fix(desktop): isolate runtime authority and reject lossy legacy receipts

[loganj]

Summary

Dependent repair atop #7364, keeping the original six lifecycle and eight inventory/Stop draft heads unchanged.

• Give managed runtime identity its own host-preserving canonicalizer. localhost, numeric loopback and IPv6 loopback remain distinct communities; paths, trailing slashes and empty queries retain their meaning. Frontend runtime lookup agrees; legacy Bestie/AUTH normalization is unchanged.
• Stamp new process receipts with authority version 1. A live V0 receipt proves only instance ownership for normal global shutdown cleanup, never pair authority: the legacy renderer lost both host and trailing-slash provenance, including repeated root slashes. Matching pair Start/Stop fails closed with normal-quit/reopen recovery rather than adopting/killing a different community's child.
• Put the receipt admission before actual Start and local/remote Stop effects, preserving ordinary process-tree teardown. Production-bound tests cover tracked/untracked Stop and Start. The child fixture uses the test executable, explicit readiness and cleanup guards.

Evidence

Candidate 76fb1e66287b186b54b09e5b73bbd45e3bd7a551:

• Full composed native workspace suite: 3,203 main-library tests passed, 19 ignored; all non-ignored integration/doc targets passed.
• Native workspace/all-target Clippy, root/nested formatting and repository file-size gate passed.
• Full composed frontend suite: 6,293 passed; four mounted Stop/chrome smoke checks passed. Frontend unchanged by the final native-only V3 delta.
• The earlier full composed just ci stopped at two marker-fixture failures. Those are now fixed and the full native suite rerun; remaining web/mobile gates completed separately. Unaffected root/static/frontend checks are reused, not represented as a new monolithic green run.
• Real production call-site mutations failed the Start and remote tracked-Stop tests, then were reverted. Independent V1/V2 review findings are reconciled; final V3 delta review is underway, not approval.

Limits and remaining work

Successful native remote Stop, saved-result retry and recovery/no-resurrection acceptance are still pending on this composed repair. The old native receiver failed before command admission; unit/mounted evidence is not native success. Real destination-host keyless provisioning is still absent, so no new keyless Start/Restart/Move success is claimed. Nothing merged or deployed.

Originating Buzz channel: f45d3304-dcf0-44e8-a46d-bcd63b235fbc.
Thread: buzz://message?channel=f45d3304-dcf0-44e8-a46d-bcd63b235fbc&id=16211fefcee85904f49802ce5e1709bf24b4895401a944f0585e70233c4e4d39.

[loganj]

CI attempt 1 for 76fb1e66287b186b54b09e5b73bbd45e3bd7a551 completed red only on smoke shard 3 (plus dependent summary checks). Other lanes, including native/Desktop Core and relay-backed integrations, passed.

The terminal test failure is messaging.spec.ts:2439, “sends a thread message to its parent channel with a root-thread link”: the send payload and success toast assertions pass, then the shared timeline row is absent at line 2631. It fails on all three CI attempts. Two navigation cases passed on retries and are not the terminal failure.

https://github.com/block/buzz/actions/runs/33944320068/job/101247669246

Bounded comparison: the same failing test passed locally at the candidate (one initial run plus 12 repeated runs) and at unchanged parent 8f2dd70f (12 repeated runs); the parent also passed all 91 tests in messaging.spec.ts. Messaging/channel/mock-bridge/test/dependency/workflow files are unchanged by this PR. The CI merge tree 78d52c28 is byte-identical to the candidate tree. These observations suggest a nondeterministic/indirect failure but do not reproduce or exonerate the CI failure. No product or test assertion was changed to turn it green.

One same-head shard rerun is now requested; awaiting its terminal result. Native authority review and repaired native acceptance are separately inaccessible on the disconnected remote test host, so neither is approved/passed. Draft remains unready for merge.

[loganj]

Same-head smoke rerun: terminal red, changed failure set

Head remains 76fb1e66287b186b54b09e5b73bbd45e3bd7a551, base 8f2dd70f9633181c8603a37a837addecec19704e. Attempt-2 shard 3 finished with 280 passed, 2 failed, 5 retry-recovered flaky, 1 skipped. No pending checks; only this shard and its two Desktop summaries are red. Other exact-candidate lanes, including native/Core/platform/relay-backed integration, passed. No additional rerun requested.

• The original shared-thread messaging case passed first try; that does not diagnose the first run's failure.
• Status expiry: saved retry trace proves the fixture expired at 05:11:01.000 UTC, before the actual profile-opening click at 05:11:01.042. This retry never reached the status dialog. First/retry2 contexts show a new Today draft with Quick statuses, not an existing expiring draft. This is the inherited short-wall-clock fixture precondition failure, not observed loss of an already-open saved-status draft.
• Chip geometry: saved retry trace shows both chip and tooltip already data-state=closed while the two toBeVisible checks pass during the exit animation. The first box has an 81.3515625px center error; the tooltip then disappears. Pending timeline layout/scroll is visible, but the trace does not establish which event closed it. The other retry's unwrapped-chip failure remains separately unresolved. No claim that source equality alone makes these unrelated.

The status and chip specs/owning UI modules are byte-identical in the earlier base, parent and candidate. Both unchanged-parent focused cases passed 3 repetitions each; a further unchanged-parent navigation run passed 12/12. Bounded CPU/scroll diagnostics also did not reproduce, and all temporary instrumentation was reverted. These local passes do not clear CI.

Useful fixture follow-up: control the status clock and assert the existing draft before advancing expiry; bind stable sent-row layout and require an open tooltip before measuring first/last fragment centers. Preserve the original behavior assertions. No product or test change is included in this triage, and this PR remains draft with native acceptance and final authority review outstanding.