chore(sessions): Split client and daemon loadout resolution logic - #528

Rebuild the spec PR as docs-only. The sdd-spec derivation committed a large
sessions-composition code refactor and several reverts alongside the spec
document; a spec PR must change only the spec under docs/specs/. Reset every
code and non-spec-doc file to current main (161b763), keeping just the
derived spec so the PR no longer reverts merged work.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

The execute branched before #528 (Split client and daemon) merged, so the
diff reverted all of crates/sessions/** on top of #500's DNS work. Reset
crates/sessions to match current main exactly, keeping only #500's intended
minimald DNS registry changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

The execute branched before #528 (Split client and daemon) merged, so the
diff reverted all of crates/sessions/** on top of #500's DNS work. Reset
crates/sessions to match current main exactly, keeping only #500's intended
minimald DNS registry changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

…l hostname registry (#546)

* feat(minimald): add *.localhost hostname registry, resolver probe, and HostNet registration

* fix: drop stale-base revert of #528 sessions split from #500 PR

The execute branched before #528 (Split client and daemon) merged, so the
diff reverted all of crates/sessions/** on top of #500's DNS work. Reset
crates/sessions to match current main exactly, keeping only #500's intended
minimald DNS registry changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

* fix(minimald): address review feedback on hostname registry

Respond to review comments on PR #546:

- Mark `ProbeOutcome` `#[non_exhaustive]`, per the repository's Rust
  coding standards for public enums that may grow.
- Stop leaking a hostname registry entry on session teardown: derive the
  deregister name from the record up front and let a read error propagate
  (the subsequent `delete` would fail on the same error) instead of
  silently dropping it via `.ok()`. `deregister` is called unconditionally
  since it is a no-op for a session that never registered a hostname.
- Align spec R3.5 to the registry-by-name architecture: the structured
  tracing field is `session_name` (the registry key), not `session_id`,
  which is a distinct, separate identifier not available at this layer.

Gate (native Linux, -p minimald, --locked): cargo fmt --check, build,
clippy --all-targets -D warnings, and test (54 passed) all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(minimald): emit R3.5 session_id and deregister before delete

Address the open, in-scope review comments on the hostname registry:

- R3.5 tracing fields (dns.rs:102, deregister): the events emitted
  `session_name` only. R3.5 governs the tracing event field and calls
  for `session_id` -- the stable, unique identifier log pipelines
  correlate on, where `session_name` is mutable (RenameSession) and
  reusable after a session exits. Plumb the `SessionId` through
  `register`/`register_host_net`, store it on the registration so
  `deregister` emits the same id, and carry both `session_id` and
  `session_name`. Realign R3.5 in the networking spec to list both.

- `ip` field format mismatch (dns.rs deregister): the `deregistered`
  event used Debug on `Option<IpAddr>` (`ip=Some(V4(127.0.0.1))`) while
  `registered` used Display (`ip=127.0.0.1`), so a log filter on
  `ip=127.0.0.1` missed deregistrations. `by_host` is kept in sync with
  `by_session` by `register`, so unwrap with `expect` and format with
  Display to match.

- Registry entry leaked on teardown (sessions.rs DestroySession): the
  `?` on `store.delete` returned early before `deregister`, leaving a
  stale routing entry pointing at a destroyed session. Deregister the
  hostname before the fallible on-disk delete, so a delete failure
  leaves a repairable on-disk record but never a stale routing entry.

Gate (native Linux, -p minimald, --locked): cargo fmt --check, build,
clippy --all-targets -D warnings, and test --lib (54 passed) all green.

* fix(minimald): parse bracketed IPv6 Host header in resolve

The `Host:` header port strip used split-on-first-colon, which yields
`[` for a bracketed IPv6 literal such as `[::1]:8080` instead of
`[::1]`. Extract a `host_component` helper that strips the optional
`:port` after the closing bracket for the IPv6 form and at the first
colon otherwise. The registry only holds `*.localhost` names so an IPv6
literal never routes, but the parse is now correct rather than latently
wrong. Addresses a review comment on #546.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(minimald): re-scope Unit 3 DNS to B5 host-side egress proxy

Re-align PR #546 to the re-scoped #500 task body: the DNS mechanism is
the spec B5 host-side egress proxy, not the systemd-resolved narrowing.

- Keep the in-memory `HostnameRegistry` (register/deregister + R3.5/R3.6
  structured tracing) but remove the resolver write/probe path; no host
  resolver is ever written or read.
- Add `net/proxy.rs`: the B5 host-side egress proxy plus the shared
  `Router`/`HostRoute` routing core that #502 (B8 HTTPS/mTLS) extends.
  A forward/`CONNECT` proxy routes by `Host:` header / authority through
  the registry — `HostNet` to `127.0.0.1:<port>`, `OwnIp` to its gvproxy
  switch IP. The host resolver is never consulted; the TLD is opaque.
- Replace the systemd-resolved startup probe (R3.4) with an egress-proxy
  listener reachability check that warns
  `component="dns-proxy", status="unavailable"` on bind failure.
- Tests: registry/proxy routing contract, OwnIp routing to its switch IP,
  and the bind-failure warn; drop the systemd-resolved NXDOMAIN test.
- Spec: close Open Question 1 with the B5 host-side-egress-proxy decision,
  superseding spike #485's systemd-resolved finding.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(minimald): time-box egress proxy head read and clarify routing

Address CodeRabbit and sdd-review feedback on the B5 egress proxy:

- Bound the request-head read with a 30s timeout, returning 408 so a
  client that connects but never sends \r\n\r\n cannot hold a connection
  task indefinitely (proxy.rs read_head deadline).
- Add a forward-proxy test asserting an absolute-form request target
  (GET http://web.dev.localhost/path) is routed by Host: header and
  replayed verbatim to the upstream, per RFC 9112.
- Document on Router::route that the upstream port is client-supplied
  and per-PTask loopback port restriction is a deferred multi-tenant
  follow-up (accepted single-tenant limitation).
- Report the startup bind check as status="reachable" rather than
  "listening", since the probe drops the listener without serving.

* refactor(minimald): rename PTask TLD .localhost -> .min.internal

Under the B5 host-side egress proxy the TLD is a free label (the proxy
routes by Host header, no host resolver), so .min.internal is the
semantically honest choice for internal PTask services and drops the
misleading loopback connotation of .localhost. Renames the hostname
suffix constant and updates the registry/proxy docs, routing tests, and
the spec hostname format + Open Question 1 closure. Bare loopback
localhost (mesh tunnel, listen address) is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

---------

Co-authored-by: gominimal-aw-bot[bot] <281738952+gominimal-aw-bot[bot]@users.noreply.github.com>
Co-authored-by: Norrie Taylor <norrie@minimal.dev>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>