@tea-agent/loop-agent 0.34.3 → 0.34.4

package/AGENTS.md

@@ -74,7 +74,9 @@ DAG 执行期间，主 agent 不得修改 writeSet 外的任何工作区文件
 
 权威源：`docs/governance/verification-matrix.md`。
 
-默认节奏：编辑中只跑矩阵「最低验证」（typecheck + 定向 Vitest）；`git commit` 的 `pre-commit` 只做 `check-repo`；`git push` 的 `pre-push` 跑 `bash scripts/ci.sh`（全量 typecheck + `npm test`）。每个 clone 安装一次 hooks：`bash scripts/install-git-hooks.sh`。
+默认节奏：编辑中只跑矩阵「最低验证」（typecheck + 定向 Vitest）；`git commit` 的 `pre-commit` 只做 `check-repo`；`git push` 的 `pre-push` 经 `node scripts/pre-push-verify.mjs` 在 receipt 命中时复用、miss 时跑 full `bash scripts/ci.sh`（全量 typecheck + `npm test`）。每个 clone 安装一次 hooks：`bash scripts/install-git-hooks.sh`。
+
+连续 source→target 交付遵循**单一最终树全量验证**：同一 Git tree、相同环境与命令合同在 receipt TTL 内只选一个本地 full authority（有效 receipt / target pre-push / 可选 `npm run verify:tree`），不按分支名策略化，也不机械双跑 full CI。细节见 verification-matrix 与 branch-merge-guideline。
 
 常用：
 
@@ -83,7 +85,10 @@ DAG 执行期间，主 agent 不得修改 writeSet 外的任何工作区文件
 npm run typecheck
 npx vitest run <相关测试路径>
 
-# push / 交付前（或依赖 pre-push）
+# 可选：提前验证当前 clean HEAD 并写 receipt（随后同 tree push 可复用）
+npm run verify:tree
+
+# push / 交付前（或依赖 pre-push；receipt miss 时安全回退 full）
 bash scripts/ci.sh
 npm run build
 node bin/loop-agent.js --help

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [0.34.4] - 2026-08-12
+
+### 重点更新
+
+- 本地连续交付改为按精确 Git tree 复用验证结果，避免提交、推送和分支合并之间机械重复全量测试，同时保持不同 tree、不同环境和远程 CI 的独立质量门槛
+- 全面加固 Operator Chat 的 Turn 所有权、停止与异常恢复流程，解决浏览器与服务端状态错位时的重复提交、停止失效和错误提示问题
+- Operator Chat 新增按仓库保存的 Skills 自动使用偏好，用户可控制技能是否进入模型自动发现范围，同时保留手动调用能力
+- 修复控制台任务导航无法自主执行后端测试与前端测试 DAG 的问题，现可正确识别 pytest、playwright 等多种测试框架的验证命令
+
+### 新增
+
+- 新增可选的 `npm run verify:tree`，对当前严格 clean HEAD 执行完整验证并写入 receipt，随后推送同一 tree 时可直接复用
+- 新增只读的当前 tree receipt 诊断，可区分匹配、缺失、过期、损坏和工作区不合格等状态，不执行测试或写入 receipt
+- Operator Chat 引入完整的 Turn ownership 协议和服务端真实中止接口，并在状态接口中提供 active/latest Turn 与 runtime busy 事实
+- Operator Chat Skills 新增「允许自动使用」开关，偏好按仓库持久化；关闭后仍可通过 `/skill:<name>` 手动调用
+
+### 改进
+
+- source→target 连续交付统一选择一个本地全量验证权威；默认 commit/push 不增加步骤，远程 CI 与发布环境不复用本地 receipt
+- pre-push receipt 诊断和执行日志改用有界命令摘要，并严格校验 tree、环境、命令合同、有效期及 receipt 内容一致性
+- Skills 运行时快照改为使用服务端资源标识和独立的自动调用状态，资源变更仅接受当前 inventory 中的合法条目
+- Turn 已占用时返回可恢复的中文状态提示和真实 active Turn，不再向用户暴露裸露的 `chat turn already active` 错误
+
+### 修复
+
+- 修复浏览器已认为对话结束、服务端却仍持有 active Turn 时的重复提交竞态；提交现在支持幂等请求标识、boot epoch orphan 隔离和 durable Turn/runtime busy 联合对账
+- 修复创建 Turn 的响应不确定时状态被过早释放的问题；客户端会保留 ambiguous 状态，通过 `/state` 绑定或释放真实 ownership，不会重新生成请求标识
+- 修复停止请求在 Turn 尚未绑定时丢失的问题；绑定成功后只发送一次真实 abort，且服务端缺少 abort 能力时不会通过 dispose 会话伪造停止
+- 修复 active bind、terminal SSE 与 React streaming 状态交错时提交锁未释放的问题，并统一 adopt、停止中和 abort-pending 为非致命提示
+- 修复控制台任务导航执行 backend-test 和 frontend-test DAG 时，因结构化验证门禁未识别 pytest/playwright 等命令而始终被阻断的问题
+
 ## [0.34.3] - 2026-08-12
 
