runtime: M2 review follow-ups

[mfw78]

Successor to #374, which closed as delivered. These six are its residual review follow-ups.

The six review follow-ups left over from #374. The generic venue-agnostic host has shipped and is gate-protected by scripts/check-venue-agnostic.sh and scripts/check-cow-orderbook-only.sh; this epic tracks residual hardening, one test and two doc facts, nothing structural.

Every item already has an implementation open as a PR against feat/m5-pre-carve-runbook. That base is disregarded: M5 will be redone after these land. Re-home each PR onto dev/m1 by rebasing, not cherry-picking. crates/videre-host/src/registry.rs and crates/videre-host/tests/platform.rs have both moved since the carve branch point, so #533, #534 and #531 apply with offset; #529, #530 and #532 apply clean.

Scope

#508, PR #532: spell all four ComponentsBuilder params on CoreRuntime::components at crates/nexum-runtime/src/preset.rs:94, which compiles today only on the L = LogPipelineBuilder default. Signature only, body unchanged.

#517, PR #529: one boot-time uniqueness pass across the three collision classes (service namespace, subscription kind, manifest section), run before HostServices::from_extensions in both Supervisor::boot (supervisor.rs:398) and Supervisor::boot_single (supervisor.rs:493), otherwise the existing namespace bail at host/extension.rs:256 fires first and the new pass is dead code for that class. The class that is silently deduped today is extension_subscription_vocabulary at supervisor.rs:338, not the module-side extension_subscription_kinds at supervisor.rs:1369, where duplicates across modules are expected. The pass must be boot-only and must not reject a kind or section claimed twice by the same extension.

AC2 of #517 stays optional as written and is satisfied by the existing supervisor::tests stubs. The cow-api candidate second consumer was deleted in #471, and nullislabs/nexum-runtime#13 owns the fuller enum-seam and integrity-tag model at M6.

#519, PR #533: two terse doc facts, not an essay. admit_worker and admit_provider state that a manifest omitting [venue] is admitted unconditionally, an intentional silent opt-out for non-venue keepers. crates/videre-host/src/registry.rs:749 records that verify_exported_versions runs post-instantiation and pre-init, unlike the pre-compile manifest predicates in supervisor.rs. Both are ordering facts, not security guarantees.

#510, PR #531: cover crates/videre-host/src/client.rs:22, the no-registry-service path to UnknownVenue. client.rs has no test module and every existing UnknownVenue assertion drives the adapter-map miss at registry.rs:376 instead. The test asserts on log strings emitted by modules/examples/echo-client, a cross-crate coupling to a fixture the M4 cars were re-pointing; pin those strings or drive an inline component.

#509, PR #530: PresetBuilder::with_components, so with_chain, with_store, with_ext and with_logs become reachable from the preset shortcut. PresetComponentsBuilder::launch duplicates PresetBuilder::launch; the two must gather extensions and install add-ons in the same order or embedders get different boots down the two paths. This lands L1 API surface that the M5 carve exports verbatim, so the signature is expensive to walk back.

#507, PR #534: narrow VenueRegistry::install to pub(crate), add the mutex-discipline line, and give the out-of-crate caller at crates/videre-host/tests/platform.rs:284 a shim. videre-host declares no test-utils feature today, so the shim plus self dev-dependency is new Cargo-graph surface the standalone L2 repo inherits. The doc line must not contradict registry.rs:558, which already relies on the same invariant.

Waves

Wave 1, fully parallel: #508, #517, #519, #510. Their file sets are disjoint (preset.rs; supervisor.rs plus supervisor/tests.rs; handshake.rs plus registry.rs; tests/platform.rs).

Wave 2, parallel with each other: #509, #507. Disjoint cones, nexum-runtime/src/builder.rs against the videre-host crate plus Cargo.lock.

#507 is held to wave 2 because it is the only item with file collisions: it edits crates/videre-host/src/registry.rs alongside #519 and crates/videre-host/tests/platform.rs alongside #510. Hunks are disjoint in both cases, so this is a rebase cost, not a merge conflict. The previously recorded #507 depends on nullislabs/shepherd#510 edge is otherwise unfounded: #531's test never calls install.

#509 is held to wave 2 for review discipline, not merge safety. It collides with nothing. Its new NoAddOnCore test preset reintroduces the three-param elision #508 exists to remove, so land #508 first and have #509 spell all four params there and sweep the existing test preset at builder.rs:684 in the same pass.

Done when

The six issues are closed, the six PRs are merged into dev/m1, and no follow-up branch still targets feat/m5-pre-carve-runbook.

Sequencing

Wave 1 runs #508, #517, #519 and #510 in parallel: pairwise-disjoint file sets, and none of them touches Cargo.lock. Land #508 first within the wave so #509 has the four-param ComponentsBuilder spelling to copy.

Wave 2 runs #509 and #507. #507 is the only item sharing files with others, videre-host/src/registry.rs with #519 and tests/platform.rs with #510, and it is the only one touching Cargo.lock, so it lands last. The hunks are disjoint, so this is rebase cost rather than conflict.

This lane is independent: no M2 item blocks or is blocked by anything in M3 or M4, so it can run at any point. Its only outbound edge is #517 to nullislabs/nexum-runtime#13 at M6, which owns the fuller enum-seam and integrity-tag model deliberately carved out of #517.

Wave 3 runs #503 alone, added after the epic was filed. It refreshes the watch-eviction deadline on a status-body encode failure and edits crates/videre-host/src/registry.rs, which #519 already claims in wave 1 and #507 in wave 2. Three uncoordinated writers on that file is the thing to avoid, so it lands last rather than in parallel. It arrived unmilestoned and was re-homed here rather than left loose.

[mfw78]

All seven follow-ups are closed: #508, #517, #519, #510, #509, #507 via PRs #532, #529, #533, #531, #530, #534 merged into dev/m1, and #503 as already delivered by #514. The M2 review follow-up epic is complete.