feat: extraction coverage — message-granular ledger + token-batched runs (d132373 vision)

THE MESSAGE IS THE UNIT OF COVERAGE (vision-extraction-coverage.md): a
per-chat append-only ledger (coverage.jsonl) records which messages the
pipeline has extracted, by content fingerprint over exactly what the
extraction view sees (one shared line builder — core/coverage.ts); the
uncovered remainder is DERIVED at read time, never dual-tracked. A quiz
answer merging into the asking message re-opens only that message;
plan-block data-part attach never re-opens anything.

- The trigger (turn-service) replaces every-3-quiz-answers with
  uncovered-tokens >= EXTRACTION.chunkTokens (4096) — quiz-less sessions
  extract too, content size is the honest signal.
- runExtraction is now chunked: token-budgeted batches of the oldest
  uncovered consecutive messages (a tool call + result never split), each
  merged batch checkpointing its messages' coverage atomically — an abort
  or error loses at most the in-flight batch; merged batches stay covered.
- Observation refs are batch-tagged (obs:<batchTag>:<sourceId>): re-runs
  of the same batch dedupe; a re-opened message's fresh understanding
  lands as a new event. Fixes the old obs:p1 position-collision.
- New API: GET /api/graph/coverage (exact per-session derived coverage +
  running flags, most-uncovered first) and POST /api/graph/coverage/extract
  (manual run for one session, 409 while in flight).
- Graph view chrome: the coverage button opens a panel with every
  session's covered/uncovered tokens and a per-session Extract button —
  the manual answer to aborted runs, errors, and dormant tails. Renders
  even when the graph is empty: an empty graph with uncovered sessions is
  exactly when it matters. Polls only while open.
- Notes imports keep the whole-file checkpoint path (coverage undefined).
- Tests: pure-core coverage suite (11), chunked-pipeline suite (3:
  multi-batch + no-op, abort-keeps-earlier-batches + remainder re-run,
  re-open alone + data-part invisibility), panel render suite (5);
  pendingQuizAnswers and its tests deleted as dead code. 486/486.

Live-smoked on real GLM: manual extract of "teach me modal realism" ran
one batch, wrote 4 coverage entries, panel flipped to "1.3k covered ·
complete" with the button disabled, graph refetched (nodes 11), usage
persisted with real stats.

src/core/contracts/graph.ts

@@ -116,6 +116,24 @@ export interface SessionCheckpoint {
 	foldedAt: string;
 }
 
+/** coverage.jsonl line (vision-extraction-coverage.md, settled 2026-09-15):
+ *  ONE MESSAGE of one chat has been extracted — by content fingerprint over
+ *  exactly what the extraction view sees. The MESSAGE is the unit of
+ *  coverage; "uncovered" is derived (fingerprint the current transcript,
+ *  diff) — never dual-tracked. A quiz answer merging into the asking
+ *  message changes its fingerprint: the message re-opens itself, only
+ *  itself. Chat extractions write these instead of whole-chat checkpoints;
+ *  notes imports keep the checkpoint (a file is one shot). */
+export interface CoverageEntry {
+	chatId: string;
+	/** sha256 of the message's view lines — "covered" means exactly this. */
+	fp: string;
+	/** chars/4 estimate of the message's view — display + budgeting. */
+	tokens: number;
+	/** ISO — when this message's last extraction run merged. */
+	foldedAt: string;
+}
+
 /**
  * Event kinds (DECIDED 2026-09-02): quiz outcomes only — correct / miss /
  * dont-know — plus `observation`, the extractor's per-proposition