feat(daemon): add semantic checkpoints

[9s5bz2jvd2-lang]

Summary

• add a private, run-scoped checkpoint tool to LingTai daemon sessions after the exact DaemonRunDir exists
• validate, redact, and atomically persist only the latest bounded semantic checkpoint in daemon.json.latest_checkpoint
• project that checkpoint through live and historical daemon(check) and preserve the same tool surface after same-run compact reconstruction
• keep the checkpoint event/heartbeat secondary and best-effort after the authoritative state commit

Why

Long daemon runs can cross hard turn, compaction, or parent-restart boundaries without a small machine-readable statement of which semantic phase actually completed. This adds an explicit voluntary phase boundary without treating every model turn as causal progress.

Safety and scope

• LingTai backend only; not exposed to external CLI daemon backends
• exact internal schema/handler binding; same-name external schema cannot capture the handler
• UTF-8 byte caps, row caps, strict enums, redaction, secret-bearing evidence-ref rejection, traversal/absolute/symlink escape checks
• raw checkpoint args are masked from parent lifecycle logs
• next_action is advisory text only: no automatic execution, retry, message, or resume
• phase_status="complete" is not a run terminal state; only the existing daemon completion gate followed by finish(status="done") can mark the run done
• old runs remain backward compatible and omit checkpoint
• T1 only: no Gemini / feat(daemon): add same-run compact context reset #961 work and no T2-T5 handoff, effect, recovery-selection, or benchmark changes

Validation

1. Focused offline regressions

• named authority regression: test_checkpoint_complete_does_not_mark_run_done_or_bypass_finish — 1 passed
  • snapshots authoritative state after checkpoint: still running, finished_at=null, no daemon_done
  • snapshots again after the original finish(done) completion signal: still non-terminal until the runner's existing completion gate accepts it
  • then verifies final done and event order checkpoint < finish tool_call < daemon_done
  • verifies the advisory next_action marker is never created
• full tests/test_daemon_checkpoint.py: 29 passed
• daemon CONTRACT + architecture docs: 7 passed
• py_compile: pass
• git diff --check: pass
• Ruff: pass
• test file: Black-clean

2. Exact unfiltered offline daemon matrix

One pytest command ran all eight files documented in the daemon CONTRACT, with no -k, manual exclusion, new skip, or xfail:

• 366 passed, 1 pre-existing failure in 22.21s
• the sole failure is test_daemon_tool_contract_verification_matrix_covers_native_mimo
• its exact required regex returns NO_MATCH on both pristine base a3f172ff571c39792ae219b76611e38feb673de4 and this branch; this PR does not modify that unrelated anchored-claims row

This is an offline fake/mock contract matrix. It is not presented as real-provider end-to-end evidence.

3. Real provider-backed multi-stage acceptance

An isolated agent imported this PR's source explicitly (no install or refresh of the running main agent), loaded no ordinary addons or external MCP registry entries, and ran a real codex-pool / gpt-5.6-sol daemon from 2026-07-16T11:30:23Z to 11:31:17Z.

Observed immediately after the real model completed phase 1 and called checkpoint:

• daemon.json.state == "running"
• finished_at == null
• latest_checkpoint.phase_id == "phase-one-real"
• latest_checkpoint.phase_status == "complete"
• live daemon(check).checkpoint matched the same checkpoint ID
• daemon_completion.json did not exist
• phase 2 did not yet exist
• an adversarial next_action asking for auto-next-action.txt had not executed

The parent harness then released phase 2. The real model continued, created the phase-2 artifact, verified the advisory marker was still absent, and explicitly called the existing daemon-common finish(status="done"). The durable event order was:

checkpoint (11:30:59Z) < phase-2 shell work < finish tool_call/result (11:31:15Z) < daemon_done (11:31:17Z)

Result: 14/14 acceptance assertions passed. The completion file used the existing lingtai.daemon_completion.v1 schema with status="done"; the advisory marker never existed.

Selected local evidence hashes (SHA-256):

• acceptance result: 22ed1263abfa537461181563b19bed854a1108a98f65b70f3c61e5b69693ea8c
• post-checkpoint daemon.json: 9aa14919a7263176e1ba81b12010c021ea0a241c40b8b5850c188bcd5d5c13a4
• final event log: 2ea30414bf136365a8acee1b26768e6b1f1adec6494aa79622d5d2f5b5e13afe
• final completion file: 19b04563f9be6d875f98e2702e787882601731ed99c2a79b4f976a7a4b742a49

Design archaeology

The bounded inspectable surface and explicit semantic-boundary choices were informed by #81, #263, #340, #510, #532, #624, and open #712. These references constrain the design; this PR does not claim to reopen or solve those broader issues.