feat: prepare Sync Web 1.5

[thiennamdinh]

Summary

• Deliver the Sync Web 1.5 tree-native Records model, reciprocal federation, canonical committed paths, proof retention, signed scalar and batch Stage operations, and local-administrator-only staged calls.
• Integrate the Gateway, Explorer, WebDAV service, social-agent harness, release QA, deployment checks, Windows callback correction, and operator-only legacy historical-reader procedure.
• Make Wasmer 7.2.1 nofuel the sole request evaluator on qualified Linux x86_64 paths, with fail-closed startup before durable initialization, bounded capabilities, and no replay of oversized host responses.
• Qualify the AOT from the clean current checkout in each owning workflow, record exact source/WASM/AOT/toolchain provenance, require independent in-environment build pairs, and reuse the exact tested artifact downstream without claiming cross-host byte equality.
• Derive image AOT bindings from the supplied file and enforce the same SHA-256 in builder/runtime file checks, evaluator environment, and OCI label. Publish only the musl Journal runtime while retaining exact glibc and musl Ledger binary builders and tests.
• Publish the Synchronic Web whitepaper through the documentation site as a standard plain article with a visible DRAFT watermark, while keeping the generated PDF out of source control.
• Deduplicate exact internal required-history paths before immutable evidence enrichment, eliminating repeated proof work for valid duplicate remote retention paths without changing signed arguments, per-member authorization/results, order, atomicity, or fixed evaluator bounds.
• Reuse a successfully prepared and applied local no-proof retention path only for later exact no-proof duplicates in the same attempt. Aligned and compact proofs remain independently validated and failures retain complete rollback.
• Make Router replacement validation wait for old DNS aliases to withdraw, verify the replacement directly at its distinct new IP, require exact in-network DNS answers, and only then apply the unchanged 15-second proxy-convergence contract.

Testing

• A clean Ubuntu 24.04 current-source build at the reviewed tree produced pair-identical WASM and AOT artifacts; provenance verification rejects checkout-commit mismatch, mutated source/artifact fields, every required receipt mutation, and receipt-inventory mismatch.
• The exact Ubuntu AOT passed the full locked Journal suite, fail-closed wrong-hash startup and same-path correction, and the canonical Records suite (15/15).
• The byte-identical accepted AOT/runtime/Docker path passed the full musl runtime-image build and tests plus the glibc --target builder release tests, Journal evaluation, Ledger installed-Interface smoke, and nofuel attestation.
• Sequential changed-profile validation passed Journal, Records, Gateway, Explorer, social-agent, release QA, Docs, Deploy/router, versions, and diff checks. The final successor reran Basic Interface 289/289, Records 15/15, changed Records and Deploy profiles, and diff checks.
• The hosted Check 266 reproducer contains 1,024 exact duplicate remote committed paths. Barrier-isolated validation reduced terminal history/proof work from 233,268 calls / 15.146 seconds to 39,924 calls / 4.766 seconds and the inclusive operation from 17.589 seconds to 6.776 seconds, without changing the post-pin permanent-history digest.
• The hosted Check 271 reproducer contains 1,024 exact duplicate local committed paths. Barrier-isolated validation reduced the operation from 150,670 calls / 12.13 seconds / 148,481 persistence calls to 631 calls / 0.60-0.63 seconds / 146 persistence calls, with an exact baseline/candidate permanent-history digest match.
• The focused Check 271 regression verifies that a later malformed aligned proof for the same path is still evaluated and rolls back the complete retention mutation.
• Router replacement validation passed repeated independent Podman runs. The staged checks observed real old-alias withdrawal delays of three to four seconds for Gateway and six seconds for the UI, then verified exact direct replacement bodies, exact new DNS addresses, proxy recovery, distinct IPs, and one non-replayed POST.
• The isolated Ubuntu whitepaper build produced 34 pages with DRAFT on every page, linked References, stable list/TOC structure, no severe or unresolved-reference warnings, and byte-identical source/public/Astro PDFs.
• Independent technical, correctness, and article reviews approved the exact reviewed tree. Fresh hosted CI on this replacement commit remains authoritative before merge or release, including Records Checks 266 and 271, Deployment validation, and final source/tree/input image labels.

Notes/Risks

• Sync Web 1.5 remains fresh-install-only. The two-query 1.4.3 reader is a narrow operator-controlled historical aid, not an in-place migration or identity conversion.
• Wasmer request evaluation is qualified only for Linux x86_64. Native AOT bytes are target-specific, not portable; the native parent retains persistence, networking, capabilities, commit, and retry ownership.
• The Records corrections retain complete ordered signed arguments, authenticate and authorize every member, preserve proof-slot cardinality and atomic retention, and do not change the 1,024-item cap or any deadline, call, byte, memory, or replay bound. The hosted bounded-capability errors do not expose the exhausted dimension; deadline exhaustion remains the primary evidence-backed hypothesis rather than an instrumentally proven fact.
• Router validation keeps the strict 15-second replacement convergence limit. Its bounded readiness stages inspect actual container DNS and exact replacement responses rather than adding blind delay or weakening the body, address, method, or replay assertions.
• Staged calls are intentionally non-atomic and restricted to root or configured local Interface administrators. Federation replay remains accepted by design.
• Secrets and private keys remain outside durable Journal state; request-transient signing capability is derived from presented credentials.
• No deployment, merge, tag, package publication, migration, Pages action, or production release is performed by this commit.