feat(core): project Multiverse placement in signed event order - #7321

Summary

First foundational slice of the updated Multiverse design, replacing—not extending—the obsolete exact-run preview in #7145. 450 added lines, four files, based directly on current main b1f6b7ef770dddbb7f33c9f5861c379a47bca1d6. No old PR is rewritten or closed; #7140 and #7151 are separate baseline repairs, not dependencies.

buzz_core::placement projects desired placement and per-host intent from the relevant valid events for one scoped agent:

• Newer signed created_at wins; lower event ID wins timestamp ties. Arrival time never decides.
• Stop X preserves desired Y and Y's unchanged Start token, including reordered backfill.
• Stop of the latest desired host clears placement without resurrecting an earlier host.
• A stale launch continuation loses its token; duplicate intent does not change projection.

This proves the uncertain projection semantics without enabling incomplete remote effects. It is not a command executor, auth adapter, durable dedup journal, or implementation of Restart/Move. There are no runtime consumers yet. Inputs must be authenticated, decoded and scope-checked by the subsequent transport adapter; the helper does not confer authority. No relay sequencing, clock-skew gate, lease, special replay or stronger Stop proof is introduced.

Design and dependencies

Approved design sections 5.2 and 7.1; locally verified SHA-256 46724375f9913a7da96caabaf2020433e2b06fa8bb2f5f4879e30410f8188f9a.
Owner implementation authorization / source channel.

Base: main; head: work/multiverse-01-order-b4f2fd6c. Next PR stacks on this branch and binds a versioned authenticated intent codec to the projection. In particular, old destination-only ciphertext cannot let X learn Start Y: authorized multi-host visibility must be solved without receiver-specific order or widening private disclosure. Then private transport/history, automatic profiles/inventory, durable admission/retention, ordinary local controls and current-host Restart, remote intake/results, typed keyless integration, Move, UI/observations and acceptance follow in bounded slices. Detailed API boundary is in docs/multiverse-placement.md.

Broker #6742 is merged; #6922 and #6967 remain proposed, and #6967 has changes requested. This PR depends on neither unmerged broker branch and does not claim keyless runtime integration. The owner-approved Desktop-host design accepts partition overlap and forbids key export, unlike the older remote-provider vision's single-instance/key-handoff language.

Validation — exact head 46323b421888a45dcec687e784545d295f89145e

Clean tracked/untracked worktree before and after final checks:

• Full buzz-core: 264 unit tests + 2 doc tests pass, none ignored.
• Nine placement regressions include 1,440 full permutations, every partial prefix and duplicate full sets, checked against an independent signed-order transition model. Also targeted Stop isolation/no fallback, stale continuations, same-second ties and future-clock cases.
• Three negative controls fail as expected: reverse ID tie order, let Stop cross host boundaries, ignore the newer Stop fence. Source restored and full suite rerun afterward.
• cargo clippy -p buzz-core --all-targets --all-features -- -D warnings: pass.
• Workspace cargo fmt --all -- --check, repository differential file-size gate (including ten policy tests), and git diff --check: pass.

All Cargo runs used the committed lockfile and existing Hermit cache offline, compiling this worktree's actual source. Full just ci is blocked, not passed: workspace Clippy requires uncached aes 0.8.4; offline mode prevents download. The run stopped there, before broader packages/frontend/mobile. No dependency installation or service/configuration changes were authorized or performed. Required remote CI remains a gate; package checks do not replace it.

Review / limitations

Draft; do not merge or mark ready automatically. Independent review should focus on equivalence of the two-scan reducer to signed chronological transitions, Stop isolation/no fallback, unchanged-target tokens, tie direction and non-authorizing API boundaries. No native app, remote lifecycle, bounded-retention, privacy transport or end-to-end acceptance is claimed. Presence is not stopped proof; same-second races, clock skew and potentially unbounded partition overlap remain accepted limits.