feat(runtime): derive durable request preservation diagnostics

[Astro-Han]

Status: closed, deferred

I am closing this PR because cache-usage and cost reporting do not require this diagnostic, and the value of maintaining a continuous request-comparison result has not been established. The branch is retained so this work can be reopened if a concrete need emerges. The independently useful authority cleanup in merged #4300 is retained. The implementation and verification below describe the closed proposal, not a shipped feature.

Summary

Workstream 2 of #4299 derives one durable backend diagnostic from the canonical prepared-request observations merged in #4300:

• Runtime selects one causal predecessor from durable retry, step, continuation, and previous-root lineage.
• Runtime compares ordered cacheable semantic segments and returns no_predecessor, preserved, diverged, unknown, or unavailable.
• The verdict is sealed into the existing latest_context projection and exposed through the existing Runtime Host Context Diagnostics protocol.
• Desktop does not consume or present this diagnostic. A separate product/UI workstream must first establish a user role, decision, and action before adding any surface.

This PR was originally stacked on #4300 in GitHub Stack #4303. #4300 is merged; PR2 is now rebased directly onto current main.

Lifecycle and ownership

sequenceDiagram
  participant Host as Runtime Host
  participant Runtime
  participant Ledger as Canonical attempts + durable lineage
  participant Projection as latest_context
  participant Protocol as Context Diagnostics

  Host->>Runtime: admitted main call + providerStateIdentity
  Runtime->>Ledger: read retry / step / continuation / previous-root lineage
  alt predecessor state is durable
    Ledger-->>Runtime: one predecessor, none, or ambiguous
    Runtime->>Runtime: compare ordered cacheable segments
    Runtime->>Projection: commit verdict with canonical attempt
  else causal predecessor is not readable yet
    Ledger-->>Runtime: unresolved
    Runtime->>Projection: commit internal rebuild marker with canonical attempt
    Projection-->>Protocol: public unavailable result
    Ledger-->>Ledger: predecessor later becomes durable
    Host->>Runtime: later diagnostics query
    Runtime->>Ledger: rebuild from final durable facts
    Runtime->>Projection: CAS-repair final verdict
  end
  Projection-->>Host: sealed context diagnostics
  Host-->>Protocol: validate and return bounded backend result

Loading

Ownership remains single-source:

• ModelCallAttempt.requestObservation from refactor(runtime): make dispatched attempts own request observations #4300 is the only observation DTO.
• Durable RootTurnAdmission and AgentRun lineage select the predecessor; there is no mutable session-wide last value, append-order guess, or wall-clock guess.
• Runtime Host's admitted providerStateIdentity qualifies the comparison domain, including connection revision and proxy configuration.
• latest_context remains a repairable projection, not a new event or authority.
• The internal rebuild marker never enters the Runtime Host protocol; callers still see only the five public states.
• Runtime Host compatibility epoch 88 fences the added closed protocol field from older peers.

Backend behavior

• Appending new tail content preserves the previous cacheable semantic prefix.
• Changing, removing, inserting, or reordering an earlier segment reports the first divergence.
• Opaque evidence returns unknown; it never proves preservation.
• Missing observation, ambiguous lineage, child/auxiliary lanes, or provider/model/connection/transport-domain changes return unavailable.
• A temporarily unreadable causal predecessor returns public unavailable but remains repairable; once durable facts are readable, warm, cold, and restart paths converge.
• A terminal predecessor with no dispatched request settles as unavailable and does not cause repeated ledger scans.
• Provider cache-read/cache-write usage remains an independent provider-reported fact; this diagnostic does not infer a cache hit or miss.

Verification

Focused Runtime verifier on rebased head a6a4aa1a36a3b8997df5edc389184b65bd3109dc: 48/48 passed.

Cumulative #4300 + #4302 backend verifier on the same head: 133/133 passed. It covers:

• the Core ModelCallAttempt observation codec,
• prepared-request observation derivation and request tracking,
• request-preservation comparison and durable lineage,
• delayed predecessor persistence and pending projection repair,
• terminal predecessors with no canonical attempt,
• warm/cold/restart latest_context behavior,
• strict Runtime Host Context Diagnostics protocol,
• production Host composition paths.

Additional checks:

• Core, Storage, Runtime, and Runtime Host builds passed after rebase.
• Runtime Host protocol epoch guard passed: 87 → 88.
• Biome check and git diff --check passed.

Scope and simplification

Final diff: 12 backend files, +1357/-47:

• production: +585/-13
• tests: +772/-34
• Desktop/UI: 0 files, 0 lines

The PR adds no separate observation DTO, copied-lineage migration, new Runtime event, parallel projection, provider wire capture, mutable last-request state, permanent dual-read/write path, or frontend presentation.

A later ablation audit superseded the earlier no-removals conclusion: the candidate-level invalid-event state can be removed, while blindly replacing the existing snapshot path with full recomputation breaks historical behavior. These experiments were not committed.

Non-goals

• any Desktop Inspector, badge, copy, visualization, or other UI/UX
• inferring provider cache hit, miss, eviction, TTL, or cache keys
• capturing provider-specific HTTP/WebSocket bodies
• changing Workstream 1 observation authority
• comparing across a conversation copy, provider, model, connection, revision, or known transport partition
• adding another provenance system or general-purpose request manifest