数据所有权与迁移
Package-owned storage, deterministic migration, upgrade and uninstall boundaries.
# Data Ownership
Declare every package-owned namespace. Store relations to host objects only as normalized identities and public display facts. Never claim forum, user, session or another package’s namespace as package-owned.
# DataStore
RuntimeContext::data 已绑定当前包，只公开 get(namespace, key)、put(namespace, key, value) 和 delete(namespace, key)。没有 query、list 或 transaction API；跨包 namespace 会在 ownership gate 被拒绝。
# Migration
Migration binds an immutable id, order, checksum and callable receiving scoped DataStore. Applied migrations are journaled and not run again.
# Upgrade
Construct and validate a complete target PackageManifest. The Kernel stages declarations, journals the operation, applies migrations and lifecycle work, then atomically publishes the candidate. Recover only with the same immutable candidate.
# Uninstall / Preserve
Uninstall policy is REMOVE, PRESERVE or an explicit package policy. Disable an enabled package before uninstall. Never delete host or foreign package data.