fix(runtime): persist external tool effects

[AsperforMias]

Summary

• Persist MCP external-effect intent, attempt, result, and unknown-fence state in D1.
• Redeliver a durable MCP result after terminal-receipt loss without invoking the provider again.
• Keep a terminal Driver record while it has an executing or unknown external effect, so routine expiry cleanup cannot cascade-delete the unresolved fence.
• Require Driver protocol v2 and the durable effect ledger for MCP execution.

Why

• Closes fix(runtime): persist uncertainty for external tool effects #412: a Driver restart could otherwise replay a write-capable MCP call after an ambiguous terminal delivery.

Verification

• just check
• just test-file apps/api/tests/driver-instance-record.test.ts
• just test-file apps/api/tests/driver-finalization-repair.test.ts
• Local fault injection uses D1 plus the real Driver Dispatcher to simulate provider success followed by lost terminal delivery, restarts the Dispatcher, and asserts exactly one provider call.
• Not run: live remote MCP or Cloudflare resources (not available locally).

Impact

• User/API/contract changes: Driver control protocol v2; an unknown effect fails closed with its durable effect ID.
• Generated files / GraphQL / DB / lockfile: additive 0005_external-tool-effects plus Drizzle snapshot/journal; no GraphQL or lockfile changes.
• Env or config changes: none.
• Risk and rollback: the migration is additive; old Driver versions are intentionally rejected to prevent unsafe execution.

Review

• Closest review areas: Driver RPC, API runtime persistence, D1 migrations, Agent Driver MCP dispatcher.
• Known trade-offs: generic MCP has no universal reconciliation or compensation protocol, so unknown effects never auto-replay. Follow-up feat(runtime): reconcile external tool effects for idempotency-capable MCP providers #446 tracks provider-specific reconciliation.
• Dependency: Driver feat(cost): merge preview into debug in usage cost view #89 is merged and provides the runtime persistence protocol. Mosoo main currently relies on the package-manager manifest introduced by its earlier Driver gitlink; Driver feat(web): replace Debug dropdown with direct Terminal tab in agent editor toolbar #48 restores that manifest on current Driver main. Therefore this PR must not merge before feat(web): replace Debug dropdown with direct Terminal tab in agent editor toolbar #48, and its repository check remains blocked until that Driver dependency is merged and the gitlink is refreshed to the resulting main commit.

[AsperforMias]

这个要driver那边的#89先合 @Yevanchen

[Yevanchen]

The durable fence is directionally correct, but one persistence invariant is currently lost: unknown effects cascade-delete with their Driver, and maintenance deletes stopped/failed Drivers after 24 hours. That erases the evidence the PR says requires explicit resolution. Please decouple unresolved-effect retention or exclude such Drivers from cleanup and add the retention regression test.

Separately, the PR currently conflicts on apps/driver and points at an obsolete Driver commit; after Driver #89 lands, rebase/update the gitlink. Both this PR and #481 currently allocate migration 0005, so whichever lands second must generate the next append-only migration rather than reusing 0005.

[Yevanchen]

cleanupDriverInstances() deletes stopped/failed Driver rows at expiresAt (24 hours), and this cascade then deletes unknown effects plus their attempt/receipt evidence. That contradicts the explicit-resolution fence: after one day Mosoo no longer knows the action was uncertain. Preserve unresolved effects independently, or prevent Driver cleanup while an executing/unknown effect exists, and cover that retention boundary.

[AsperforMias]

Addressed the requested retention invariant and rebased onto current main. Terminal Driver cleanup now skips records with executing or unknown external effects, preventing the Driver/command cascade from erasing the durable fence. Added direct maintenance and end-to-end persistence regressions; just check and both focused tests pass. The submodule now points at merged Driver #89 (ddbb4305).

[AsperforMias]

CI diagnosis: #449 itself does not fail a runtime-persistence test. Its updated Driver #89 gitlink lacks the package-manager manifest that current Mosoo main expects from the earlier #340 gitlink; the contract test fails with ENOENT for apps/driver/environment-package-managers.json. Driver #48 restores that manifest on current Driver main and is now the required merge-order dependency. I have corrected the PR description accordingly; #449 must be refreshed to the post-#48 Driver main commit before merge.

[AsperforMias]

#449 的CI 依赖 driver #48，driver #89 的当前 main 缺少 mosoo #340 所依赖的 package-manager manifest。driver #48 合并后需刷新 gitlink，才能合 #449

[Yevanchen]

Review update: the retention fix and regression now address the inline durable-fence finding, but the PR is still not merge-ready. Driver #48 merged on Aug 6; please rebase onto current Mosoo main, update the Driver gitlink to the post-#48 commit, and generate the next append-only migration with just db-generate instead of retaining stale 0005. Then resolve the remaining review state and rerun just check. Issue #412 stays open until this lands.