v2-platform: 04 grafting engine in the real host — mount registry + one-plugin tracer bullet

Parent

#274 (v2 platform services spec)

What to build

Route grafting in the real host, as proven by the beta-v2 web-grafting prototype: a mount registry derived from pathless layouts, the composition function that grafts web-plugin route trees into mounts (reparenting only the subtree root, namespacing route ids per plugin), MF shared-singleton scope participation, and SSR-by-exclusion for session-gated mounts. The tracer bullet is ONE real web plugin grafted at one mount and served by the actual host — with the prototype's headless verify scripts promoted into the real test suites. The prototype code and its documented findings (including the corrections it produced) are the specification.

Acceptance criteria

• One real web plugin's route tree is grafted into a host mount with zero host-side routing code for that plugin
• Route ids are namespaced; duplicate leaf URL paths across plugins resolve first-wins without breaking either plugin
• Auth/apiClient context flows to grafted routes through root-route context
• Session-gated mounts server-render nothing; public mounts SSR fully
• The prototype's composition/SSR/collision verify scripts run as part of the real test suites
• The host joins the MF shared scope with React/router as eager singletons (no double-instance footgun)

Blocked by

• Epic #248 (oRPC v2 / Effect 4 migration) — grafting lands on the migrated platform.

Start with the beta-v2 web-grafting prototype and its documented findings, then trace the real host and the prototype's composition, SSR, and collision verify scripts. Done means one real web plugin is served through a host mount, the listed routing, context, SSR, collision, and shared-scope criteria pass, and the scripts run in the real test suites.