fix(cli): avoid duplicating sealed Roost message bodies

[Lampese]

Related issue

Storage companion to Roost #16. Depends on #1735, which adopts the coordinated published Roost 0.2.0 packages and v4 storage diagnostics. Merge #1735 first.

Problem / pressure

Correcting a sealed assistant message copied its entire content into a mutable state Turn. SDK fallback batches also retained full commands and unused baselines in receipt updates. A small correction could therefore replicate a large unchanged tool result repeatedly.

Summary

Store versioned field/text/array operations relative to the exact immutable primary Turn. Reconstruct complete entries for existing readers, reuse the decoded primary, and convert existing whole-message state on its next normal mutation. Preserve sealed records and retained updates.

Use the SDK's owner-local recovery option for CLI fallback batches, permission responses and staged generation commands. SDK preparation and final publication remain atomic; Lody adds no write retry or recovery loop. Moving unfinished work requires the complete owner database and matching host identity.

This branch is rebased on #1735 and uses published SDK and Native 0.2.0, with no local package override. The previous SDK 0.1.3 API release gate is resolved. Native 0.2.0 requires SQLite container v4; no migration, reset or existing-history cleanup is added.

Visual explanation

flowchart TD
  P[Immutable sealed primary] --> R[Reconstruct complete logical entry]
  D[State: primary ID and changed operations] --> R
  C[CLI fallback batch] --> T[Atomic compact receipt and private command journal]
  T --> A[Atomic effects, publication, receipt seal and journal retirement]
  A --> R

Loading

State is bound to one primary ID. Invalid bases, offsets and paths fail the existing history read. Legacy whole-message state remains readable inside a supported SQLite container. Reopening delta state requires the updated adapter; RPC readers still receive complete entries.

Before / after

Before	After
State copied unchanged message bodies.	State carries operations relative to its immutable primary.
Fallback receipt history carried full recovery commands.	Commands use an atomic owner-local journal; replicated recovery remains the SDK default for other hosts.
An earlier paired synthetic run with a 432 KiB unchanged body and 32 corrections retained 889,477 added update-value bytes.	The paired optimized run retained 4,113 bytes (99.54% less), with the same 37 added updates and identical logical content.

That comparison excludes the initial primary, outbox copy, indexes, WAL and stream transport framing. It is not a claim of the same percentage reduction in total database size or network traffic. The current regression enforces bounded growth rather than exact wire sizes.

Test plan

• Published SDK and Native 0.2.0: both owning test files pass 82 tests, including legacy-state reopen/conversion, lost first-state replies, later corrections, unchanged sealed frames, permissions, branches/inputs, Unicode, nested arrays, field removal, invalid bases/paths and own JSON keys.
• Complete pnpm check passes: package typechecks, ordinary typed lint, Effect lint, all repository tests, i18n and boundary checks. Full CLI suite: 4,435 passed, four existing skips.
• Repository format, documentation and diff checks pass.
• The public CLI builds with a 2 GiB heap, including published-bundle runtime/Worker probes. Desktop CLI staging and a real Electron Native Worker signed-SQLite write/verify/reopen probe pass.
• Four Native staging tests cover all six target selections using synthetic foreign bindings and execute the installed host binding. Local GUI E2E and foreign-platform execution are not claimed; standard PR CI is rerun.

Context handoff

Same-repository maintainer branch. The bilingual implementation note records the state format, owner-local recovery boundary, earlier measurements and current published-package acceptance. Merge #1735, then #1737. This update does not publish packages, deploy, merge PRs or modify an application database.

[github-actions]

Desktop PR smoke regression failed on commit c09a7047f5272caa1006be075c8ae7e24f6ee51f.

• Workflow run: https://github.com/LodyAI/Lody/actions/runs/39295941691
• Failed scenarios indexed: 0
• Recording: 1/1

Recordings not attached

• Run evidence: failure-index.json is missing

The Actions artifact retains the complete trace, screenshots, logs, and runtime evidence.

[github-actions]

Desktop PR smoke regression failed on commit 31e88a041623e14150ba946d0b7728507cbd8fad.

• Workflow run: https://github.com/LodyAI/Lody/actions/runs/39297981076
• Failed scenarios indexed: 0
• Recording: 1/1

Recordings not attached

• Run evidence: failure-index.json is missing

The Actions artifact retains the complete trace, screenshots, logs, and runtime evidence.