoverable-OOM certification.
• No CPU/memory resource cap is invented; Implement: enforce one versioned resource profile across compiler, observations, joint reports and adapters #429 remains undated until real limits exist.
• Full ordinal-prebound appearance execution, one-time Paint materialization, and allocator-fallible lowering are a separate stacked performance change because they alter compiled IR.

Local validation for d4a5f38f4fa9…

• pinned Rust 1.85 formatting on the exact Rust allowlist — PASS;
• cargo clippy -p labcolors-core --all-targets --offline -- -D warnings — PASS;
• Core all-targets: 693 passed, 0 failed, 6 explicitly ignored; all four bench targets executed;
• Core doctests: 30 passed, 0 failed;
• rustdoc with -D warnings — PASS;
• cargo package plus packaged-crate verification — PASS (87 files);
• Program→Session tests: 12/12 PASS, including mixed hard/report-only × two-case complete matrix;
• independent point-support verifier — PASS;
• source-binding mutation suite: 5/5 PASS, 42 negative controls over 18 exact whole-file records;
• source closure: 2dba7f59bd0f8d665b79d3286527cc67a99d1dfe1f7604e6d19be3643e39ed5d;
• proof payload: 62871d3b874e4b4601c11db97f5ab73cd4e9781e462330bccda0d9dfdadcb5be;
• both release validators pin the exact 42 controls; local package-release verifier syntax — PASS.

Exact-head remote validation

• GitHub CI run 29942452152 — SUCCESS: MSRV, Core tests/proofs, docs/package-doctests, clippy/rustfmt, audit, WASM deterministic build/size, TypeScript/runtime tests, byte-exact npm artifact, headless Chrome;
• Native conformance run 29942452090 — SUCCESS: Swift 6.1.3 Linux conformance passed; the manual paid macOS lane was skipped by policy.

Submitted reviews: 0; inline/unresolved threads: 0. CodeRabbit skipped review because the PR remains draft, so no CodeRabbit review is claimed.

Refs #417 #419 #440 #441. Built on merged #447.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7eccbfa6-6a30-4ca3-af70-ff7f10ebb10b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/program-session-hard-cut

---

_{Comment @coderabbitai help to get the list of available commands.}

[lemone112]

Superseded by the reviewed cumulative squash merge #465 (24fd1f4). The lower stacked branch was intentionally not merged on its own because its intermediate head was not the safe terminal public boundary.