feat(runtime): add durable continuation authority

[zhiiw]

Summary

This change establishes durable continuation correctness on top of the canonical RuntimeEvent recovery store.

• derives continuation cursors only from immutable RuntimeEvents using versioned composite boundaries;
• materializes one provider replay projection per lineage segment and binds its digest to the claim;
• adds SQLite-owned unique continuation claims with exact source and target execution identity;
• makes runtime_admission continuation-start the only durable provider-call T1, backed by an opaque one-shot admission receipt;
• converges claim-only and pre-provider crashes with deterministic claim_repair start + terminal facts and zero provider calls;
• rejects active or non-terminal source claims inside the SQLite transaction, so an erroneous caller cannot seal a live Run.

Primary invariant

A durable continuation may call the provider only after one versioned composite immutable boundary has been rebuilt, revalidated, and atomically claimed. Every lineage segment uses the same replay projection. Only a continuation-start durably committed by the SQLite authority with start_kind=runtime_admission grants provider execution authority; claim_repair is audit-only and never grants execution.

Ownership and atomicity

• Boundary/replay owner: core boundary codecs plus the shared runtime replay materializer.
• Claim owner:SqliteRuntimeStore; BEGIN IMMEDIATE re-reads the latest immediate-source ledger, validates identity, position, and digest, requires exactly one terminal RuntimeEvent at the tail, checks an empty exact target, and inserts the claim.
• Provider admission owner:RuntimeKernel and the package-private one-shot admission proof/receipt consumed by RuntimeRunner.
• Repair owner:SessionManager classifies durable claim/start/terminal state before generic ledger repair.

Claim and continuation-start failures roll back their SQLite transactions. A rejected non-terminal claim creates no row and does not seal the source, so the active Run can still commit its terminal fact.

Failure states and rollback

• missing, stale, corrupt, non-terminal, or suffix-bearing source boundaries fail closed before provider dispatch;
• exact claim retry returns the existing claim and does not create another target;
• claim-only or target-created-without-start crashes converge through deterministic repair with provider call count 0;
• a durable live start without a terminal fact remains continuation_started_indeterminate unless ownership can be proven;
• unknown authority/projection versions, mismatched target headers, claim rows, starts, terminal tails, or replay digests park instead of falling back.

Existing provider retry compatibility

The hosted runtime currently uses a file RuntimeEvent store and does not yet own the SQLite continuation authority lifecycle. To avoid regressing its existing child provider-429 retry, this change keeps an explicit legacy_provider_retry lane:

• it is selected before claim, Run creation, or provider T1 only when continuation authority and the safety inspector are both absent;
• partial capability installation fails closed instead of falling back;
• it reads immutable RuntimeEvents and revalidates the immediate source before execution;
• it never writes a continuation claim, continuationSource, or continuation-start;
• it cannot retry a repaired pre-provider abandonment and carries no durable resume or cross-process exactly-once guarantee.

A later host authority lifecycle integration will replace and remove this compatibility lane.

Compatibility

• supports the released populated SQLite schema 5 to schema 6 upgrade;
• mutable partial snapshots remain UI-only and never contribute to a durable cursor;
• JSONL may be read for legacy history but does not provide durable continuation claim authority;
• unpublished experimental databases from feat(runtime): complete Phase 3A file-transaction recovery #1346 are intentionally outside the compatibility contract.

Explicitly out of scope

This change does not implement general typed retry/reattach, Bash replay, ShellRun reattach, conversation-clone evidence rewriting, ContinuationExecutionProfileV1, Write/Edit file checkpoints, workspace/Git checkpoints, hosted SQLite authority lifecycle integration, or default hosted auto-resume. Those remain separate changes because they have different owners and failure boundaries.

