Implement LINA LIFE world, social, work and image engine with recovery

[thisisjun786]

Change

Implement the LINA LIFE backend alongside ordinary Codex work: user-confirmed world revisions, places/scenes/time and seeded events; individual knowledge, secrets, beliefs, asymmetric relationships and personality growth; explicit task/memory provenance; internal posts, replies, reactions and later experience; permitted event images and scheduled avatars with original-request recovery, pin/history/restore and separate delivery receipts.

Integrate the current dev image-owner baseline and preserve authored identity. Ordinary conversations share permitted growth/relationships while event and secret access remains separately controlled. Fix confirmation-mode world reads and reject out-of-range event revisions at startup. A rejected LIFE database now preserves its original files and leaves ordinary chat/tasks usable, with owner-only recorded health.

Consumer contracts and recovery instructions: LIFE_ENGINE.md. Requirement/evidence map: 010–080 roadmap.

Verification

• Local native-enabled full suite: LINA_LIFE_NATIVE_TEST=1 LINA_AUTHOR_NATIVE_TEST=1 bun test — 3,369 passed, 0 failed; 19,757 assertions / 481 files. Source hashes unchanged during the run.

• Root/browser typecheck, Biome lint, runtime asset build/out-of-checkout CLI smoke, CI validation and dependency audit passed. Complete-history secret scan is recorded for the final commit. Hosted CI is reported separately by GitHub checks.

• Independent implementation review: PASS, no blockers. Focused reviewer run: 11 tests / 105 assertions, plus integrated causal story.

• Isolated task receipt → work-dependent event → directed relationship → pictured post → viewer feedback → later experience, with replay after restart and captured private-text exclusion.

• Actual child SIGKILL/WAL recovery and offline checkpoint restore: reopen world/agent/image owners, validate UUID/usage/terminal/archive bindings and asset hashes; reject active owner capture.

• Actual HTTP: 27 image-owner cases and 11 health/isolation cases; zero external provider calls. Owned listeners stopped and temporary state removed.

• PR delivery repairs preserve verbatim Ensemble inputs with nine exact Git-attribute paths, and reduce canonical JSON overhead while retaining bytes, digests and validation. The three hosted timeout scenarios pass locally with their original limits; 1,910 differential assertions and independent review passed. Final commit cefaffc passed hosted CI and dev-gate: 3,140 package tests passed, 45 native qualification cases intentionally skipped, zero failures. The local native-enabled suite covers those gated cases. All three former timeout scenarios passed without changing their test limits.

Risks and remaining work

• This is the engine/backend and consumer handoff. LIFE renderer/user journeys, real narrative/image quality and likeness, and installed-user-data rollout are not qualified. Native transport and synthetic services are distinguished in the unit documents.
• World, cadence, audience, model and admission budgets remain explicit/unset. No live generation, external SNS, merge or deployment was performed.
• Startup audits a private DB/WAL/journal copy before the original; memory and startup cost grow with retained history. A rejected shared LIFE database quarantines all its worlds until offline recovery.
• Checkpoints cover local state, not external memory/provider history, credentials or the external ima2 service configuration. See the guide for the exact recovery boundary.
• Risu-inspired behavior is a bounded declarative subset; the pinned Ensemble social adapter retains upstream notices. This is not arbitrary Risu script execution or a replacement conversation engine.