refactor(coding-agent): cut over session action admission

[snimu]

Summary

Third PR of the session-action stack, and its core: every turn-producing entrypoint now flows through the action scheduler, and the alternate ownership machinery - direct dispatch paths, direct checkpoint fencing, dispatch observers, the accepted-agent-message parallel state - is deleted in the same commit. Net -116 production LOC.

Stack: #572 contracts <- #573 kernel <- #574 admission (this) <- #575 protocol <- #576 cleanup

Motivation

After #2 there were still two authoritative owners for new work: the scheduler (queued input) and the legacy direct paths (idle prompts, injected messages, accepted agent messages, custom trigger-turns). Split ownership was the root cause of the compensating-state sprawl this stack exists to remove: every busy check, restart fence, and completion mechanism had to be implemented twice and kept in agreement by hand. This PR makes the scheduler the single owner and deletes the second implementation wholesale.

Code changes

• Routed through the scheduler: idle/direct prompt() (promptUntilAccepted, promptAndWait included), _promptInjectedMessage* (heartbeats, goal context), acceptAgentMessagePrompt/queueAgentMessagePrompt, sendCustomMessage trigger-turn and streaming custom messages, RLM child initial prompts. Idle submissions become immediately eligible actions - externally indistinguishable from the old direct path (no queued-row flash, no spurious queue events).
• Settlement contracts preserved exactly per entrypoint: AgentConnection.prompt at acceptance/preflight; AgentSession.prompt waits for the run when idle, returns after enqueue when visibly queued; promptUntilAccepted at ownership (and still rejects validation failures); promptAndWait through delivery + completion incl. retry chain; steer/followUp at enqueue (false on coalesce); agent-message ownership/delivery/completion remain separate; heartbeat/cron wake behavior unchanged.
• Normalization stays entrypoint-specific: steer("/compact") remains model text; extension commands still execute immediately even while streaming.
• Deleted: _promptUnserialized, _promptInjectedMessageUnserialized, _dispatchPromptWithFence, _observeDirectDispatch, _directPromptSectionCount, _directDispatchObservers, _acceptedAgentMessagePrompt + its event-filtering machinery (behaviors preserved through tickets/lifecycle: clearing an accepted-unstarted prompt restores next-turn context and rejects with the same error; late-event filtering; delivery correlation), _acceptedPromptCompletions, _queueWithPendingNextTurnMessages, _enterDirectPromptSection, _acquireDirectTurnAdmission.
• Review-driven hardening included: visible-queued gating of early settlement; pump-epoch rollback of preselected actions (update-restart checkpoint deadlock); abort during preparation cancels invisible actions instead of leaving an unsettled ghost; no double error surfacing for awaited failures; queue_update dedup.
• Wire/UI behavior still bit-for-bit via the legacy projection (protocol changes land in add model agnostic rlm system prompt #4).

LOC: +865/-965 production (net -100), +390/-144 tests (includes review-fix commits: policy-split batching, handed-off clear boundary).

Note

Migrate session action admission in coding agent to action store and ticket pipeline

• Replaces AcceptedAgentMessagePrompt and PromptDispatchFence abstractions with action store entries and typed tickets, unifying how all prompts (direct, queued, injected, triggered) are admitted and tracked.
• Introduces TurnExecutionPolicy to parameterize per-turn behavior: when to run extension hooks, drain next-turn context, and whether to await retry chains; turns with different policies no longer batch together.
• Renames _enqueueSessionInput to _admitSessionInput, which now returns { accepted, disposition, ticket } and supports immediate-start eligibility without waiting on the pump.
• Adds _cancelSessionActions to handle differentiated cancellation: rejected delivery for accepted/invisible turns, context message restoration, and transcript cleanup for in-flight cancelled dispatches.
• Risk: several internal APIs used in tests were removed or renamed (_acceptedAgentMessagePrompt, _directPromptSectionCount, activeActionsForMessage), and queue_update events are now suppressed when visible queue content is unchanged.

^{Macroscope summarized b17d052.}

---

Note

High Risk
Large refactor of core prompt admission, pumping, cancellation, and restart checkpoint behavior with many entrypoint-specific settlement contracts that must stay behavior-identical.

Overview
Unifies session input so idle prompts, injected messages, agent-message acceptance, custom trigger-turns, and queued steer/follow-up all admit through _admitSessionInput with ActionTicket delivery/completion semantics instead of parallel direct agent.prompt() paths.

Adds TurnExecutionPolicy on prepared turns (preparation barriers, before_agent_start, next-turn context timing, retry-inclusive completion) and CommitPreparationPolicy flags for optional model/auth waits. The input pump batches follow-ups only when policies match, handles preselected actions for update-restart rollback, and uses captureRunMessages on cancel to strip in-flight transcript rows.

Deletes _dispatchPromptWithFence, direct-prompt checkpoint fencing, _acceptedAgentMessagePrompt, and _acquireDirectTurnAdmission; cancellation/clear/abort now reject tickets, restore prefix/next-turn context, and gate queue_update / legacy queue projections on queueVisible. session-action-store gains rejectDelivered and actionsForMessage (broader than the old active-only lookup).

^{Reviewed by Cursor Bugbot for commit b17d052. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 212d2be. Configure here.}