Validation

After rebasing onto upstream/main@e4c6ddbf:

• Core boundary/decoder/AgentRun V2 focused tests: 54/54
• SQLite store/schema/claim/start/terminal/multi-process tests: 43/43
• Runtime continuation/replay/admission/planner focused tests: 46/46
• SessionManager continuation, authority, branch-preflight, and upstream-conflict tests: 25/25
• real-process continuation SIGKILL harness: 1/1, covering five durable boundaries
• UI resume copy: 4/4
• monorepo typecheck passes
• hosted linked-child production-shape retry completes through the explicit compatibility lane; its assertions verify that no durable continuation lineage or start fact is written

These are focused proofs for the affected paths; this description does not use CI green as a substitute for concurrency, crash, or data-safety reasoning.

[zhiiw]

Summary

This change establishes durable continuation correctness on top of the canonical RuntimeEvent recovery store.

• derives continuation cursors only from immutable RuntimeEvents using versioned composite boundaries;
• materializes one provider replay projection per lineage segment and binds its digest to the claim;
• adds SQLite-owned unique continuation claims with exact source and target execution identity;
• makes runtime_admission continuation-start the only durable provider-call T1, backed by an opaque one-shot admission receipt;
• converges claim-only and pre-provider crashes with deterministic claim_repair start + terminal facts and zero provider calls;
• rejects active or non-terminal source claims inside the SQLite transaction, so an erroneous caller cannot seal a live Run.

Primary invariant

A durable continuation may call the provider only after one versioned composite immutable boundary has been rebuilt, revalidated, and atomically claimed. Every lineage segment uses the same replay projection. Only a continuation-start durably committed by the SQLite authority with start_kind=runtime_admission grants provider execution authority; claim_repair is audit-only and never grants execution.

Ownership and atomicity

• Boundary/replay owner: core boundary codecs plus the shared runtime replay materializer.
• Claim owner:SqliteRuntimeStore; BEGIN IMMEDIATE re-reads the latest immediate-source ledger, validates identity, position, and digest, requires exactly one terminal RuntimeEvent at the tail, checks an empty exact target, and inserts the claim.
• Provider admission owner:RuntimeKernel and the package-private one-shot admission proof/receipt consumed by RuntimeRunner.
• Repair owner:SessionManager classifies durable claim/start/terminal state before generic ledger repair.

Claim and continuation-start failures roll back their SQLite transactions. A rejected non-terminal claim creates no row and does not seal the source, so the active Run can still commit its terminal fact.

Failure states and rollback

• missing, stale, corrupt, non-terminal, or suffix-bearing source boundaries fail closed before provider dispatch;
• exact claim retry returns the existing claim and does not create another target;
• claim-only or target-created-without-start crashes converge through deterministic repair with provider call count 0;
• a durable live start without a terminal fact remains continuation_started_indeterminate unless ownership can be proven;
• unknown authority/projection versions, mismatched target headers, claim rows, starts, terminal tails, or replay digests park instead of falling back.

Existing provider retry compatibility

The hosted runtime currently uses a file RuntimeEvent store and does not yet own the SQLite continuation authority lifecycle. To avoid regressing its existing child provider-429 retry, this change keeps an explicit legacy_provider_retry lane:

• it is selected before claim, Run creation, or provider T1 only when continuation authority and the safety inspector are both absent;
• partial capability installation fails closed instead of falling back;
• it reads immutable RuntimeEvents and revalidates the immediate source before execution;
• it never writes a continuation claim, continuationSource, or continuation-start;
• it cannot retry a repaired pre-provider abandonment and carries no durable resume or cross-process exactly-once guarantee.

A later host authority lifecycle integration will replace and remove this compatibility lane.

Compatibility

• supports the released populated SQLite schema 5 to schema 6 upgrade;
• mutable partial snapshots remain UI-only and never contribute to a durable cursor;
• JSONL may be read for legacy history but does not provide durable continuation claim authority;
• unpublished experimental databases from feat(runtime): complete Phase 3A file-transaction recovery #1346 are intentionally outside the compatibility contract.

