[m-mdy-m]

Scope

References Runtime issue #4. This PR is the Runtime-side error-contract follow-up to the resolver-backed extension lifecycle: structured errors raised by the trusted Backend resolver must remain actionable when they cross Lua execution boundaries.

This change is part of the wider CDIN integration and release epic #111, but it does not by itself complete live product-level extension activation.

Changes

• Preserve recognized cdin.runtime error records (domain, stable code and details) when a nested require() module fails.
• Preserve the same records when the entry module executes or its init hook fails.
• Preserve resolver errors raised while Runtime resolves the entry module itself.
• Keep ordinary Lua errors normalized to BAD_EXTENSION.
• Keep sandbox capability denials as PERMISSION_DENIED, rather than flattening them to BAD_EXTENSION.
• Add integration coverage for nested resolver, entry-resolution, entry-execution and init failures; assert failed loads register no extension and partial init contributions are rolled back.
• Define and test deterministic lifecycle behavior: duplicate active loads are idempotent, failed unload hooks still clean owner-scoped contributions, unknown unloads return false, and manager shutdown removes contributions without invoking unload hooks.
• Document resolver error propagation and duplicate/unload/shutdown semantics.

Ownership and integration boundaries

• Runtime owns Lua execution, extension lifecycle policy, owner-scoped rollback and structured Runtime errors.
• Backend issue #14 owns the confined filesystem resolver. Backend PR #16 adds trusted owner-thread C lifecycle entry points and translates Runtime error codes to Backend statuses. The current Backend candidate a906e3265daa6c1aa304a17a1b0dd07c07abfcf8 includes the Lua integration-target build fix and case-insensitive filesystem test correction; its Live Runtime and native/sanitizer CI passed.
• Extension administration remains a trusted local embedding API. This PR does not add extension.load / extension.unload Frontend Protocol commands and does not grant remote Drivers permission to load local code.
• CDIN's Composition Root PR #110 pins this Runtime candidate at 07d43f9b1aba96baf707635c5e821f6da217bb4f and Backend at a906e3265daa6c1aa304a17a1b0dd07c07abfcf8. The combined CDIN native/sanitizer run 42199285019 is pending; product-level capability grant/deny and failure-isolation evidence remains part of issue #111.
• Frontend issue #15 (GUI-SDL adapter) and PR #16 (Windows ConPTY TUI handles) remain Frontend-owned work and require no Runtime API change.

Verification

Runtime CI run 42198326330 passed:

• Linux / Lua 5.5
• macOS / Lua 5.4
• Windows / Lua 5.4
• Documentation and workflow validation
• Pipeline quality task

This PR is intentionally separate from the merged resolver-backed lifecycle work in Runtime PR #5. It references, but does not close, the broader Runtime, Backend or CDIN integration issues.

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-06T09:49:58.584158Z We couldn’t complete this review. Comment @codex review to try again.	da1fa74	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.