[Refactor] Define an ordered context-transformation plan and protected-turn IR #3472

Goal

Extend the existing contextcompression.RequestIR and MessageIR with one ordered transformation plan and protected-segment contract so reset, deduplication, turn selection, and compression cannot independently mutate the same request history.

Proposed Workgroup

Agentic & Context

Background

Current request preparation already applies RAG, then Router Memory, then the context-compression stage before provider encoding. The active children of #2984 add topic evidence, optional history reset, deduplication, prior-turn selection, and summarization around that shared path. A second IR or another raw-message mutation pipeline would make ordering and protected-content behavior diverge.

Work item shape and dependency

This is the shared integration seam for behavior-changing context work. #3342 signal-contract work and #3345 research can proceed independently. #3343, #3344, and #3346 may develop bounded policy and fixtures in parallel, but their request-pipeline integration must use this seam after it lands.

Scope

• Extend, rather than replace, pkg/contextcompression.RequestIR and MessageIR with typed source, eligibility, protection, and complete-turn/tool-exchange identity.
• Preserve an immutable view of original conversation history for [Feature] Add bounded topic-continuity signals for context policy #3342 topic evidence so injected RAG or Memory content cannot change that signal accidentally.
• Keep the current RAG-then-Memory preparation order and represent their injected content with explicit provenance before lossy context transforms run.
• Define the behavior-changing order as eligible-history reset ([Feature] Reset eligible history safely on topic change #3343), exact safe deduplication ([Feature] Deduplicate repeated context without changing conversation semantics #3346), complete-turn selection ([Feature] Select relevant prior turns under a context budget #3344), existing configured block compression, then provider encoding.
• Protect system/developer instructions, the live user turn, multimodal blocks, authorization/safety context, and atomic assistant/tool exchanges throughout the plan.
• Give each step declared inputs, outputs, protected invariants, skip/failure behavior, and a content-minimized receipt.
• Add unit and property tests for baseline preservation, ordering, idempotency, protected content, RAG/Memory provenance, tool-exchange atomicity, and protocol-neutral round trips.

Configuration and API impact

This is an internal refactor. It adds no public configuration or client protocol and preserves current RAG, Memory, and compression behavior until an existing child policy explicitly enables a new step.

Non-goals

• Create a second context IR or compression framework.
• Implement topic detection, reset policy, deduplication policy, turn ranking, summarization, RAG, Memory, or token budgeting.
• Reorder current RAG and Memory behavior as an incidental refactor.
• Permit lossy mutation without an explicit plan entry and receipt.

Completion signal

• Existing RequestIR/MessageIR own the ordered plan and protected invariants.
• Existing behavior is byte-compatible when no new transformation is enabled.
• RAG, Memory, original history, protected content, and eligible history remain distinguishable.
• [Feature] Reset eligible history safely on topic change #3343, [Feature] Select relevant prior turns under a context budget #3344, and [Feature] Deduplicate repeated context without changing conversation semantics #3346 can integrate without another raw-message mutator.
• Tests cover ordering, idempotency, safe failure, protocols, multimodal content, and atomic tool exchanges.