fix(runtime): preserve durable RuntimeEvent order in conversation copies

[Colafornia]

What happened

A branch or revision copy can silently discard a valid history-compaction checkpoint when RuntimeEvent timestamps differ from durable append order.

Since #4348, a checkpoint prefix mismatch no longer fails the copy with persistence_failed. The copy succeeds, but it drops the valid checkpoint. The target ledger can also lose the source session's cross-run interleaving because copy import groups events by run.

Expected behavior: Integrity checks and copied ledgers use durable RuntimeEvent order. A valid checkpoint remains valid after the copy.

How to reproduce

1. Append compactable RuntimeEvents from two runs in interleaved order.
2. Give the events timestamps that produce a different order.
3. Record a history-compaction checkpoint over the durable prefix.
4. Create a branch or revision.
5. Observe that the copy drops the checkpoint or writes a different target prefix.

Durable order: A1 -> B1 -> A2 -> B2
Timestamp order: B1 -> B2 -> A1 -> A2
Grouped copy: A1 -> A2 -> B1 -> B2

Root cause

RuntimeReadModel used timestamps as its primary session ordering key. The copy path also imported one batch per run, which regrouped interleaved events in the target ledger.

Fix

• Require readSessionRuntimeEventEntries() on RuntimeEventStore.
• Order immutable read-model events by session ordinal.
• Keep mutable partial snapshots beside their surrounding immutable run events.
• Put legacy backfilled events without ordinals after durable events, with deterministic timestamp ordering.
• Import copied inline events in source session order, including interleaved batches from the same run.
• Keep strict checkpoint validation.

readSessionRuntimeEvents() remains timestamp-based because it includes mutable presentation snapshots and serves repair and trace projection. It is not the immutable copy-order API.

Acceptance criteria

• A valid checkpoint remains present after branch and revision copies.
• The target immutable ledger preserves the copied source order across runs.
• Changed event content still fails checkpoint validation.
• Terminal partial snapshots remain visible in the read model.
• Production and test stores use the same required ordinal-reader contract.
• The copied message, turn, run, and inline-run sets remain unchanged.

AI use

OpenAI Codex helped diagnose, implement, test, and review this change. I reviewed and approved the issue text.

[Colafornia]

take