core: establish the private canonical Program spine

[lemone112]

Root cause

The product had useful point-graph, occurrence, evaluator, and Session work split across a legacy recipe runtime and an unfinished second public Program root. Merging the stacked slices one by one would expose that second root before the terminal C7c cutover.

Cumulative outcome

This PR is the only merge candidate for the superseded #448–#461, #463, and #464 stack. Relative to main, it:

• establishes one crate-private canonical Program/Session spine for point occurrences;
• binds observations, output/viewing identities, constraints, joint finite selection, reports, certificates, ownership, and revision-safe emission;
• lowers the current recipe frontend one-way into that private spine without making it an extension point;
• hard-deletes the Pair taxonomy and unsupported Display P3 promises;
• keeps the incomplete Program unreachable from every public Rust path until terminal C7c;
• revokes outputs whenever the current owner/session lacks current Verified evidence;
• rejects alias-based public-surface escapes through compiler visibility plus resolved-rustdoc verification;
• preserves the existing adaptive runtime and its current public recipe frontend until its useful behavior is fully lowered and the frontend can be atomically deleted.

No public replacement API, compatibility layer, or new recipe variant is introduced.

Architectural invariants

• Core treats client identifiers as opaque.
• Source, target, paint, surface, occurrence, and observation are distinct physical concepts.
• Evaluation and selection are separate; successful emission requires current evidence.
• One Session generation owns each admitted result.
• Program remains crate-private; the legacy frontend remains the sole public root only until C7c.
• PairLabel/PairFill do not survive as hidden Program semantics.

RED → GREEN highlights

• stale output after owner/session handoff was characterized, then made impossible;
• use crate::program as staged; pub use staged::DraftV1 as ... bypassed the old text guard; crate-private items plus resolved-rustdoc origin tracing now reject it;
• empty finite joint order, incomplete evidence projection, identity mutation, observation revision drift, and second-solve invalidation have hostile coverage.

Verification

Exact head: dcd49435df1a0a07e20ac345d6488081e08119d7.

• all GitHub Actions checks pass, including Rust MSRV, fmt/clippy, workspace tests, docs, audit, Swift conformance, Linux WASM/headless Chrome/size, and Node 22 consumer floor;
• CodeRabbit approved every reviewed terminal slice and all review threads are resolved;
• resolved public inventory: 155 items, none originating in staged Program files;
• full cumulative diff is now intentionally reviewed against main; lower drafts will be closed as superseded after squash merge.

The exact WASM budget is bound to the canonical Linux artifact; the final visibility cut does not alter runtime bytes.

Summary by CodeRabbit

• Изменения API

  • Уточнена область доступности программных компонентов: внутренние элементы больше не отображаются как публичный API.
  • Обновлены проверки границ доступа и документации, чтобы предотвращать непреднамеренные публичные публикации.

• Проверки и качество

  • Добавлена автоматическая проверка сгенерированной документации на утечки внутренних компонентов.
  • Усилены тесты корректности staged-контрактов и обработки ошибок.

• Производительность

  • Обновлены контрольные данные и допустимый размер WASM-бандла.

[coderabbitai]

@lemone112 Thanks for the precise RED/GREEN evidence. I’ll review the exact-head alias/re-export regression fix, focusing on the rustdoc origin resolution and the crate-private visibility boundary.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/verify_program_public_surface.py`:
- Around line 129-160: Уточните сообщение RustdocShapeError в функции
program_public_surface() при source_links == 0: явно укажите, что не найден
compiler-emitted source link с ожидаемым классом rustdoc и возможна
несовместимость разметки или версии toolchain. Остальную проверку ссылок и
поведение функции не изменяйте.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8bb669f7-138d-4737-a5ab-af933f566b53

📥 Commits

Reviewing files that changed from the base of the PR and between a30d03d and 18cb0ff.

📒 Files selected for processing (7)

• .github/workflows/ci.yml
• crates/labcolors-core/src/generic_boundary_tests.rs
• crates/labcolors-core/src/program.rs
• packages/colors/bench/wasm.json
• scripts/check-wasm-size-budget.mjs
• scripts/test_program_public_surface.py
• scripts/verify_program_public_surface.py