 ### 重点更新
@@ -85,36 +116,33 @@
 
 ## [0.33.6] - 2026-08-11
 
+### 重点更新
+
+- 加固 PRD 导入与 Semantic Intake，在结构化解析不足时提供安全回退，并增强 writeSet 审查与运行结果摘要
+- Operator Chat 接入单一事件流、启动 epoch 隔离、实时运行时控制与开放资源加载，提升长会话恢复和自主 DAG 监督能力
+- 统一 Windows 等环境下只读 Git 命令的有界恢复机制，同时保留用户自有的 Pi 模型路由配置
+
 ### 新增
 
-- stabilize PRD intake + add Semantic Intake fallback
-- Operator Chat 单事件流 + boot epoch fence（Task C）
-- gate writeSet delta + run summary（操作面增强）
-- supervise DAG runs autonomously
-- ChatEventStore 事件持久化压缩（coalescing + maxBytes 双限制）
-- reconcile(cursor_expired) 自动恢复而非全局致命错误
-- 接入 Operator Chat 实时运行时控制
-- open operator chat resource loading
-- enrich execution report and URL resolution
+- task advance 新增 writeSet delta 与 run summary，直接展示边界扩张来源、节点结果和下一步操作
+- Operator Chat 引入单一事件流与 boot epoch fence，支持 cursor 过期后的自动对账恢复，避免将可恢复问题升级为全局错误
+- ChatEventStore 增加事件合并与容量上限双重压缩，控制长期会话持久化体积
+- Operator Chat 新增实时模型、thinking 和运行时资源控制，并按开放资源加载规则解析 Skills、Extensions 与 Packages
+- Operator Chat 可对安全的 bounded DAG 进行持续监督和恢复，执行报告同步补充运行细节与目标 URL 来源
 
 ### 改进
 
-- style(task-advance): biome autoformat 对齐（无功能变化）
-- style(console): apply biome formatting from pi-lens autoformat
+- 只读 Git 查询统一使用共享韧性执行器，在 Windows 启动型故障下有界恢复，不扩大 mutation 命令权限
+- 初始化与升级流程保留用户自行配置的 Pi 模型路由，不再因默认配置变化机械覆盖
+- Packages 面板区分配置状态与真实安装元数据，并统一使用品牌图标
 
 ### 修复
 
-- unify resilient read-only command execution
-- preserve user-owned Pi model routing
-- show installed package metadata
-- escape preflight backtick matcher
-- align chat streaming reliability with pi-web
-- split rerun defaults and repair selector escaping
-- ignore delimiters inside pytest strings
-- resolve target URL from runtime context
-- reject priority-only module stems
-- stop desiredSha256 mechanical checks from blocking generated-content upgrades
-- use mobius header brand icon
+- 修复 Operator Chat 流式状态与 pi-web 可靠性机制未完全对齐的问题，提升重连和终态收敛稳定性
+- 修复前端测试环境预检中的反引号转义错误，以及重跑默认值和 repair 选择器转义不一致的问题
+- 修复后端测试完整性检查误判字符串内部未配对分隔符，以及按优先级生成非法单模块文件的问题
+- 修复前端测试目标 URL 未从运行时上下文解析的问题，执行时现使用可审计的真实地址来源
+- 修复 generated init 内容因 `desiredSha256` 机械比较而阻断安全升级的问题
 
