Canonical model transcripts: exact token counting, tool naming, health, and session lifecycle

[raphael]

Canonical model transcripts end to end: exact Anthropic token counting, one provider tool-name projection, deterministic registry health, and durable session-lifecycle enforcement in the run loop.

Model providers

• Anthropic exact token counting: the adapter now separates the canonical request encoding (messages, tools, cache markers, tool choice, betas) from completion policy (max_tokens, temperature, thinking). CountTokens consumes the encoding directly, so counting works without a default MaxTokens and can never drift from the completion encoding ("tools": [] vs omitted).
• Tool-examples beta: attached additively (WithHeaderAdd) so caller-configured betas (e.g. 1M context) survive, and only when a tool authors examples — header-compatible gateways reject unknown beta identifiers. Live-verified against Vertex rawPredict (usage.input_tokens deltas): Claude-on-Vertex delivers input_examples natively with no beta activation and ignores the header, so no transport gate exists.
• Counting projection owned once: model.CountingRequest is the single owner of the TokenCounter projection (thinking stripped, thinking-only messages dropped); anthropic, bedrock, and vertex all consume it, deleting vertex's divergent private copy.
• Canonical tool names: features/model/toolname owns the provider-name projection for the shared [a-zA-Z0-9_-]{1,64} contract (Claude Messages API + OpenAI Responses); openai's byte-identical copy is deleted and toolname.BuildMaps owns the injectivity invariant for anthropic, bedrock, and openai. Direct Anthropic now sends fully namespaced tool names (leaf-stripping removed); provider names are per-request projections, never persisted.

Registry

• computeToolsetHealth is a pure function with explicit winner selection: ProviderID no longer flaps with replicated-map iteration order (freshest pong wins; newest registration is the no-pong fallback). Order-independence is asserted by running every table case forward and reversed.
• deriveStalenessThreshold pins the ping-config-to-freshness-window derivation so a config change cannot silently shrink the window; the former Redis-backed property tests are replaced by fast table tests, with the distributed plumbing behind the integration build tag.
• The integration tag is an explicit opt-in: TestMain fails loudly when Redis cannot be provisioned instead of skipping every test and turning the lane vacuously green. CI runs make itest so the lane has one source of truth.

Runtime

• Session lifecycle enforced at turn boundaries: every planner activity (start and resume) consults the durable session status first and refuses to plan under an ended session, recording CancellationReasonSessionEnded so the terminal RunCompleted event carries canonical provenance even when engine cancellation never delivered (CancelRun rolls its provisional reason back in exactly that case). The workflow terminates through the existing cancellation path; engine cancellation is now an expedite-only optimization, closing the gap where in-flight runs outlived their session on engines without cancellation.
• Timeout is terminal: tool timeouts and exhausted budgets no longer produce planner retry hints — elapsed execution time is not an instruction to repeat a call.
• One retry vocabulary: policy.RetryReason/RetryHint are aliases of the planner types (no import cycle exists); the mirrored constants and the runtime's deep-cloning conversion are deleted, so retiring a reason is a single compiler-propagated edit.
• Stream event identity (EventKey) is preserved through the hinting sink, and pending agent-tool child workflows are canceled at the parent finish-by deadline.

Verification

• go build ./..., golangci-lint (0 issues), full unit suite with -race (54 packages), Docker-backed registry integration suite, and the end-to-end scenario suite all pass.
• Vertex beta behavior verified empirically against the live rawPredict endpoint.