fix: release Dever 0.1.6 with shared runtime assets and unbounded workers

.trellis/spec/backend/compiler-contracts.md

@@ -36,6 +36,8 @@ Applies to AST/HIR contract metadata, typed LLVM/resource/coroutine lowering, pr
 
 ## 3. Contracts
 
+External Worker operations have no implicit execution deadline. `protocol_timeout_ms` bounds startup and protocol writes only; cancellation, peer failure and shutdown remain supervised and bounded. Explicit Task deadlines remain caller-owned, and `external command` retains its separate configured process limits. Neither a `long` entry nor this policy creates a container or an inner sandbox. Keep native and LLVM/ABI definitions aligned, and verify an actual call exceeding 30 seconds alongside cancellation and cleanup regressions.
+
 The current LLVM kernel accepts ordinary checked functions with supported value types, including Decimal, Text/Id, Bytes standard operations, List/Map and nested Record/Choice/Nullable, File/Stream, Task/Group/Channel, AsyncStream, TCP Socket/Listener and HTTP/TLS/WebSocket resources. Time/calendar, process arguments, stdout/logging, Uuid and Secret/crypto use the same typed runtime bridge. List/Bytes each/filter/find/reduce/reduce_until/sum and Stream/AsyncStream traversal use static typed handlers, including the existing checked suspending-handler contracts, never a generic Value interpreter. `dever_entry(ptr out, ptr fault) -> i32` initializes both slots, returns 0 on success and 1 on checked runtime or business failure; outputs are read only after success. Fault is `{i32 code, i32 origin, i32 depth, [capacity x i32] caller_locations, {ptr, i64} message, i32 business_type, i32 business_variant, [words x i64] business_payload}` with separate source-span metadata. Keep fields 0..4 stable; the aligned payload holds the complete concrete Choice and is sized for the largest reachable error type. Named fault codes (overflow=1, division-by-zero=2, RuntimeAbi=3, Business=4) are not the runtime C ABI status. RuntimeAbi retains original owned diagnostic bytes; Business retains nominal identity (`type_id+1`, 0 means absent), variant and typed payload. Callers release root outputs and both fault payloads through `dever_outputs_release` and `dever_fault_release`, including zero-initialized outputs after failure. Application entries and unsupported application intrinsics remain source-located rejections.
 
 File create uses create_new and never truncates an existing path; clone/close preserve shared owner semantics. File chunks yield a shared synchronous Stream cursor, with one terminal Failed before End. Source traversal uses only its existing each/reduce/reduce_until contracts; stream_pull is internal ABI, not a new source pull/first(Stream). Preserve aliases and unvisited rows on early stop, and release resources on both typed business and runtime faults.

.trellis/spec/backend/toolchain-and-library.md

@@ -91,6 +91,8 @@ Authenticate the catalog before extraction. Zstandard is a single checksummed fr
 
 Shared extensions live in service-writable `cache/extensions/<version>/<catalog-sha>/<id>`, outside native cache eviction and immutable core directories. IPC accepts only version and typed ID for an already authenticated installed catalog, never caller URLs/paths/keys. Prepare under the persistent install lock in private staging, verify complete bytes then publish readonly with NOREPLACE; corrupted reuse is an error. `SignedResources` owns verified read/list/root selection for Lib, daemon runtime verification and the actual compile worker. `dever target add linux-aarch64` and explicit dependency preparation may ensure resources; ordinary run/build/read cannot. Update prepares precisely the old active version's installed extension selection before switching the one core/skill active journal; any failure preserves the old selection. Stable launcher/daemon protocol changes require matching trusted bootstrap provisioning. Do not rewrite users' skill directories or add an independently switched skill pointer.
 
+Client Lib reads select immutable base artifacts locally and obtain extension bytes through the authenticated daemon; they never probe or mount its private cache. Resource requests bind the installed version, signed catalog digest, typed extension ID and exact signed byte receipt, not filesystem paths or URLs. The daemon verifies the declared local resource and the client verifies the response receipt and payload digest. Catalog-only enumeration must be followed by a verified read of every consumed artifact; daemon compilation keeps full local pack validation. Reading never installs a missing extension or falls back to another source.
+
 The root first-install script embeds its independently provisioned public key, verifies the full package before executing bootstrap, and generates only an owned temporary installer config. Its Bash entry passes the embedded Python source through a quoted heredoc to `/usr/bin/python3 -I -`; parse the complete function before invoking it. Non-root installation uses `/usr/bin/sudo`; help must neither elevate nor download. Missing Python 3.9/OpenSSL, unsupported OS/ABI, unavailable package or invalid signature is an explicit failure. Current x86_64 host packages require glibc 2.39; ARM application support does not establish an ARM compiler-host release. The installer never reads business configuration. Real-root installation explicitly starts the machine service unless --no-start is selected; image-root verification must not touch host services. Python/OpenSSL are installer prerequisites, not application runtime dependencies. `sdk/release-assets.py` uses an explicitly supplied author zstd executable and publishes deterministic base/extension/raw assets with Linux NOREPLACE directory rename; it cannot clean another writer's public output.
 
 The root script is served at `/shemic/dever/raw/branch/main/install`; Release metadata and attachments must also allow anonymous HTTPS reads. Redirects are restricted to HTTPS `git.dever.cc` with no credentials, non-443 port or fragment. Complete all assets before publishing a release. Source pushes and local transport tests do not prove public download readiness. Changing the download protocol requires rebuilding the stable launcher/daemon and provisioning them once through the new installer; ordinary update activates version payloads but does not replace that bootstrap pair. Never relabel old binaries as a new release. Focused Rust/Python tests assert latest/exact selection, signature and length rejection, missing attachments and preservation of active versions. Correct: reuse one resolved release snapshot for the base and installed extensions. Wrong: reopen latest between those downloads or guess an attachment path from its name.