Recover tracing through an event WAL and SQLite span ledger

[Stephen Belanger (Qard)]

Summary

Implement tracing recovery as a pipeline with two bounded recovery stores:

• Capture full native events in a checksummed, session-scoped NDJSON WAL before translation. Require source and a nonempty session ID; unknown unused events do not fail, while malformed fields in recognized events pause translation.
• Translate each source session once into a SQLite ledger of route-neutral span create/merge operations. Atomically commit bounded output batches, translator continuation, and the input watermark before collecting the corresponding event prefix.
• Let attachment overlays, plugins, authentication, and checked backend delivery consume only committed span output. Each destination has its own durable output cursor. Collect output through the slowest consumer; preserve paused consumers across retirement and restart.
• Persist generic source and route incidents with precise positions and retry conditions. Keep credentials out of captured events, resolve authentication only for delivery, and expose full failure details through doctor.
• Retry a plugin only when the exact failing plugin file changes. Replace its temporary plugin failure: <path> marker using the same span ID; successful output has no recovery annotation. Preserve earlier successful operations within the failed revision.
• Restore translator continuation after crash or temporary storage failure. Retry shape failures after a translator revision change and delivery failures according to their credential, destination, permission, rate-limit, or transport conditions.
• Treat both ledgers as immediate recovery caches, not historical archives. Historical import and attach continue to read agent transcripts directly, with potentially less detail than live hook events. Collect old transcript mirrors only when no remaining input or translator continuation references them.
• Remove compatibility for PR Recover tracing after span plugin failures #130's unreleased plugin recovery state. Keep compatibility for event journals and span identity namespaces already released on main. Captured and resolved attachment routes share one consumer cursor.

The design document and runtime documentation describe the complete implementation. This branch is stacked on #130 and uses checked SDK delivery from #106; #132 supersedes the plugin-specific model before release.

Validation

• cargo test --manifest-path bt-daemon/Cargo.toml --all-features --locked — passed (494 tests; 5 ignored).
• cargo clippy --manifest-path bt-daemon/Cargo.toml --all-features --all-targets --locked -- -D warnings — passed.
• git diff --check — passed.
• CI run 37815147002 — all checks passed, including daemon builds, tests, lint, and integration checks on Linux, macOS, and Windows.
• Atomic SQLite rollback, temporary database lock recovery, continuation after collected input and restart, slowest-consumer collection, and independent input/output cursor regression tests.
• Plugin file correlation, exact failed-operation replay, normal-span replacement, paused-session isolation, and delivery of committed output while later translation is paused.
• Native translator fixture replay with continuation restoration, distributed parent routing, transcript import, and capture completion while delivery is explicitly blocked.

Earlier remote marker verification through bt view trace confirmed same-ID replacement in project coding-agents. That verification predates this SQLite revision; the current storage changes are covered by local tests and CI.

A crash after backend acceptance but before local acknowledgement can still cause a retry. Identical destination-visible projections are suppressed where possible; exactly-once external side effects require backend idempotency support.