fix: bridge project-context hashes and preserve forced repairs

[andrei-hasna]

Summary

• accept external project-context v1 bundles only when they pass the strict v1 schema and their supplied hash is either the exact canonical hash or the exact bounded legacy hash that includes generated_at
• normalize accepted legacy bundles and migrate cache, manifest, marker, and fragment state to the canonical hash without accepting hashless or tampered input
• fail closed when an existing managed END marker is malformed; --force repairs it while preserving same-line trailing user bytes
• create a restorable v2 before-image snapshot for every target mutation so forced repair has command-provided rollback evidence
• require exact pre-mutation metadata-snapshot proof before treating a different same-revision manifest hash as an interrupted migration

Release order

1. Merge, release, and install this Instructions compatibility bridge.
2. Then merge/release Projects PR #112: fix(project-context): stabilize bundle hashes projects#112

That sequence is zero-downtime: new Instructions accepts both the old exact legacy producer hash and the new canonical producer hash, then persists canonical state. Old Instructions never needs to consume the new Projects producer.

Regression coverage

• old Projects bundle -> new Instructions: PASS and persisted hash becomes canonical
• new Projects bundle -> new Instructions: PASS
• tampered and hashless bundles: FAIL
• managed Codewith render plus two repeated applies: PASS and idempotent
• malformed fused END marker without force: FAIL closed with target bytes unchanged
• forced repair: PASS, preserves adjacent same-line user bytes, returns a usable rollback snapshot, and permits instructions session plan
• instructions session restore: PASS and restores the exact malformed preimage
• arbitrary same-revision manifest hash: FAIL unless canonical or proven by an exact pre-mutation metadata snapshot
• interrupted legacy-to-canonical migration with exact snapshot proof: PASS

Gates

• affected project-context/session lanes after reviewer remediation: 109 pass, 0 fail across 4 files
• full suite before the narrow reviewer remediation: 643 pass, 0 fail across 56 files
• bun run typecheck: exit 0
• bun run build: exit 0
• git diff --check and staged diff check: exit 0
• staged scan: no leaks found
• pre-push commit scan: 1 commits scanned and no leaks found
• independent focused re-review after the P1 fix: GO, no P0/P1 blockers

The post-remediation validation was deliberately scoped to the four affected lanes; the remediation changed only same-revision recovery proof and its regression.

Live acceptance follow-up

After review/release, rerun the user-supplied station01 fixture for wks_ZXg7liK4CFJ1KZjC_Fg_b at unchanged revision 2026-08-02T22:25:51.298Z through managed Codewith render and two post-render applies. That production-path rerun is intentionally not claimed by this station02 candidate gate.

Tracking

• Todos d8d5e195-561e-4e05-b83f-38e5a5c63877
• Todos ed31c2f5-61bc-4950-9f34-a0201ea35bd5
• incident 687465
• Projects producer Todos 95d07dbc-d521-4c94-975d-509ac57c9d23

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO at 9e51a85f2be1d0c0f10279edf17ca1ca29137642.

Independent adversarial verification found zero concrete, reachable, in-scope
P0/P1 defects. Evidence: focused 71/0; full 644/0; typecheck/build and repository
secret scan pass; Ubuntu/macOS CI pass; exact head re-pinned before verdict.

Release order remains binding: publish/install this dual-compatible Instructions
bridge before merging/releasing Projects PR #112.