[schlessera]

Closes #2051

What changed

Governed turns pass their assembled prompt unchanged to the backend. UI replay removes only the exact legacy 0.42/0.43 trailing budget suffix before local-command and message-source joins, restoring command order, voice source, thinking level and file metadata without rewriting saved provider transcripts. The measurement harness carries the actual host-owned prepared prompt receipt to its strict worker observer, preserving the reviewed original and exact provider bytes.

Why this shape

This ordinary PR now contains only #2051's 14-file layer on delivered main; its former context and saved-history prerequisites have merged. Static session limits, actionable changed-tail context, current governance/budget fields and replay provenance remain intact. Integration preserves the incoming createTurnLifecycle import and all lifecycle behavior; the only runtime prompt changes are removal of the routine note and UI-only legacy replay stripping. Measurement instrumentation stays in existing private preloads, with no production event, field or extension seam. Includes a server patch changeset and required historical citation updates.

Proof

• Current integration head eb10f050d1b7339faa2751b03781d45cf43d7c59, base d6b527290fe203fca7f653464895e92775ec422f, tree d58b68c61126f7526a8c30c8cbf2c77ce929c576. The preserved own layer applied cleanly initially; the later import conflict was resolved by retaining incoming lifecycle wiring and removing only inferenceBudgetNote. No upstream history/provenance or new governance code was replaced.
• Current focused host-budget, Claude/Pi legacy replay, SDK session-replay provenance and citation run: 58 tests pass; one documentation-citation test fails on the two unchanged inherited anchors tracked by docs: refresh worker SDK and file-viewer decision anchors after source movement #2154. Both backend replay tests verify unchanged provider transcripts, original user text, local exchange order and source/thinking/file metadata. Budget warning/stop and static-limit transport checks pass.
• Current real offline Pi/server exact prepared-prompt receipt and independent changed/extra/original input controls pass 2 tests / 35 assertions. Focused selection intentionally filters other experiment cases; this is not a complete experiment-tier pass.
• Original proved head 0d658e7ca5a1ef98860ad1b79653782931a1b63c, tree f3261f4bcfb381eb1bced8a039aae97b01bda102, parent 395ff3a0f3981f2da9cebb17aa6a4dc887a7a94a: focused 53 / 206, restored budget/replay 9 / 93, native exact/negative 2 / 35, typecheck, and parent-based local preflight 864 tests / 5541 assertions plus lint/leakage/changeset gates pass. These retain their original SHA and are not relabelled as a fresh combined-main receipt.
• Four mutations on that original head fail the intended behavioral assertions: routine note restoration fails all six GOVERNED_PROMPT_PRESERVES_USER_BYTES cases; bypassing the legacy strip fails both adapters' LEGACY_LOCAL_EXCHANGE_ORDER; reaching actual-user metadata first fails LEGACY_MESSAGE_METADATA; appending input after host receipt capture fails the actual native observer with Actual Codex input differs from the exact expected user-plus-host prompt. All sources were restored byte for byte and controls passed.
• Current integration source assessment preserves those own runtime/helper/test bytes except the incoming lifecycle changes in run-session.ts; focused host tests exercise the integrated turn path. Earlier standalone/prospective receipts remain attributed to their original trees. Per the user's explicit direction, there is no new full refresh solely for base advancement. Global/current-head CI remains pending; no provider cache-hit or savings claim.

Checklist

• Complete current-head hosted/global proof passed. Existing full proof is retained at its actual earlier SHA; current focused proof and the known inherited citation failure are recorded above.
• Scoped behavior checked with meaningful failing-first and restored mutation receipts.
• PR and issue release milestones read back as 0.44.0; registry latest 0.43.1. Reconfirm before merge.
• Patch changeset included and package references/full pending plan validated.
• Public body/diff leakage screening and focused scope review completed; prior lint receipt remains attributed to its SHA.
• No production integration contract field changes in this layer.
• Historical decision context and this layer's moved citations reconciled.

Anything left open

Current global CI is pending. #2154 owns two inherited documentation-citation anchors (const sdkOptions and the standalone Mermaid viewer branch); this PR does not claim that citation suite is green. Merge follows the user's explicit direction to retain previously passed full proof with focused integration evidence, without admin/protection bypass. Actual integrated-main, issue closure and milestone reconciliation remain required after merge.