feat!: Add per-execution runId, at-most-once tracking, and cross-process tracker resumption

[jsonbailey]

BEGIN_COMMIT_OVERRIDE
feat!: Add per-execution runId on all AI track event payloads for billing isolation
feat!: Enforce at-most-once tracking — each metric type (duration, tokens, feedback, success/error, time-to-first-token) records once per tracker; duplicates are dropped with a warning
feat!: Add ResumptionToken on ILdAiConfigTracker and ILdAiClient.CreateTracker(resumptionToken, context) for cross-process tracker reconstruction with the original runId
feat: Add MetricSummary property on ILdAiConfigTracker summarizing recorded metrics
END_COMMIT_OVERRIDE

Summary

• Per-execution runId: Every tracker gets a unique runId (UUID) included in all track event payloads, enabling per-execution billing isolation
• At-most-once tracking: Each metric type (duration, tokens, feedback, success/error, time-to-first-token) can only be tracked once per tracker instance — duplicates are dropped with a log warning
• CreateTracker() on LdAiConfig: Each call on a config (e.g. LdAiCompletionConfig) returns a new tracker with a fresh runId and independent tracking state. The returned tracker is always non-null, even when the config is disabled
• ResumptionToken property on ILdAiConfigTracker: URL-safe Base64-encoded JSON containing { runId, configKey, variationKey, version } for cross-process tracker reconstruction
• CreateTracker(string token, Context context) on ILdAiClient: Reconstructs a tracker from a resumption token with the original runId, enabling deferred feedback from a different process. Model and provider names are set to empty strings on reconstruction
• MetricSummary property on ILdAiConfigTracker: Snapshot of metrics recorded on this tracker

Test plan

• CreateTrackerReturnsTrackerWhenDisabled — factory returns a non-null tracker for disabled configs
• CreateTrackerReturnsNewTrackerWithFreshRunId — each tracker gets a unique runId
• CreateTrackerReturnsTrackerWithIndependentTrackingState — at-most-once state is independent per tracker
• CreateTrackerCanBeCalledMultipleTimes — factory produces multiple independent trackers
• ResumptionTokenContainsExpectedFields — token contains exactly runId, configKey, variationKey, version
• ResumptionTokenIsUrlSafeBase64 — no +, /, or = characters
• ResumptionTokenIsConsistentAcrossCalls — same token on repeated access
• CreateTrackerFromResumptionTokenRoundTrips — full round-trip preserves runId
• CreateTrackerFromResumptionTokenSetsEmptyModelAndProvider — reconstructed tracker has empty model/provider
• CreateTrackerFromInvalidTokenThrows — malformed input throws ArgumentException
• CreateTrackerFromNullTokenThrows — null input throws ArgumentNullException
• CreateTrackerFromTokenMissingRunIdThrows — incomplete payload throws ArgumentException

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes public tracking semantics (runId on events, duplicate metrics ignored) and default version behavior, which can affect downstream analytics and billing correlation; resumption token parsing is a new trust boundary for cross-process flows.

Overview
AI config trackers are now scoped to a single run with a UUID runId on every track payload, ResumptionToken / ILdAiClient.CreateTracker(token, context) for cross-process reuse of that run, and a MetricSummary snapshot of what was recorded.

LdAiConfigTracker is rebuilt around explicit fields (not the whole config): each CreateTracker() gets a new runId; duplicate Track* calls are dropped (with warnings) using atomic slots, including shared success/error; empty token usage does not consume the tokens slot. Track metadata adds runId, omits empty variationKey, and resumption tokens are URL-safe Base64 JSON without model/provider.

Smaller contract tweaks: caller defaults use version: 1; missing _ldMeta.version defaults to 1; ModelConfig stores parameters in ImmutableDictionary so downcasts cannot mutate maps.

^{Reviewed by Cursor Bugbot for commit f7488be. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kinyoklion]

Tangentially — not introduced by this PR, but surfaced while reviewing it — ModelConfiguration.Parameters and .Custom are typed as IReadOnlyDictionary<> but the underlying instances are mutable Dictionary<>s that the builder hands off by reference. A downstream consumer can downcast through any IDictionary<>-compatible interface and mutate them, and writes are visible on config.Model.Parameters.

Failing test that pins the desired behavior (it goes green once the dictionaries are stored as a defensive copy):

// ModelConfiguration.Parameters is typed as IReadOnlyDictionary<>, so the
// public contract is "read-only". Even if a consumer downcasts to a
// mutable view, writes through that view must not be visible on
// config.Model.Parameters.
[Fact]
public void DowncastedMutationOfModelParametersMustNotAffectBuiltConfig()
{
    var config = LdAiConfig.New().SetModelParam("temperature", LdValue.Of(0.7)).Build();

    if (config.Model.Parameters is System.Collections.Generic.IDictionary<string, LdValue> mutable)
    {
        mutable["temperature"] = LdValue.Of(2.0);
    }

    Assert.Equal(0.7, config.Model.Parameters["temperature"].AsDouble);
}

Two options for the fix:

1. ImmutableDictionary<string, LdValue> in ModelConfiguration's ctor (and copy the input into it). Type system enforces no mutation.
2. Store the whole thing as LdValue instead — LdValue.ObjectFrom(...) already handles immutability and deep-copies primitive map data.

Happy to file as a separate issue if it's out of scope for this PR.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0f3f7d5. Configure here.}