root/v0 package

untrusted-render: live is the only stored string Render echoes, and SetLive validates it with assertPkgPath before storing it.

Package root is the data realm of the "state realm + swappable logic" upgrade pattern (pattern C of the exploration; see ../../README.md).

root holds the state and nothing else worth changing. It grants write access to exactly one logic realm at a time, identified by package path off the crossing frame rather than passed in as an argument, so a logic realm cannot claim to be a path it does not occupy. Upgrading is a single SetLive call: no migration, no downtime, and the data never moves.