[Dimoshka]

Summary

• Adds ModelCall to the domain and two JournalPort methods (modelStarted, modelCallsForRun), so model calls are recorded before they happen (invariant 5).
• HiveJournal gains a kind discriminator: model calls and tool invocations share one steps box and one seq counter.
• Adds the JournalingLlm decorator, an application-layer LlmPort wrapper that journals each call and bounds error text before it is stored.
• Introduces AgentDepsFactory.forRun(RunId) and replaces the agentDeps DI binding with it.
• Adds four chat end-to-end tests, journaling_llm_test.dart, hive_journal_test.dart coverage, and the matching domain/storage/plan/doc updates.

Decision

ADR-0012 (resolving open question Q13): model-call journaling lives in an application-layer LlmPort decorator, applied per run through AgentDepsFactory.forRun. The section 9 agent loop itself stays journal-free — it keeps receiving an LlmPort and does not learn about RunId or the journal. Transcript persistence also belongs in this decorator but is deferred to plan Step 8.

Review notes

Deliberate non-goals, reported during review but not fixed in this PR:

• DI bypass enforcement: AgentDeps keeps its public primary constructor, and getIt<LlmPort>() still returns the raw provider. Structurally preventing a bypass (private constructor, @visibleForTesting, non-default Hive instanceName) is deferred.
• _nextSeq has no write lock: the monotonic seq under concurrency currently relies on a hive_ce implementation detail.
• No unified seq-ordered recordsForRun; tool invocations and model calls are read through separate methods.
• _writeStarted is duplicated between the tool and model paths in HiveJournal.
• FakeJournal.modelStarts / modelRecords are currently unused by tests.
• ADR-0012 status is left Accepted although the ADR is not yet merged.

Test evidence

• melos run ci: SUCCESS — 230 tests passed.
• arch_check: OK (no forbidden imports).
• docs_check: OK.
• Codegen is idempotent (no diff after melos run gen).

Refs #43