fix(core): the last fixes' core half (W1 W2 W5 W19)

Stage 4 of docs/modules/rust/PLAN_LAST_FIXES.md, with the org lead's
2026-10-22 decisions.

W19: one module per site at boot, as at install. The first module
directory by name holds the site, whether or not it then loads; every
other is recorded startup_failed at the manifest stage, before a line of
its code is required, with a reason naming the module that holds the
site. Module-uo and Module-Rust side by side used to fail the second
with a slot collision. Loader, lifecycle, schema and event-contract
tests that loaded several fixture modules now load each case alone.

W1: a reconcile files a resource the game no longer has, and that is
past its `until`, as expired rather than orphaned, with the same log
line expired() writes. No MODULE_API bump: `until` and reconcile's
answer are unchanged.

W5: a dry run that passes on the draft is kept with the fingerprint of
the validated spec (three nullable columns on event_definitions).
Publish stamps the new version verified, with that dry run's reviewer
and time, when the spec it freezes has the same fingerprint, and writes
version.verified on the occurrences it re-pins. Verify answers
draftRecorded and publish answers verified; OpenAPI regenerated.

W2: the run console says "Phase p1: steps done, waiting to advance" and
"Why this phase has not advanced", not "has not started".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/test/moduleSchema.test.js

@@ -150,23 +150,18 @@ test('fragments are split exactly the way core schema.sql is', async () => {
 
 // ── Failure is a state ─────────────────────────────────────────────────────
 
-test('a fragment that throws fails its own module and no one else', async () => {
-  writeModule('aaa', { schema: 'CREATE TABLE IF NOT EXISTS aaa_x (id INT);' })
+test('a fragment that throws fails its module, not the boot', async () => {
   writeModule('bbb', { schema: 'CREATE TABLE IF NOT EXISTS bbb_boom (id INT);' })
-  writeModule('ccc', { schema: 'CREATE TABLE IF NOT EXISTS ccc_x (id INT);' })
   const loader = freshLoader(tmpRoot)
   const rec = recorder('bbb_boom')
 
   // Never throws — this is called on the boot path, between core's schema and
-  // seedDefaults(), and one bad module must not stop the site coming up.
-  await replayFragments({ query: rec.query, modules: loader })
+  // seedDefaults(), and a bad module must not stop the site coming up.
+  await assert.doesNotReject(() => replayFragments({ query: rec.query, modules: loader }))
 
-  assert.equal(stateOf(loader, 'aaa').state, 'registered')
   assert.equal(stateOf(loader, 'bbb').state, 'startup_failed')
   assert.match(stateOf(loader, 'bbb').reason, /ER_PARSE_ERROR/)
-  // The one that matters: the module AFTER the failure still got its tables.
-  assert.equal(stateOf(loader, 'ccc').state, 'registered')
-  assert.equal(rec.ran.length, 3)
+  assert.equal(rec.ran.length, 1)
 })
 
 test('a fragment stops at its first failing statement', async () => {
@@ -217,15 +212,13 @@ test('a module that failed validation is not replayed at all', async () => {
   // It is never going to run, so creating its tables would leave an operator
   // with rows belonging to a module that does not load.
   writeModule('bad', { schema: 'CREATE TABLE IF NOT EXISTS not_prefixed (id INT);' })
-  writeModule('good', { schema: 'CREATE TABLE IF NOT EXISTS good_x (id INT);' })
   const loader = freshLoader(tmpRoot)
   const rec = recorder()
 
   await replayFragments({ query: rec.query, modules: loader })
 
   assert.equal(stateOf(loader, 'bad').state, 'startup_failed')
-  assert.equal(rec.ran.length, 1)
-  assert.match(rec.ran[0], /good_x/)
+  assert.equal(rec.ran.length, 0)
 })
 
 // ── The seed script ────────────────────────────────────────────────────────