T09: crystallization

A stable agentic realization becomes deterministic code. All four exit
criteria met; 163 tests pass.

- crystallization.py: trajectory capture, stability assessment requiring the
  same path across several runs, CrystallizedDriver, pytest codegen
- crystallized/test_grant_access.py: generated, runs with no model, carries
  its lineage in the docstring
- descendant preserves the ancestor's oracle set, agrees with it across five
  lab versions, and still catches a seeded defect
- reversibility shown both ways via new M24 (grant endpoint renamed): the
  frozen descendant fails loudly rather than searching, and the agentic
  ancestor recovers from the same mutation

F-0007 (open): the 54% cost reduction must not be quoted in support of the
thesis. The T07 runtime is token-free, so the measured saving is one page
fetch, one parse and a two-candidate scoring pass. The saving the concept
actually claims - tokens, latency, retry variance - is unmeasured. Together
with F-0005 this makes a bounded live-model experiment the highest-value next
investment.

Assertions in the generated test are imported rather than restated, so it is
not fully standalone. Deliberate: paraphrased claims would be a second
unverified statement of intent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1629012@bnt-lap001
Assistant-Session: 78d4fb13-8a1e-474b-87a3-9b9261c49a39

lab/http_api.py

@@ -68,7 +68,7 @@ def _render(app: LabApp, user_id: str, resource_id: str) -> str:
 
     share_form = (
         f'<form id="share" data-td="share-form" method="post" '
-        f'action="{_resource_path(app, resource_id)}/grant">'
+        f'action="{_resource_path(app, resource_id)}/{app.api_grant_path}">'
         f"{fields}"
         f'<{tag}{href}{role} id="share-submit" data-td="share-submit">'
         f"{share_label}</{tag}></form>"
@@ -196,7 +196,7 @@ class LabHandler(BaseHTTPRequestHandler):
         if self.app.ui_field_names == "renamed" and "recipient" in body:
             body["subject_id"] = body.pop("recipient")
 
-        if url.path.endswith("/grant"):
+        if url.path.endswith(f"/{self.app.api_grant_path}"):
             self._dispatch("grant", resource_id=resource_id, **body)
         elif url.path.endswith("/revoke"):
             self._dispatch("revoke", resource_id=resource_id, **body)