Miracle: add and harden synthetic Decision/KL and replay-reading mechanisms

[thugongheng]

Summary

This Draft PR contains three isolated commits:

1. b8ec009 adds synthetic/fake-only Decision Space/KL and canonical replay-reading mechanisms.
2. 12f230a records the approved Miracle target contract and explicitly marks legacy KL boundaries.
3. 504acbb closes three reviewer-confirmed trust and numerical-validation blockers.

Decision Space / KL contract

The isolated core implements:

• atomic Judge operation as the game decision boundary;
• state-local, complete, ordered ActionSupport + support_id;
• D_KL(old||new) using the natural logarithm;
• no smoothing;
• new-policy occupancy;
• trajectory arithmetic mean;
• unit nats / decision;
• acceptance boundary mean <= 0.01;
• structured failure with no scalar when old > 0, new = 0.

Each trajectory decision rebuilds ActionSupport from state_before and revalidates support identity and complete old/new distributions. Uploaded or self-reported KL scalars are not accepted as evidence.

Replay Reading boundary

Replay Reading remains synthetic/fake-only. It:

• accepts only canonical UTF-8 JSON;
• binds replay, case, role, seeds, policy/champion and match-plan identities;
• rebuilds and verifies ActionSupport for every frame;
• verifies chosen action, state chain and terminal state;
• requires issuer-created context;
• reopens and revalidates source bytes for every render;
• does not invent rationale.

The production replay approval set is empty.

Reviewer blocker hardening

The hardening commit closes:

1. Public caller-supplied ActionSupport trust bypass:

   • the public local-KL calculator was removed;
   • trajectory calculation remains the trusted entry and rebuilds support internally.

2. Subnormal probability instability:

   • KL now uses old * (log(old) - log(new));
   • new = 5e-324 produces a finite value of approximately 744.44;
   • new = 0 retains structured old_positive_new_zero failure.

3. Replay JSON weak-type equality:

   • regenerated ActionSupport uses canonical JSON byte equality;
   • 0 -> 0.0 and 0 -> false mutations are rejected even after replay/manifest SHA rebinding and test-only approval injection.

Validation

• Core mechanisms: 71 passed
• Related regressions: 98 passed
• LF commit-tree full suite: 738 passed, 9 skipped

The 9 skips are not counted as passes:

• 4 Results pipeline tests require the Results aggregate/report builder.
• 5 vendor-boundary tests require the upstream aggregate/report builder.
• AGENTBENCH_RESULTS was intentionally unset.

On the direct Windows checkout, the full suite reports 647 passed, 91 failed, 9 skipped because the unmodified minimal_bootstrap_strategy.py checkout has CRLF bytes while its approved Git blob is LF. A raw LF commit-tree copy matches the approved bootstrap SHA and passes all 738 runnable tests. No bootstrap file, approved SHA or validation logic is changed here.

Explicit non-goals

This PR does not:

• wire Miracle runtime KL;
• add tracking, reports or Results integration;
• run formal evaluation or benchmark flows;
• validate or approve real replay assets;
• provide a human-authored Replay Skill;
• complete the broader HL Checklist;
• establish authoritative readiness.

authoritative readiness = false