 ## [0.33.5] - 2026-08-11
 

package/dist/worker/console/app-data.js

@@ -43,6 +43,7 @@ export function openConsoleAppData(options) {
         chats: path.join(repoNamespace, "chats"),
         chatSessions: path.join(repoNamespace, "chat-sessions"),
         chatEvents: path.join(repoNamespace, "chat-events"),
+        resourcePreferences: path.join(repoNamespace, "resource-preferences.json"),
     };
     for (const dir of [
         paths.drafts,
@@ -55,6 +56,7 @@ export function openConsoleAppData(options) {
         paths.chats,
         paths.chatSessions,
         paths.chatEvents,
+        path.dirname(paths.resourcePreferences),
     ]) {
         ensureSecureDir(dir);
     }

package/dist/worker/console/chat/chat-event-store.js

@@ -221,6 +221,20 @@ function shouldCoalesce(ring, turnId, partial) {
         return false;
     return nowMs - Date.parse(tail.at) <= ring.coalesceWindowMs;
 }
+/** Stable hash of the normalized prompt payload for clientRequestId binding. */
+export function hashChatTurnPayload(input) {
+    const normalized = {
+        text: input.text,
+        images: (input.images ?? []).map((image) => ({
+            type: image.type ?? "image",
+            mimeType: image.mimeType ?? "",
+            data: image.data ?? "",
+        })),
+    };
+    return createHash("sha256")
+        .update(JSON.stringify(normalized))
+        .digest("hex");
+}
 const DEFAULT_MAX_EVENTS = 2000;
 /** Mirrors pi-web's bounded-ring orientation (2000 events / 10 MiB). */
 const DEFAULT_MAX_BYTES = 10 * 1024 * 1024;
@@ -399,6 +413,24 @@ export function createChatEventStore(options) {
                 eventId: eventIdFor(sessionId, event.seq),
             }));
             const turns = Array.isArray(parsed.turns) ? parsed.turns : [];
+            // New Console epoch: orphan any queued/running turn whose ownerEpoch is
+            // missing or mismatched. Releases the active lease without pretending the
+            // user aborted (CHAT_TURN_OWNER_LOST fence).
+            let orphaned = false;
+            const now = new Date().toISOString();
+            for (const turn of turns) {
+                if (turn.state !== "queued" && turn.state !== "running")
+                    continue;
+                if (turn.ownerEpoch === eventEpoch)
+                    continue;
+                turn.state = "failed";
+                turn.finishedAt = now;
+                turn.error = {
+                    code: "CHAT_TURN_OWNER_LOST",
+                    message: "turn ownership lost after Console restart; previous execution is no longer owned",
+                };
+                orphaned = true;
+            }
             turnCounts.set(sessionId, parsed.turnCount ?? 0);
             const ring = {
                 events,
@@ -415,6 +447,8 @@ export function createChatEventStore(options) {
             // R6: re-check the bounds after a restart — a persisted file may exceed the
             // current limits if it was written by an older config or hand-edited.
             enforceBounds(sessionId, ring);
+            if (orphaned)
+                persist(sessionId, ring);
             return ring;
         }
         catch (error) {
@@ -521,11 +555,35 @@ export function createChatEventStore(options) {
             }
             return { copiedCount };
         },
-        createTurn(sessionId) {
+        createTurn(sessionId, input) {
             const ring = ringFor(sessionId);
+            const clientRequestId = input?.clientRequestId?.trim() || undefined;
