feat(runtime-host): own session revision authority

[M4n5ter]

English

Summary

Make Runtime Host the canonical authority for exact, retryable Session branches and revisions through the v0 session.branch.create and session.revision.create commands.

A branch retains the selected source turn; a revision retains the conversation strictly before that turn. Both operations bind a Client-supplied target identity to the complete request, compare the expected source revision, and publish one cross-store conversation snapshot.

Revision authority

• Add closed, bounded protocol contracts for branch and revision creation.
• Use the source metadata revision as a compare-and-set boundary and reject active source Sessions before copying.
• Serialize the source, target, and revision-family root while unrelated Sessions remain independent.
• Keep exact retries stable across response loss and later source revisions; reject target identities reused for different work.
• Preserve branch and revision lineage, inherited execution configuration, labels, flags, title ownership, and connection locking.
• Commit a prepared revision when its first root turn starts.
• Recover interrupted publication by removing incomplete or unused revisions while retaining admitted revisions and their required ancestors.
• Restrict publication metadata to the stable-create authority so ordinary Session creation cannot forge a preparing copy.

Exact conversation copy

• Hide preparing targets from catalog reads until the cross-store publication commits.
• Copy the exact message boundary together with canonical Runtime events, AgentRun lineage, provider request telemetry, history-compaction checkpoints, Artifacts, and Task Ledger state.
• Allocate target-owned Session, Run, Invocation, RuntimeEvent, provider-trace, Artifact, and Task references; exact copies fail closed when an owned reference cannot be resolved.
• Include retained legacy child AgentRun dependencies and resumed-child checkpoint history.
• Preserve opaque tool arguments and provider payloads while rewriting only typed owned references.
• Preserve retained Artifact tombstones and copy payloads sequentially through filesystem-native copying instead of buffering an entire conversation in memory.
• Rewrite and validate tool-recovery evidence as one canonical RuntimeEvent batch before publication.
• Attempt cleanup for every sidecar Store and delete the stable publication anchor only after all sidecars are clean.

Coordination and boundaries

• Extend Session admission so Artifact and Task operations cannot race conversation publication.
• Return typed source-revision conflicts, target conflicts, busy-state failures, and commit-unknown outcomes.
• Linked child Session graphs fail closed with operation_unavailable; this slice supports same-Session legacy child AgentRuns only.
• Source-bound active and semantic compaction diagnostics are not inherited because target-owned identities invalidate their hashes; the target can derive fresh diagnostics.
• This slice does not wire Desktop or TUI production adapters and does not change production Host activation.
• The pre-release Runtime Host wire protocol remains v0.

Validation

• Root typecheck and production build passed.
• Biome passed for the changed TypeScript files.
• Storage: 825 passed.
• Runtime: 2,843 passed.
• Runtime Host: 377 passed.
• Real two-Client UDS coverage for concurrent branch/revision requests, exact retries, conflicts, restart recovery, cross-store copying, legacy child Run lineage, and linked-child fail-closed behavior.
• git diff --check passed.

Part of #1167 and #853.

简体中文

概要

让 Runtime Host 通过 v0 session.branch.create 和 session.revision.create command，成为精确、可重试的 Session branch 与 revision 权威所有者。

Branch 会保留选中的 source turn；revision 会保留该 turn 之前的 conversation。两种 operation 都会把 Client 提供的 target identity 绑定到完整 request，比较预期的 source revision，并发布一份跨 Store 的 conversation snapshot。

Revision authority

• 为 branch 和 revision 创建增加封闭且有界的 protocol contract。
• 使用 source metadata revision 作为 compare-and-set 边界，并在复制前拒绝存在 active Turn 的 source Session。
• 串行化 source、target 和 revision-family root；无关 Session 仍可独立运行。
• 在 response 丢失和 source 后续 revision 变化后保持 exact retry 稳定；拒绝将同一 target identity 用于不同工作。
• 保留 branch/revision lineage、继承的 execution configuration、labels、flags、title ownership 和 connection locking。
• Revision 的第一个 root turn 启动时提交 prepared revision。
• Recovery 会删除中断的 publication 或未使用 revision，同时保留已经 admission 的 revision 及其必需祖先。
• Publication metadata 仅由 stable-create authority 接受，普通 Session create 无法伪造 preparing copy。

精确 Conversation Copy

• 在跨 Store publication 提交前，从 catalog read 中隐藏 preparing target。
• 在精确 message 边界内复制 canonical Runtime event、AgentRun lineage、provider request telemetry、history-compaction checkpoint、Artifact 和 Task Ledger state。
• 为目标分配自有的 Session、Run、Invocation、RuntimeEvent、provider trace、Artifact 和 Task reference；exact copy 中任何 owned reference 无法解析时都会 fail closed。
• 包含保留范围内的 legacy child AgentRun 依赖和 resumed-child checkpoint history。
• 保留 opaque tool argument 和 provider payload，只重写 typed owned reference。
• 保留被历史引用的 Artifact tombstone，并通过文件系统原生复制逐个复制 payload，避免把整段 conversation 缓存在内存中。
• 在 publication 前，将 tool-recovery evidence 的引用一起重写，并按一个 canonical RuntimeEvent batch 完整验证。
• 尝试清理所有 sidecar Store；只有全部清理成功后才删除 stable publication anchor。

协调与边界

• 扩展 Session admission，避免 Artifact 和 Task operation 与 conversation publication 竞态。
• 返回 typed source-revision conflict、target conflict、busy-state failure 和 commit-unknown outcome。
• Linked child Session graph 会以 operation_unavailable fail closed；本 slice 只支持同一 Session 内的 legacy child AgentRun。
• Source-bound active/semantic compaction diagnostic 不会被继承，因为 target-owned identity 会使其 hash 失效；目标可以重新生成 diagnostic。
• 本 slice 不接入 Desktop/TUI production adapter，也不改变 production Host activation。
• 预发布 Runtime Host wire protocol 继续保持 v0。

验证

• 根级 typecheck 与 production build 通过。
• 改动的 TypeScript 文件通过 Biome。
• Storage：825 项通过。
• Runtime：2,843 项通过。
• Runtime Host：377 项通过。
• 真实双 Client UDS 覆盖并发 branch/revision request、exact retry、conflict、重启恢复、跨 Store 复制、legacy child Run lineage，以及 linked-child fail-closed 行为。
• git diff --check 通过。

属于 #1167 和 #853 的一部分。

[likun666661]

LGTM