Make machine configuration authoritative and restore native checkpoints exactly

scripts/generate_recovery_acceptance.mjs

@@ -0,0 +1,34 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { readFile, writeFile } from "node:fs/promises";
+import createModule from "../build-wasm/linuxcnc-sim-core.js";
+
+const root = new URL("../", import.meta.url);
+const names = ["axis3-selected-case.report.json", "axis-gates.report.json", "axis3-checkpoint.report.json", "checkpoint-state.report.json", "exact-checkpoint.report.json", "power-off.report.json", "storage-bridge.report.json", "browser-reload.report.json", "browser-reload-xyzbc-trt.report.json"];
+const evidence = [];
+for (const name of names) {
+  const path = `coverage/recovery/${name}`;
+  const bytes = await readFile(new URL(path, root));
+  const report = JSON.parse(bytes);
+  assert.equal(report.status, "verified", path);
+  evidence.push({ path, sha256: createHash("sha256").update(bytes).digest("hex") });
+}
+const wasmBinary = await readFile(new URL("build-wasm/linuxcnc-sim-core.wasm", root));
+const core = await createModule({ wasmBinary });
+const pointer = core._sim_checkpoint_build_id();
+const buildId = new TextDecoder().decode(core.HEAPU8.subarray(pointer, pointer + 64));
+assert.match(buildId, /^[a-f0-9]{64}$/);
+const exact = JSON.parse(await readFile(new URL("coverage/recovery/exact-checkpoint.report.json", root)));
+const report = {
+  report_id: "cfg-r01-trt-r01-acceptance-v1", status: "verified",
+  tasks: ["CFG-R01", "TRT-R01"],
+  native_build_id: buildId,
+  wasm_sha256: createHash("sha256").update(wasmBinary).digest("hex"),
+  checkpoint_sizes: Object.fromEntries(["sim_core", "sim_protocol", "sim_event", "sim_program", "sim_linuxcnc_tp", "sim_hal"].map((name) => [name, core[`_${name}_checkpoint_size`]() ])),
+  continuation_samples: exact.rows.filter((row) => row.phase !== "post-recovery-jog").reduce((sum, row) => sum + (row.samples ?? 0), 0),
+  first_divergent_tick: null,
+  boundaries: ["matching native build and machine configuration required", "old snapshots lacking native state are rejected", "TRT checkpoint event tails require explicit subsequent commands", "backward public recovery requires a fresh transport session", "OPFS retains its existing quota; no physical crash or cross-browser parity claim"],
+  evidence,
+};
+await writeFile(new URL("coverage/recovery/acceptance.report.json", root), JSON.stringify(report, null, 2) + "\n");
+console.log(JSON.stringify({ report_id: report.report_id, status: report.status, continuation_samples: report.continuation_samples, evidence: evidence.length, native_build_id: buildId }));