Restart-safe observation identity and turn-scoped events (FIG-615)

[SamGalanakis]

The three recoverable-chat items FIG-610 left open. Each needed an upstream change — the observation stream simply did not carry what a host needed — so all three land as one protocol bump (16 → 17).

1. Event identity is now restart-safe

RecoverableChatEventId was (session_id, cursor). The in-memory replay position restarts at 0, so a cursor is reused after a restart and a host retaining applied identities could silently suppress a genuinely new event.

Investigated first: the durable SessionRevision does not fix this — it advances only on commit, so a crash before a commit leaves it unchanged while the cursor resets. The fix is a replay-store incarnation id: a UUID generated when the store is constructed, neither persisted nor ordered, because it only needs to be distinct per instantiation. Identity becomes (session_id, replay_incarnation_id, cursor).

Consequence worth noting: retaining applied ids across a restart is now safe — a fresh incarnation cannot match a pre-restart identity — so the old "never persist these" warning is removed rather than reworded. Gap-clearing stays as belt-and-braces and the applied set is bounded (4,096, FIFO).

2. Turn identity on the observation envelope

Nothing told a host which turn an event belonged to (TurnActivity has no turn id; neither did the envelope), so the workbench had to retract transient rows session-globally — turn A's terminal wiped turn B's in-flight prose.

turn_id goes on the envelope, not on TurnActivity: the envelope already carries session/revision/cursor, so this scopes every payload kind. Optional, because QueueChanged/ProcessChanged/AgentFrameSwitched are genuinely not turn-owned. Turn activities and Committed populate it.

3. Committed gains turn identity and nothing else

No read view, no committed-delta. The host still refetches /api/state for content but can now fence that fetch precisely by turn. A full read view would grow unboundedly with session length and dominate stream bandwidth on long chats; the stale-snapshot race is already closed by FIG-610's generation fencing.

Workbench

finishTransientRows(turn_id) retracts only state belonging to the terminating turn; browser dedup uses the three-part identity. All FIG-610 behaviour intact (generation fence, authoritative dedup replacement, per-session cursor scoping, canonical merge).

Verification

Protocol v17 with exact-version validation — a v16 peer is rejected with a structured UnsupportedProtocolVersion, no panic or silent mismatch. 2,489 workspace tests, strict clippy, docs lint, and the Restate E2E lane on both SQLite and PostgreSQL. Key regressions independently re-run (9/9), including recoverable_chat_restart_identity_does_not_depend_on_gap_clearing — which proves a retained pre-restart identity no longer suppresses a real event.

Breaking: v17 envelopes require replay_incarnation_id; remote hosts must adopt the new envelope and identity key.

Closes FIG-615.