Expose deterministic IDs and tighten TUI controls

[tony]

Summary

Add deterministic, privacy-safe identities for normalized search records and
observed conversations, expose them consistently through CLI text, JSON/NDJSON,
MCP, and the HUD TUI, and disclose the accompanying pi-style TUI command pass.

This establishes three distinct versioned handles:

• agc1: identifies semantic content from record kind, case-folded role, and
  exact normalized text.
• agr1: identifies one defensible native or source-order occurrence.
• agt1: identifies one defensible backend-native thread anchor.

Each handle uses the first 128 bits of a domain-separated SHA-256 envelope,
encoded as full lowercase base32hex. Unknown record or thread identity remains
null; agentgrep does not invent identity from a path, timestamp, or file mtime.

Design

• Add a dependency-light identity module and adapter-owned topology metadata for
  the supported Codex, Claude, Cursor, Antigravity, Gemini, Grok, Pi, OpenCode,
  and VS Code stores.
• Preserve native message/parent coordinates where available and retain source
  ordinals only when the scan direction proves them stable.
• Add frontend-neutral ConversationUnit grouping with explicit native_tree,
  source_order, or unordered fidelity. It represents only the records
  observed by the caller; it does not claim source completeness, select a
  revision, or invent timestamp chronology.
• Bound source-order linearization to one physical (store, adapter, path)
  domain, so file-local ordinals from separate transcripts cannot fabricate a
  shared timeline.
• Replace raw ad hoc engine dedupe with seven hash-free, coordinate-aware tuple
  forms. Namespaced coordinates may compare across physical views; unnamespaced
  coordinates remain scoped to their source path and adapter.
• Reuse prepared identity bundles at CLI/MCP/TUI boundaries, keep identity work
  off the Textual message pump, and bound/generation-gate the HUD caches.
• Keep agref1: and agcur1: as opaque version 1 tokens. Positioned results
  bind the physical fingerprint to their occurrence coordinate; a position-blind
  ref retains bounded first-match fallback only while every other normalized
  fingerprint input still matches. Refs and cursors are snapshot-relative
  physical handles, while canonical IDs remain comparison handles.
• Validate opaque refs and cursors as canonical base64url-encoded JSON, rejecting
  alternate spellings and JSON booleans at integer fields before dispatch.

ADR 0015 records the canonical envelopes, field policy, nullability, dedupe
forms, topology limits, privacy model, physical-handle lifetime, and downstream
contract for bookmarks, exports, and similarity.

TUI controls

• Replace Textual's global command palette with one shared pi-style slash-command
  menu across HUD and grep-log.
• Keep command input and focus visible through zoom, add clean /screenshot SVG
  capture, and make help, filtered-row styling, and quit confirmation consistent.

Issue refinement

The issue proposed several useful directions but left important policy forks
open. This PR resolves them conservatively:

• Ship full purpose-specific content, occurrence, and thread IDs rather than a
  single short universal ID with auto-widening.
• Exclude mutable provenance, model, timestamp, and path from content identity.
• Do not derive flat-store thread IDs from paths or seed content.
• Do not publish a Merkle root or imply that an observed thread is complete.
• Keep engine equality and physical ref resolution as separate policies.
• Keep the scan candidate path free of cryptographic hashing.

This gives #79 durable record/thread targets with an explicit content fallback,
requires #81 to own null-thread partitioning and complete-source/revision policy,
and lets #82 use canonical IDs for result/cache equality while using agref1:
to resolve a physical seed.

Compatibility and performance

• Existing result fields remain compatible; the four identity fields are
  additive and required-nullable at typed output boundaries. agcur1: bytes and
  positionless agref1: bytes remain unchanged. Newly emitted positioned refs
  gain occurrence-aware fingerprints. Physical refs and cursors are
  snapshot-relative and may need to be reacquired after store or normalization
  changes.
• Two exact-SHA, five-command benchmark matrices ran 25 samples per row in both
  commit orders. No user-visible command crossed the 5% median / 10% p95
  investigation threshold in both orders.
• A 1 MiB identity takes about 0.65 ms on the measured machine. Prepared CLI and
  MCP consumers hash zero prompt bytes, and 500 threadless 1 MiB records are
  rejected before hashing.
• The trusted source-order fast path improves its isolated 600,000-position
  benchmark by about 15% in both orders. End-to-end parsing remained order-noisy,
  so no broader speedup is claimed.
• The follow-up Cursor positioned-iterator sample was effectively tied with the
  former iterator, at about 9.5 microseconds per loop.

Verification

The required repository gate passed on the final commit:

$ rm -rf docs/_build; uv run ruff check . --fix --show-fixes; uv run ruff format .; uv run ty check; uv run py.test --reruns 0 -vvv; just build-docs;

Results: 2,720 passed, 3 skipped, and 3 expected failures; documentation built
successfully.

