Advance operation contexts from a validated WAL prefix #777

1. Background Context

Echo retains immutable operation observations and logical-request bindings in its native WAL. PR #727 supplies this protocol; its merged implementation reconstructs validated history for each context lookup or append.

2. Problem Description

Healthy context operations repeatedly decode the committed WAL prefix. A fresh Docker regression on the integrated prerequisite observed 48 additional recovery calls and 376 decoded frames during eight capture/read/bind/retry cycles. This is work-count evidence, not a throughput or physical-I/O measurement.

2b. Proposed Solution

Derive an operation-context index and writer cursor from one validated committed prefix. Advance the index only after acknowledged appends. Invalidate it on every append error and reconcile the actual prefix before identity checks or another write.

2c. Alternatives considered and rejected

Repeated recovery: preserves semantics but repeats prefix work.
Independent persistent context store: creates unnecessary authority and consistency obligations.

2d. Acceptance Criteria

• Healthy context operations perform no additional filesystem recovery after opening.
• Before-commit failures reconcile safely; durable-but-reported-failed records retain original identity and bytes.
• Exact retries recover the original request; changed semantic input refuses.
• Read-only fallback does not restore permission to append from an uncertain cursor.
• Existing WAL format, durability and default behavior remain compatible.

2e. Test Plan

Golden: capture/read/bind/retry work-count witness plus existing host/pipeline/WAL/CLI suites.
Edges: reopening, duplicate identities, changed input, in-memory rollback.
Known failure modes: faults at append-frame, flush-commit and commit-marker-synced boundaries.
Fuzz and stress: bounded deterministic fixtures; no unbounded campaign or timing claim.

3. Prerequisites

• Retain observation-bound executable requests across host loss #727 merged: it owns the observation/request protocol this derived index accelerates. Retained strands are not a correctness prerequisite.

4. Scope

In: validated-prefix context cache, error invalidation/reconciliation, executable work counters and opt-in diagnostic reporting.
Out: retained strand admission, new persistent authority, WAL format changes, production Keep adoption and new benchmark claims.

5. Why now

Land the useful independent #729 outcome before repairing retained strands.

6. Risks

Stale indexes after uncertain durable append; mitigate with fail-closed invalidation and committed-prefix replay before writes. Recovery history remains authoritative.

7. Definition of Done

One independently mergeable PR passes relevant guarded Docker checks and current CI, receives exact-head independent review, and links its main integration commit here. Main continues operating without retained-strand features.

8. Stakeholders

Echo trusted-host maintainers and local scripted consumers.

9. Related Issues

Original implementation PR #729; merged prerequisite PR #727; later retained-strand PR #728. The new PR supersedes #729 only after its independent outcome lands.