Explicitly out of scope

This change does not implement general typed retry/reattach, Bash replay, ShellRun reattach, conversation-clone evidence rewriting, ContinuationExecutionProfileV1, Write/Edit file checkpoints, workspace/Git checkpoints, hosted SQLite authority lifecycle integration, or default hosted auto-resume. Those remain separate changes because they have different owners and failure boundaries.

Validation

After rebasing onto upstream/main@e4c6ddbf:

• Core boundary/decoder/AgentRun V2 focused tests: 54/54
• SQLite store/schema/claim/start/terminal/multi-process tests: 43/43
• Runtime continuation/replay/admission/planner focused tests: 46/46
• SessionManager continuation, authority, branch-preflight, and upstream-conflict tests: 25/25
• real-process continuation SIGKILL harness: 1/1, covering five durable boundaries
• UI resume copy: 4/4
• monorepo typecheck passes
• hosted linked-child production-shape retry completes through the explicit compatibility lane; its assertions verify that no durable continuation lineage or start fact is written

These are focused proofs for the affected paths; this description does not use CI green as a substitute for concurrency, crash, or data-safety reasoning.

[zhiiw]

Summary

This change establishes durable continuation correctness on top of the canonical RuntimeEvent recovery store.

• derives continuation cursors only from immutable RuntimeEvents using versioned composite boundaries;
• materializes one provider replay projection per lineage segment and binds its digest to the claim;
• adds SQLite-owned unique continuation claims with exact source and target execution identity;
• makes runtime_admission continuation-start the only durable provider-call T1, backed by an opaque one-shot admission receipt;
• converges claim-only and pre-provider crashes with deterministic claim_repair start + terminal facts and zero provider calls;
• rejects active or non-terminal source claims inside the SQLite transaction, so an erroneous caller cannot seal a live Run.

Primary invariant

A durable continuation may call the provider only after one versioned composite immutable boundary has been rebuilt, revalidated, and atomically claimed. Every lineage segment uses the same replay projection. Only a continuation-start durably committed by the SQLite authority with start_kind=runtime_admission grants provider execution authority; claim_repair is audit-only and never grants execution.

Ownership and atomicity

• Boundary/replay owner: core boundary codecs plus the shared runtime replay materializer.
• Claim owner:SqliteRuntimeStore; BEGIN IMMEDIATE re-reads the latest immediate-source ledger, validates identity, position, and digest, requires exactly one terminal RuntimeEvent at the tail, checks an empty exact target, and inserts the claim.
• Provider admission owner:RuntimeKernel and the package-private one-shot admission proof/receipt consumed by RuntimeRunner.
• Repair owner:SessionManager classifies durable claim/start/terminal state before generic ledger repair.

Claim and continuation-start failures roll back their SQLite transactions. A rejected non-terminal claim creates no row and does not seal the source, so the active Run can still commit its terminal fact.

Failure states and rollback

• missing, stale, corrupt, non-terminal, or suffix-bearing source boundaries fail closed before provider dispatch;
• exact claim retry returns the existing claim and does not create another target;
• claim-only or target-created-without-start crashes converge through deterministic repair with provider call count 0;
• a durable live start without a terminal fact remains continuation_started_indeterminate unless ownership can be proven;
• unknown authority/projection versions, mismatched target headers, claim rows, starts, terminal tails, or replay digests park instead of falling back.

Existing provider retry compatibility

The hosted runtime currently uses a file RuntimeEvent store and does not yet own the SQLite continuation authority lifecycle. To avoid regressing its existing child provider-429 retry, this change keeps an explicit legacy_provider_retry lane:

• it is selected before claim, Run creation, or provider T1 only when continuation authority and the safety inspector are both absent;
• partial capability installation fails closed instead of falling back;
• it reads immutable RuntimeEvents and revalidates the immediate source before execution;
• it never writes a continuation claim, continuationSource, or continuation-start;
• it cannot retry a repaired pre-provider abandonment and carries no durable resume or cross-process exactly-once guarantee.

