feat(modules): optional modules load through one host and are turned on under capabilities

[V3RON]

Closes #595

Status

Implement: done (5303/5303 green) Review: round 2 passed, 1 text fix applied unreviewed Hardware: deferred to the end of the run Gate: waiting for the stack
Next: hardware check at the end of the run, then the stack gate

Done when

• Every Tests line passes in the fast lane (pnpm test:changed: 5303 passed).
• pnpm lint passes (commit hook: lint, boundaries, typecheck, fallow green) with the dependency-cruiser changes above.
• simlock config get on a fresh worker prints "capabilities": {}.
• main.ts imports nothing from src/modules but createModuleHost and types, and nothing from src/module-registry but optionalModules.

Assumptions

• Assumption: the ordering claims "after agent-device's stop steps" (beforeDrain, beforeDriversDispose) and "after agent-device's" (doctor findings) have no cheap seam, so those tests prove the other half of each claim and their titles say only that — the green stage or the audit should check the agent-device ordering by hand.

• Assumption: createModuleHost also takes the daemon logger (spec lists { role, definitions, config, context, wiredElsewhere }) — it logs hook failures and builds each module's child logger.

• Assumption: the by-shape copies are named Module* in src/modules (ModuleCapabilitySource, ModuleRelayTarget, ModuleEndedLease, ModuleLeaseEndParticipant, ModuleDispatch, ModuleMount).

• Assumption: a module's check runs only on a worker — a gateway ignores worker keys, so checking them would fail a start over a value nothing reads.

• Assumption: a module whose findings() keeps throwing is warned once, when it starts to — doctor reads findings at startup and at every run.

• Assumption: the fake module's default capability state is available (the old ready is not a state status.get accepts).

• Assumption: the spec test "a module turned on is loaded once..." used state busy, which status.get does not accept (only available, unavailable, off); the fixture value is now unavailable (round 1 asked for a state other than the fake's default), nothing else in the test changed.

Review

Spec review: 5 blocking, 5 fixed, 1 notes. Code review: 6 blocking, 6 fixed, 2 notes. Claims review: 1 blocking, 1 fixed, 3 notes.
Rounds: 2. Tokens: 5.4M.

Fixed unreviewed: code: src/modules/host.ts:173 a module whose findings() throws, recovers and throws again is now tested to be warned again.

Rejected:

• spec: src/core/config.ts:429 Assumption 4 skips a module's check on gateways, not conservative — not blocking: skipping avoids failing a start over values a gateway ignores; spec and docs do not require it

Written by an agent.

[V3RON]

Review notes

Not blocking, not verified. Each is one reviewer's claim.

• code: src/daemon/main.ts:644 a daemon.stop after the socket claim but before onSocketClaimed runs beforeDrain first, then afterSocketClaimed starts the module after its drain hook; the host has no stopped guard
• code: src/modules/conformance.test.ts:93 "settles within its row's deadline" can fail only by test timeout; a never-settling hook gives no named assertion
• spec: src/daemon/main.ts:600 the host runs beforeDrain and beforeDriversDispose even when the socket was claimed by a lost race; created-not-started modules have nothing to stop
• claims: src/contract/protocol.ts:80 the doc says CORE_ROUTE_SEGMENTS lists routes the HTTP app registers itself, but uplink is in the list and createHttpApp registers no /v1/uplink route
• claims: src/modules/AGENTS.md:5 "the bus for types only" is true of the rule, but testing.ts imports EventBus as a value (exempt via linkTestFile)
• claims: docs/internal/flows/startup.md:39 step 15 lists what onSocketClaimed does but omits the modules' afterSocketClaimed, which main.ts:645 calls first

Written by an agent.