+            const payloadHash = input?.payloadHash?.trim() || undefined;
+            if (clientRequestId) {
+                const existing = ring.turns.find((turn) => turn.clientRequestId === clientRequestId);
+                if (existing) {
+                    if (payloadHash &&
+                        existing.payloadHash &&
+                        existing.payloadHash !== payloadHash) {
+                        return {
+                            ok: false,
+                            code: "REQUEST_ID_REUSE_CONFLICT",
+                            message: `clientRequestId ${clientRequestId} was reused with a different payload`,
+                            existingTurn: { ...existing },
+                        };
+                    }
+                    // Same id + same (or missing) payload: idempotent return, no new lease.
+                    return {
+                        ok: true,
+                        turn: { ...existing },
+                        created: false,
+                        idempotent: true,
+                    };
+                }
+            }
             const active = ring.turns.find((turn) => turn.state === "queued" || turn.state === "running");
             if (active)
-                return { ok: false, code: "TURN_ACTIVE", activeTurn: active };
+                return { ok: false, code: "TURN_ACTIVE", activeTurn: { ...active } };
             const ordinal = (turnCounts.get(sessionId) ?? 0) + 1;
             turnCounts.set(sessionId, ordinal);
             const now = new Date().toISOString();
@@ -536,11 +594,14 @@ export function createChatEventStore(options) {
                 ordinal,
                 state: "queued",
                 createdAt: now,
+                ownerEpoch: eventEpoch,
+                ...(clientRequestId ? { clientRequestId } : {}),
+                ...(payloadHash ? { payloadHash } : {}),
             };
             ring.turns.push(turn);
             ring.approxBytes += byteHint(turn);
             persist(sessionId, ring);
-            return { ok: true, turn };
+            return { ok: true, turn: { ...turn }, created: true, idempotent: false };
         },
         setTurnState(sessionId, turnId, state, error) {
             const ring = ringFor(sessionId);
@@ -561,6 +622,27 @@ export function createChatEventStore(options) {
             persist(sessionId, ring);
             return { ...turn };
         },
+        markAbortRequested(sessionId, turnId, at) {
+            const ring = ringFor(sessionId);
+            const turn = ring.turns.find((candidate) => candidate.turnId === turnId);
+            if (!turn)
+                return undefined;
+            const before = JSON.stringify(turn).length;
+            if (!turn.abortRequestedAt)
+                turn.abortRequestedAt = at ?? new Date().toISOString();
+            ring.approxBytes +=
+                (JSON.stringify(turn).length - before) * BYTE_GATE_SCALE;
+            persist(sessionId, ring);
+            return { ...turn };
+        },
+        findTurnByClientRequestId(sessionId, clientRequestId) {
+            const id = clientRequestId.trim();
+            if (!id)
+                return undefined;
+            const ring = ringFor(sessionId);
+            const turn = ring.turns.find((candidate) => candidate.clientRequestId === id);
+            return turn ? { ...turn } : undefined;
+        },
         getTurn(sessionId, turnId) {
             const ring = ringFor(sessionId);
             const turn = ring.turns.find((candidate) => candidate.turnId === turnId);

