feat(runtime-host): own multi-account API-key onboarding

[me2seeks]

Summary

Before: Runtime Host onboarding without a Connection ID always targeted the canonical provider slug, so CLI/TUI could not create a second account. After onboarding created two same-provider accounts, /model could still lose immutable Connection identity or render colliding labels.

After:

• onboarding uses explicit create(providerType) and existing(connectionId) targets;
• Storage allocates and recovers the exact Connection ID/slug, preserves existing defaults, and keeps historical v1 onboarding intents recoverable;
• CLI/TUI projects every API-key-onboardable account plus an add-account action;
• model selection carries the exact connectionId + connectionSlug + model, including CAS retries, and never silently rebinds a deleted account;
• labels include account slugs and remain globally unique even when a connection name resembles another generated label;
• resume distinguishes an absent original account from a present but disabled account.

Fixes #3869

Verification

• Core, Storage, Runtime, Runtime Host, and CLI builds/typechecks passed.
• Storage runtime-policy suite: 57/57 passed.
• Runtime Host connection-effect/protocol slice: 27/27 passed.
• Real UDS two-client same-provider account creation: 1/1 passed.
• CLI session driver: 55/55 passed.
• CLI Pi TUI runner: 141/141 passed.
• CLI onboarding and TUI context: 9/9 passed.
• Protocol epoch guard passed: 52 -> 53.
• Biome and git diff --check passed.

Dependency and compatibility

• Stacked on feat(runtime): bind new sessions to connection identity #3864 head f5ba1f2dd.
• The onboarding protocol changes closed request/result shapes and advances the Runtime Host compatibility epoch from 52 to 53.
• OAuth Connection creation and Desktop account management remain follow-up work under [Tracking] Explicit multi-account provider connections across Runtime Host surfaces #3852.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex assisted with implementation, tests, review remediation, and verification. Both commits contain a Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

I reviewed this head and found blocking issues.

[P2] /model cannot disambiguate same-provider accounts

Storage writes name="OpenAI" for every new account; /model shows connectionName || slug only — two OpenAI accounts both render as OpenAI, user cannot tell which will be selected. Violates disambiguation requirement.

Fix: render name + slug together with regression test using real same-name onboarding.

Also Standards 3 hard (template, missing trailer, before/after).

Hosted test/windows_recovery: SUCCESS.

简体中文

同名账号无法区分。

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[me2seeks]

Addressed on head e69f48e5d:

• /model now derives one visible label per Connection slug and appends the slug only when that final label is shared by multiple Connections;
• two same-name catalog entities project as OpenAI · openai and OpenAI · openai-2, and selecting the second sends openai-2;
• one Connection with multiple model rows remains OpenAI without a redundant slug;
• name/fallback-slug collisions and the full model-change notice are covered;
• the branch is rebased onto feat(runtime): bind new sessions to connection identity #3864 head 844ecff82, the single onboarding commit carries Generated-by: Codex, and the PR body now follows the repository template with Before/After and AI-use disclosure.

Validation: CLI typecheck/build; focused TUI 4/4; Runtime Host onboarding projection 6/6; Biome and diff-check. Hosted checks are rerunning for the new head.

[me2seeks]

Hosted freshness is complete for head e69f48e5d: both test and windows_recovery passed. The PR body has been updated to match the final check state.

[Astro-Han]

I reviewed this head and found blocking issues.

[P2] /model new-account path carries only connectionSlug, not connectionId

Multi-account selection sends only slug; if account A deleted and slug reused, server resolves by slug and silently binds to B.

Fix: carry connectionId through ModelChoice/driver/protocol.

[P2] Label dedup collision

modelChoiceConnectionLabels() groups by raw name then appends slug once; OpenAI/openai, OpenAI/openai-2, OpenAI · openai/relay can collide to OpenAI · openai duplicate. Fix: globally unique final labels with regression test.

Hosted test: SUCCESS and windows_recovery: SUCCESS, but code is NO-GO.

简体中文

多账号标识与标签去重问题。

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[me2seeks]

Addressed both review blockers in 77ece3349: /model now carries the exact connectionId + connectionSlug + model through the picker, driver, wire update, and CAS retry; account labels now use a globally unique deterministic allocator. Added regressions for same-name accounts, label collisions, deleted versus disabled resume, and identity preservation across retries.

[me2seeks]

Addressed the hosted release-smoke failure on head a70bc6707.

The Runtime Host resolver already selected the exact Connection entity, but MakaRunContext.target dropped its connectionId; maka run and activation then created a Session with slug + model only, and the driver correctly rejected that as legacy state. Both create funnels now carry required connectionId + connectionSlug + model without weakening the legacy-null fail-closed rule.

A regression uses two same-provider accounts, selects account 2 by slug, runs through the real Runtime Host context and Session driver, and asserts the exact account-2 triplet on session.create. Two independent final reviews returned GO. Validation: CLI 500/500 before the patch-equivalent final restack, targeted real-funnel 3/3 after restack, typecheck, epoch guard, and the installed release-package controlled model-turn smoke.

Generated-by: Codex

[Astro-Han]

I reviewed this head and found the overall feature is not merge-ready.

Multi-account API-key onboarding (intent create/existing, Storage UUID/slug assignment, recovery intent, Host-committed identity) is necessary and bounded correctness shows no independent P0-P3; hosted test/windows_recovery SUCCESS.

[Feature/Global-design] NO-GO — composed sequence mismatch

This head (a70bc67) still carries the superseded 6-commit #3864 stack (actual parent 26bf00bb, body misstates f5ba1f2d) for 109 files / +4124 -668, and its last two commits are exactly the model-selection/CAS/run/activation work that now belongs to #3926 per #3852. The intended sequence is #3864 (04686a0) → #3926 → #3882 (onboarding-only). Until #3864 and #3926 land and #3882 is rebased/deduped to onboarding-only with corrected dependencies, this composed PR should not be merged.

简体中文

当前组合与既定序列不一致，需等待前置 PR 落地后再重叠为 onboarding-only。

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.