fix: preserve scoped public failure contracts (C1)

[Ancienttwo]

Selected runtime, CLI, MCP and native failure boundaries now preserve registered classifications and safe actionable facts in strict bounded envelopes. Unknown escaping failures use fixed stages and do not infer provider causes from message text. Successful result shapes, side effects, and the explicitly held C2 recovery/lifecycle paths are preserved.

The existing production reachability and DE1/DE3 source-wiring audits now follow that contract. DE3 requires the current fixed observed-absence throw and all three facts (observed, unavailable, unclassified) inside the producing declaration. Independent removal negatives and an out-of-declaration fact test prevent accepting missing witnesses. Bounded reads, no-empty-observed fallback rejection and explicit graph authority checks remain intact. The final audit correction changes no package product/test or CI file and includes no unmerged B change.

Validation on b824f40:

• Complete wiring audit: 40 pass, zero fail, 86 assertions. Typecheck, five-workspace boundaries and production reachability audit passed.
• The requested single unfiltered root bun test --timeout 60000 completed across 266 files in 700.57 seconds: 2861 pass, 75 fail, 3 existing skips, 22339 assertions. This is not full green; the original non-green evidence is retained.
• Those 75 failures are classified separately: 64 have direct server/listen failure evidence, one has Chromium sandbox-parameter startup failure, one reports npm cache EPERM, and nine original blocks show only startup timeout/assertion failure.
• Identical isolated commands reproduce all nine original unknown cases under default execution and pass all nine with normally approved loopback execution (96 assertions). The loopback probe changes from EPERM to OK. The single approved headless-browser recheck passes (2 assertions). These selected rechecks do not replace or rewrite the unfiltered full-root result; no second full suite was run.
• Packaged native-context and CLI smoke both pass under normally approved execution. Package source/test/audit hashes remain unchanged. npm cache EPERM remains recorded without ownership or permission changes.
• Full final-head hosted Verify remains required. The previous run also exposed a separate Windows Node22 Let projection apply accept the major change it observes in one request #261 fixture where codegraph init prints Done and exits 5 with empty stderr; this correction does not claim its root cause or a Windows CodeGraph sync child crashes with UV_HANDLE_CLOSING during projection check #358/UV_HANDLE_CLOSING fix.

Refs #328. This PR is the approved C1 slice and does not close the remaining D6 work.

Accepted-main integration

Head 1fd88cf61e2f5ba49914680fd43ba479266720b2 merges accepted main 670b7474d76d3cadfecc1b138513b6ed9546e7fc into the reviewed C1 candidate. The only source conflict is the shared failure stage list, resolved as the union. B-only and C1-only code blobs are unchanged; both shared test additions remain intact.

Affected verification passes: 502 tests / 6941 assertions across 18 complete files, plus typecheck, five-workspace boundary audit, production reachability audit and packaged native/CLI smoke. Source/test/check hashes are unchanged from the recorded verification. The historical default-execution full-root attempt remains non-green and is not claimed as a passing suite.

Old b824 Verify 38694500518 completed successfully before this ordinary push. Current exact-head Verify: 38701008450, completed successfully at attempt 2: all 43 jobs and all nine OS/Node summaries are green. Attempt 1's Windows25 ACL-fixture PowerShell subprocess timeout is retained as historical evidence. The fixture and test were byte-identical to the prior passing candidate; the single bounded retry reran topology and its dependency chain because attempt-bound artifacts prohibit a shard-only retry, retaining successful independent Governance/arm64 checks. No product code, assertions, permissions, or timeout budgets changed for the retry. Independent final integration review found no blockers, and no unresolved review threads remain. D6/C2 and D7 work is isolated and absent from this PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-15T09:26:40.703292Z	1fd88cf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.