[yabasha]

Summary

Sync the accepted 0.2.4 package from upstream 0.15.36 at c742dd61706fbacc1b95f1a20b7b988cf096ce6c. This combines upstream PRs #977, #982, #981, #986 and #1043.

accepted baseline
  -> portable statechart compiler and correctness fixes
  -> reproduced adversarial findings and cross-family judge guards
  -> dependency-only PR stacking and explicit branch ownership
  -> retained portable orchestration, source acceptance and metadata

Keep Bun, explicit dependency and external-write approval, immutable input snapshots, bounded execution and honest incomplete results. Retain the portable orchestration helper as an explicit extension. Keep foreign-host generated material reference-only and the deferred video root inert. The package contains 573 canonical files, 58 canonical roots and 57 runtime skills.

Use a merge commit. The accepted source receipt binds the manifest in ancestor f64d3ac; squash or rebase would discard that required ancestry.

Evidence

• Before: New executable replay fixtures lost their executable bit during update materialization. CLI reproduction failed with permission errors, so cancellation tests never reached their target phase.
  After: Reviewed modes are digest-bound and shared by preview/apply, with byte/mode readback and failure restoration. The compiler subset passes all 192 tests.

Scope	Exact commit	Result
Runtime and maintenance	f64d3ac	154 maintenance tests, 192 compiler subset tests, strict typechecking and actual local TLC counterexample smoke passed
Acceptance metadata	af7afd5	57 focused tests, package/workflow checks and generated feed validation passed
Current PR head	c125a55	Repository workflow test passes with 23 assertions; generator check and diff check pass
Acceptance prose correction	8e96b90	74 focused metadata tests, package/workflow/feed validation passed; runtime skill/helper bytes unchanged
Local installed observation	cc58f11	All 1,998 installed files/modes match; two fresh desktop discovery views each find 57 enabled skills with no errors

The installed copy remains at cc58f11. This PR also corrects acceptance-facing prose and metadata; it does not refresh that installed copy.

The 75 previously dependency-blocked renderer, differential and JDK-oracle checks remain unrun. Linux qualification of the new compiler remains open; older Linux results do not transfer. Actual personal chat plugin loading and full tool-enabled workflows on both hosts remain unverified. Local discovery is not full behavioral parity. The reviewed archive remains local. No dependencies were installed for this PR.

Merge Danger

Door: two-way

Tracked content is reversible, while acceptance provenance must retain its tested ancestor. Protected uncommitted readiness changes are outside this branch and remain untouched.

Blast Radius: workflows

Compiler commands, review output, judge eligibility and PR ownership change. Preserve one writer per branch, current-head evidence, cancellation, persistence readback and explicit authorization. Source acceptance, installed discovery and workflow qualification remain distinct. This PR does not claim full release qualification or refresh the installed package after merge.