package/dist/worker/console/chat/pi-runtime.js

@@ -32,6 +32,7 @@ import { projectCompactSnapshot, } from "./chat-event-store.js";
 import { extractUsageSample } from "./usage.js";
 import { OPERATOR_CHAT_ALLOWED_TOOLS, authorizeOperatorChatTool, assertNoWriteToolInList, } from "./tools.js";
 import { createOperatorChatResourceLoader, } from "./resource-loader.js";
+import { applySkillAutoInvocationPreferences, isAutoInvocationEnabled, loadResourcePreferences, skillResourceId, } from "./resource-preferences-store.js";
 import { buildModelCallableToolSchemas } from "./tool-adapter.js";
 import { resolveDefaultChatModel, resolveLowChatModel, } from "./model-resolver.js";
 import { filterActiveInterviewTools } from "../interview/tools.js";
@@ -466,7 +467,8 @@ export function projectRuntimeSnapshot(input) {
         ...(skill.baseDir ? { baseDir: field(skill.baseDir, 400) } : {}),
         scope: skill.scope,
         source: field(skill.source, 200) ?? "",
-        enabled: skill.enabled,
+        resourceId: field(skill.resourceId, 200) ?? "",
+        autoInvocationEnabled: skill.autoInvocationEnabled,
         diagnostics: skill.diagnostics.map((diag) => field(diag, 400) ?? ""),
     });
     const projectExtension = (ext) => ({
@@ -645,6 +647,8 @@ export class ConsolePiRuntime {
     revisions = new Map();
     /** RF-01: per-session reload in-flight lock (concurrent second call → PI_SESSION_BUSY). */
     reloadInFlight = new Set();
+    /** Synchronous prompt ownership per session (admission before first await). */
+    promptOwners = new Set();
     /** At most one detached automatic-title task per durable Console session. */
     titleInFlight = new Set();
     /** Composer thinking selection ("auto" = no explicit override). */
@@ -665,6 +669,78 @@ export class ConsolePiRuntime {
         this.loader = createOperatorChatResourceLoader();
         this.bindings = options.bindings ?? createDefaultPiSdkBindings();
     }
+    /** Absolute path for repo-scoped resource preferences (may be undefined in unit tests). */
+    get resourcePreferencesPath() {
+        return this.options.resourcePreferencesPath;
+    }
+    /**
+     * Load repo-scoped skill auto-invocation preferences (fail closed on malformed).
+     * Missing path / missing file → empty prefs (all skills auto-invocation default on).
+     */
+    async loadSkillAutoInvocationPreferences() {
+        const filePath = this.options.resourcePreferencesPath;
+        if (!filePath) {
+            const empty = { schemaVersion: 1, skills: {} };
+            this.cachedSkillPrefs = empty;
+            return empty;
+        }
+        const prefs = await loadResourcePreferences(filePath);
+        this.cachedSkillPrefs = prefs;
+        return prefs;
+    }
+    /**
+     * Build resourceLoaderOptions that inject skillsOverride from stored prefs.
+     * Skills remain in inventory; only disableModelInvocation is forced for
+     * auto-invocation-off preferences. Manual /skill:name is preserved.
+     *
+     * The override re-reads preferences on EVERY invocation so session.reload()
+     * after a PATCH sees the latest resource-preferences.json (not create-time
+     * closure state).
+     */
+    async buildResourceLoaderOptions(base = {}) {
+        const runtime = this;
+        return {
+            ...base,
+            skillsOverride: (current) => {
+                // Synchronous override surface: use last-known prefs via a sync
+                // fail-closed path. Prefer async cache filled by ensurePrefs.
+                const prefs = runtime.cachedSkillPrefs ?? {
+                    schemaVersion: 1,
+                    skills: {},
+                };
+                return {
+                    skills: applySkillAutoInvocationPreferences(current.skills, prefs),
+                    diagnostics: current.diagnostics,
+                };
+            },
+        };
+    }
+    /** Last successfully loaded skill prefs (sync override + snapshot projection). */
+    cachedSkillPrefs;
+    /** Refresh cached prefs before materialization / reload so override sees latest. */
+    async refreshSkillPrefsCache() {
+        const prefs = await this.loadSkillAutoInvocationPreferences();
+        this.cachedSkillPrefs = prefs;
+        return prefs;
+    }
+    /**
+     * Resolve a skill in the current session inventory by server-issued resourceId.
+     * Returns undefined when the id is unknown (caller maps to PI_SKILL_NOT_FOUND).
+     */
+    async findSkillByResourceId(sessionId, resourceId) {
+        const snapshot = await this.getRuntimeSnapshot(sessionId);
+        if (!snapshot)
+            return undefined;
+        const skill = snapshot.skills.find((entry) => entry.resourceId === resourceId);
+        if (!skill)
+            return undefined;
+        return {
+            resourceId: skill.resourceId,
