Resolve repository-wide architecture and quality review findings

[aelefebv]

Summary

This PR implements the repository-wide review remediation tracked under Bead lucida-87k and the final follow-up Beads lucida-ufw, lucida-c5y, and lucida-co8. It favors shared architectural boundaries over local patches across security, protocol, storage, resource control, delivery, rendering, and UI/UX.

• consolidates canonical session, chunk, generated-coarse, persistence, and view-query contracts across Rust, TypeScript, and Python
• hardens authentication, authorization epochs, origin/source policy, migrations, diagnostics, and upgrade recovery
• introduces exact process and per-connection outbox ownership plus bounded cache, CPU, GPU, admission, parsing, and durable-mutation budgets
• restructures the web rendering/upload pipeline around dataset, image, tier, and chunk identity
• makes reconnect snapshots authoritative for both intensity and label fetch descriptors
• removes superseded surfaces and adds pinned toolchains, supply-chain policy, CI coverage, deployment validation, compatibility, security, support, and contributor documentation

Final architectural fixes

• Server snapshots now carry exact generation-bound dataset fetch descriptors. The browser validates manifest/fetch parity before mutating scene state and preserves compressed intensity and label codecs across reconnect.
• Browser delivery uses prospective response credit, truthful bridge admission, transport generations, and non-joinable sent tombstones so collection bursts cannot overrun a healthy WebSocket.
• Cache, rejection, delivery, renderer feedback, cold-state application, and debug identity are consistently dataset + image + tier + chunk. Shared-owner images and identical detail/coarse coordinates remain independent.
• Label pools and transient descriptors are dataset-scoped and epoch-guarded, preventing stale labels, same-name collisions, and tier drift.
• Workspace and credential mutations use required finite persistence handles with committed, definitely-not-committed, and typed indeterminate outcomes. Bounded quiescence and reconciliation distinguish safe retry from restart-required fail-close without retaining session, outbox, terminal, or worker resources.
• Outbox overload notification now closes the late-listener race by registering the waiter and rechecking durable state.

Verification

• Rust: cargo fmt clean; workspace all-target check passed; workspace all-target strict Clippy passed with warnings denied; complete cargo test workspace passed, including loopback integration tests
• Web: 191 test files and 2,255 tests passed; production build and TypeScript passed; ESLint passed with zero errors
• Protocol: Rust and TypeScript wire goldens passed, including authoritative snapshot fetch descriptors
• Persistence: stalled, never-completing, lost-completion, cold-restore, credential, role, document, dataset-open, and outbox-race regressions passed
• Live demo: verified server health and the newly built SPA bundle at http://127.0.0.1:9876 with local-source and allowlisted GCS configuration
• Independent convergence reviews: final transport, cache/tier/image identity, renderer cold-state, diagnostics, and persistence reviews are clean with no remaining P0, P1, or P2 findings

Follow-up and limits

• The local host uses Node 24 while the repository pins Node 22; the build emits the expected engine warning, and CI uses the pinned toolchain.
• Vite reports the existing advisory for a minified chunk larger than 500 kB.
• Persistence cancellation relies on backend workers and quiescence barriers honoring the required cooperative contract; unquiesced external work fails closed until restart.
• Live Docker mount migration and a live Kubernetes deployment were not exercised in this final increment; the earlier static configuration, mutation, and delivery reviews remain in the PR.

This remains a draft because the repository-wide remediation is intentionally broad and should be reviewed in architectural slices.

[aelefebv]

CI follow-up pushed in e555d38 after inspecting the first Actions run.

• committed the compact multiscale wire corpus that was present locally but hidden by the generic MANIFEST ignore rule
• updated the Python snapshot contract for dataset_fetch
• updated lucida-py crossbeam-epoch from 0.9.18 to 0.9.20 for RUSTSEC-2026-0204
• made the ingestion-safety job explicitly use nightly-2026-07-01 so the repository stable override cannot mask Miri and sanitizer support

Local verification after the fixes:

• exact scripts/verify-wire-contracts.sh passed across Rust, TypeScript, and Python
• Python wire tests: 72 passed
• both exact Miri tests passed under the job-level toolchain override
• locked lucida-py all-target check passed
• full web suite: 2,255 passed
• independent CI-fix review: clean, no P0/P1/P2 findings

The replacement GitHub Actions run is now in progress.