fix(legal): preserve validated source apply handoff

[zhengdaqi]

Summary

V24R11 closes the protocol handoff gap observed in the V24R10 Case 09 product gate. When an ordinary source proposal becomes valid only after the final tool result, Legal Coverage now advances the existing opaque handoffOrdinal once so Core can grant one existing handoff_grace and deliver the exact apply command on the next model turn.

This remains a stacked draft on V24R10. It must not merge until a fresh immutable product campaign passes Gate 0, paired smoke, Case 05, and Case 09.

Changes

• Add a Legal Coverage-owned, state-bound source-fragment-apply-ready checkpoint using the validated state hash, immutable proposal SHA-256, and sorted exact source IDs.
• Preserve the existing boundary: apply readiness is not semantic progress, the Agent still executes the command explicitly, and only the durable V24R9 receipt advances progressOrdinal.
• Add counterexample coverage for invalid proposals, one-time handoff, replay, exact-command stability, durable receipt renewal, and applied-state replay.
• Add a real local Gateway/O1 regression that drives proposal write, apply, receipt observation, and completion through baseline -> handoff_grace -> renewed -> completed.
• Add a disposable replay of the exact V24R10 Case 09 15,355-byte proposal and preserved workspace.

QA & Evidence

• Counterexample first: V24R10 failed only at the new 0 !== 1 handoff assertion; V24R11 passes the same workflow. Artifact: .omo/evidence/20260727-v24r11-source-apply-handoff/QA.md.
• Focused Legal/Gateway/Lease/O1 suite: 85/85 passed, including complete model/tool/turn pairing and zero O1 drops.
• Preserved Case 09 replay: handoff 0 -> 1 -> 1 -> 1 -> 1; progress 0 -> 0 -> 0 -> 1 -> 1; exact apply mutated 4 sources and 20 facts, wrote the durable receipt, and left the input tree unchanged. Artifact: .omo/evidence/20260727-v24r11-source-apply-handoff/case09-replay-result.json.
• Complete repository suite: 309/309 passed.
• Static hygiene: all relevant node --check commands and git diff --check passed.

Risks & Residuals

• Core, O1, Lease thresholds 8/2, deadlines, Router, Memory, validators, model, corpus, source apply, receipt validation, repair, matrix, and authority protocols are unchanged.
• The checkpoint accepts only a validator-derived source-fragment-apply work item with valid hashes and 1-12 unique bounded source IDs; invalid or replayed state does not advance.
• Local, Gateway, O1, full-suite, and exact-failure replay gates pass. Production-model Case 09 remains unproven and blocks merge, V25, and the 85-case campaign.

Stack

• Base: codex/convergence-v24r10-validated-repair-contract (fix(legal): validate immutable source repair preparation #451)