Identity exposure through GetAssetInfo

[snkmcb]

The first half of v0.4.0: identity leaves the process. The other half —
on-disk persistence — is not in this PR.

What ships

GetAssetInfo publishes the four neutral values of
RESOLVER.md §3 in ArAssetInfo::resolverInfo:
resolvedIdentifier, size, validationToken, stability. The token is the
backend's captured validator, opaque here and opaque all the way out.

What decided the shape of the surface is in the consumer, not here.
usd-pointcloud-plugins reads ArAssetInfo::version, falls back to
GetModificationTimestamp, and classifies the result itself — a non-blank
identifier plus a non-blank token is Stable — consulting no stability field.
The fail-safe therefore cannot ride next to the token, because in the field a
consumer actually reads, nothing rides next to it. Three rules follow:

• version carries a token only for a Stable identity. A weak validator's
  token goes in the annotated dictionary, where stability stands beside it: a
  weak validator that changed is still evidence the asset changed, and it is
  proof of sameness that weak cannot give.
• GetModificationTimestamp is invalid, permanently, and now overridden
  rather than inherited so the reasoning sits where the tempting mistake would
  be made. A fabricated time would be turned into a resolver-mtime: identity
  by that same consumer fallback — manufacturing a durable identity for an asset
  that has none.
• A contradicted identifier stops being reusable. ArAssetInfo is keyed by
  path and this resolver hands out one reader per open, so after a republish
  underneath a live process there is no way to say which revision a caller
  holds. Stable degrades to Unstable and version empties for the rest of
  the process; the current token stays visible as evidence of change.

Asset info is answered from the open this process already performed, never from
a metadata request issued to answer the question — cheaper, and more to the
point more correct: the identity a consumer needs is the identity of the bytes
it is holding, and a HEAD issued now describes whatever is published now.

A crash this surfaced, fixed here

A reader retained by Resolve and never opened is destroyed with the resolver,
during static destruction, and folded its counters into a process metrics
aggregate that had been destroyed first — the aggregate is constructed at the
first reader and so is destroyed before the resolver constructed before it.
Reachable since v0.2.0 by any host that probes for existence and exits;
invisible until a test left a retained open behind. It presents as a
segmentation fault after the suite prints ok.

The aggregate is now never destroyed and the opt-in
USD_HTTP_RESOLVER_METRICS_DUMP runs from std::atexit. The regression test
asserts nothing in a CHECK: it resolves an asset it never opens, and the exit
code does the asserting.

Tests

• httpResolver_identity, new, offline, one translation unit: strong, weak,
  Last-Modified, absent, contradicted, a strength with no kind, and both
  credential shapes. The defect it exists to catch does not fail here — it fails
  in a consumer, weeks later, as a generated cache that served the wrong bytes.
• httpResolver_stage, seven new cases over a real socket: the four fields, the
  version rule per stability class, a republish that withdraws reusability, an
  invalid timestamp, an identity that costs no second metadata request, and the
  teardown case above.

Lane	Result
plugin (MSVC / Release, OpenUSD + fixture server)	30/30
core (no OpenUSD)	25/25
core-asan (address,undefined, GCC 15.2)	25/25
core-tsan (thread, GCC 15.2)	25/25

Documents

RESOLVER.md §3 rewritten and no longer "Planned"; consumer-integration.md §4.1
records how the consumer reads the surface, because a rule whose reason lives in
another repository is a rule somebody will relax; ADR-0001's second open question
answered, ADR stands. CAPABILITY_MATRIX, WORKSPACE, implementation-status, the
roadmap, the bundle README, and CHANGELOG follow. The README also loses two
claims v0.3.0 had already made false: that the bundle performs no caching, and
a configuration table listing five variables out of nine.

🤖 Generated with Claude Code