A later host authority lifecycle integration will replace and remove this compatibility lane.

Compatibility

• supports the released populated SQLite schema 5 to schema 6 upgrade;
• mutable partial snapshots remain UI-only and never contribute to a durable cursor;
• JSONL may be read for legacy history but does not provide durable continuation claim authority;
• unpublished experimental databases from feat(runtime): complete Phase 3A file-transaction recovery #1346 are intentionally outside the compatibility contract.

Explicitly out of scope

This change does not implement general typed retry/reattach, Bash replay, ShellRun reattach, conversation-clone evidence rewriting, ContinuationExecutionProfileV1, Write/Edit file checkpoints, workspace/Git checkpoints, hosted SQLite authority lifecycle integration, or default hosted auto-resume. Those remain separate changes because they have different owners and failure boundaries.

Validation

After rebasing onto upstream/main@e4c6ddbf:

• Core boundary/decoder/AgentRun V2 focused tests: 54/54
• SQLite store/schema/claim/start/terminal/multi-process tests: 43/43
• Runtime continuation/replay/admission/planner focused tests: 46/46
• SessionManager continuation, authority, branch-preflight, and upstream-conflict tests: 25/25
• real-process continuation SIGKILL harness: 1/1, covering five durable boundaries
• UI resume copy: 4/4
• monorepo typecheck passes
• hosted linked-child production-shape retry completes through the explicit compatibility lane; its assertions verify that no durable continuation lineage or start fact is written

These are focused proofs for the affected paths; this description does not use CI green as a substitute for concurrency, crash, or data-safety reasoning.

[zhiiw]

Summary

This change establishes durable continuation correctness on top of the canonical RuntimeEvent recovery store.

• derives continuation cursors only from immutable RuntimeEvents using versioned composite boundaries;
• materializes one provider replay projection per lineage segment and binds its digest to the claim;
• adds SQLite-owned unique continuation claims with exact source and target execution identity;
• makes runtime_admission continuation-start the only durable provider-call T1, backed by an opaque one-shot admission receipt;
• converges claim-only and pre-provider crashes with deterministic claim_repair start + terminal facts and zero provider calls;
• rejects active or non-terminal source claims inside the SQLite transaction, so an erroneous caller cannot seal a live Run.

Primary invariant

A durable continuation may call the provider only after one versioned composite immutable boundary has been rebuilt, revalidated, and atomically claimed. Every lineage segment uses the same replay projection. Only a continuation-start durably committed by the SQLite authority with start_kind=runtime_admission grants provider execution authority; claim_repair is audit-only and never grants execution.

Ownership and atomicity

• Boundary/replay owner: core boundary codecs plus the shared runtime replay materializer.
• Claim owner:SqliteRuntimeStore; BEGIN IMMEDIATE re-reads the latest immediate-source ledger, validates identity, position, and digest, requires exactly one terminal RuntimeEvent at the tail, checks an empty exact target, and inserts the claim.
• Provider admission owner:RuntimeKernel and the package-private one-shot admission proof/receipt consumed by RuntimeRunner.
• Repair owner:SessionManager classifies durable claim/start/terminal state before generic ledger repair.

Claim and continuation-start failures roll back their SQLite transactions. A rejected non-terminal claim creates no row and does not seal the source, so the active Run can still commit its terminal fact.

Failure states and rollback

• missing, stale, corrupt, non-terminal, or suffix-bearing source boundaries fail closed before provider dispatch;
• exact claim retry returns the existing claim and does not create another target;
• claim-only or target-created-without-start crashes converge through deterministic repair with provider call count 0;
• a durable live start without a terminal fact remains continuation_started_indeterminate unless ownership can be proven;
• unknown authority/projection versions, mismatched target headers, claim rows, starts, terminal tails, or replay digests park instead of falling back.

