fix: preserve source text and bound JSON escape expansion

[iperev]

Summary

• Preserve canonical internal UTF-8 text in the private source model, reject invalid UTF-8 without disclosure, and apply unfinished-invariant policy only to its semantic roles.
• Preserve existing stable scenario identifiers without requiring an SCN prefix; retain source-local uniqueness and typed reference closure.
• Correct the codec bound from three to six output bytes per admitted text byte. The maximal-control-text witness fails under the old formula and checks the next rejected input unit, exact escaping and the complete model/format/parse round trip.
• Prepare compatible patch 0.14.3 and update the independent release-note oracle without weakening its mutation controls.
• Close RELEASE-02 against retained replacement-artifact, installed-wheel and provider-yank evidence. All four inaccurate 0.1.159 PyPI wheels are yanked with the compatibility-and-license reason. Immutable release history is unchanged; signed protected-tag policy remains open as RELEASE-01.

Scope

The candidate model and codec are not linked into the public CLI. This PR does not expose source-v2, migrate current sources, introduce a scenario/binding join, select a DSL, change platform requirements or complete the global roadmap. No consumer repository or installed engineering skill is changed. Design and implementation notes remain outside the product repository.

Validation

Targeted model/codec suites, race checks, release-change and release-manifest suites passed on the repaired worktree. A retained native counterexample established the escape-bound defect before repair.

The complete npm run check passed on clean commit ad4070732e398e3e9ebde8a5ebd886a2091ab0f8, using repository-pinned npm 12.0.2. The final head is unchanged and the worktree remained clean. This includes all Go, static-analysis, vulnerability, package, self-hosting and release-closeout gates and 315 browser tests across the three configured engines. The retained stdout SHA-256 is 0e188325fc2f92dc5fb72af268910beb796cb9c0d15851b24940b04bf31df7bb; stderr SHA-256 is c2b32d6baf0ef3bf3975850392adc7e495629c028e8ce9bfd98cce21d3795f7d.

The successor checklist and governance reviews reported no findings and closed their assigned source-level escape-bound obligations. The broader review-campaign aggregate remains unproven: host-enforced writer isolation, campaign-wide causality partition and a global discovery fixed point were not established. These non-claims do not replace the retained native red/green falsifier or the exact-commit gates; this PR does not claim a globally perfect architecture.

Review And Retrospective

The first lexical review found a missing worst-case bound after widening text admission. The old fixed-size sample was replaced by a maximal-admitted witness with a next-unit control; no timeout, retry or admission weakening was used.

A successor review correctly refused to infer the formula from call sites because its root-prepared file set omitted the formula owner. The corrected review input derives in-repository production dependencies, includes every changed model/codec file, and asserts the named predicate owners before dispatch. Prior unresolved results are retained, not reported as passes.

Registry publication, postmerge CI, attestations, consumer deployment and production readiness are separate evidence boundaries.