feat(context): durable local working memory

[dollspace-gay]

Summary

Implements the local-working-memory design end to end for product writer/fixer/reviewer loops, enabled by default, with explicit legacy mode.

• D0 receives a host-owned context port; local mode makes no separate provider semantic-compaction request and preserves fresh grounding/completion gates.
• C6 provides bounded source-backed working entries, atomic deltas, sticky dependency invalidation, canonical replay, semantic pins, and evidence-only rendering.
• G4 persists exact observations and published views through C0, recovers the trace-to-memory gap idempotently, and never redispatches unresolved effects.
• Bounded context_read/context_update tools support exact-source retrieval and validated updates. Reviewer policy excludes derived entries and writer archives.
• Strict daemon configuration, fully-offline route admission, versioned trace references/metrics, and read-only peritusd context-inspect are documented.
• Optional preinstalled local inference uses existing C2/C3 ownership and native isolation, with deterministic local retention on failure. Linux private filesystem projection and Windows explicit read-only inputs do not widen normal workspace authority.

Design and operational guide: .design/local-working-memory.md and docs/local-working-memory.md.

Local verification

• 541 tests passed across 69 affected-crate test binaries (10 packages), plus the final compactor filesystem-projection regression.
• Strict Clippy for all affected packages, all targets/features.
• Full workspace all-target/all-feature compile.
• Windows GNU cross-target compile for product runner and daemon, all targets/features.
• Warning-denied rustdoc and affected-package documentation tests.
• cargo xtask all: architecture, source layout, ordinary API, trust, docs, dependency/CI policy checks passed without weakening their rules.
• cargo xtask format-check and git diff --check.
• Pinned Verus checks for C6, G4, and daemon composition passed; runtime IO and semantic truth are not claimed as proofs.
• Native Linux private-filesystem fixture executed; exact installed weights were readable and an unrelated host file was inaccessible.
• Public inspection CLI rejected a missing store without initializing any files.

CI follow-up

• Initial Windows Clippy exposed a platform-dependent const-function lint. The fixed native runtime allowlist now uses static slices on every OS, preserving the exact sandbox contract without a lint suppression.
• The initial Windows runner test job exhausted the retained ten-minute ceiling during its final integration test; completed tests passed. The clean baseline was already 8m31s. Both Rust workflows now partition runner unit targets, recovery integrations, and product integrations into bounded native jobs, with unchanged single-threaded fixtures and time limits.
• Cargo metadata validation rejects unassigned integration targets; mutation tests reject missing, duplicated, or misrouted workflow partitions.
• Follow-up local verification: all 191 runner tests across the three actual shard commands; all 280 xtask tests; strict Linux and Windows GNU Clippy; workflow lint; full repository policy and formatting checks.
• The split runner unit/recovery/product jobs all passed natively on Windows. That run then exposed a 16,512-byte async future in both external benchmark adapters. The shared product runner now heap-pins its role-loop future inside the existing timeout, preserving cancellation ownership and avoiding separate wrapper-level workarounds. An 8 KiB caller-facing future regression is included.
• Final repair verification: all 259 product-runner and benchmark-adapter tests, full-workspace strict Clippy on Linux and Windows GNU, pinned product-runner Verus verification, repository policy, and formatting all passed locally.

Final hosted verification

All 439 checks passed on head 9dde7880f358c691a30b4629cc2a90fd983a536d, including the main-branch merge. All four workflows completed successfully:

• Gate A
• Foundation verification
• Native security qualification
• Native product package

No failed, cancelled, queued, or running checks remained at verification. The head was zero commits behind main. Strict lint rules and existing job timeout limits remain intact.

Boundaries

This is a draft for review. Cross-platform hosted runner results are tracked on this PR. Native tests can report unsupported host prerequisites; a cross-build is not native runtime evidence.

Inspection reports the exact last published view and explicitly flags an uncovered tail. Trace and checkpoint stores are ordered, not one cross-store transaction. Torn trace tails fail closed for operator repair. Optional inference requires installed executable/weights/native resources; no downloads, raw fallback, or cloud fallback are added.

No real-model quality/cost improvement is claimed. Paired evaluation requires a separately declared candidate/campaign. The frozen S9 worktree and campaign were not changed.

Crosslink result recording was unavailable because its pre-existing session database/readiness daemon failed to open/start; no unrelated tracking repair was performed.