Persist durable, isolated, idempotently resumable control instances

[bigboateng]

Boundary

The change crosses the kernel's durable persistence boundary: the Store port every control instance lives behind. That boundary previously exposed a single implicit instance whose state could be loaded without its committed history, so nothing proved that instances are created explicitly, isolated from each other, or able to return an already-committed result after the caller lost the response. Every store method now names its exact control instance, and loading returns the atomic instance record — current control state plus the complete ordered committed receipt history — so the boundary itself carries the evidence needed to trust or refuse what it stores.

Transition

Before: a missing instance could be silently manufactured from a constructor-supplied initial state; state and receipt history loaded separately; revisions, compare-and-swap, locking, and recovery were effectively global to the one instance a store was built around; and retrying an Apply whose transition had already committed was refused as stale, so a lost successful response was unrecoverable without re-executing the effect. After: instances are provisioned explicitly and atomically (concurrent creation yields one winner and one typed instance-exists loser; a missing instance is a typed not-found result); two independent objectives occupy two durable instances in one store with per-instance revisions, CAS, locks, recovery, and append-only history; retrying an exactly-committed prescription returns the original durable receipt with no new observation, execution, verification, state mutation, receipt, or revision, while a failed attempt without a committed receipt stays recovery-required and is never reported successful; and every loaded record fails closed on fabricated, misrouted, duplicated, reordered, or truncated history. The reviewer CLI provisions its instance at mutating command boundaries only; read-only status now reports an unprovisioned instance's deterministic initial state without persisting anything.

Evidence

A new domain-neutral InstanceStoreConformance suite proves the laws — create/load/restart, duplicate and concurrent creation, two-instance isolation, per-instance CAS and locking, atomic state-plus-receipt commit, append-only history, exact committed retry returning the original receipt with zero side effects (including retry of an earlier, non-latest prescription), failed-attempt retries staying recovery-required, cross-instance replay rejection, concurrent retries returning one durable result, corrupted-history fail-closure, and restart reconstruction — and runs against all three in-tree stores: the integer memory store, the settlement register store, and the reviewer's on-disk file store with a real reopen. Seven dishonest white-box stores prove the suite rejects a singleton store that ignores the requested instance, torn state-receipt commits, blind global CAS, latest-receipt lookup, replaced history, truncated history, and synthetic success after an unresolved attempt. A regression test proves read-only status never persists an unprovisioned instance. Full verification: go build ./... and go vet ./... clean, go test ./... -race green, the canonical sharded runner passes 652/652 tests, the repository-contract unittests pass 69/69, and release-note validate/preflight pass. The exact-tree self-review converged with blocking measure 0 and its attestation is sealed for this head.

Commits

• Persist durable, isolated, idempotently resumable control instances
• Report unprovisioned review instances read-only from status
• Seal converged self-review attestation

Self-review attestation

• reviewed tree: 975232189c6c9be401c457c38fa72e489d6a9b53
• program fingerprint: 3ca3397ff275d89bdb6d5c934b86b51d3cbdfab0ee628c47fe94d1d4f5767155
• the review-verified CI job re-derives both facts deterministically from the base-admitted policy