Parent and architecture

• Implementation epic: #6
• Accepted architecture decision: #1
• Depends on: SESSION-01 #20, SESSION-02 #21, SESSION-03 #22, SESSION-04 #23

Outcome

Make every worker invocation reconstruct bounded context from canonical events and immutable snapshots instead of relying on a frontend transcript or harness-local session database.

Estimate

• 8 SP / 5 engineering days
• Risk: high

Scope

• Extend worker jobs with session_id, trigger_event_id, optional snapshot version and bounded event range.
• Load the newest compatible snapshot at or before the trigger sequence, then page and verify subsequent canonical events.
• Materialize referenced message, tool and attachment payloads into a fresh tenant/run-scoped workspace.
• Add immutable, content-addressed compressed transcript snapshot support under:
  tenants/<tenant-id>/sessions/<session-id>/snapshots/<version>.jsonl.zst.
• Persist snapshot manifests, digest, covered event sequence and format version in YDB.
• Fall back to an earlier snapshot or bounded event replay when a snapshot is missing, corrupt or incompatible.
• Keep Codex/OpenCode/Claude/Hermes native session IDs as attempt/checkpoint metadata only.
• Remove context assembly from Telegram-history and context_epoch assumptions.
• Enforce context byte/event/tool limits before launching a harness.
• Update worker/context contracts and operational documentation.

Non-goals

• Semantic summaries or search.
• Permanent worker filesystem.
• Harness-specific session restore as the correctness path.
• Archive/listing HTTP endpoints.

Verification

• A stateless deterministic worker reproduces the same materialized context from events alone and from snapshot-plus-tail.
• Corrupt/mismatched snapshots are detected by digest/version and do not silently alter context.
• Tenant/session mismatches fail before any payload is materialized.
• Warm worker reuse cannot see a prior session workspace or harness home.
• Context bounds fail predictably without partial execution.
• Retry/checkpoint paths retain canonical session/event linkage.

Acceptance criteria

• Deleting all worker-local state does not remove or corrupt product history.
• Canonical event replay is the correctness baseline.
• Snapshot creation and selection are deterministic, immutable and tenant scoped.
• A harness adapter cannot promote its native session ID to product identity.
• Context materialization tests include images/files and tool payload references.