Existing provider retry compatibility

The hosted runtime currently uses a file RuntimeEvent store and does not yet own the SQLite continuation authority lifecycle. To avoid regressing its existing child provider-429 retry, this change keeps an explicit legacy_provider_retry lane:

• it is selected before claim, Run creation, or provider T1 only when continuation authority and the safety inspector are both absent;
• partial capability installation fails closed instead of falling back;
• it reads immutable RuntimeEvents and revalidates the immediate source before execution;
• it never writes a continuation claim, continuationSource, or continuation-start;
• it cannot retry a repaired pre-provider abandonment and carries no durable resume or cross-process exactly-once guarantee.

A later host authority lifecycle integration will replace and remove this compatibility lane.

Compatibility

• supports the released populated SQLite schema 5 to schema 6 upgrade;
• mutable partial snapshots remain UI-only and never contribute to a durable cursor;
• JSONL may be read for legacy history but does not provide durable continuation claim authority;
• unpublished experimental databases from feat(runtime): complete Phase 3A file-transaction recovery #1346 are intentionally outside the compatibility contract.

Explicitly out of scope

This change does not implement general typed retry/reattach, Bash replay, ShellRun reattach, conversation-clone evidence rewriting, ContinuationExecutionProfileV1, Write/Edit file checkpoints, workspace/Git checkpoints, hosted SQLite authority lifecycle integration, or default hosted auto-resume. Those remain separate changes because they have different owners and failure boundaries.

Validation

After rebasing onto upstream/main@e4c6ddbf:

• Core boundary/decoder/AgentRun V2 focused tests: 54/54
• SQLite store/schema/claim/start/terminal/multi-process tests: 43/43
• Runtime continuation/replay/admission/planner focused tests: 46/46
• SessionManager continuation, authority, branch-preflight, and upstream-conflict tests: 25/25
• real-process continuation SIGKILL harness: 1/1, covering five durable boundaries
• UI resume copy: 4/4
• monorepo typecheck passes
• hosted linked-child production-shape retry completes through the explicit compatibility lane; its assertions verify that no durable continuation lineage or start fact is written

These are focused proofs for the affected paths; this description does not use CI green as a substitute for concurrency, crash, or data-safety reasoning.

[zhiiw]

Summary

This change establishes durable continuation correctness on top of the canonical RuntimeEvent recovery store.

• derives continuation cursors only from immutable RuntimeEvents using versioned composite boundaries;
• materializes one provider replay projection per lineage segment and binds its digest to the claim;
• adds SQLite-owned unique continuation claims with exact source and target execution identity;
• makes runtime_admission continuation-start the only durable provider-call T1, backed by an opaque one-shot admission receipt;
• converges claim-only and pre-provider crashes with deterministic claim_repair start + terminal facts and zero provider calls;
• rejects active or non-terminal source claims inside the SQLite transaction, so an erroneous caller cannot seal a live Run.

Primary invariant

A durable continuation may call the provider only after one versioned composite immutable boundary has been rebuilt, revalidated, and atomically claimed. Every lineage segment uses the same replay projection. Only a continuation-start durably committed by the SQLite authority with start_kind=runtime_admission grants provider execution authority; claim_repair is audit-only and never grants execution.

Ownership and atomicity

• Boundary/replay owner: core boundary codecs plus the shared runtime replay materializer.
• Claim owner:SqliteRuntimeStore; BEGIN IMMEDIATE re-reads the latest immediate-source ledger, validates identity, position, and digest, requires exactly one terminal RuntimeEvent at the tail, checks an empty exact target, and inserts the claim.
• Provider admission owner:RuntimeKernel and the package-private one-shot admission proof/receipt consumed by RuntimeRunner.
• Repair owner:SessionManager classifies durable claim/start/terminal state before generic ledger repair.

Claim and continuation-start failures roll back their SQLite transactions. A rejected non-terminal claim creates no row and does not seal the source, so the active Run can still commit its terminal fact.

