Merge origin/master (agent-scope runtime #224, session-query, run-gates CI harness)

Conflict resolution beyond line merges: the ACP bridge's mode/set
re-notify moved inside master's new containment finally (a throwing
presenter must not desync the picker), and session/new keeps the modes
advertisement beside master's plain object return. dsh-mode's boundary
flush moved off the session/event feed onto the loop's interception
seams (agent/prompt-submit / agent/turn-continuation): master's scoped
dispatch made post-commit session observers observe-only — an append
from one re-enters the publishing append — while the two waterfalls
fire outside any log emit and bracket the same boundaries; mode.spec's
boundary helper now dispatches those seams via agentEvents, and the
containment tests stub only the mode/set append. Catalogs, doc graphs,
and the module graph regenerated.

packages/ui/acp/tests/dispose.spec.ts

@@ -159,8 +159,8 @@ describe('acp bridge — disposal & HMR safety', () => {
   it('the final turn closing events are persisted across an AgentHandle dispose (durability)', async () => {
     // The teardown-ORDER guarantee: a per-agent dispose must stop the loop,
     // AWAIT its exit (so the loop's final `turn/end` + `session/flush` fire
-    // through the still-attached `session.onAppend` → `session/event`), and only
-    // THEN detach onAppend + remove the session. If the order were inverted
+    // through the still-attached store observer → `session/event`), and only
+    // THEN remove its publication hooks and session entry. If the order were inverted
     // (detach first), the closing events would never reach persistence. Drive a
     // CLEAN turn to completion, dispose JUST the bridge, then re-load the
     // persisted log from disk and assert the closing turn/end is on disk — the
@@ -190,7 +190,7 @@ describe('acp bridge — disposal & HMR safety', () => {
     // produced BY the dispose itself. Here the model stream HANGS, so the turn is
     // still open when teardown runs: the composite agent effect stops the loop,
     // the loop unwinds and appends `turn/end {disposed}` + runs its final
-    // `session/flush` — all while `onAppend` is still attached (the session
+    // `session/flush` — all while the store-owned publication hooks are still attached (the session
     // detach is the LAST disposer in the same effect's LIFO chain) — and only
     // THEN is the session detached. If the order were inverted (or the session
     // were a racing SIBLING effect), the abort-produced `turn/end` would never
@@ -229,10 +229,10 @@ describe('acp bridge — disposal & HMR safety', () => {
     // dispose one handle, and assert the other survives, registered and
     // queryable, with its session still in the store.
     const harness = await makeBridgeHarness({ storageDir, script: [] })
-    const handleA = harness.ctx.agents.create({
+    const handleA = await harness.ctx.agents.create({
       agentId: AgentId('sib-a'), sessionId: SessionId('sib-a'), agentOptions: { model: 'mock' },
     })
-    const handleB = harness.ctx.agents.create({
+    const handleB = await harness.ctx.agents.create({
       agentId: AgentId('sib-b'), sessionId: SessionId('sib-b'), agentOptions: { model: 'mock' },
     })
     expect(harness.ctx.agents.get(AgentId('sib-a'))).toBe(handleA.agent)
@@ -255,13 +255,13 @@ describe('acp bridge — disposal & HMR safety', () => {
     // into ONE composite effect whose disposers run as a `.then()` chain. The
     // register disposer emits `agent/disposed`; if a listener throws and the
     // emit is UNCONTAINED, the rejected chain skips the LATER session-detach
-    // disposer — stranding the session in the store with `onAppend` attached (a
+    // disposer — stranding the session in the store with its publication hooks attached (a
     // leak AND a durability hole, since the new design relies on detach
     // running). The emit must be contained. Register a throwing listener, drive
     // a clean turn, dispose, and assert the session was STILL removed.
     const harness = await makeBridgeHarness({ storageDir, script: [textResponse('ok')] })
     harness.ctx.on('agent/disposed', () => { throw new Error('boom disposed listener') })
-    const handle = harness.ctx.agents.create({
+    const handle = await harness.ctx.agents.create({
       agentId: AgentId('guard-a'), sessionId: SessionId('guard-a'), agentOptions: { model: 'mock' },
     })
     handle.agent.send([{ type: 'text', text: 'go' }])
@@ -282,7 +282,7 @@ describe('acp bridge — disposal & HMR safety', () => {
     // first call's await agent.done + final flush finished. Every caller must
     // observe the same quiescence boundary.
     const harness = await makeBridgeHarness({ storageDir, script: ['hang'] })
-    const handle = harness.ctx.agents.create({
+    const handle = await harness.ctx.agents.create({
       agentId: AgentId('conc-a'), sessionId: SessionId('conc-a'), agentOptions: { model: 'mock' },
     })
     // Drive a turn that hangs in the model stream, so the loop is mid-turn when

