Deploy replaces the record: the lifetime in the store, reconcile's six words, an occupant is what the record wrote, and adopt leaves a record - #940

…sent, changed, dangling, stale

The record is the desired state; the layer checkout is only deploy's input. reconcile compares
the system to the record and says one of six words per entry. absent: the record says a target
is there and it is not. changed: it is there but is not what the record says. dangling: the
source the record names does not resolve, for a link and for a copy alike, a reference that
outlives its referent, reported and left because only deploy makes a new record. stale: the
source resolves and its content moved, a derivative behind its origin, upgrade's to refresh.
orphan, missing, conflict, modified and modified-or-stale are gone.

The classifiers decide from the link and the two recorded digests; the fresh-render comparison
goes. The ledger records a source under the path the run read it from, the pinned snapshot, so
the graph's files annotation now carries read_from and readback joins the source digest through
it; without that, stale never fired on a real deploy.

Part of #923; lane 2 of #916, PR A.

Claude-Session: https://claude.ai/code/session_01SqQVFZz7AdiLZkGoAcUqRW

…ngling link is re-pointed under stop

readback.Entry.AsRecorded is the one predicate. A link is as recorded when its literal endpoint,
absolutized against the link's own directory, is the recorded source, resolved or dangling; a
copy when its content digest is the recorded as-deployed digest. The source is never resolved.
Deploy's pre-flight under stop and reconcile's changed decide by it, so a link left dangling by a
file that moved between layers is writ's own and a plain deploy re-points it; occupantIsOurs,
which resolved both sides and read a dangling link as foreign, is gone.

The layer-journey scenario's step 3.3 redeploys the moved links under the default policy. The
guide and the reconciliation page say what an occupant of writ's own is.

Part of #883; lane 3 of #916, PR A.

Claude-Session: https://claude.ai/code/session_01SqQVFZz7AdiLZkGoAcUqRW

--platform names the suffix the adopted files carry, in the segment vocabulary the layer tree
matches (Darwin, Unix, Windows, Linux, Linux.Debian, Darwin.arm64); a word the matcher never
reads is a usage error, and the file lands under <project>.<suffix>.

An adoption is a write into the current deployment. Its graph now carries the origin and the
files annotation a deploy's carries, one file.move and one file.link unit per item so every link
has its own unit id, and RunBatches writes the graph before the run, which it never had. The fold
reads an adoption as it reads a deploy, reconcile says linked, and the next deploy recognizes the
link as writ's own.

Two findings on the way. A graph holding a flow.choose does not load back from the document
(#939), so the existing-destination guard runs before the graph and the chain has no subgraph. A
registered layer is a symlink into its repository and the confined run root refuses to write
through it, so adopt had never worked on a real install; the layer path now resolves through its
symlink, which is also what the record must name.

Part of #931; lane 14 of #916, PR A.

Claude-Session: https://claude.ai/code/session_01SqQVFZz7AdiLZkGoAcUqRW

…me-fold