Failure states and rollback

• missing, stale, corrupt, non-terminal, or suffix-bearing source boundaries fail closed before provider dispatch;
• exact claim retry returns the existing claim and does not create another target;
• claim-only or target-created-without-start crashes converge through deterministic repair with provider call count 0;
• a durable live start without a terminal fact remains continuation_started_indeterminate unless ownership can be proven;
• unknown authority/projection versions, mismatched target headers, claim rows, starts, terminal tails, or replay digests park instead of falling back.

Existing provider retry compatibility

The hosted runtime currently uses a file RuntimeEvent store and does not yet own the SQLite continuation authority lifecycle. To avoid regressing its existing child provider-429 retry, this change keeps an explicit legacy_provider_retry lane:

• it is selected before claim, Run creation, or provider T1 only when continuation authority and the safety inspector are both absent;
• partial capability installation fails closed instead of falling back;
• it reads immutable RuntimeEvents and revalidates the immediate source before execution;
• it never writes a continuation claim, continuationSource, or continuation-start;
• it cannot retry a repaired pre-provider abandonment and carries no durable resume or cross-process exactly-once guarantee.

A later host authority lifecycle integration will replace and remove this compatibility lane.

Compatibility

• supports the released populated SQLite schema 5 to schema 6 upgrade;
• mutable partial snapshots remain UI-only and never contribute to a durable cursor;
• JSONL may be read for legacy history but does not provide durable continuation claim authority;
• unpublished experimental databases from feat(runtime): complete Phase 3A file-transaction recovery #1346 are intentionally outside the compatibility contract.

Explicitly out of scope

This change does not implement general typed retry/reattach, Bash replay, ShellRun reattach, conversation-clone evidence rewriting, ContinuationExecutionProfileV1, Write/Edit file checkpoints, workspace/Git checkpoints, hosted SQLite authority lifecycle integration, or default hosted auto-resume. Those remain separate changes because they have different owners and failure boundaries.

Validation

After rebasing onto upstream/main@e4c6ddbf:

• Core boundary/decoder/AgentRun V2 focused tests: 54/54
• SQLite store/schema/claim/start/terminal/multi-process tests: 43/43
• Runtime continuation/replay/admission/planner focused tests: 46/46
• SessionManager continuation, authority, branch-preflight, and upstream-conflict tests: 25/25
• real-process continuation SIGKILL harness: 1/1, covering five durable boundaries
• UI resume copy: 4/4
• monorepo typecheck passes
• hosted linked-child production-shape retry completes through the explicit compatibility lane; its assertions verify that no durable continuation lineage or start fact is written

These are focused proofs for the affected paths; this description does not use CI green as a substitute for concurrency, crash, or data-safety reasoning.

[zhiiw]

Summary

This change establishes durable continuation correctness on top of the canonical RuntimeEvent recovery store.

• derives continuation cursors only from immutable RuntimeEvents using versioned composite boundaries;
• materializes one provider replay projection per lineage segment and binds its digest to the claim;
• adds SQLite-owned unique continuation claims with exact source and target execution identity;
• makes runtime_admission continuation-start the only durable provider-call T1, backed by an opaque one-shot admission receipt;
• converges claim-only and pre-provider crashes with deterministic claim_repair start + terminal facts and zero provider calls;
• rejects active or non-terminal source claims inside the SQLite transaction, so an erroneous caller cannot seal a live Run.

Primary invariant

A durable continuation may call the provider only after one versioned composite immutable boundary has been rebuilt, revalidated, and atomically claimed. Every lineage segment uses the same replay projection. Only a continuation-start durably committed by the SQLite authority with start_kind=runtime_admission grants provider execution authority; claim_repair is audit-only and never grants execution.

