Parent and architecture

• Implementation epic: #6
• Accepted architecture decision: #1
• Depends on: SESSION-01 #20, SESSION-02 #21, SESSION-03 #22, deterministic worker #10
• Transport follow-up: TELEGRAM-02 #37

Outcome

Finalize worker output as canonical assistant/tool events and create frontend-neutral projection work without coupling canonical history to Telegram delivery.

Estimate

• 5 SP / 3 engineering days
• Risk: high

Scope

• Define which user-visible/reconstructable tool calls/results become canonical events and which operational telemetry remains attempt/audit metadata.
• Store large assistant/tool payloads in Object Storage and commit event metadata, digests and manifests in YDB.
• Change terminal worker finalization to atomically create:
  • exactly one logical assistant event for the run;
  • canonical tool events required for reconstruction;
  • result/artifact manifests;
  • frontend-neutral projection records for currently authorized bindings.
• Keep renderer/delivery transport details outside the finalization transaction.
• Reject stale lease fences and duplicate terminal callbacks without another canonical event.
• Append structured failure/cancellation events only where defined by the domain contract.
• Define projection idempotency, authorization snapshot/recheck and expired-binding behavior.
• Update finalization/projection contracts and tests.

Non-goals

• Telegram message rendering/sending; tracked in #37.
• Snapshot construction.
• Session listing API.
• Harness-specific transcript databases.
• Physical exactly-once frontend delivery.

Verification

• Duplicate terminal finalization creates one assistant event and one logical projection per eligible binding.
• A stale worker fence cannot append events or projection work.
• Projection retry/state changes cannot duplicate canonical assistant/tool events.
• Tool payload manifests are tenant/session scoped and content digests are verified.
• Cancellation, timeout and terminal failure follow explicit event/no-event contracts.
• Two-tenant negative tests cover events, manifests, bindings and projection references.

Acceptance criteria

• Canonical result history survives projection-row and attempt TTL expiry.
• One completed run has one stable logical assistant event identity.
• Canonical tool events are sufficient for later stateless reconstruction.
• The finalization core contains no Telegram-specific delivery type.
• No message/tool payload is stored inline in hot YDB rows beyond documented bounded previews.