#707 feat(sdk): replace Relay broker execution with node spawn

Summary

• Replace broker/PTY agent execution with Relay node placement, readiness confirmation, exact result correlation, exact release, and journal-before-inbox-settlement ordering.
• Remove the harness-driver/broker runtime dependency from the Flows SDK path.
• Support the explicit local Desktop schema-v2 service-caller path and retain the remote publisher-token path.
• Keep one lazy publisher runtime per worker and close it only after dispatch drain and durable settlement reconciliation.
• Fail closed across ambiguous spawn, invalid authority, cancellation, cleanup, recovery, deadline expiry, and inbox-settlement windows.

Current exact head

2dc93663f92b5040e950cb57883751d50ab3151e

The production repair inherited from feeba7eb closes the strict-replay gap:

• every dispatch is reconstructed from the durable claim, including a retry after proven side-effect-free preflight;
• the claim retains the original rendered task and exact local node name/ID;
• current scope and target checks still run for a new unfenced dispatch;
• an already-fenced replay repeats the stored bytes without depending on mutable scope or target discovery;
• same-name node re-enrollment conflicts before effect;
• malformed node_id-without-node state is rejected at the durable read boundary;
• legacy v2, remote, injected, custom, wrapped, subclassed, or method/state-overridden ports remain non-replayable.

The exact-head successor repairs the Linux artifact test without weakening its contract:

• spawn entry is established before the test triggers its timeout;
• the timeout is controlled explicitly rather than relying on a loaded runner meeting a 50 ms wall-clock assumption;
• failed exact cleanup remains durable; and
• a replacement worker proves idempotent exact release after the original worker has closed.

Exact-head verification

• SDK build: passed locally.
• Source and type-level authoring checks: passed locally.
• Test typecheck: passed locally.
• Serial affected suite: 12 files / 171 tests passed.
• Timeout/late-cleanup stress: 20 / 20 passes after the repair.
• Exact-head GitHub checks passed: packed-consumer, validation, guard, and Linux artifact (28m19s).
• git diff --check: passed.
• Current review threads: 69 total / 0 unresolved.
• Snow Lunch independent exact-head review: SIGNOFF for 2dc93663 (receipt).

Mutation evidence:

1. routing the safe retry/replay through the current rendered task fails the preflight → changed rendering → response loss → fenced replay regression;
2. removing the malformed local node identity pairing check fails its dedicated regression;
3. restoring the old timeout test bytes reproduces the CI race on repetition (failure on mutation run 4);
4. byte-for-byte restoration of the deterministic test passes 20/20 repetitions and the 171-test affected suite.

Literal evidence:

• production F1 commands, outputs, mutations, and hashes
• exact-head CI repair, mutation failure, 20/20 restoration, and affected suite

The response-loss acceptance kit remains part of this head. The public Core Bridge proof dependency remains 18.1.0 with the production optional peer contract >=18.1.0 <19.

Honest boundary

This head is proved locally at the source, package, deterministic crash/replay, timeout, and replacement-worker reconciliation layers, and exact-head GitHub CI passed. The final Linux artifact job tested SDK/type-level authoring contracts, built the standalone CLI, assembled the artifact, and passed its exact Linux smoke. This final commit does not claim a new customer mutation, production deploy, package release, or fresh real-node lifecycle.

The PR remains draft. A human decides merge readiness and merges; publishing is a separate explicit GitHub workflow action. No merge, publish, provision, or deploy occurred here.