Consolidate hosted runtime authority into one astrid.volume #1803

Outcome

A hosted Astrid runtime can run with one durable authority file and no parallel live native state tree.

For the AOS integration, a cleanly stopped runtime directory is exactly:

~/.aos/runtime/astrid.volume

The file is a mode-0600 regular file with no redirect. Mutable config, keys, principals, installed capsules/WASM/WIT, audit records, staging receipts, and application data are authoritative only inside that volume.

Current blocker

Current main uses ASTRID_HOME/volume, creates and continues to read/write etc, var, run, log, keys, bin, and wit, and the runtime-tree admission path copies native files into ASTVOL without retiring their source authority. It can also admit transient run markers. Renaming volume alone would leave two live authorities.

PR #1801 / issue #1797 supplies the inode-stable ASTVOL root/reclaim primitive but does not implement this cutover. PR #1781 / issue #1780 remains frozen and is not reclaim-complete.

Contract

• AOS supplies a private explicit transient root at ~/.aos/run; standalone Astrid may retain ASTRID_HOME/run as its default.
• Transient socket, PID, readiness, token, gateway, and scratch state is excluded from ASTVOL.
• Host executables and release assets are immutable external inputs, not volume contents.
• The offline migrator admits exact known legacy state, verifies the staged volume by reopening it, publishes one authority, and retires old native files only after durable receipt and restart proof.
• Legacy volume and var/astrid.volume are migration inputs only and receive no later writes.

Required falsifiers

• Fresh init, restart, and clean stop leave exactly astrid.volume in the runtime directory.
• The packed catalog contains no run/** state or host executable.
• Native config/key/capsule/WIT/WASM/audit files cannot become a second live authority after cutover.
• Both-present, redirected, special, hard-linked, mount-crossing, mutated-source, and unknown legacy entries fail closed.
• Every cut between staged construction, verification, publication, receipt, restart, and backup retirement recovers exactly one generation.
• CLI mount/status/sync/unmount projects the same owner roots from astrid.volume.

Sequencing

Implement only after #1797 lands and #1780/#1781 release their overlapping runtime-layout paths. Keep hosted-volume root publication owned by #1797. Do not activate User storage or relax namespace/reclaim threats in this issue.

Tracks the Astrid 0.11.0 plus AOS 2026.9.0 release gate.