feat: replace Session Task Ledger with a SessionTodo current snapshot

[me2seeks]

Problem

The Session Task Ledger is still a workflow-shaped authority with stable Task identities, mutation history, hierarchy, ownership, evidence, claim and settle paths, a paginated Host query, and a Task-specific Desktop panel. RFC #2290 accepted a narrower end state: one Session-local current Todo snapshot that records only the model latest explicitly written checklist.

Current main also removed generic turn-tail injection in #4278, so Todo recovery must be explicit and durable rather than injected into every provider request.

Desired outcome

Replace the model-facing Session Task Ledger with a Host-owned SessionTodo current snapshot:

• todo_read returns the complete current ordered snapshot.
• todo_write atomically replaces the complete ordered snapshot.
• no revision, IDs, item CRUD, mutation history, cursor, watermark, hierarchy, owner, evidence, claim, or settle semantics.
• completed is model-reported progress only and never execution evidence.
• TUI renders settled semantic tool cards only.
• Desktop renders the same current snapshot as a flat read-only checklist.
• restart and compaction preserve the snapshot; the model reads it on demand.
• no Todo turn-tail or dynamic system-prompt injection.

Migration and lifecycle

• Lazy bootstrap imports canonical legacy pending and in_progress Tasks as-is and maps blocked Tasks to pending while preserving the subject. Workflow-only blocked reasons are not imported.
• Terminal completed, failed, and cancelled Tasks are not imported.
• Uninitialized and initialized-empty are distinct durable states.
• First explicit todo_write wins and never merges legacy Task data.
• Once initialized, SessionTodo never reads legacy Task state again.
• Full/latest copies may copy current Todo only when the source is idle and the selected cut includes the latest committed turn.
• Historical cuts, before revisions, and active side conversations initialize Todo as explicitly empty.
• Remove/discard purges Todo; archive retains it; backup and restore cover both non-empty and initialized-empty documents.
• Old Task tables remain preserved during migration and rollback, without dual writes or dual product surfaces.

Delivery

• Storage foundation: current-document contract, bounds, schema/store, authentic internal writer, lazy bootstrap including blocked-to-pending preservation, initialized-empty, purge primitive, migration, and backup/restore (feat(storage): add dormant SessionTodo foundation #4340). This remains dormant and creates no production Todo rows.
• Atomic Host/product cutover: export and compose the single Host authority; enforce Session presence/admission; wire copy/discard/remove/archive; enable todo_read/todo_write and Desktop/TUI projection; and simultaneously disable the complete legacy Task demand chain (feat(runtime): cut over SessionTodo to Runtime Host authority #4351). Host lifecycle composition does not land earlier because it would initialize snapshots while legacy Task mutations remain active.
• Retirement: remove legacy replay, codecs, tests, and tables after the migration and rollback window.

The cutover includes the old model tools, task.ledger.query/change feed, subagent task_id/claim/settle, Goal Task gate, conversation Task copy, Desktop Task panel, full Task writer composition, and new Deep Research task-id production.

Item-count and encoded-byte bounds are engineering-derived from the released Task limits and Runtime Host frame budget, not inherited from the deleted turn-tail budget.

Parent RFC: #2290
Supersedes the durable Task mutation-history direction in #4179 and Draft PRs #4239/#4241.

AI assistance disclosure: Codex helped audit current main, compare alternative interfaces, and draft this issue. I reviewed the scope and own the final position.

[me2seeks]

take