feat(agent-loop): turn-enclosure invariant + post-turn error model

Every session event now lives inside a turn (between turn/start and its
turn/end). The loop records queued user/message events AFTER turn/start;
an idle agent.inject() wraps its context/message in a one-shot injection
turn. This makes the turn the single durability/replay boundary so a
persistence backend can treat anything after the last turn/end as a
crash tail without dropping legitimate between-turn context.

A failure once the turn is already closed (rejecting session/flush, a
throwing agent/turn-end listener) has no in-turn position for a session
error event, so it is reported via agent/error + logger only; the turn
stays balanced. failTurn appends an error event only while the turn is
open.

The dsh-invariants plugin enforces turn-enclosure via a default case:
every non-boundary event type — including plugin-added merge-extensible
keys — must sit inside an open turn or it throws.

Documented in ADR 0017 + architecture.md.

packages/agent-loop/tests/agent.spec.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
 import { AgentId } from '@deepseek-ai/dsh-agent'
 import LlmService from '@deepseek-ai/dsh-llm'
@@ -82,6 +82,80 @@ describe('LoopAgent', () => {
     expect(() => { agent.inject([{ type: 'text', text: 'too late' }]) }).toThrow('disposed')
   })
 
+  it('inject() decides enclosure from the LOG (open turn), not agent status', async () => {
+    const adapter = new MockAdapter([textResponse('ok')])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create('a1', { model: 'mock' })
+
+    // Simulate an OPEN turn in the log while the agent is idle (status is not a
+    // reliable open-turn signal). inject must append into that open turn, NOT
+    // wrap a new one.
+    agent.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    agent.inject([{ type: 'text', text: 'mid' }], { source: { kind: 'plugin', plugin: 'p' } })
+    expect(agent.session.events.filter(e => e.type === 'turn/start')).toHaveLength(1)
+    expect(agent.session.events.at(-1)!.type).toBe('context/message')
+
+    // Close the turn; now inject must wrap its own one-shot injection turn.
+    agent.session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
+    agent.inject([{ type: 'text', text: 'after' }], { source: { kind: 'plugin', plugin: 'p' } })
+    const starts = agent.session.events.filter(e => e.type === 'turn/start')
+    expect(starts).toHaveLength(2)
+    const last = starts[1]!
+    expect(last.type === 'turn/start' && last.data.trigger.kind).toBe('injection')
+    expect(agent.session.events.at(-1)!.type).toBe('turn/end') // turn-enclosed
+  })
+
+  it('idle inject() contains a failing flush (logs, does not throw into the caller)', async () => {
+    const adapter = new MockAdapter([textResponse('ok')])
+    const ctx = await harness(adapter)
+    // A persistence-like listener whose flush rejects.
+    ctx.on('session/flush', () => { throw new Error('disk gone') })
+    const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => undefined)
+    const agent = ctx.agentLoop.create('a1', { model: 'mock' })
+
+    // inject() is synchronous and fires a fire-and-forget flush; a rejecting
+    // flush must be contained (logged), never thrown into the caller.
+    expect(() => { agent.inject([{ type: 'text', text: 'notice' }], { source: { kind: 'plugin', plugin: 'p' } }) }).not.toThrow()
+    await new Promise(r => setTimeout(r, 20)) // let the contained flush settle
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('flush after idle injection failed'))
+    warn.mockRestore()
+  })
+
+  it('idle inject() closes its one-shot turn AND still checkpoints even if the append throws', async () => {
+    const adapter = new MockAdapter([textResponse('ok')])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create('a1', { model: 'mock' })
+    let flushes = 0
+    ctx.on('session/flush', () => { flushes += 1 })
+
+    // Non-serializable injected content makes Session.append throw AFTER
+    // turn/start was recorded. The turn/end must still be appended (finally),
+    // AND the durability checkpoint must still fire — the balanced turn is in
+    // memory and a crash before the next turn/dispose would otherwise lose it.
+    expect(() => {
+      agent.inject([{ type: 'text', text: 'x', bad: 1n } as never], { source: { kind: 'plugin', plugin: 'p' } })
+    }).toThrow(/non-JSON-serializable/)
+    const types = agent.session.events.map(e => e.type)
+    expect(types).toEqual(['turn/start', 'turn/end']) // balanced, no open turn
+    await new Promise(r => setTimeout(r, 10)) // let the fire-and-forget flush run
+    expect(flushes).toBe(1) // checkpoint fired despite the throw
+  })
+
+  it('idle inject() with a non-serializable source opens no turn (nothing to close)', async () => {
+    const adapter = new MockAdapter([textResponse('ok')])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create('a1', { model: 'mock' })
+
+    // A non-serializable source makes the turn/start append throw BEFORE the
+    // event is pushed (Session.append validates before push), so NO turn opens.
+    // The finally's isTurnOpen() guard sees no open turn and appends nothing —
+    // the log stays empty, not left with a dangling turn/start.
+    expect(() => {
+      agent.inject([{ type: 'text', text: 'x' }], { source: { kind: 'plugin', plugin: 'p', bad: 1n } as never })
+    }).toThrow(/non-JSON-serializable/)
+    expect(agent.session.events).toHaveLength(0)
+  })
+
   it('steer() when idle falls through to send() and starts a turn', async () => {
     const adapter = new MockAdapter([textResponse('ok')])
     const ctx = await harness(adapter)