ExtractionInvocationRecord

One attempt at one model call: its identity, and what was observed about it.

Observed facts only. There is no requested-configuration field on this type and there will not be one — that separation is the whole reason ExtractionRequestedModelConfig is a different type sitting on the run rather than a section of this one. A reader of an invocation record can never mistake "what we asked for" for "what happened", because the record cannot express the first.

configuredService is an observed fact too: it is the service this attempt was actually dispatched against, which a router can change between attempts.

Failures live on the run's bounded failure list, tagged with this record's id, rather than being duplicated here — one bound, one place to sanitize. A run rejects a failure naming an attempt it has no record of, so the pair arrives together.

Timing is an observation and may be absent on a terminal record. A SUCCEEDED attempt with no startedAt is constructible, and means the clock was not recorded rather than that the call did not run. Requiring timing would push callers to invent it, and a made-up duration is worse evidence than none. The two checks that do apply are the ones a record can be wrong about on its own terms: a finish cannot precede its start, and an ExtractionInvocationOutcome.IN_FLIGHT attempt has not finished.

EXPERIMENTAL. The shape may still change while extraction runs (DICE #67) land.