Ownership and atomicity

• Boundary/replay owner: core boundary codecs plus the shared runtime replay materializer.
• Claim owner:SqliteRuntimeStore; BEGIN IMMEDIATE re-reads the latest immediate-source ledger, validates identity, position, and digest, requires exactly one terminal RuntimeEvent at the tail, checks an empty exact target, and inserts the claim.
• Provider admission owner:RuntimeKernel and the package-private one-shot admission proof/receipt consumed by RuntimeRunner.
• Repair owner:SessionManager classifies durable claim/start/terminal state before generic ledger repair.

Claim and continuation-start failures roll back their SQLite transactions. A rejected non-terminal claim creates no row and does not seal the source, so the active Run can still commit its terminal fact.

Failure states and rollback

• missing, stale, corrupt, non-terminal, or suffix-bearing source boundaries fail closed before provider dispatch;
• exact claim retry returns the existing claim and does not create another target;
• claim-only or target-created-without-start crashes converge through deterministic repair with provider call count 0;
• a durable live start without a terminal fact remains continuation_started_indeterminate unless ownership can be proven;
• unknown authority/projection versions, mismatched target headers, claim rows, starts, terminal tails, or replay digests park instead of falling back.

Existing provider retry compatibility

The hosted runtime currently uses a file RuntimeEvent store and does not yet own the SQLite continuation authority lifecycle. To avoid regressing its existing child provider-429 retry, this change keeps an explicit legacy_provider_retry lane:

• it is selected before claim, Run creation, or provider T1 only when continuation authority and the safety inspector are both absent;
• partial capability installation fails closed instead of falling back;
• it reads immutable RuntimeEvents and revalidates the immediate source before execution;
• it never writes a continuation claim, continuationSource, or continuation-start;
• it cannot retry a repaired pre-provider abandonment and carries no durable resume or cross-process exactly-once guarantee.

A later host authority lifecycle integration will replace and remove this compatibility lane.

Compatibility

• supports the released populated SQLite schema 5 to schema 6 upgrade;
• mutable partial snapshots remain UI-only and never contribute to a durable cursor;
• JSONL may be read for legacy history but does not provide durable continuation claim authority;
• unpublished experimental databases from feat(runtime): complete Phase 3A file-transaction recovery #1346 are intentionally outside the compatibility contract.

Explicitly out of scope

This change does not implement general typed retry/reattach, Bash replay, ShellRun reattach, conversation-clone evidence rewriting, ContinuationExecutionProfileV1, Write/Edit file checkpoints, workspace/Git checkpoints, hosted SQLite authority lifecycle integration, or default hosted auto-resume. Those remain separate changes because they have different owners and failure boundaries.

Validation

After rebasing onto upstream/main@e4c6ddbf:

• Core boundary/decoder/AgentRun V2 focused tests: 54/54
• SQLite store/schema/claim/start/terminal/multi-process tests: 43/43
• Runtime continuation/replay/admission/planner focused tests: 46/46
• SessionManager continuation, authority, branch-preflight, and upstream-conflict tests: 25/25
• real-process continuation SIGKILL harness: 1/1, covering five durable boundaries
• UI resume copy: 4/4
• monorepo typecheck passes
• hosted linked-child production-shape retry completes through the explicit compatibility lane; its assertions verify that no durable continuation lineage or start fact is written

These are focused proofs for the affected paths; this description does not use CI green as a substitute for concurrency, crash, or data-safety reasoning.

[zhiiw]

Summary

This change establishes durable continuation correctness on top of the canonical RuntimeEvent recovery store.

• derives continuation cursors only from immutable RuntimeEvents using versioned composite boundaries;
• materializes one provider replay projection per lineage segment and binds its digest to the claim;
• adds SQLite-owned unique continuation claims with exact source and target execution identity;
• makes runtime_admission continuation-start the only durable provider-call T1, backed by an opaque one-shot admission receipt;
• converges claim-only and pre-provider crashes with deterministic claim_repair start + terminal facts and zero provider calls;
• rejects active or non-terminal source claims inside the SQLite transaction, so an erroneous caller cannot seal a live Run.

