docs(mc-host): document managed lifecycle architecture

[ahrav]

Summary

Documents the shipped ck-mc-host lifecycle owner, fixed three-component composition, immutable Broca closures, managed demand behavior, CLI commands, and Synapse package contract. Commits the Beads task export used for this work.

Generated machine-specific mc-host qualification evidence is now ignored:

• docs/evidence/mc-host-installed-release-evidence.json
• docs/evidence/mc-host-release-qualification.json
• docs/evidence/mc-host-synapse-smoke.json

Verification

• Beads JSONL parses
• bun run test:release: 136 passed
• cargo test -p mc-host --test protocol_vectors: 18 passed
• git diff --check

Stack

Layer 9 of 9 above #46. Parent: #66.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Review summary

This PR is docs + generated task-tracking data only (.beads/issues.jsonl, .gitignore, ARCHITECTURE.md, STRUCTURE.md, docs/mc-host-wire-protocol.md, docs/synapse-model-bundle.md) — no application code changed, so there's nothing new to assess for runtime bugs, security, or performance in this diff itself. Checked for accidentally-committed secrets in the beads export (task notes mention "secret redaction" as a feature, not an actual leaked value) — none found.

Doc-quality notes below (left as inline comments too):

1. docs/mc-host-wire-protocol.md §7.6 heading vs. content — the section is still titled ### 7.6 \host.shutdown`but now documentshost.statusfirst. The §7.4 cross-reference list also cites(Section 7.6)forhost.shutdownbut gives no section pointer forhost.status`, even though it lives in the same section. Minor navigability nit.
2. Broadened unavailable fallback-reason semantics — the old text distinguished dynamic unavailability (provider Recovering/Quarantined, admission pressure) from permanent absence (which selected TCP with no reason), and described a client "automatic re-upgrade probe" that could retry a non-TCP candidate after unavailable. This PR replaces both with a single flat definition ("no installed provider serves an offered non-TCP transport") and deletes the re-upgrade-probe paragraph entirely, with no leftover references. Since this is a docs-only PR, please confirm this matches the already-shipped client/host behavior (i.e., the re-upgrade probe was actually removed from the implementation, not just from the docs) rather than the doc silently dropping a real capability.

Everything else (payload_manifest_digest now required + validated, the two-lock lifetime-fence model, the daemon_ver length-prefix added to the HMAC proof preimage, credential_fingerprints, the new host.status operation, and the synapse-model-bundle.md pinned-model/tolerance additions) reads as internally consistent with the rest of the document.

[claude]

This section heading is still ### 7.6 \host.shutdown`but now documentshost.statusfirst (lines 534-543) before getting tohost.shutdown. Consider retitling to ### 7.6 `host.status` and `host.shutdown`so the heading matches the content, and so a reader scanning the TOC/section list can findhost.status`'s home.

[claude]

route.open, catalog.list, and transport.negotiate each cite their defining section in this sentence, and so does host.shutdown (Section 7.6), but the newly-added host.status has no section pointer even though it's documented in that same Section 7.6. Suggest host.status (Section 7.6)`` for consistency.

[claude]

This flattens the previous distinction between dynamic unavailability (provider Recovering/Quarantined, admission pressure) and permanent absence (previously: selects TCP with no reason at all), and the paragraph below no longer mentions the client's "automatic re-upgrade probe" that used to be authorized specifically by this unavailable reason. Since this is a docs-only PR, can you confirm the re-upgrade-probe behavior was actually removed from the client/host implementation (in an earlier layer of this stack) rather than just undocumented here? If the probe still exists in code, this doc change would silently misdocument real behavior.