Merge remote-tracking branch 'origin/master' into codex/enforce-tool-cancellation

# Conflicts:
#	docs/event-producer-consumer.md
#	examples/acp-agent/tests/snapshots/bash-spill/session.jsonl
#	examples/acp-agent/tests/snapshots/escalation-approved/session.jsonl
#	examples/acp-agent/tests/snapshots/escalation-rejected/session.jsonl
#	examples/acp-agent/tests/snapshots/fs-escalation-approved/session.jsonl
#	examples/acp-agent/tests/snapshots/hook-cc-pretool-ask/session.jsonl
#	packages/context/workspace-context/tests/workspace-context.spec.ts
#	packages/core/agent/src/index.ts
#	packages/support/invariants/tests/invariants.spec.ts
#	packages/ui/acp/src/index.ts
#	packages/ui/tui/tests/harness.ts
#	packages/ui/tui/tests/tui.spec.ts

packages/goal/goal-session/src/invariant.ts

@@ -0,0 +1,84 @@
+/** Package-owned goal-round prompt invariants. @module @deepseek-ai/dsh-goal-session/invariant */
+
+import { isDeepStrictEqual } from 'node:util'
+import type { Context } from 'cordis'
+import { foldGoal, type FoldedGoal, type GoalMessageSource, type GoalView } from '@deepseek-ai/dsh-goal'
+import type { InvariantFailure, InvariantInstaller } from '@deepseek-ai/dsh-invariants'
+import type { Session, SessionEvent } from '@deepseek-ai/dsh-session'
+import { renderGoalRoundPrompt } from './prompt.ts'
+
+const PACKAGE_NAME = '@deepseek-ai/dsh-goal-session'
+
+/** Cordis companion plugin name. */
+export const name = 'goal-session-invariant'
+/** Service required before the companion can reserve package ownership. */
+export const inject = ['invariants']
+
+/** Attribute strict goal-fold failures to this companion's reconstruction. */
+function foldChecked(events: readonly SessionEvent[], fail: InvariantFailure): FoldedGoal {
+  try {
+    return foldGoal(events)
+  } catch (error: unknown) {
+    /* v8 ignore next -- the strict goal decoder throws Error instances */
+    const message = error instanceof Error ? error.message : String(error)
+    return fail(`cannot reconstruct the goal before a continuation message: ${message}`)
+  }
+}
+
+/** Recreate the live-shaped view consumed by the package's pure prompt renderer. */
+function goalView(folded: FoldedGoal, source: GoalMessageSource, fail: InvariantFailure): GoalView {
+  const goal = folded.goal
+  if (goal === undefined || folded.createdAt === undefined || folded.updatedAt === undefined
+    || goal.phase !== 'active' || goal.id !== source.goalId || goal.revision !== source.revision
+    || source.round !== folded.roundsStarted + 1 || source.round > goal.maxGoalRounds) {
+    return fail(`goal round ${source.round} cannot be reconstructed from the preceding durable goal state`)
+  }
+  return {
+    ...goal,
+    roundsStarted: folded.roundsStarted,
+    createdAt: folded.createdAt,
+    updatedAt: folded.updatedAt,
+    activation: 'armed',
+  }
+}
+
+/** Validate one package-owned continuation message against its durable prefix. */
+function validateEvent(
+  prior: readonly SessionEvent[],
+  event: SessionEvent,
+  fail: InvariantFailure,
+): void {
+  if (event.type !== 'user/message') return
+  const source = event.data.source
+  if (source.kind !== 'goal' || source.round <= 0) return
+  const expected = renderGoalRoundPrompt(goalView(foldChecked(prior, fail), source, fail), source.round)
+  if (!isDeepStrictEqual(event.data.content, expected)) {
+    fail(`goal round ${source.round} content does not match the package-owned continuation prompt`)
+  }
+}
+
+/** Check existing sessions and every candidate event before Session publishes it. */
+const install: InvariantInstaller = Object.assign((ctx: Context, fail: InvariantFailure) => {
+  for (const session of ctx.sessions.list()) {
+    const prior: SessionEvent[] = []
+    for (const event of session.events) {
+      validateEvent(prior, event, fail)
+      prior.push(event)
+    }
+  }
+  /* jscpd:ignore-start -- package companions share dispatch and registration plumbing */
+  ctx.on('internal/dispatch', (_mode, eventName, args) => {
+    if (eventName !== 'session/event') return
+    const [session, event] = args as [Session, SessionEvent]
+    validateEvent(session.events, event, fail)
+  }, { global: true })
+}, { inject: ['sessions'] })
+
+/**
+ * Register the goal-session invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export const apply = (ctx: Context): Promise<() => void> =>
+  Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install))
+/* jscpd:ignore-end */