Preserve multi-turn context across Provider handoff

[Lucas1479]

中文摘要

给中文审阅者的速览；下方英文正文仍是完整技术说明。

• 问题：用户通过多轮对话逐步补充目标、对象或约束时，委托给 Provider 的当前消息可能只是“为什么没做”等指代性追问；旧实现最多保留一条更早用户消息，恢复路径甚至可能完全漏掉父对话上下文。
• 修复：由 Host 维护有界的父对话 checkpoint。冷启动、Provider 切换或游标不可信时发送 snapshot；只有同一类型化 Provider Session、同一 Chat/AppSession 来源、有效投递回执和唯一锚点同时成立时才发送 delta，否则安全回退到 snapshot_fallback。
• 权威与隐私边界：最多传递最近六条 User/Main Chat 消息、总计 2000 字符。历史 Main Chat 内容只作为对话证据，不能变成任务、权限、回执或完成事实；但选用外部 Provider 时，这些有界内容会随 Work 请求离开 Host，审阅时应重点确认披露范围。
• 兼容性：不改变数据库、Provider 能力、WorkItem/Attempt、权限、完成或用户接受语义。Provider Session 仍按 WorkItem 复用，checkpoint 只解决有界可恢复性，不等于完整长期记忆。
• 验证：关键跨层测试 82 项通过；完整 Python 套件 1689 项通过、1 项跳过；Electron 测试与构建、Ruff、compileall 和 diff 检查通过。未进行付费真实模型验证，真实 Provider 对上下文的理解效果及 token/延迟收益仍属后续证据。

关联讨论：#17。

What and why

Provider delegation lost the multi-turn object when the current user message was an anaphoric follow-up, and recovery could omit parent context entirely. The initial repair improved the normal path but an independent audit found two unsafe cursor cases and two residual presentation/activity leaks.

This PR now repairs the complete Host-owned handoff boundary:

• a prepared or attached Provider Session is not treated as proof of prompt delivery;
• a parent-context cursor advances only after the adapter observes the native acceptance boundary;
• delta requires the same typed Provider Session, the same Chat/AppSession source scope, a valid delivery receipt, and one unique full-text anchor;
• every unverified, missing, rolled, ambiguous, cross-source, or clipped anchor falls back to the current bounded snapshot;
• A1-scoped handoff reads only the exact AppSession role branch and never falls back to unrelated parent Chat;
• the internal delivery receipt is removed from public run/result/terminal projections and Electron Work signals;
• receipt persistence does not advance Attempt or WorkItem activity timestamps.

Linked product-semantic discussion: #17

Fixes #17

Product semantics

This is a bounded product-semantic and data-disclosure change, not only an internal optimization.

A model-driven Provider receives the exact current user wording plus up to six recent User/Main Chat messages and 2000 characters from the dialogue source that owns the turn. For an external selected Provider, that bounded text leaves the Host with the authorized Work request. This can change model behavior, prompt tokens, latency, cost, and disclosed data.

Prior Main Chat text is labelled evidence, not another task, permission, receipt, or completion fact. Host task, workspace, permission, completion, and acceptance authority remain unchanged. Prompt wording alone is not proof of real-model interpretation.

Dialogue-source scope protects handoff provenance and delta calculation; it is not native-history isolation. Provider Sessions remain WorkItem-scoped, so the same WorkItem may reuse its native thread across Chat/A1 sources while receiving a bounded snapshot_fallback from the current source.

The bounded snapshot is best-effort recoverability within its window, not complete conversation memory.

Change class

• Routine fix, documentation, test, maintenance, or presentation-only UI
• Product-semantic or public-contract change discussed in the linked Issue
• Isolated, default-off experiment

Owning layers: Chat source projection, Provider Runtime native-acceptance boundary, Work Ledger delivery cursor, and public Provider/Electron presentation projections.

Compatibility or migration impact: no database migration or Provider capability change. Provider-visible prompt content and disclosure are intentionally broader and documented.

Evidence

• python tools/probes/probe_provider_parent_context_handoff.py
  • reproduces the latest-only baseline;
  • compares the pre-PR, original PR, and receipt/scope repair behavior;
  • covers failed-before-delivery and cross-parent-session counterexamples;
  • verifies provider-neutral prompt rendering and authority labels.
• Eight key cross-layer Python files: 82 passed.
• Full cu124 Python suite: 1689 passed, 1 skipped.
• Electron receipt visibility tests: 2 passed.
• Electron TypeScript and production Vite build passed.
• Ruff, compileall, and git diff --check passed.

No paid live-model run was used. Real Provider interpretation of Main Chat evidence and measured token/latency savings remain outside the current evidence.

• Relevant Python tests pass
• CPU/model-less baseline remains supported
• Electron npm test and npm run build pass
• Dependency audit passes when dependencies changed (no dependency change)
• Before/after screenshots are attached (no intended visible UI signal)
• Documentation is updated for the changed contract and limitations

Final check

• This PR addresses one coherent Provider handoff problem
• It fails closed to bounded snapshot rather than guessing a cursor
• It does not add a summary model, provider-name shortcut, or database migration
• No secrets, local state, model weights, voice material, or restricted assets are included
• Third-party notices and provenance are preserved

[Lucas1479]

Audit follow-up commit \68ee843\ is ready. Both required CI checks are green, and Issue #17 now records the clarified disclosure, source-scope, receipt, and bounded-snapshot semantics. @i-so-late, could you review the updated PR when convenient? I will use the repository's normal squash-merge path after approval.

[Lucas1479]

Maintainer self-review complete: no blocking findings remain. The Host sends the authorized task separately from exact current wording and a bounded six-message/2000-character role-labelled checkpoint. Delta is permitted only for the same typed Provider Session, the same dialogue-source scope, a native delivery receipt, and one unique full-text anchor; missing, clipped, ambiguous, failed-before-delivery, or cross-source cases fall back to the bounded snapshot. Receipt authority remains internal: it does not enter Runtime events/results, WebSocket/Electron Work projections, Work Activity, Provider Activity journal, visible timestamps, or the public event sequence. Self-review added two corrections before merge: ARCHITECTURE/current-contract documentation for the disclosure boundary, and a regression that keeps internal receipts out of the public event cursor. Validation in the formal .venv_cu124 environment on the rebased merge train: full pytest 1719 passed / 1 skipped; after the final event-sequence correction, 29 direct and 277 combined handoff+narration tests passed. The deterministic A/B/C provider-neutral probe, changed-surface Ruff/compile/diff checks, Electron tests (2/2), TypeScript/Vite production build, provenance gate, and deterministic source-release gate passed. Required build and cpu-model-less checks are green on final head 3c8d0f0. Admin merge bypass is used only for the unavailable external approval requirement.