refactor(events): remove the turn boundary mirror events

Complete the boundary-mirror removal begun with the step mirrors: drop
`agent/turn-start` and `agent/turn-end` from the agent event taxonomy. Turn and
step boundaries are now read exclusively off the durable `session/event` feed
(`turn/start`/`turn/end`/`step/start`/`step/end`) — there is no `agent/*` mirror
for any boundary.

- loop.ts: delete both turn emits; `closeTurn` loses its `emit` parameter and
  its now-unreachable idempotency guard (it is called exactly once per turn, on
  mutually exclusive normal/catch paths); `failTurn` loses the dead post-close
  branch that only a throwing turn-end LISTENER could reach.
- ui-stdio: render turn boundaries from `session/event`, recovering the short
  agent label from an `agent/created`→id map (the `turn/start` event carries only
  the turn number, and the session id is not reliably the agent id). ui-stdio is
  a disposable test REPL, so this migration retires the sole justification the
  event-domain-semantics RFC gave for KEEPING the turn mirrors.
- Tests: reason/turn-number collectors and the boundary-ordering test now read
  `session/event`; the throwing-turn-boundary-LISTENER tests are deleted (that
  code path no longer exists). A new test covers the outer-catch disposed branch
  via a pre-step listener that disposes-then-throws (the surviving real path).
- Docs: promote the "remove agent boundary mirror events" RFC to implemented
  (amended/narrowed — `agent/steering` is RETAINED, not a boundary mirror);
  update the event-domain-semantics + turn-enclosure RFCs, architecture.md, the
  cookbook, the ACP/agent/ui-stdio prose, and regenerate the cordis catalog.

`agent/steering` and `agent/stream-chunk` are explicitly out of scope (not
durable-boundary mirrors). ACP is unaffected — it already settles from the log's
`turn/end` + `agent/status`; snapshot goldens are byte-unchanged.

packages/ui/acp/README.md

@@ -57,7 +57,7 @@ When the client does NOT advertise the capability, none of the `_meta`/terminal
 
 ## Settle-exactly-once
 
-A `session/prompt` resolves (or rejects) exactly once, keyed off the canonical session log (the `session/event` stream), NOT the `agent/turn-start`/`agent/turn-end` events. One listener captures the prompt's owning turn from the log's `turn/start` and settles on the matching `turn/end` — the one signal that always fires (`closeTurn` appends it unconditionally, even when a boundary emit throws and the `agent/turn-end` EVENT is skipped). A prompt settles only on ITS OWN turn (`inflight.turn === turn/end.turn`), so a stale `turn/end` for a previously-cancelled turn whose end arrives late can never settle the wrong prompt. A turn that ends `error` REJECTS the RPC with an internal error carrying the failure message (ACP has no error stop reason); every other reason resolves via the codec. As a fallback, when the agent settles to `idle`/`disposed` with a prompt still pending — e.g. a `session/event` listener registered before the bridge threw and starved the bridge's listener — an `agent/status` handler reconciles the prompt from the log (the owning turn's `turn/end`, or `cancelled` if the turn was torn down without one). An empty/whitespace prompt is rejected up front — it would queue no work, so no turn would start and the RPC would hang.
+A `session/prompt` resolves (or rejects) exactly once, keyed off the canonical session log (the `session/event` stream). One listener captures the prompt's owning turn from the log's `turn/start` and settles on the matching `turn/end` — the durable boundary event (`closeTurn` appends it unconditionally; there is no `agent/*` turn mirror). A prompt settles only on ITS OWN turn (`inflight.turn === turn/end.turn`), so a stale `turn/end` for a previously-cancelled turn whose end arrives late can never settle the wrong prompt. A turn that ends `error` REJECTS the RPC with an internal error carrying the failure message (ACP has no error stop reason); every other reason resolves via the codec. As a fallback, when the agent settles to `idle`/`disposed` with a prompt still pending — e.g. a peer `session/event` listener registered before the bridge threw and starved the bridge's listener — an `agent/status` handler reconciles the prompt from the log (the owning turn's `turn/end`, or `cancelled` if the turn was torn down without one). An empty/whitespace prompt is rejected up front — it would queue no work, so no turn would start and the RPC would hang.
 
 ## Disposal & disconnect
 

packages/ui/acp/src/index.ts

@@ -199,13 +199,14 @@ interface SessionRecord {
 }
 
 /**
- * Drive the in-flight prompt's settle from the harness event stream. A turn
- * can end three ways the bridge must all handle (AGENTS.md "honor cross-seam
- * contracts on BOTH sides"): the normal `agent/turn-end` event; a `turn/end`
- * session event WITHOUT the agent event (a boundary emit threw inside the loop,
- * which still appends `turn/end`); or the agent erroring/settling to idle. The
- * first of these to fire settles the prompt; `settle` is then cleared so the
- * others are no-ops (settle-exactly-once).
+ * Drive the in-flight prompt's settle from the harness event stream. The bridge
+ * settles off the durable log: the `turn/end` session event on the
+ * `session/event` feed for the prompt's own turn, with the agent
+ * erroring/settling to idle as a fallback (AGENTS.md "honor cross-seam contracts
+ * on BOTH sides") for the case where a throwing peer `session/event` listener
+ * starved the bridge's listener before it saw the boundary. The first of these
+ * to fire settles the prompt; `settle` is then cleared so the others are no-ops
+ * (settle-exactly-once).
  */
 export function apply(ctx: Context, config: AcpConfig): void {
   // TODO(double-default): these literals duplicate the Config schema defaults
@@ -318,15 +319,14 @@ export function apply(ctx: Context, config: AcpConfig): void {
   // the canonical log: every assistant/chunk and tool/call/result is logged, so
   // translating from the log makes live streaming and `session/load` replay
   // share the identical path (streamSessionEventUpdate). Both the owning-turn
-  // capture and the settle key off the log's own `turn/start`/`turn/end` — NOT
-  // the `agent/turn-start`/`agent/turn-end` EVENTS, which a throwing PEER
-  // listener (cordis `emit` stops at the first throw) or a boundary-emit failure
-  // can skip. `closeTurn` appends `turn/end` to the log unconditionally, and
-  // `turn/start` is appended before any step runs, so within this one listener
-  // we always see the prompt's turn-start (tag `inflight.turn`) then its
-  // turn-end (settle). A `turn/end` settles the prompt ONLY when it is the
-  // prompt's OWN turn (`inflight.turn === event.data.turn`) — a previous,
-  // already-cancelled turn whose end arrives late is ignored (see
+  // capture and the settle key off the log's own `turn/start`/`turn/end` — the
+  // durable boundary events (there is no agent/* turn mirror). `closeTurn`
+  // appends `turn/end` to the log unconditionally, and `turn/start` is appended
+  // before any step runs, so within this one listener we always see the
+  // prompt's turn-start (tag `inflight.turn`) then its turn-end (settle). A
+  // `turn/end` settles the prompt ONLY when it is the prompt's OWN turn
+  // (`inflight.turn === event.data.turn`) — a previous, already-cancelled turn
+  // whose end arrives late is ignored (see
   // SessionRecord.inflight). A turn that ends `error` REJECTS the prompt (ACP
   // has no error stop reason); other reasons resolve via the codec. Demux
   // strictly by session id: a `session/event` is routed to its own record, so