fix(webui): Make cross-session switching transactional - #8882

LGTM. The transactional core holds up under an adversarial pass: commitCrossSession is a fully synchronous ownership swap (microtask-batched store notification, one React batch — no observer-visible intermediate state), the arbitration (intent identity, lifecycle, env generation, deadline, source logical identity) re-runs inside the commit with no await between staging and commit, discard paths only retire the candidate without touching the current session's store/refs/stream, and the coordinator serializes with latest-queued-only and identical-target coalescing. No sessionId-only ownership is reintroduced, double-commit and commit-after-discard are structurally impossible, and all prior rounds' Criticals (round-2's seven, round-3's four, plus round-1's 89 broken unit tests) are verifiably fixed at head with 96 new cases and a real-daemon E2E. CI green on head.

Two P2 hardening items for fast-follow, not blockers: (1) the pump accepts a candidate attachment whose clientId differs from the requested id (DaemonSessionProvider.tsx:3440-3448 never compares candidate.clientId to requestClientId, and persistStableClientId persists the echoed one) — that weakens the #8833 exact-attachment fencing to 'some attachment identity' if a daemon ever echoes a different id; reject or persist the requested id and pin with a test. (2) 'bounded staging' only bounds side queues: the staging store is created with maxBlocks MAX_SAFE_INTEGER and the replay is synchronous, so an incident-class 76 MiB target transiently holds ~3x block arrays and blocks the main thread; deliberate and pinned by tests, not a regression vs legacy, but cap staging at maxBlocks or chunk across macrotasks and document the peak cost. Plus the known-deferred P3s (silent pump stall when client_identity capability is missing at pump time until the watchdog fires; releaseSession only cancels a pending transition when the current session matches). Ship it.

Review — transactional cross-session switching

Reviewed range 1a2c5026b..5651663d8 (4 commits). The transactional-switch machinery is well-engineered and holds up under close inspection: the commit is a single synchronous ownership handoff (re-validating desired-intent identity / lifecycle / environment generation / absolute deadline immediately before install), A's buffered events cannot contaminate B's store, late results are fenced by exact attachment + environment identity, unmount fencing is careful, and the WebShell owner-guard sweep is consistent across navigation paths. No Critical issues found.

One Important and three Minor items are inline:

1. actions.ts:1549 (Important) — branchSession's in-flight flag is cleared only when the raw request settles; withActionTimeout does not abort it, so a slow branch blocks every requireStableSession action (prompt / model / rename / recap …) for up to the SDK's 30 s fetch timeout. Clear the flag in a whole-operation finally.
2. useQueuedPrompts.ts:625 — dropped mid-turn admissions leak in pendingMidTurnAdmissionsRef (one entry per interrupted mid-turn submission, app lifetime).
3. ChatPane.tsx:483 — this useQueuedPrompts instance lacks writeBlocked; mid-switch submits fail at the actions layer and land in the queue as failed instead of being rejected at the composer.
4. DaemonSessionProvider.tsx:3300 — a throwing onSessionTransitionCommit is swallowed after B is installed; the self-heal-on-next-render contract deserves a comment or a retry on failure.

Scope note: the acp-bridge / cli-serve / SDK daemon changes described in the PR body are not part of this diff (they landed in the base via #8691/#8833); this review covers the 23 files actually changed here.

Re-approving at head 5651663 after the two rebases: commitCrossSession is byte-identical to the head I approved, the arbitration/discard/coordinator code is untouched, no tests were removed, and the genuine new work checks out — the O(B) single-dispatch replay (fixing my P2-2's multiplicative transient allocation, with a batch-size regression test), the pendingMidTurnAdmissionsRef ledger with workspace-scoped owner-token identity and fenced old-owner reconciles (14 new tests), and the #8883 adaptation clearing failed loads without auto-fresh attach.

Remaining, all bounded fast-follows: my P2-1 (candidate clientId still accepted on truthiness without equality vs requestClientId, and commit persists the candidate's id) is open but re-scoped — types.ts now documents clientId as not an ownership boundary for stable-id mid-turn queues and the design doc defers client-id replacement; still a cheap unperformed check. New P2 from ytahdn verified: branchSession's setSourceBoundOperationInFlight clears only when the raw branch request settles and withActionTimeout is a Promise.race, so a hung branch serializes every requireStableSession action for up to the 30s fetch timeout — a whole-operation finally fixes it. P3s: pendingMidTurnAdmissionsRef never deletes non-matching entries on post-switch rejection (one orphaned entry per interrupted submission), ChatPane's useQueuedPrompts lacks writeBlocked so mid-switch pane submits land as failed queue entries instead of composer rejection, and a throwing onSessionTransitionCommit after B install self-heals one frame late. CI green on head, identical skip profile to the old head. Ship it with the fast-follows.

✅ Approved

Approved after the review discussion resolved on the four inline threads: three suggestions were withdrawn (the branch in-flight interlock, the mid-turn admission retention, and the commit-observer boundary are all intentional and correctly reasoned), and the remaining ChatPane writeBlocked follow-up is accepted as a tracked deferral per the review-round policy. No blockers remain.

Note: Test (macos/windows) and Integration Tests (CLI, No Sandbox) are skipped on this head (the existing repo-wide pattern); the jobs that ran — Test (ubuntu), Desktop Shell (ubuntu/windows), web-shell E2E Smoke, visuals — are green.

✅ Approved (re-approved after rebase)

Re-reviewed the updated head b700a4cef (rebase onto the newer main + one new commit):

• The rebase is content-clean — every PR-specific file (DaemonSessionProvider, actions, types, useQueuedPrompts, WorkspaceSessionProvider, useBackgroundTasks, useSessionArtifacts, midTurnDedup, the daemon side channels, integration test, design doc) is byte-identical to the previously approved head; the diff on the shared App.tsx/ChatPane files is entirely the newer base's own progress (#8891/#8914), not conflict-resolution churn.
• The new commit b700a4cef is sound — it moves the owner.isCurrent() gate in the rename flow to run after the catalog reconciliation and before the local status notice / error report, so a confirmed server-side rename still reconciles into the catalog after its source attachment was replaced, with a dedicated regression test (reconciles a confirmed rename after its source attachment is replaced). Matches its stated purpose.
• Prior discussion conclusions are unchanged: three suggestions withdrawn (branch in-flight interlock, mid-turn admission retention, commit-observer boundary), one accepted as a tracked deferral (ChatPane writeBlocked).

CI on the new head: no failures (checks re-running after the rebase). The Test (macos/windows) / Integration Tests (CLI, No Sandbox) skip pattern remains the pre-existing repo-wide one; Test (ubuntu), Desktop Shell, web-shell E2E Smoke, and visuals were green.