fix(tui,tool-tasks): finish removing dispose-ness from delivery

The TUI's referenced-prompt snapshot now rides the prompt's own
admission transaction instead of a pre-admission inject: while idle, a
one-shot prepended agent/prompt-submit wrapper appends the snapshot to
the allow decision's additionalContexts, so a blocking hook discards
the prompt and its attached context together instead of stranding the
snapshot in history for the next unrelated prompt. A prompt discarded
before admission releases the wrapper; steering keeps the inject path
since it bypasses admission and drains at the same boundary. The
session-reference snapshot adapter pinned the old context-before-prompt
order; the branch-wide order (prompt first, its contexts after) is now
asserted and the fixture re-recorded.

tool-tasks drops the last consumer of the removed thrown-disposed
contract: completion notices now inject unconditionally, which is
well-defined during owner teardown — the loop treats disposal like any
cancel, so the notice appends as durable idle context (persisted for
resume while the session is attached, dropped with the detached log
after). README pair and the owner-disposal tests state the new
delivery contract.

packages/tasks/tool-tasks/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write
-README.md: 70c0c7da6ef17129241902d37359dd58b6d56605
-README.zh.md: 3ad8d8897ab348832b0d357436a0e78bf98c429b
+README.md: 276ca3f8284b366bee54e585297c3a033a65c8d1
+README.zh.md: f4d61b23c1b90e24591efd6773ffe9f9c46c2b4b

packages/tasks/tool-tasks/README.md

@@ -18,7 +18,7 @@ When a producer supplies `outputLimitBytes`, `task_output`, terminal `task_kill`
 
 ## Completion notices
 
-An unreported completion injects `background task <id> (<kind>: <label>) finished [status: ...]. Read its output with task_output.` into the exact owner's session. When bounded, the stable id prefix and collection command outrank variable label/detail so the notice remains actionable at PTY's supported 64-byte minimum. Injection is durable context for the next request, not a wake-up. A kill or terminal read/wait marks delivery reported and suppresses the redundant notice; owner-disposal races are contained.
+An unreported completion injects `background task <id> (<kind>: <label>) finished [status: ...]. Read its output with task_output.` into the exact owner's session. When bounded, the stable id prefix and collection command outrank variable label/detail so the notice remains actionable at PTY's supported 64-byte minimum. Injection is durable context for the next request, not a wake-up. A kill or terminal read/wait marks delivery reported and suppresses the redundant notice. An owner-disposal race needs no special handling: the loop has no terminal state, so a notice injected during teardown appends as idle context — persisted for resume while the session is still attached, dropped with the detached log afterwards.
 
 ## Config
 

packages/tasks/tool-tasks/README.zh.md

@@ -18,7 +18,7 @@
 
 ## 完成通知
 
-一项尚未报告的完成会向精确 owner 的会话注入 `background task <id> (<kind>: <label>) finished [status: ...]. Read its output with task_output.`。应用上限时，在 PTY 支持的 64 字节下限内，稳定 id 前缀和收集命令的优先级高于可变 label/detail，因此通知仍可操作。注入是下一次请求使用的持久上下文，并非唤醒。kill 或终止性 read/wait 会把交付标为已报告，并抑制重复通知；owner 释放竞态会被封装。
+一项尚未报告的完成会向精确 owner 的会话注入 `background task <id> (<kind>: <label>) finished [status: ...]. Read its output with task_output.`。应用上限时，在 PTY 支持的 64 字节下限内，稳定 id 前缀和收集命令的优先级高于可变 label/detail，因此通知仍可操作。注入是下一次请求使用的持久上下文，并非唤醒。kill 或终止性 read/wait 会把交付标为已报告，并抑制重复通知。owner 释放竞态无需特殊处理：循环没有终结状态，teardown 期间注入的通知作为空闲上下文追加——会话仍挂接时随之持久化以供恢复，脱离后随无引用日志一并丢弃。
 
 ## 配置
 

packages/tasks/tool-tasks/src/index.ts

@@ -218,21 +218,20 @@ export function apply(ctx: Context, config: Config): void {
   })
 
   // Use the exact lifecycle owner; reusable ids could resolve to a replacement.
+  // Delivery into a tearing-down owner is well-defined: the loop treats
+  // disposal like any cancel, so the notice appends as durable idle context
+  // (still attached and persisted during owner cleanup, presented on resume);
+  // after detach it lands in an unreferenced in-memory log and is dropped
+  // with it.
   ctx.tasks.onTaskDone((snapshot, owner) => {
     if (snapshot.reported || owner === undefined) return
-    try {
-      owner.inject({
-        content: [{
-          type: 'text',
-          text: fitCompletionNotice(snapshot),
-        }],
-        source: { kind: 'plugin', plugin: 'tool-tasks' },
-      })
-    } catch (error: unknown) {
-      // Disposal may win the race after settlement; other injection failures surface.
-      if (error instanceof Error && error.message.includes('is disposed')) return
-      throw error
-    }
+    owner.inject({
+      content: [{
+        type: 'text',
+        text: fitCompletionNotice(snapshot),
+      }],
+      source: { kind: 'plugin', plugin: 'tool-tasks' },
+    })
   })
 
   ctx.tools.register(defineTool({

packages/tasks/tool-tasks/tests/tool-tasks.spec.ts

@@ -573,27 +573,21 @@ describe('completion notices', () => {
     expect(inject).not.toHaveBeenCalled()
   })
 
-  it('drops the notice for unowned tasks and for a disposed owner (benign race)', async () => {
+  it('drops the notice for unowned tasks without throwing', async () => {
     const { ctx } = await setup()
     // Unowned: settles with nobody to notify — nothing throws.
     const unowned = producer()
     ctx.tasks.start(unowned.spec)
     unowned.settle({ status: 'completed' })
     await tick()
-
-    // Disposed owner: inject throws the disposed message — contained.
-    const inject = vi.fn(() => { throw new Error('agent "sess-1" is disposed') })
-    const owner = fakeAgent(ctx, 'sess-1', inject)
-    const p = producer({ owner })
-    ctx.tasks.start(p.spec)
-    p.settle({ status: 'completed' })
-    await tick()
-    expect(inject).toHaveBeenCalledTimes(1)
   })
 
   it('does not route an old owner completion notice to a same-session replacement', async () => {
     const { ctx } = await setup()
-    const oldInject = vi.fn(() => { throw new Error('agent "shared" is disposed') })
+    // Delivery into a tearing-down owner is a plain inject: the loop has no
+    // terminal state, so the notice lands in the old owner's (detached)
+    // session instead of throwing or re-routing.
+    const oldInject = vi.fn()
     const oldOwner = fakeAgent(ctx, 'shared', oldInject)
     const p = producer({ owner: oldOwner })
     ctx.tasks.start(p.spec)
@@ -608,7 +602,7 @@ describe('completion notices', () => {
     expect(replacementInject).not.toHaveBeenCalled()
   })
 
-  it('propagates a non-disposed inject failure (a real bug must surface)', async () => {
+  it('surfaces an inject failure through listener containment (a real bug must be visible)', async () => {
     const { ctx } = await setup()
     const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
     const owner = fakeAgent(ctx, 'sess-1', () => { throw new Error('unexpected inject bug') })