Primary invariant

A durable continuation may call the provider only after one versioned composite immutable boundary has been rebuilt, revalidated, and atomically claimed. Every lineage segment uses the same replay projection. Only a continuation-start durably committed by the SQLite authority with start_kind=runtime_admission grants provider execution authority; claim_repair is audit-only and never grants execution.

Ownership and atomicity

• Boundary/replay owner: core boundary codecs plus the shared runtime replay materializer.
• Claim owner:SqliteRuntimeStore; BEGIN IMMEDIATE re-reads the latest immediate-source ledger, validates identity, position, and digest, requires exactly one terminal RuntimeEvent at the tail, checks an empty exact target, and inserts the claim.
• Provider admission owner:RuntimeKernel and the package-private one-shot admission proof/receipt consumed by RuntimeRunner.
• Repair owner:SessionManager classifies durable claim/start/terminal state before generic ledger repair.

Claim and continuation-start failures roll back their SQLite transactions. A rejected non-terminal claim creates no row and does not seal the source, so the active Run can still commit its terminal fact.

Failure states and rollback

• missing, stale, corrupt, non-terminal, or suffix-bearing source boundaries fail closed before provider dispatch;
• exact claim retry returns the existing claim and does not create another target;
• claim-only or target-created-without-start crashes converge through deterministic repair with provider call count 0;
• a durable live start without a terminal fact remains continuation_started_indeterminate unless ownership can be proven;
• unknown authority/projection versions, mismatched target headers, claim rows, starts, terminal tails, or replay digests park instead of falling back.

Existing provider retry compatibility

The hosted runtime currently uses a file RuntimeEvent store and does not yet own the SQLite continuation authority lifecycle. To avoid regressing its existing child provider-429 retry, this change keeps an explicit legacy_provider_retry lane:

• it is selected before claim, Run creation, or provider T1 only when continuation authority and the safety inspector are both absent;
• partial capability installation fails closed instead of falling back;
• it reads immutable RuntimeEvents and revalidates the immediate source before execution;
• it never writes a continuation claim, continuationSource, or continuation-start;
• it cannot retry a repaired pre-provider abandonment and carries no durable resume or cross-process exactly-once guarantee.

A later host authority lifecycle integration will replace and remove this compatibility lane.

Compatibility

• supports the released populated SQLite schema 5 to schema 6 upgrade;
• mutable partial snapshots remain UI-only and never contribute to a durable cursor;
• JSONL may be read for legacy history but does not provide durable continuation claim authority;
• unpublished experimental databases from feat(runtime): complete Phase 3A file-transaction recovery #1346 are intentionally outside the compatibility contract.

Explicitly out of scope

This change does not implement general typed retry/reattach, Bash replay, ShellRun reattach, conversation-clone evidence rewriting, ContinuationExecutionProfileV1, Write/Edit file checkpoints, workspace/Git checkpoints, hosted SQLite authority lifecycle integration, or default hosted auto-resume. Those remain separate changes because they have different owners and failure boundaries.

Validation

After rebasing onto upstream/main@e4c6ddbf:

• Core boundary/decoder/AgentRun V2 focused tests: 54/54
• SQLite store/schema/claim/start/terminal/multi-process tests: 43/43
• Runtime continuation/replay/admission/planner focused tests: 46/46
• SessionManager continuation, authority, branch-preflight, and upstream-conflict tests: 25/25
• real-process continuation SIGKILL harness: 1/1, covering five durable boundaries
• UI resume copy: 4/4
• monorepo typecheck passes
• hosted linked-child production-shape retry completes through the explicit compatibility lane; its assertions verify that no durable continuation lineage or start fact is written

These are focused proofs for the affected paths; this description does not use CI green as a substitute for concurrency, crash, or data-safety reasoning.