[schlessera]

Closes #2049

What changed

Claude and Pi keep runtime-written transcript bytes intact across turns. Host-owned replay metadata restores promoted file links and authoritative application receipts in UI history, including early direct effects with no native transcript. Pi may append a missing result only for an actual runtime-written application call after worker shutdown.

Why this shape

The provider transcript remains the runtime record; display mappings and host receipts belong to the UI replay layer. Both history readers retain the delivered UUID/digest-based user-text provenance from #2072. This ordinary PR contains only #2049 changes on delivered main, with the incoming context fixtures and CI updates preserved.

Proof

Current head d58edc04f7f34a3b5250cd58d8037137ae28d3f4, base 3031e31a11249a3ebcd53987e764a199b3af9925, tree c12e0bc08af92a65a2ee63740f08f2f6156093ac.

• Current focused integration: 136 tests / 490 assertions pass across 13 files, including installed real Claude/Pi worker request-prefix probes, native persistence, fresh history display, exact user-text provenance, six early/direct receipt scenarios, storage isolation and citations.
• Current bun run check:pr --base origin/main passes: lint/leakage and 638 fast invariant tests / 3806 assertions. bun run typecheck passes. The preserved own-layer patch applied cleanly; runtime history/worker sources equal their previously tested implementation. Upstream fixtures and CI changes remain intact.
• Earlier layered head 395ff3a0f3981f2da9cebb17aa6a4dc887a7a94a on parent b11c43ff08c9490f5acce54873682333b2a2601a: 123 tests / 493 assertions, types and parent-relative preflight passed. Deliberately restoring Claude transcript rewriting or Pi parent persistence failed the named request-prefix assertions; restored probes passed.
• Local correction 371c5b51900cad8ff8ef1c335c553d38dcaebb47 reproduced the stale saved-answer rewrite oracle, then independently proved the real-worker test rejects native JSONL byte changes and missing fresh UI display mappings. Restored focused worker/prefix/promotion controls passed 61 tests / 300 assertions. Related Claude/Pi fixtures were audited for the same stale expectation.
• Offline two-turn/four-request probes use loopback provider endpoints and fictional credentials. They promote an intermediate and final chart link before resuming. Claude ordinary caching normalizes only cache_control metadata; the caching-disabled control checks raw serialized messages. These prove request assembly and replay, without claiming provider cache hits or savings.

Prior receipts retain their original SHA attribution. Current hosted CI is pending; no cancelled native-stack run is claimed as passing. Following the current authorized merge workflow, prior passing runtime/mutation evidence plus focused current integration checks support review without repeating complete CI solely for base advancement.

Checklist

• Focused current preflight and runtime integration pass; earlier mutation receipts retain actual source identities.
• Current hosted jobs have completed (pending at publication).
• Scoped acceptance behavior implemented, including early receipts and native file absence.
• PR and issue release milestone 0.44.0 verified.
• Changeset, internal API inventory, docs and citations maintained.
• Public-text and tree leakage checks pass; no public machine-surface contract changes.

Anything left open

Current hosted checks are pending. Merge must respect actual branch protections and review requirements. Reconcile the delivered squash and run focused post-merge conflict checks if main advances; prior evidence is not relabeled as proof of another tree.