The original three-way implementation bakeoff compared position-aware v1
fingerprints, canonical record IDs embedded in refs, and explicit v2 refs.
Adversarial Python, MCP/DX, and terminal/TUI judging selected the position-aware
v1 design 2-1: it resolves repeated turns exactly without longer handles or
coupling physical locators to canonical identity, while retaining a bounded
position-blind fallback.

A follow-up implementation bakeoff compared a localized physical-source repair,
a typed source-coordinate domain, and late identity/dedupe disambiguation.
Adversarial Python, typing, performance, MCP/DX, TUI, concision, and slop reviews
selected the localized repair: it fixes Cursor's within-line coordinates and
bounds conversation ordering for every adapter without expanding public models
or changing canonical IDs.

A live MCP smoke test resolved all seven positioned results from a bounded
ten-result page to their exact record IDs and rejected a malformed ref without
emitting store content.

Independent adversarial reviews also reproduced the source-domain, session,
ordering, threadless-hash, CLI/MCP parity, TUI worker/cache/race, ref-byte,
privacy, import-boundary, and documentation invariants. A watchdog-enabled live
TUI run searched 3,256 real-store matches, resized between 77 and 40 columns,
switched records, filtered to zero and back, and exited cleanly; full identity
handles stayed on one row at both widths.

Closes #80

Goal

Idempotent completion condition for /goal. It asserts an end state, not an action: if the state already holds, the first evaluation passes and nothing is edited.

/goal PR #111 lands on local master. Work ONLY in the worktree agentgrep-issue-80-final; check out no branch in the shared master tree, never push. Report FIRST: git rev-parse --abbrev-ref HEAD (prints issue-80-deterministic-identities; judge local HEAD only) and git -c rerere.enabled=false merge-tree --write-tree --name-only master HEAD; it prints 24 CONFLICT lines today (CHANGES, adapters.py, serializers.py, four ui/ modules incl. layouts/hud.py, 15 deleted tests). End state there: HEAD is rebased on local master, that merge-tree prints zero CONFLICT lines, and uv run ruff check ., uv run ty check and NO_COLOR=1 AGENTGREP_TUI_WATCHDOG=1 PATH=$PWD/.venv/bin:$PATH env -u VIRTUAL_ENV -u UV_NO_SYNC ./.venv/bin/python -m pytest -m '' --reruns 0 -q each exit 0 (this suppresses known false reds and arms the audit hook). Resolve hud.py by keeping master's offloaded group="detail" builder as the sole generation-guarded path, not unioning guards, and take master's test deletions. Also: Accepted ADR 0014 OL-3 makes emitted order a function of the records, never arrival time, so restate this branch's identity ADR's driver-owns-representative clause as one collector-owned policy applied identically by every driver (timing may differ, the kept view may not), never weakening ADR 0014; and since other open branches ship the same ADR number, keep its slug but record in its Status line that the NUMBER is provisional pending merge-time allocation; renumber nothing. Preserve ADR 0011: no file, sqlite, subprocess, network, json load/dump, lock wait or unbounded CPU reachable from a pump callable one hop down; pump entrypoints @pump_only, workers @offload. Freeze no agc1:/agref1:/agcur1: encoding; add no short-id resolver, Merkle root or index. Or stop after 25 turns and report what remains.

• Proof — git rev-parse --abbrev-ref HEAD && git -c rerere.enabled=false merge-tree --write-tree --name-only master HEAD && grep -A3 '^## Status' docs/dev/adr/*deterministic-record-identity.md && NO_COLOR=1 AGENTGREP_TUI_WATCHDOG=1 PATH=$PWD/.venv/bin:$PATH env -u VIRTUAL_ENV -u UV_NO_SYNC ./.venv/bin/python -m pytest -m '' --reruns 0 -q
• Idempotence — Once rebased, merge-tree exits with no CONFLICT line and the ADR Status line already carries the provisional-number note, so a re-run is a read-only transcript and no second rebase, edit or push occurs.
• Blocked by — nothing (it rebases onto the local master ref and requires no other open item to land first)
• Blocks — nothing hard; Add durable bookmarks across CLI and TUI #121 and Add portable record export across surfaces #122 sit on this branch as their base, and their own goals now rebase once onto the moved tip instead of stalling, so this branch's rebase cannot strand them
• Preserves — Versioned agc1:/agr1:/agt1:/agref1:/agcur1: prefixes stay a migration seam rather than a frozen encoding, so Deterministic IDs for conversations / prompts #80 and ADR 0020's cursor retirement can still change them; a short-id resolver, thread Merkle root, or persistent identity index for Find similar prompts and conversations #82/Durable prompt corpus and derived search indexes (ADR 0019) #142 remains buildable; master's offloaded group="detail" worker keeps the ADR 0011 non-blocking TUI seam; the ADR number is left for merge-time allocation, so the other branches claiming it are not foreclosed.