Hold 0115's creation, its capability answer and the core's lifetime (#115)

.github/coverage/pinned-surface

@@ -66,6 +66,7 @@ area    src/server/     Reaching a server: the address a person typed, which hos
 area    src/cache/      What is written to a client's storage and under what key. 0041 makes the key what stops two servers and two people on one device reading each other's entries, and everything that decides what the store is asked to hold is in the same directory.
 area    src/failure/    The one point every failure in the core is mapped onto the vocabulary in 0004. A defect here is a case falling through and a caller being told nothing went wrong.
 area    src/diagnostics/ What may leave the device through an event. 0071 decides that per field name and before the client's sink is called, so a defect here is a token, an account or an item identifier in a log somebody is asked to attach to a bug report.
+area    src/lifecycle/ The core's own lifetime: what a client hands to creation, which of those the core has, the bound a stop is given, and what a call does once a stop has been asked for. A defect here reports a stop as done while a lane it could not stop is still running, or lets a core that was asked to stop keep taking work, and 0115 puts both on the list of answers that go wrong towards making a call look like it succeeded.
 area    src/artwork/    Turning bytes that arrived over a network into pixels, which 0003 calls the most attacked surface this repository will carry, and the refusal of every format the core does not decode.
 
 module  src/session/mod.rs          The session handle and the secret store interface a client implements.
@@ -75,6 +76,7 @@ module  src/session/password.rs      0030's password: the one reading that spend
 module  src/session/quick_connect.rs  0031's cadence for asking about a Quick Connect exchange, its four endings, and which of the two values the server issued crosses to the client. A defect here is a backoff nobody decided on a route where the answer arrives from a person, a denial reported as a failure, or the value the core presents handed out beside the code.
 module  src/session/sign_out.rs   0114's two acts: what each of them takes away, the order that puts the local half of a sign-out before the request to the server, how work in flight ends, and what a removal that could not be completed reports. A defect here leaves a token in memory on a device somebody handed over, empties a library on an ordinary evening act, or tells an operator their data is gone when it is not.
 module  src/session/device.rs       The device identity, whose identifier is one part of the cache key 0041 derives and one half of the key a server puts a live session under, so a defect here reaches two other surfaces on this list.
+module  src/lifecycle/mod.rs   0115's creation, its capability answer, its stop bound and the lifetime a call is judged against.
 module  src/server/mod.rs           The server module and what it places at its own boundary.
 module  src/server/address.rs       The address a person typed, parsed and refused where it is not usable.
 module  src/server/certificate.rs   The one exception 0029 admits to certificate validation: which certificate an operator pinned for which server, and what a pin never vouches for. A defect here accepts a certificate nobody asserted was theirs, or turns one server's key into something that can answer for a name the person never typed.

src/lib.rs

@@ -27,7 +27,13 @@
 //! the one source all three clocks reach the core through, for the same reason:
 //! `docs/decisions/0102-the-clocks-every-deadline-is-measured-against.md` states
 //! a rule per clock, and a reading taken anywhere else would be a deadline no
-//! test can move.
+//! test can move. [`lifecycle`] holds what
+//! `docs/decisions/0115-creating-and-stopping-the-core.md` decides about the
+//! core's own lifetime: what a client hands to creation, which of those the core
+//! has, the bound a stop is given, which lane a stop that expired names, and
+//! what a call does once a stop has been asked for. It is beside [`Core`] rather
+//! than inside one of the six because its subject is the core itself, and it
+//! starts no thread, for the same reason `server::transport` holds no socket.
 //!
 //! # What is deliberately not here
 //!
@@ -86,6 +92,7 @@ pub mod cache;
 pub mod clock;
 pub mod diagnostics;
 pub mod failure;
+pub mod lifecycle;
 pub mod measurement;
 pub mod playback;
 pub mod server;
@@ -112,6 +119,13 @@ const fn any_thread<T: Send + Sync>() {}
 
 const _: () = {
     any_thread::<Core>();
+    any_thread::<lifecycle::Lane>();
+    any_thread::<lifecycle::HowTheStopEnded>();
+    any_thread::<lifecycle::StopBound>();
+    any_thread::<lifecycle::WhatIsPresent>();
+    any_thread::<lifecycle::Supplied<'static>>();
+    any_thread::<lifecycle::WhatACallDoes>();
+    any_thread::<lifecycle::Lifetime>();
     any_thread::<session::Session>();
     any_thread::<session::device::DeviceIdentity>();
     any_thread::<session::device::Capabilities>();