+            name: skill.name,
+            path: skill.path,
+            autoInvocationEnabled: skill.autoInvocationEnabled,
+        };
+    }
     get sessionDir() {
         return this.options.sessionDir;
     }
@@ -820,13 +896,15 @@ export class ConsolePiRuntime {
             ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
         ];
         // Single services construction for formal materialization (+ optional
-        // default-model resolve from the same modelRuntime).
+        // default-model resolve from the same modelRuntime). Repo-scoped skill
+        // auto-invocation prefs inject skillsOverride without touching SKILL.md.
+        await this.refreshSkillPrefsCache().catch(() => undefined);
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
-            resourceLoaderOptions: {
+            resourceLoaderOptions: await this.buildResourceLoaderOptions({
                 appendSystemPrompt,
-            },
+            }),
         });
         if (this.disposedSessions.has(sessionId))
             return;
@@ -1176,6 +1254,9 @@ export class ConsolePiRuntime {
         }
         this.reloadInFlight.add(sessionId);
         try {
+            // Refresh prefs cache so skillsOverride applied during reload sees
+            // the latest resource-preferences.json written by PATCH.
+            await this.refreshSkillPrefsCache().catch(() => undefined);
             await session.reload();
         }
         catch (error) {
@@ -1283,9 +1364,33 @@ export class ConsolePiRuntime {
             catch (error) {
                 resourceFailure("context files", error);
             }
+            // Preferences are the source of truth for UI auto-invocation state;
+            // loader disableModelInvocation may also reflect frontmatter. Prefer
+            // explicit preference (default on) when projecting autoInvocationEnabled.
+            let skillPrefs = { schemaVersion: 1, skills: {} };
+            try {
+                skillPrefs = await this.loadSkillAutoInvocationPreferences();
+            }
+            catch (error) {
+                diagnostics.push({
+                    type: "error",
+                    code: "PI_RESOURCE_PREFERENCES_MALFORMED",
+                    message: error instanceof Error ? error.message : String(error),
+                    retryable: true,
+                });
+            }
             try {
                 const skillsResult = resourceLoader.getSkills?.();
                 for (const skill of skillsResult?.skills ?? []) {
+                    const resourceId = skillResourceId({
+                        name: skill.name,
+                        filePath: skill.filePath,
+                    });
+                    // Preference off always means autoInvocationEnabled=false even if
+                    // loader already applied disableModelInvocation. Frontmatter-only
+                    // disable (no preference) also surfaces as autoInvocationEnabled=false.
+                    const prefEnabled = isAutoInvocationEnabled(skillPrefs, resourceId);
+                    const autoInvocationEnabled = prefEnabled && skill.disableModelInvocation !== true;
                     skills.push({
                         name: skill.name,
                         description: skill.description ?? "",
@@ -1293,7 +1398,8 @@ export class ConsolePiRuntime {
                         ...(skill.baseDir ? { baseDir: skill.baseDir } : {}),
                         scope: skill.sourceInfo?.scope ?? "unknown",
                         source: skill.sourceInfo?.source ?? "",
-                        enabled: !skill.disableModelInvocation,
+                        resourceId,
+                        autoInvocationEnabled,
                         diagnostics: [],
                     });
                     resolvedResources.push({
@@ -1620,12 +1726,13 @@ export class ConsolePiRuntime {
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
             ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
         ];
+        await this.refreshSkillPrefsCache().catch(() => undefined);
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
-            resourceLoaderOptions: {
+            resourceLoaderOptions: await this.buildResourceLoaderOptions({
                 appendSystemPrompt,
-            },
+            }),
         });
         const modelRuntime = services.modelRuntime;
         const resolvedModel = init.model
@@ -1669,81 +1776,142 @@ export class ConsolePiRuntime {
     hasSession(sessionId) {
         return this.sessions.has(sessionId);
     }
+    /**
+     * Live runtime busy facts for /state reconcile. isPromptRunning is owned by
+     * this Console admission fence; other flags mirror the Pi session when present.
+     */
+    getSessionBusyFacts(sessionId) {
+        const session = this.sessions.get(sessionId);
