feat(runtime): surface semantic request prefix continuity

[Astro-Han]

Summary

• derive semantic request-prefix continuity from canonical model-call attempts and Workstream 1 prepared-request observations
• persist an explicit causal predecessor and dispatch-owned non-secret request domain so retries, restart, overlapping turns, and conversation copies keep the same durable result
• project the Runtime verdict through latest_context and Runtime Host, then render it as a compact Desktop Inspector tag
• show positively evidenced provider cache read/write usage separately; semantic continuity never claims a provider cache hit or miss

Stacked on #4300 (refactor/4299-request-observation-authority). Merge order: #4300, then this PR.

Part of #4299. This PR implements Workstream 2 only.

End-to-end lifecycle

flowchart TD
  subgraph Dispatch["1 · Dispatch and durable authority"]
    A["Physical model-call dispatch"] --> P{"Select one causal predecessor"}
    P -->|"first durable root"| P0["none"]
    P -->|"retry or next tool-loop step"| PA["explicit prior attempt"]
    P -->|"parent, retry, regenerate, branch, or RootTurnAdmission"| PL["one lineage-derived attempt"]
    P -->|"compaction, auxiliary, missing, or ambiguous lineage"| PU["unavailable"]

    A --> D["Host freezes non-secret request domain<br/>connection + provider/model + endpoint/wire<br/>overlay revision + effective proxy basis<br/>credential revisions + provider partition"]
    A --> O["PR1 observes the prepared semantic request<br/>only when the physical attempt dispatches"]

    P0 --> M["Canonical ModelCallAttempt"]
    PA --> M
    PL --> M
    PU --> M
    D --> M
    O --> M
    M --> E[("Attempt ledger + RootTurnAdmission")]
  end

  subgraph Derive["2 · Runtime-owned continuity derivation"]
    E --> S{"Stored predecessor kind"}
    S -->|"none"| N["no_predecessor · 0/0"]
    S -->|"unavailable"| U["unavailable · 0/0"]
    S -->|"attempt"| Q{"Both observations exist<br/>and request domains match?"}
    Q -->|"no"| U
    Q -->|"yes"| C{"Compare cacheable prior prefix<br/>in semantic order"}
    C -->|"kind/index/role/label or digest differs"| V["diverged · first divergent segment"]
    C -->|"opaque segment blocks an exact claim"| K["unknown · known preserved count"]
    C -->|"entire prior prefix is exact<br/>new tail segments are allowed"| R["preserved · previous/previous"]

    N --> L["latest_context projection"]
    U --> L
    V --> L
    K --> L
    R --> L
  end

  subgraph Recovery["3 · Restart, copy, and concurrency"]
    X["Restart"] -->|"cold rebuild from the same ledger"| L
    B["Branch / conversation copy"] -->|"rewrite attempt links and import retained admissions"| E
    W["Overlapping turns"] -->|"each follows its own durable admission; no mutable last"| P
  end

  subgraph Delivery["4 · Runtime Host to Desktop Inspector"]
    L --> H["context.diagnostics.query<br/>closed protocol · compatibility epoch 79"]
    H --> DM["Desktop main passes the Runtime verdict unchanged"]
    DM --> UI["Inspector tag<br/>Request prefix 8/8 preserved<br/>or diverged at message 3"]

    PC["Provider-reported cacheRead / cacheWrite usage"] --> CU["Separate provider cache usage display"]
  end

Loading

The authority boundary is deliberate: Runtime selects the predecessor and derives the verdict; the Host transports it; Desktop only controls freshness and presentation. There is no session-wide mutable baseline, append-order or wall-clock fallback, and no edge from provider cache usage into semantic continuity.

Workstream 2 scope

The Runtime reports only no_predecessor, preserved, diverged, unknown, or unavailable, with previous/preserved segment counts and the first divergent segment when knowable.

Comparison is limited to one durable causal lane and the same non-secret dispatch domain: immutable connection identity, provider/model, effective endpoint/wire, request-overlay revision, effective secret-free proxy basis, credential revisions, and an exact known provider/cache partition. Missing observations, historical unqualified attempts, and opaque content never become false preserved results. Known segment structure is compared before opaque content.

Conversation copy rewrites attempt links and imports the retained RootTurnAdmission chain. The compatibility import preserves frozen historical execution kinds without re-enabling them for new admissions.

The Inspector consumes the Runtime Host conclusion unchanged. It neither hashes content nor selects a predecessor, and it hides an old context verdict while the current Host snapshot is refreshing or failed.

context.diagnostics.query uses a closed result decoder, so adding requestPrefix advances the Runtime Host compatibility epoch to 79; older Clients fail during the handshake instead of rejecting a mid-connection response.

Verification

Focused verifier for this PR:

npm --workspace @maka/core run build
npm --workspace @maka/storage run build
npm --workspace @maka/runtime run build
npm --workspace @maka/runtime-host run build
npm --workspace @maka/desktop run build:main
node --test \
  packages/core/dist/__tests__/model-call-attempt.test.js \
  packages/storage/dist/__tests__/regenerate-root-admission.test.js \
  packages/runtime/dist/__tests__/semantic-prefix-continuity.test.js \
  packages/runtime/dist/__tests__/context-diagnostics.test.js \
  packages/runtime/dist/__tests__/latest-context-commit.test.js \
  packages/runtime/dist/__tests__/conversation-copy.test.js \
  packages/runtime/dist/__tests__/provider-request-telemetry.test.js \
  packages/runtime-host/dist/__tests__/context-protocol.test.js \
  packages/runtime-host/dist/__tests__/protocol.test.js \
  packages/runtime-host/dist/__tests__/execution-model-composition.test.js \
  packages/runtime-host/dist/__tests__/session-revision-two-client-uds.test.js \
  packages/runtime-host/dist/__tests__/root-admission-owner.test.js \
  packages/runtime-host/dist/__tests__/root-turn-coordinator.test.js \
  apps/desktop/dist/main/__tests__/session-inspector-panel-model.test.js \
  apps/desktop/dist/main/__tests__/session-inspector-composition.test.js \
  apps/desktop/dist/main/__tests__/use-session-trace.test.js

Result: 296 tests passed.

Cumulative verifier for #4300 + this PR adds the Workstream 1 request-shape and AI SDK backend suites to the focused command.

Result: 518 tests passed.

Additional checks:

• node scripts/protocol-epoch-check.mjs --base refactor/4299-request-observation-authority: epoch 78 → 79 passed
• node --test --test-concurrency=1 scripts/protocol-epoch-check.test.mjs: 12/12 passed
• npm run check:renderer-architecture: 62/62 passed
• Astryx surface inventory: 229 files, 1 exclusion passed
• Biome: all 41 changed TypeScript/TSX files passed
• CLI build: passed
• git diff --check: passed

The full Desktop typecheck remains blocked only by pre-existing @maka/ui/Astryx type errors for autoScroll, settledText, and trailingAction; the Desktop main build and all affected Inspector tests pass.

Non-goals

• inferring provider cache hit or miss from semantic continuity
• provider-specific wire capture or restoring computeRequestShapeDiagnostic
• changing Workstream 1 observation authority or defining another observation DTO
• adding permanent dual-read or dual-write paths
• changing historical ledger/read compatibility
• adding a new Runtime event