fix(runtime-host): recover legacy Root source messages

[Sun-GLiang]

Summary

• add an optional, shared proven-Root handoff contract for legacy source messages without message_admissions
• atomically materialize legacy transcript entries while preserving admission authority, cancellation checks, conflict rejection, and idempotency
• require exact Session/Turn/Run/Message Root receipt proof before Runtime Host recovery forwards fallback data
• cover legacy follow-up, steering, repeated startup, and missing-proof fail-closed recovery

Root cause

#3721 made message-admission proof mandatory during handoff. Older terminal Root admissions can still own source messages but have no corresponding message_admissions row, so startup recovery failed with Message admission does not exist before the Host became ready.

Verification

• npm --workspace @maka/storage run test: 970 passed, 16 skipped
• Runtime Host full suite with --test-concurrency=1: 1242 passed, 9 skipped
• npm run rebuild: passed
• npm run typecheck: passed
• npm run lint: passed
• npm run check:stale: passed

The default parallel Runtime Host invocation exposed an unrelated shared control-cache cleanup race (ENOTEMPTY / ENOENT) on two runs; the failing Host-kernel case passed in isolation, the serial full suite passed, and all #3902 recovery tests passed in every run.

A production Desktop/Host run against an adopted workspace copy reached ready and materialized both legacy messages exactly once with clean SQLite integrity. The real workspace was intentionally not started because one active durable Goal would auto-resume external work.

Closes #3902

[Astro-Han]

I reviewed this head and found blocking issues.

[P1] Recovered legacy input appended out-of-order

Missing legacy source inserted at MAX+1 regardless of its original Turn/time; forms [old outputs..., recovered user input] and corrupts catalog preview with stale text + new timestamp.

Fix: recover in original Turn/time order or use non-linear compatible representation with regression for non-empty transcript.

[P1] Two legacy crash cuts still crash Host startup

Missing Root-source transcript with run===undefined or non-terminal Run still throws does not match queue source before nonterminal recovery can run — Host fails despite recoverable receipt.

Fix: allow proof-owned source to materialize fail-closed during later recovery; add crash-cut tests.

Hosted test/windows_recovery: SUCCESS, but code is NO-GO.

简体中文

历史恢复时序与启动崩溃问题。

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[Sun-GLiang]

Implemented the review remediation in c073644.

Changes:

• preserve append semantics for ordinary admission-backed handoffs; historical reordering is limited to receipt-proven Root sources
• insert recovered Root sources before same-Turn output and newer/equal-time transcript rows while preserving chunk/payload foreign keys
• reject fully materialized or partial source-order conflicts, steering Turn conflicts, and unsafe sequence ranges atomically
• validate exact durable Root source receipts during recovery preparation, before creating or terminalizing a Run
• cover terminal, missing-Run, nonterminal-Run, repeated recovery, equal timestamps, partial/all-existing conflicts, and overflow

Verification:

• @maka/storage: 993 total, 977 passed, 16 skipped, 0 failed
• @maka/runtime-host: 1255 total, 1246 passed, 9 skipped, 0 failed
• npm run typecheck: passed
• npm run lint: passed
• npm run check:stale: passed

No design or plan documents are included. Please re-review the updated changes.

[Sun-GLiang]

Fixed the CI formatting failure in e63367a. The change is formatting-only across the three files reported by Biome.

Fresh local verification:

• npm run format:check: passed
• npm run lint: passed
• npm run typecheck: passed
• npm run rebuild: passed
• npm run check:stale: passed

[Sun-GLiang]

Rebased onto current main at 6762085 and resolved the conflicts with #3803 while preserving both authority changes: SubmittedTurnIntent support from main and receipt-proven legacy Root recovery from this PR.

Fresh post-rebase verification:

• full rebuild: passed
• typecheck: passed
• storage: 1003 total, 987 passed, 16 skipped, 0 failed
• runtime-host: 1284 total, 1275 passed, 9 skipped, 0 failed
• lint: passed
• format:check: passed
• check:stale: passed

GitHub now reports the PR as MERGEABLE; remaining BLOCKED state is checks/review, not a merge conflict.