feat(runtime-host): extract Usage/Pricing authority

[M4n5ter]

English

Summary

This extracts the Usage/Pricing domain as one complete Runtime Host authority slice:

• one lease-bound telemetry and pricing writer per Interactive root;
• awaitable telemetry admission with single-flight loading, flush, drain, close, and observable publication failure;
• an independent pricing revision with compare-and-swap mutation;
• bounded, exact v0 Host operations for usage projection and pricing query/mutation;
• loss-aware bounded projection for protocol-visible identities;
• lossless, idempotent migration of existing unversioned telemetry, tool invocation, and embedded pricing data;
• Desktop compatibility wiring that keeps the existing product behavior behind the current non-serving Host activation gate.

This is part of the M3 extraction tracked by #1167 and follows the ownership/lifecycle direction in #853.

Why these belong together

Runtime model and tool execution publish detailed telemetry, while cost projection resolves pricing against the same root-scoped usage history. Splitting the writer lifecycle from pricing mutation would leave either an unowned persistence path or an incomplete execution prerequisite.

The slice still keeps two projections separate:

• SettingsStore.usageStats() remains the Session-derived dashboard projection.
• The telemetry authority owns detailed LLM/tool logs, buckets, summaries, and pricing overrides.

Neither projection becomes a compatibility alias for the other.

Authority and lifecycle

• Authentic Interactive write leases are required to open the writer facade. Reads either re-enter the lease or return detached immutable snapshots.
• The low-level Pricing Store is no longer a public package entry point. Host code reaches telemetry and pricing only through the lease-bound facade.
• Concurrent loads are single-flighted and retryable after a failed attempt. Load state is committed only after the complete attempt succeeds, while close joins every load and mutation admitted before draining.
• Telemetry mutation admission owns and validates its input before returning a Promise<void>. Accepted publications participate in the facade barrier, so drain and close cannot silently abandon them.
• Pre-rename publication failure preserves the previous readable state. A post-rename directory-sync failure makes the commit outcome unknown, poisons subsequent reads, and asks the Host to drain.
• A live root whose marker or filesystem identity changes is also treated as poisoned and asks the Host to drain. Transient setup and I/O failures do not trigger that terminal transition.
• Pricing mutations compare an expected revision against the current revision. Exactly one competing mutation can commit; a loser receives the current revision and may query before retrying.
• Host outcomes are classified at the Storage facade boundary. The coordinator does not inspect Store implementation errors or persistence object shapes.

Existing data

An unversioned telemetry.json may contain LLM usage records, tool invocations, and embedded pricingOverrides. Opening the authority:

1. validates and normalizes the legacy records without dropping current diagnostics or token aliases;
2. publishes canonical telemetry and a separate revisioned pricing document through atomic filesystem replacement;
3. remains safe to retry after interruption without duplicate records or a second writer.

No compatibility layer is added to the unreleased integer v0 Host protocol.

Protocol boundary

The Host exposes only three closed operations:

• usage.query
• pricing.query
• pricing.mutate

Usage pages have item and byte bounds. Pricing pages are pinned to a revision and use a strictly advancing numeric offset. Client-side response correlation rejects a valid-looking response whose source, request kind, revision, or offset does not match the canonical request.

Protocol-visible identity fields preserve ordinary short values. If control-character canonicalization or byte truncation would otherwise make distinct identities collide, the projection keeps a bounded readable prefix and a digest of the original JavaScript identity. Display labels remain plain bounded text.

Desktop and activation boundary

Desktop continues to host the raw compatibility writer in-process for M3. It resolves and validates the Interactive root before opening the embedded repository, but does not yet acquire the Runtime Host owner/lease. Current production Candidate wiring remains deliberately non-serving and cannot reach the execution composition that opens this authority, so the two writers cannot coexist through a supported product path in this milestone.

Removing this embedded writer and switching surfaces to the Host remain M4/M5 work. Acquiring ownership around the compatibility writer or completing that cutover is a hard gate before a serving production Host may open the same root.

Validation

• Scoped Biome checks, root typecheck, and the production build pass.
• Storage passes 749 tests with one existing skip; Runtime Host passes all 334 tests.
• Core, Runtime telemetry/cost, and the affected Desktop tests pass.
• Independent correctness and maintainability re-reviews found no remaining P0-P3 issues in this slice.

