feat(prime): isolate native instance ownership

[rynfar]

Prime instance generations could share mutable daemon state, and restart adoption or teardown could proceed without exact current ownership proof. This made concurrent environments vulnerable to cross-instance routing, stale-generation publication, and uncertain cleanup.

This change isolates every native Prime runtime context and binds it to its instance home, socket, token, generation, MCP ownership, status cache, and usage cache. It adds current post-attach capability proof, durable ownership receipts with quarantine and exact recovery rotation, generation fences, compare-and-set settings mutation, and identity-bound teardown. ACP remains an explicit degraded N=1 fallback on POSIX/WSL2. Native Windows fails before Prime process, import, probe, download, or install I/O. The public capability stays disabled for this release with supportsMultipleInstances: false and one-account UI guidance.

The safety delta from 2f2a89165..e66023641 is intentionally one commit. Applying the cumulative delta was the only safe way to preserve the newer pylon performance/coalescing work and merged #250/#255 without replaying recovery commits or merge history.

Verification:

• Target safety, ownership, admission, contracts, web, and mobile tests: 29 files passed, 3 skipped; 772 tests passed, 5 skipped.
• Hosted regression fixture and related settings tests: 4 files passed; 17 tests passed.
• Full Prime provider suite: 24 files passed, 3 skipped; 589 tests passed, 5 skipped.
• Exact Prime a3dd5ce633fef161d30ded9474f75a609a9e7a2a real process suite: 20 passed, 9 expected skips.
• Five-restart adoption regression passed with the exact Prime fixture.
• Real macOS isolated native runs passed: N=1 (4 processes, 539.2 MiB), N=2 (8 processes, 987.4 MiB), N=4 (16 processes, 1961.5 MiB).
• Modeled macOS/Linux N=1/2/4 admission and isolation cases passed in the target suite.
• Server, contracts, client-runtime, web, desktop, and mobile typechecks passed.
• Desktop packaged build and Electron smoke passed. release:smoke passed.
• Changed-file lint passed with one pre-existing ws.ts unused-import warning. Changed-file format and git diff --check passed.

Full-server note: two 4,079-test runs each reached 4,063 passes with one unrelated parallel-only failure. The first exposed and led to a fixed cwd-independent ownership helper path. The second was the upstream server coalescing seam receiving another test server's HTML on a reused ephemeral port; its focused rerun passed. The required target shards are green.

Screenshots were not captured because this task explicitly excluded browser use. The visible change keeps multiple Prime accounts disabled and is covered by the server-rendered settings tests.

Base: 51ce1c42174fc7d2e029499d650962a5837412c1

Built with GPT-5.6 Sol using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.4 KiB	+5 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+8 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.7 KiB	+329 B (+2.4%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−10 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.8 KiB	+339 B (+5.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.2 KiB	59.5 KiB	+2.3 KiB (+4.1%)	66.4 KiB	✅
Claude	Live turn messages	8	10	+2 (+25.0%)	21	✅

Baseline: 51ce1c4 · PR result: feacfc2 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.