feat(ts): remap checked semantics without collapsing source owners

Cross-file payload relocation (#494) now preserves canonical structural keys and declaration identities, but checked semantics still refer to the source owner's type, string, and node IDs. Integration under #480/#487 needs an independently owned, explicitly remapped semantic record for each source owner, not a blind merge of same-named tables into the importing checker.

Implement a checked-metadata transfer operation covering every retained table and every nested identifier/reference. Preserve non-ID fields (parameter positions, flags, counts, virtual-section offsets) unchanged. Deep-copy owned slices/nested containers and display text. Reject invalid/unmapped references and mapped-key collisions without mutating the source or publishing a partial record. New metadata fields must require explicit transfer classification.

Test all field shapes with distinct type/string/node mappings; source destruction; exhaustive allocation failure; and independent compiled declarations with same names but different constraints or predicates. Exercise imported rest-signature relations against the destination interner. Real source provenance must be retained as source-owner/node references in integration tests, not fabricated source locations.

This is a semantic-transfer prerequisite, not graph readmission. Actual program resolution, source-aware lookup, merging, cycles, and invalidation remain under #480/#487. Run existing shared positive/negative CLI controls against TS 6.0.3 and native TS 7.0.2; document unchanged failures and do not collect timings until admission passes.

The owner-scoped checked-metadata clone is implemented. An exhaustive table enum classifies every retained map, and nested record schemas distinguish type/string/node IDs from counts, parameter indexes, flags, and source-relative offsets. Adding an unclassified table or nested field fails compilation. Slices, display bytes, and nested containers are independently allocated; callback-owned provenance/string allocations remain the caller's responsibility.

The focused suite passes 4/4 (three tests plus the module root), including every retained table populated, source destruction, exhaustive allocation failures, mixed-key assertions, sentinel preservation, invalid mappings/references, mapped-key collisions, and successful retry. The API returns a separate per-owner record and rejects many-to-one keys within a table; it never merges records from different owners.

A compiled-source integration regression and full suites are running. The regression deliberately shares a canonical boolean signature across two separately compiled guards with different predicates, retaining separate metadata records and real source-owner/node provenance. This is not yet called by program checking; graph/global admission still needs source-aware integration under #480/#487. No timing run or new speed claim.

Three conventional commits are pushed to main: owner-scoped semantic cloning 778597026, compiled-source isolation regressions 84dc71ca5, and permanent imported-owner audit 50ff4add4.

The new untimed audit uses five owner-isolation families, positive/negative pairs, and both explicit app-before/app-after root orders. Every compiler sees identical strict/noEmit/noLib/skipLibCheck projects and genuine imports from two modules. Verified TS 6.0.3 and native TS 7.0.2 pass 20/20 each; Home's preceding release (SHA-256 860760ccee9bd0935b3371da534756bf148c733bce540d51c86714e96dce962c) passes 8/20. Twelve Home failures remain in the default audit:

• Generic results/arguments, rest arguments, and readonly controls: invalid programs accepted (six cases).
• Predicate controls: two valid programs rejected; two invalid projects emit extra/wrong diagnostics because imported guards do not narrow unknown values.
• Private-origin assignments: two invalid projects rejected with TS2741, not expected TS2322. These are diagnostic mismatches, not false acceptance.

Both root orders behave identically. The new controls are not timed and do not readmit graphs. The transfer operations remain separate from program checking; source-aware resolution, merging, cycles, and invalidation are still required. Full tests pass: 4,249 checker, 179 driver, 101 program, 69 CLI, 33 harness/report. The compiled regression deliberately shares one canonical guard signature while keeping string/number predicates and real source origins owner-isolated. Release rebuild verification and final documentation are in progress.

This checkpoint is pushed to origin/main in four conventional commits, using Chris Breuer as author without coauthors:

• 778597026: owner-scoped checked semantic transfer with exhaustive field classification, deep ownership, invalid-reference/collision checks, and allocation-failure tests.
• 84dc71ca5: independently compiled owner-isolation regression, including shared canonical guard signatures with distinct predicates and real source-owner/node references.
• 50ff4add4: permanent imported-owner positive/negative audit in both root orders.
• 3026742a0: results, reproduction commands, limitations, and linked README table.

Final tests: 4,249/4,249 checker; 179/179 driver; 101/101 program; 69/69 CLI; 33/33 harness/report. The focused transfer runner passes 4/4 including its module root. The ReleaseFast retry completed successfully; the final binary SHA-256 is 4ad8003e751e1471db6f7ea855c3bf8a3822063e89ddb793b85d3714efe93393. The first release attempt did not produce a verified artifact while disk space was low; it is not used as evidence.

Fresh CLI checks against version-verified TS 6.0.3 and native TS 7.0.2 confirm:

• All eighteen positive workloads pass; Home passes sixteen workload gates and fails both graph rejection gates.
• All 42 tuple and 36 assertion controls pass.
• Global audit: TS 6 and TS 7 each 44/44; Home 30/44 (fourteen failures across 132 checks).
• Imported-owner audit: TS 6 and TS 7 each 20/20; Home 8/20 (twelve failures across sixty checks), unchanged from the preceding binary. These include false acceptance, rejected valid predicate narrowing, and wrong diagnostic codes for private-origin assignments; the docs distinguish them.

#500 is complete for semantic cloning, not program integration. Neither transfer operation is called by program checking. #480/#487 remain open for source-aware typed lookup, merging, cycles, owner-specific caching/invalidation, and coordinated publication of payloads plus metadata. A metadata clone failure does not undo a previously committed payload transfer. Registry handles must not be treated as local HIR nodes, and name-keyed semantic records must not be blindly merged across owners.

No graph is readmitted and no timing run or speed claim was made. Frozen tuple/predicate inputs are unchanged. See the documented checkpoint; local evidence is retained in bench/vs_tsgo/results/checked-transfer.IO4A4Q.