loop: every request is built from the log — boundary snapshot, header events, config-only waterfall

The loop is now transmission-stateless; a request is a pure function of
(session log, this step's rendered assembly, current AgentOptions):

- The reconstruction boundary is step/start: the messages snapshot is
  taken in the same synchronous frame immediately before the step/start
  append, so the request's messages are exactly the derivation over
  events[0..stepStartSeq) — an inject() from an agent/request listener
  (or any concurrent task) lands after the boundary and joins the NEXT
  request. This changes behavior for a synchronous step/start
  session/event listener that appends content (master derived after the
  append, so such a listener could reach the current request):
  agent/pre-step is the sanctioned seam for current-request content.
- agent/request is re-typed to config-only: (agent, turn, step,
  config: LlmCallConfig, next) → LlmCallConfig. The frozen seed comes
  from AgentOptions on a loop instance's first request (explicit options
  beat the logged baseline — fork overrides and resume reconfiguration
  stay correct) and from the log's folded header afterwards; listeners
  return a replacement to switch. Content shaping through the request is
  no longer expressible — model-visible content flows through the log
  channels.
- recordRequestHeader appends whatever header event the request owes the
  log before dispatch: an 'initial'/'resume' snapshot anchoring each
  loop instance, a round-trip-verified delta on change, a 'fallback'
  snapshot when the encoding cannot express it. Session.requestHeader()
  is the log's incrementally-folded baseline.
- Requests are deep-frozen before dispatch (deepFreeze exempts the
  AbortSignal — freezing one breaks AbortController.abort() outright);
  frozen + sessionId is the loop-built marker the dev invariant keys on.

Ported from #162 and re-anchored on the log: the append-extension /
frozen-end-to-end / compaction-resend / prompt-change property tests,
plus new specs for the boundary semantics, resume anchoring, and the
end-to-end theorem (every recorded request rebuilds byte-equal from the
log alone). Live cache-hit e2e (request-cache.e2e.ts) verified against
the real DeepSeek API. Snapshot goldens intentionally stale until the
single re-record after the compact/summary envelope lands.

packages/core/agent/src/types.ts

@@ -44,7 +44,7 @@
  */
 
 import type { Branded } from '@deepseek-ai/dsh-brand'
-import type { ContentBlock, GenerateOptions, Message, MessageSource } from '@deepseek-ai/dsh-llm'
+import type { ContentBlock, LlmCallConfig, Message, MessageSource } from '@deepseek-ai/dsh-llm'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 
 /** Identifies one live agent in the registry. */
@@ -345,18 +345,28 @@ declare module 'cordis' {
      */
     'agent/prompt-submit'(agent: Agent, content: ContentBlock[], source: MessageSource, next: () => Promise<PromptDecision>): Promise<PromptDecision>
     /**
-     * Waterfall: mutate the fully-assembled {@link GenerateOptions} before the
-     * model call (hooks, model switching, tool filtering, …). Call `next()` to
-     * delegate, or return without it to short-circuit. For surface mutation that
-     * must precede history derivation (compaction), use {@link agent/pre-step}
-     * instead — by the time this fires, `options.messages` is already derived.
+     * Waterfall: shape the step's call configuration — model switching,
+     * sampling overrides — by returning a replacement {@link LlmCallConfig}
+     * (the frozen seed is the config the loop would otherwise use). Config is
+     * ALL a listener shapes here: every request is a pure function of the
+     * session log (the reconstructability RFC), so model-visible content
+     * flows through the log channels — `inject()`, steering, prompt-submit
+     * `additionalContext`, prompt sections via `system-prompt/assemble` —
+     * never through request mutation, and the loop records whatever config
+     * the request actually uses as a `request/header*` event before dispatch.
+     * The step's messages are already snapshotted when this fires (the
+     * `step/start` boundary): an `inject()` from a listener here lands in the
+     * log but joins the NEXT request. For surface mutation that must precede
+     * the snapshot (compaction), use {@link agent/pre-step}. Call `next()` to
+     * delegate, or return an {@link LlmCallConfig} without it to
+     * short-circuit.
      * @param agent - the agent making the model call.
      * @param turn - the open turn number.
      * @param step - the step whose request this is.
-     * @param options - the assembled request; listeners return a transformed copy.
+     * @param config - the config the loop would use (frozen); return a replacement to switch.
      * @mode waterfall
      */
-    'agent/request'(agent: Agent, turn: number, step: number, options: GenerateOptions, next: () => Promise<GenerateOptions>): Promise<GenerateOptions>
+    'agent/request'(agent: Agent, turn: number, step: number, config: LlmCallConfig, next: () => Promise<LlmCallConfig>): Promise<LlmCallConfig>
     /**
      * Waterfall: post-process the assembled assistant {@link Message} before
      * tool dispatch (validation, content rewriting, …).