Add `FrozenProcessLocal` for immutable coordinator snapshots while
retaining the existing default wire-encoding rejection.
Prevent callers and msgspec config from replacing or omitting the
process-local sentinel. Wrap subclass validation hooks with base
checks so mutable and frozen structs cannot reopen the wire bypass.
Cover direct and nested encoding, shallow frozen behavior, sentinel
replacement, omitted defaults and hostile validation hooks.
Prompt-IO: ai/prompt-io/opencode/20260907T011533Z_5966e8aa_frozen_process_local.md
(this patch was generated in some part by `opencode` using `gpt-5.6-sol` (`openai`))
Separate serializable `BindspaceSpec` and `BindspaceIdentity` values
from a process-local `BindspaceHandle` carrying FD and ownership
authority.
Deats,
- add global `ProcessLocal` wire guards for local handle structs
- derive valid kinds and ownership from their `Literal` aliases
- require a positive inode while keeping the mutable name optional
- pin supplied FDs to identity inodes with `fstat()`
- cover round trips, nested encoding and stale capabilities
Caught-during: review remediation
Found-via: `/run-tests` test_bindspace_handle_pins_local_capability
Prompt-IO: ai/prompt-io/opencode/20260822T042026Z_29141f0b_prompt_io.md
(this patch was generated in some part by `opencode` using `gpt-5.6-sol` (`openai`))
Gud Boi