[Reliability] Persist stream event log so replay survives restarts

[sjr666666]

Background

Stream Event Protocol v1 implements reconnect replay entirely in memory (StreamEventHistory caps at MAX_RUNS=32 / MAX_EVENTS_PER_RUN=2000). Restart loses every run history, and buffer eviction is silent. ADR 0001 defers event-log persistence explicitly (open question #1).

Requirements

1. Append-only JSONL event log next to the kernel store
2. Cross-restart replayStream works for runs recorded before this process started
3. Bounded disk usage; truncated/unknown run still returns recoverable:false
4. Disk failure degrades to in-memory buffering without breaking the live stream
5. Log directory supplied by the app (userData store dir)

Out of scope

• Client-side cursors (message-db concern, [Copilot] Add edit, retry, regenerate, and conversation branching without overwriting history #34)
• [Reproducibility] Persist immutable run manifests for Agent / Deep Research #21 immutable run manifests integration

Acceptance

• New-run cross-restart: replay(runId,0) returns full contiguous stream
• Truncated/unknown run still recoverable:false
• Disk write failure does not block live stream
• Identity contract ([Copilot] Add edit, retry, regenerate, and conversation branching without overwriting history #34) unchanged
• Unit + typecheck green

Related

• Depends on [Copilot] Define a structured streaming event protocol with cancel and reconnect #27; complements [Reproducibility] Persist immutable run manifests for Agent / Deep Research #21 and [Copilot] Add edit, retry, regenerate, and conversation branching without overwriting history #34

[sjr666666]

Hi, I'd like to take this one.

I implemented #27 (Stream Event Protocol v1 types, the parallel runtime channel, and the transport + renderer consumption, all in the #41/#42/#43 stack) — this issue is the natural follow-up of the same work: durable replay is listed in ADR 0001 as an open question deferred from v1.

Plan:

1. Add an append-only JSONL event log under the kernel store dir (one line per stream event)
2. Restore in-memory history from disk on boot so replayStream survives restarts
3. Bounded retention (per-run cap + total cap); truncated/unknown runs keep the explicit recoverable:false path
4. Disk failure degrades to in-memory-only without blocking the live stream (diagnosable, not silent)

Will open a PR stacked on the #27 series since this builds on the protocol/adapter/history that lands there.

[github-actions]

@sjr666666 已认领该 Issue，并已自动设为 Assignee。提交 PR 时请在描述中写 Closes #75。