+        const isPromptRunning = this.promptOwners.has(sessionId);
+        return {
+            isStreaming: session?.isStreaming === true || isPromptRunning,
+            isPromptRunning,
+            isCompacting: session?.isCompacting === true,
+            isBashRunning: session?.isBashRunning === true ||
+                session?.hasPendingBashMessages === true,
+        };
+    }
     /**
      * Send a prompt and stream events. Gate 3: each tool invocation is
      * re-authorized by authorizeOperatorChatTool before the dispatcher runs it
      * (the dispatcher is wired by the HTTP layer, see chat-session.ts).
+     *
+     * Prompt ownership is acquired synchronously before the first await so two
+     * concurrent prompts on the same Session cannot both enter the SDK path.
      */
     async prompt(sessionId, text, onEvent, options) {
-        // First message while creating waits on the same materialization promise.
-        await this.ensureSessionReady(sessionId);
-        const session = this.sessions.get(sessionId);
-        if (!session) {
-            throw new Error(`chat session not found: ${sessionId}`);
+        // Synchronous admission fence — before any await.
+        if (this.promptOwners.has(sessionId)) {
+            throw new Error("CHAT_TURN_ACTIVE");
         }
-        // Gate 2 (re-pin before each turn): interview turns pass through the
-        // existing closed interview allow/deny registry. The next ordinary turn
-        // explicitly restores the normal Operator Chat set (baseline + extension
-        // tools, ADR 0012).
-        const requestedTools = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
-        const activeTools = options?.mode === "requirement-interview"
-            ? filterActiveInterviewTools(requestedTools).allowed
-            : computeOperatorChatActiveToolNames(session);
-        session.setActiveToolsByName(activeTools);
-        const unsub = session.subscribe((event) => {
-            const mapped = mapSdkEvent(sessionId, event);
-            if (mapped)
-                onEvent(mapped);
-            // Pi puts per-assistant-message usage on `message.usage` ({ input, output,
-            // cacheRead, cacheWrite, totalTokens, cost }). Emit on message_end so
-            // multi-step tool turns accumulate like pi-web SessionInfoBar; turn_end
-            // repeats the final message and must not double-count.
-            if (event.type === "message_end") {
-                const usage = extractUsageSample(event);
-                if (usage)
-                    onEvent({ type: "usage", sessionId, usage });
-            }
-        });
+        this.promptOwners.add(sessionId);
+        let unsub;
+        let abortPromise;
         const onAbort = () => {
-            // M1 T08: Stop must abort only the current turn, NOT dispose the
-            // session. SDK AgentSession.abort() aborts the current operation and
-            // waits for the agent to become idle, keeping the session reusable for
-            // the next turn. Only fall back to dispose if the session has no abort()
-            // (e.g. a minimal stub), since a stuck turn should not leak forever.
+            // M1 T08 / AC-R3-003: Stop must abort only the current turn, NEVER
+            // dispose the session. Await session.abort() so ownership settles
+            // after the SDK reports idle. When abort is unavailable, fail closed
+            // non-destructively — Session stays reusable; terminal closeout or
+            // /state reconcile still converges ownership.
+            const session = this.sessions.get(sessionId);
+            if (!session)
+                return;
             try {
                 if (typeof session.abort === "function") {
-                    void session.abort();
-                }
-                else {
-                    session.dispose();
+                    abortPromise = Promise.resolve(session.abort()).catch(() => undefined);
                 }
+                // else: do not call session.dispose() — Stop never destroys Session.
             }
             catch {
                 // ignore
             }
         };
-        options?.signal?.addEventListener("abort", onAbort);
         try {
-            await session.prompt(text, options?.images?.length ? { images: options.images } : undefined);
-            // Wait until the session reports idle / not streaming. The SDK prompt()
-            // resolves when the agent turn completes, but post-turn continuation
-            // (auto-compaction / follow-up) may still be in flight. We poll isIdle.
-            // While polling we emit periodic heartbeat events so the SSE stream
-            // keeps proxies/browsers from timing out (no other data is flowing).
-            await waitForIdle(session, {
-                signal: options?.signal,
