feat(core): v1 core service with identity, marks, redaction, stats, export and import (AFDEV-13)

[foae]

The transport-neutral v1 service layer, on top of the decoder (pkg/envelope), the canonical writer (pkg/canonjson) and the v1 store (internal/store). Nothing serves it yet; the HTTP routes land next.

What changed

• v3 core parked. internal/core moves unchanged to internal/v3/core (import paths only, first commit), so the running v3 service and its e2e gate stay green.
• Identity. canonjson.Sum (hex SHA-256 of the canonical bytes); (*envelope.Envelope).IdentityTree and ContentHash over the identity members. Every conformance/hash/ vector passes through the decoder and through Service.Create.
• envelope.DecodeWithLimits. Decode is DecodeWithLimits(body, BodyLimit, MaxDepth); import re-decodes stored envelopes under the 32 MiB import cap (a stored envelope can exceed the 10 MiB create cap after U+FFFD replacement) and two levels of depth headroom (StoredDepthHeadroom: the nesting inference can add).
• Contract change: trim again after a cut. A member with x-trim that truncation cut is trimmed again (step 5 in conformance/README.md, reference implementation, new fixture trim-after-truncate). Without it a cut could leave trailing whitespace that a second pass removes, and the service could not re-import its own export. FuzzDecode now asserts the decoder is idempotent on its stored output. No existing fixture's expected output changed.
• internal/core (no net/http in its dependency closure, enforced by a test):
  • Create: keyed replay (200), key reused with different content (409 replay_mismatch, key_reused detail with existing_id), 24-hour keyless window skipping processed rows, UUIDv7 uid; lookups and insert in one BEGIN IMMEDIATE transaction.
  • Get, List (cursors, q, presence-aware filters validated in one place shared with Stats), Stats.
  • Mark / MarkBatch: strict body decoding, updated/unchanged/not_found classified in the same write transaction as one set-based update.
  • Redact: tombstone keeps identity, hash and processing fields; repeat is unchanged.
  • Export: format 2 streamed in one read transaction with header, trailer and digest.
  • Import: format 2 verified in full before the write transaction (strict record parser, count and digest, uid and timestamps, recomputed content_hash; tombstones recognised by redacted_at keep their hash), then uid dedupe and key conflicts reported, never failed.
  • Meta, Schemas, Schema; typed *Problem errors carrying the contract's codes and pointers (?name for parameters); a busy database is 503 unavailable.
  • Records encode stored payload and context bytes through unchanged, member order as the Submission schema, no HTML escaping.
• docs/develop.md: layout and the frozen-hash rule updated.

Tests

• Every conformance/decode/ fixture and every conformance/hash/ vector through Service.Create: status and code, warnings as a multiset of (code, pointer), stored envelope as canonical bytes, content_hash.
• Concurrency: parallel keyed creates with one key, and parallel keyless identical creates, each yield one row.
• Redaction and marks: tombstone fields, keyed replay of the original returns the tombstone, re-marks keep processed_at, processed=false clears all five.
• Property test over seeded data: stats totals equal list totals for random filters, plus group and open/processed invariants.
• Export → import → export over every accepted fixture is byte-equal (including a record over 10 MiB after U+FFFD expansion, a member cut at its limit next to whitespace, and a body at the depth limit whose member inference moves under payload); re-import is a no-op; key conflicts listed; tampered count or digest writes nothing.

Gates

just check, go test -race -count=1 ./..., just fuzz, the e2e suite against the built binary (55/55), shellcheck on both skills, bash tests/skill/run-tests.sh (124/124), just contract, and staticcheck 2026.2.1: all green locally.