Keep node workloads running across Runtime generations

[SaladDay]

Changing a node-backed Runtime or its resources currently requires waiting for all hosted resources to leave. Add generation-aware node preparation and routing so existing allocations, pending placements and suspended workloads retain their exact Runtime while new work uses a qualified available generation. Keep node identities, credentials and owner epoch across same-provider changes; backend changes still require reset.

Core owns readiness, capacity selection, retained generations and correlated collection grants. Machine protocol v2 reports bounded sparse generation facts and separates the target from serving readiness; v1 remains usable on its enrolled generation and reports that a node program update is needed. Current authenticated connection and epoch fence readiness and deletion authorization. The pinned public Agent API remains unchanged; generated machine/Core contracts, the shared client and English documentation describe the extensions.

The installer adds identity-preserving node updates, exact-release retained artifact delivery/recovery and per-generation providers. Local collection waits for queued/in-flight work and actual helper process lifetime. Durable preparation/collection journals preserve interrupted recovery, and original Runtime files require verified ownership before deletion. The original v1 generation is conservatively retained because old helpers lack the new lifetime lock; this is not a claim that legacy files were collected. Docker images are shared daemon resources and remain installed: automatic collection removes only authorized installation-local generation/private files. Microsandbox private-store collection retains native receipt and locking checks.

Validation: independent review identified preparation identity, lease continuity, missing-artifact recovery and diagnostic issues. The corrected source now separates unpublished preparation from write-once provider configuration and binds both lease openers to the same durable installation/generation/specification/inode identity. Independent negative controls reproduced the original defects. The corrected installer suite passed 243 tests with one explicit keyctl-unavailable skip; affected PostgreSQL and helper/protocol/console race checks passed. Readiness and routing fixtures now use authenticated generation observations, preserving the original timeout and placement assertions. Generated operator documentation was refreshed through the repository generator.

Current integration is 6e70d1a. One focused independent review of the changed lifecycle/publication/repair boundaries completed without actionable blockers. The complete local server make check gate and both exact-head CI checks passed, including the complete CI browser checks. Verified fixture and generated-document corrections use self-review. Earlier complete-gate failures remain recorded; they are not treated as qualification of this candidate. This draft remains unqualified for delivery until required real acceptance finishes.

Real microsandbox/KVM and Docker coexistence, retained work and update/recovery/collection acceptance remain required, followed by final Web integration and paired browser checks. No intermediate release, live-demo/rehearsal mutation or real qualification claim. Stacked on PR #177; the approved server browser exclusion is reported separately from browser acceptance.

Exact private artifact built from6e70: archive SHA256 f442fb63fb0802f80ee1bdba3654875fa1675c406a37a728daf5496ba12d4aec; manifest bba9b7c8069354d27b92fec34bf9bb9cbc7ce113d117cdacb8fcbc07256c542f. All payload/archive/Runtime smoke and companion checks passed; coordinator independently rehashed the original archive and manifest. This is build qualification, with real node lifecycle acceptance still outstanding.