-                onHeartbeat: () => onEvent({ type: "heartbeat", sessionId }),
+            // AC-FIX-002: if Stop already fired before readiness, never start model work.
+            if (options?.signal?.aborted) {
+                return;
+            }
+            // First message while creating waits on the same materialization promise.
+            await this.ensureSessionReady(sessionId);
+            // Abort may land during readiness (or between readiness and prompt).
+            if (options?.signal?.aborted) {
+                return;
+            }
+            const session = this.sessions.get(sessionId);
+            if (!session) {
+                throw new Error(`chat session not found: ${sessionId}`);
+            }
+            // Gate 2 (re-pin before each turn): interview turns pass through the
+            // existing closed interview allow/deny registry. The next ordinary turn
+            // explicitly restores the normal Operator Chat set (baseline + extension
+            // tools, ADR 0012).
+            const requestedTools = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
+            const activeTools = options?.mode === "requirement-interview"
+                ? filterActiveInterviewTools(requestedTools).allowed
+                : computeOperatorChatActiveToolNames(session);
+            session.setActiveToolsByName(activeTools);
+            // Final pre-prompt fence: abort after tool pin must still skip session.prompt.
+            if (options?.signal?.aborted) {
+                return;
+            }
+            unsub = session.subscribe((event) => {
+                const mapped = mapSdkEvent(sessionId, event);
+                if (mapped)
+                    onEvent(mapped);
+                // Pi puts per-assistant-message usage on `message.usage` ({ input, output,
+                // cacheRead, cacheWrite, totalTokens, cost }). Emit on message_end so
+                // multi-step tool turns accumulate like pi-web SessionInfoBar; turn_end
+                // repeats the final message and must not double-count.
+                if (event.type === "message_end") {
+                    const usage = extractUsageSample(event);
+                    if (usage)
+                        onEvent({ type: "usage", sessionId, usage });
+                }
             });
-            onEvent({ type: "agent_settled", sessionId });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            onEvent({ type: "error", sessionId, message });
-            throw error;
+            options?.signal?.addEventListener("abort", onAbort);
+            if (options?.signal?.aborted) {
+                onAbort();
+                if (abortPromise)
+                    await abortPromise.catch(() => undefined);
+                return;
+            }
+            try {
+                await session.prompt(text, options?.images?.length ? { images: options.images } : undefined);
+                // Wait until the session reports idle / not streaming. The SDK prompt()
+                // resolves when the agent turn completes, but post-turn continuation
+                // (auto-compaction / follow-up) may still be in flight. We poll isIdle.
+                // While polling we emit periodic heartbeat events so the SSE stream
+                // keeps proxies/browsers from timing out (no other data is flowing).
+                await waitForIdle(session, {
+                    signal: options?.signal,
+                    onHeartbeat: () => onEvent({ type: "heartbeat", sessionId }),
+                });
+                if (abortPromise)
+                    await abortPromise;
+                // User abort is closed out as Turn state `aborted`; do not publish a
+                // red ordinary error event for intentional Stop.
+                if (!options?.signal?.aborted) {
+                    onEvent({ type: "agent_settled", sessionId });
+                }
+            }
+            catch (error) {
+                if (abortPromise)
+                    await abortPromise.catch(() => undefined);
+                if (options?.signal?.aborted) {
+                    // User abort: swallow ordinary error publication (AC-FIX-003).
+                    return;
+                }
+                const message = error instanceof Error ? error.message : String(error);
+                onEvent({ type: "error", sessionId, message });
+                throw error;
+            }
+            finally {
+                options?.signal?.removeEventListener("abort", onAbort);
+                unsub?.();
+            }
         }
         finally {
-            options?.signal?.removeEventListener("abort", onAbort);
-            unsub();
+            this.promptOwners.delete(sessionId);
         }
     }
     /** Generate exactly one title in an isolated in-memory, tool-less LOW session. */