embedder boundary: missing record/flags labels lower silently; multi-store lift failures escape as AssertionError #170

From the 2026-08-20 conformance review. Neither item is guest-reachable — both concern the fault vocabulary at the embedder (host-input) boundary. Grouped because the fix discipline is shared: host misuse should fail loudly with a host-error vocabulary, never silently and never with internal AssertionErrors.

1. Missing record/flags labels from embedder values lower silently

runtime/src/cabi/store.ts ~257-268 (packFlagsIntoInt) and ~210 (storeRecord), runtime/src/cabi/lower.ts ~140 (lowerFlatRecord) vs definitions.py:1782-1786/1808-1814: the reference raises KeyError (host-precondition failure) when a record/flags value lacks a label; deltic's v[l] ? 1 : 0 treats a missing flag as unset — a silent wrong answer — and record lowering passes undefined downstream to fail later (or, for bool fields, silently store false via truthiness).

Suggested: a loud typed host error (TypeError-class, matching e.g. HostBuffer's misuse errors) on missing labels at the lowering boundary.

2. Multi-store lift failures escape as AssertionError inside a guest activation

runtime/src/cabi/async_values.ts ~108-126: liftAsyncValue can throw an internal assert_ when a shared stream/future object bound to another Store is passed in (host misuse: multi-copy/multi-store plumbing). The failure surfaces inside a guest's lift as a non-Trap, non-host-error throw — a different fault vocabulary from every other guest-reachable failure on that path. Same class: lowerStream/lowerFuture element-mismatch asserts (~166-199), host-boundary-only in practice since guest↔guest transfer routes through FACT's trapIf checks.

Suggested: classify these as host errors (the cross-copy refusal machinery in embedder/copy.ts is the existing precedent for loud, named multi-copy diagnostics).

Classification from the review: B (undocumented divergences at the host boundary), high confidence on the differences, medium on urgency.