feat(session): protocol-safe checkpoint cut planner

[bobzhang]

Summary

Third slice of the compaction production-hardening plan (R1: the substrate every later stage consumes). Stacked on #453.

Session::checkpoint_cut(requested_to~) returns the largest coverage boundary at or below the request where no assistant tool call is pending — so a checkpoint summary always swallows assistant/tool batches whole. A prefix cut inside a batch silently drops the batch's uncovered sibling results from every later projection, with nothing standing in for them; the property test pins both the clean and the split direction.

Design points:

• Pure, read-only, single pass over raw events; no new event variants (strict decoders untouched).
• Conservative at the log edge: a crashed batch keeps its calls pending forever, clamping boundaries below it — a tail must never start mid-batch even at end of log.
• Both checkpoint sites gain warn-only invariant probes (auto_compaction_cut_clamped / compaction_cut_clamped). Behavior is unchanged: full-range coverage swallows batches whole. A clamp on the auto path indicates a sequencing bug; on the manual path it flags a crash-truncated log.

The verbatim-tail, deterministic-eviction, and incremental-checkpoint stages consume this API next, where clamps become binding instead of diagnostic.

Testing

• Six unit tests: boundary placement, interleaved result order, open tail batch, mid-log dangling call, orphaned result, requested_to edge cases.
• Property test: covering to a planner boundary keeps every uncovered event verbatim; a mid-batch cut silently loses the uncovered sibling result (negative control).
• subal (codex) review: wrote an exhaustive model-check over all event sequences up to length 6 — every planner-safe cut preserves all uncovered events; no counterexample. Clean verdict.
• moon check --deny-warn clean; agent_session 36/36, agent+compact 67/67.

🤖 Generated with Claude Code