简体中文

概要

本 PR 将 Usage/Pricing 领域作为一个完整的 Runtime Host authority slice 提取：

• 每个 Interactive root 只有一个受 lease 约束的 telemetry 与 pricing writer；
• telemetry admission 可等待，并具备 single-flight load、flush、drain、close 与可观察的
  publication failure；
• pricing 使用独立 revision 与 compare-and-swap mutation；
• 为 usage projection 与 pricing query/mutation 提供有界、精确的 v0 Host operation；
• protocol 可见 identity 使用 loss-aware bounded projection；
• 无损、可重入地迁移现有无版本 telemetry、tool invocation 与内嵌 pricing 数据；
• 在当前 non-serving Host 激活门禁下保留 Desktop 产品行为。

本 PR 属于 #1167 追踪的 M3 提取，并遵循 #853 的 ownership/lifecycle 方向。

为什么放在同一个 Slice

Runtime 的模型与工具执行会发布细粒度 telemetry，而 cost projection 会针对同一个
root 的 usage history 解析 pricing。若将 writer lifecycle 与 pricing mutation 拆开，
会留下未归属的持久化路径，或一个不完整的 execution 前置。

本 slice 仍明确区分两种 projection：

• SettingsStore.usageStats() 继续提供从 Session facts 派生的 dashboard projection。
• telemetry authority 负责详细 LLM/tool logs、buckets、summary 与 pricing overrides。

两者都不会被降格为另一方的兼容别名。

Authority 与生命周期

• writer facade 只能由真实的 Interactive write lease 打开。read 要么重新进入 lease，
  要么返回已完整复制的 immutable detached snapshot。
• low-level Pricing Store 不再是 package public entry point。Host 只能通过 lease-bound
  facade 访问 telemetry 与 pricing。
• 并发 load 会 single-flight，失败后可以重试。只有完整 load attempt 成功后才提交
  实例状态；close 会等待 draining 前已经接纳的 load 与 mutation。
• Telemetry mutation 在返回 Promise<void> 前取得并验证输入所有权。已接纳 publication
  会进入 facade barrier，因此 drain/close 不会静默丢弃它们。
• rename 前 publication 失败仍保留之前可读的状态；rename 后 directory sync 失败表示
  commit outcome unknown，会 poison 后续读取并请求 Host drain。
• live root 的 marker 或 filesystem identity 变化也会被视为 poison 并请求 Host
  drain；瞬态 setup/I/O failure 不会触发这一终态转换。
• Pricing mutation 将 expected revision 与当前 revision 比较。并发 mutation 只有一个
  能提交；失败者取得当前 revision，并可在 query 后重试。
• Host outcome 在 Storage facade 边界分类。coordinator 不再识别具体 Store error 或
  探测 persistence object shape。

现有数据

无版本 telemetry.json 可能同时包含 LLM usage records、tool invocations 与内嵌
pricingOverrides。authority 打开时会：

1. 验证并规范化 legacy records，同时保留现有 diagnostics 与 token alias；
2. 通过原子文件替换发布 canonical telemetry 与独立的 revisioned pricing 文档；
3. 中断后可安全重试，不重复记录，也不会出现第二个 writer。

本 PR 不为尚未发布的整数 v0 Host protocol 增加兼容层。

Protocol 边界

Host 只暴露三个封闭 operation：

• usage.query
• pricing.query
• pricing.mutate

Usage page 同时受 item 与 byte 上限约束。Pricing page 绑定 revision，并使用严格前进的
numeric offset。Client response correlation 会拒绝与 canonical request 的 source、
request kind、revision 或 offset 不匹配的“看似有效”回复。

普通短 identity 会原样保留。若 control-character canonicalization 或 byte truncation
可能使不同 identity 发生碰撞，projection 会保留有界、可读的 prefix，并附带原始
JavaScript identity 的 digest。display label 仍使用普通的有界文本投影。

Desktop 与激活边界

M3 阶段 Desktop 继续在进程内持有 raw 兼容 writer。它会先解析并验证 Interactive
root，再打开 embedded repository，但尚未取得 Runtime Host owner/lease。当前
production Candidate 接线刻意保持 non-serving，无法到达会打开本 authority 的
execution composition，因此本里程碑不存在受支持的双 writer 产品路径。

删除 embedded writer 并让各 surface 切换到 Host 仍属于 M4/M5。在启用 serving
production Host 前，必须先让兼容 writer 取得 owner，或完成 adapter cutover 并删除它。

验证

• scoped Biome、根级 typecheck 与 production build 通过。
• Storage 749 项通过、1 项既有 skip；Runtime Host 334 项全部通过。
• Core、Runtime telemetry/cost 与受影响 Desktop 测试通过。
• 独立 correctness 与 maintainability 复审未发现本 slice 剩余 P0-P3 问题。

[Astro-Han]

Reviewed current head 6b190c8. No P0–P3 findings. Usage and Pricing retain distinct durable authorities with bounded protocol, CAS, drain, and failure semantics; required CI is green.