packages/ui/acp/tests/edges.spec.ts

@@ -20,14 +20,14 @@ describe('acp bridge — demux & config edges', () => {
 
   it('ignores events from an agent the bridge does not own (strict id demux)', async () => {
     // A second agent created directly on the registry (NOT via the bridge) runs
-    // a turn. Its session/event + agent/status must NOT produce ACP updates and
+    // a turn. Its session events must NOT produce ACP updates and
     // must not settle anything — the bridge demuxes strictly by its own id.
     harness = await makeBridgeHarness({ storageDir, script: [textResponse('foreign')] })
     await harness.client.initialize({ protocolVersion: PROTOCOL_VERSION, clientCapabilities: {} })
     await harness.client.newSession({ cwd: process.cwd(), mcpServers: [] })
     const before = harness.updates.length
 
-    const { agent: foreign } = harness.ctx.agents.create({ agentId: AgentId('foreign'), sessionId: SessionId('foreign-session'), agentOptions: { model: 'mock' } })
+    const { agent: foreign } = await harness.ctx.agents.create({ agentId: AgentId('foreign'), sessionId: SessionId('foreign-session'), agentOptions: { model: 'mock' } })
     foreign.send([{ type: 'text', text: 'hi' }])
     await foreign.whenIdle()
     await new Promise(r => setTimeout(r, 10))

packages/ui/acp/tests/turns.spec.ts

@@ -235,12 +235,9 @@ describe('acp bridge — turn outcomes', () => {
     expect(failed).toHaveLength(1)
   })
 
-  it('settles via the log fallback when a prior session/event listener throws (starvation)', async () => {
-    // A peer session/event listener that runs BEFORE the bridge's listener
-    // throws on turn/end (prepend: true puts it first). cordis emit stops at the
-    // throw, so the bridge's session/event listener never sees turn/end and
-    // cannot settle there. The agent/status idle-fallback must reconcile the
-    // prompt from the log so the RPC settles instead of hanging.
+  it('settles successfully when an earlier turn/end observer throws', async () => {
+    // Session contains each post-commit observer failure, so a prepended peer
+    // cannot starve the bridge's live turn/end delivery.
     harness = await makeBridgeHarness({ storageDir, script: [textResponse('answer')] })
     harness.ctx.on('session/event', (_s, event) => {
       if (event.type === 'turn/end') throw new Error('peer listener boom')
@@ -250,9 +247,7 @@ describe('acp bridge — turn outcomes', () => {
     expect(res.stopReason).toBe('end_turn')
   })
 
-  it('log fallback REJECTS when the starved turn ended in error', async () => {
-    // Same starvation as above, but the turn fails: the idle-fallback must
-    // reject the RPC from the logged turn/end{error}, not resolve.
+  it('still rejects a failed turn when an earlier turn/end observer throws', async () => {
     harness = await makeBridgeHarness({ storageDir, script: [errorResponse('starved boom')] })
     harness.ctx.on('session/event', (_s, event) => {
       if (event.type === 'turn/end') throw new Error('peer listener boom')
@@ -262,21 +257,18 @@ describe('acp bridge — turn outcomes', () => {
       .rejects.toThrow(/turn failed: starved boom/)
   })
 
-  it('log fallback infers the owning turn when turn/START capture is starved', async () => {
-    // A peer listener throws on turn/START (not turn/end): the bridge never
+  it('captures and settles the owning turn when an earlier turn-start observer throws', async () => {
+    // Turn correlation still reaches the bridge after the throwing peer and
     // captures inflight.turn via the live stream. A throwing turn/start listener
-    // also FAILS the turn (the throw is recorded as the turn's error). Without
-    // the watermark inference the fallback would resolve `cancelled` (the bug);
-    // with it, it infers the owning turn from the log and REJECTS from that
-    // turn's error turn/end. (The model's own error is never reached — the turn
-    // failed at start — so the rejection carries the listener's failure.)
-    harness = await makeBridgeHarness({ storageDir, script: [textResponse('never runs')] })
+    // Session contains post-commit callbacks independently.
+    // The model request and normal turn outcome therefore still occur.
+    harness = await makeBridgeHarness({ storageDir, script: [textResponse('answer')] })
     harness.ctx.on('session/event', (_s, event) => {
       if (event.type === 'turn/start') throw new Error('peer listener boom on start')
     }, { prepend: true })
     const sessionId = await newSession(harness)
-    await expect(harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }))
-      .rejects.toThrow(/turn failed:/)
+    const result = await harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] })
+    expect(result.stopReason).toBe('end_turn')
   })
 
   it('a between-turn injection does not settle the prompt early (message-trigger correlation)', async () => {