Design: the RuntimeEnvironment holds a named set of roots — (root-name, rel) identity #597

Design question (USER, 2026-08-21), filed under its feature during phase 2 of
resource-construction.

The scenario that forces it

writ installs devlore package foo, with the personal/team/base repos rooted at ~. Package foo must
read files from its own tree, download and copy files to /usr/local, and may add to XDG_CONFIG_HOME.
One logical install — one saga, one compensation story — spanning the package tree, the system tree, and
the config tree. A copy whose source is in one tree and whose destination is in another lives in a single
operation, so per-tree graph splitting cannot express it.

Candidates

1. Named multi-root (recommended). The environment holds bindings — home → ~, system → /,
   config → $XDG_CONFIG_HOME, pkg → foo's tree; the plan declares the names it consumes; the run binds
   names to directories; file identity becomes (root-name, rel). The scenario reads naturally:
   (pkg, share/foo/payload) → (system, usr/local/bin/foo), plus (config, foo/settings.yaml) — every
   resource confined by its own kernel-enforced root, every name late-binding exactly as ruled (home per
   account, system per host — Unix-literal "/" roots panic on Windows: four test fixtures, and writ's System layer TargetRoot #392). Pre-flight generalizes cleanly: every pending (name, rel) must exist
   under the run's binding of name; an unbound name fails the run — the same shape as variable binding.
   The design already points here: the phase-2 header notes Rule star's session-root anchor #571's declared-roots direction "extends
   naturally into (root-name, rel)", writ's Home/System scopes ARE named roots, and pkg/xdg exists to
   name these locations. Residual costs: identity gains a dimension (URI grammar, catalog keying,
   serialization change; schema stays 1, old documents die, per precedent); the name vocabulary needs
   governance; receipts must record the root-name so compensation rebinds correctly.
2. Single root via common ancestor (today's runRootFor, stretched). For the scenario the ancestor is
   / — confinement dissolves and every rel degenerates into a machine path, killing the relocation story
   phase 2 bought (a home rel starting Users/<account>/… never rebinds per account).
3. One root per graph; split the package per scope. Fails at the cross-tree copy (one operation, two
   trees) and fractures the install's compensation across runs with no promises between them.
4. Single root plus unconfined escapes. Reintroduces the raw os.* side-channel the Windows: restrictive file modes are unenforced (private key, state home, config, secrets) — route every mutation through fsroot #405 campaign
   exists to kill. Not a candidate.

Sequencing consequences

• This is its own feature effort, not phase-2 scope — phase 2 completes on the single-root model, which
  is the degenerate one-name case; nothing landing there needs undoing.
• Identity is rel: git-model plan-space paths; migrate the authoring surfaces #584 PR 2's plan-space grammar must reserve the root-qualification spelling now (e.g.
  @config/foo/settings.yaml — a shape that cannot collide with the drive-letter refusal), so the little
  language does not break again when this lands.

Relations

#571's candidate 4 (multiple roots as declared capabilities) IS this design — ruling here dissolves that
question's residuals (XDG unreachable through the session root). #563's hermeticity direction (declared
module subsets) is the same capability shape. #392 rules the system anchor this design late-binds.

Feature: #546

Plan and design documents