fix(runtime): land permission switches before the next turn's first tool call (#3349) - #3615

…che#3349)

setPermissionMode, setExecutionBoundaryKind and transitionSessionConfiguration
rejected with session_busy whenever a turn was running or an admission claim
existed, so a switch could never land while a Goal keeps admitting successor
turns back to back. Route commitExecutionResourceTransition through the
kernel's queued quiescent mutation instead: the switch waits out the claims
and runs that predate it, commits in the inter-turn gap, and the successor
turn — admission-barrier-gated on the reserved slot — observes the new
configuration before its first tool call.

The eager hasActiveRuns guards come out (quiescence is now the kernel's
single authority); the waiting_for_user rejections and
relocateSessionWorkspace's fail-fast keep their semantics. Existing
assertions expecting the reject behavior are updated to the queued
semantics, and a regression test drives a gated turn through an Auto→Bypass
switch, asserting the switch commits in the gap and the next turn is rebuilt
from the committed mode.

Generated-by: ZCode (Z.ai GLM)

…che#3349)

ctx.permissionMode was frozen at backend build time from the session
header, so even a committed switch left a running turn's approvals on the
old mode — the half-applied state behind the issue's mixed symptoms.
Derive the mode per tool dispatch from the authoritative boundary
(executionBoundaryDisplayMode), with the plan-mode downgrade applied at
the same point; an external boundary falls back to the last known header
mode. resolveCollaborationPermissionMode moves to core so the composer
(build time) and the tool runtime (dispatch time) share one rule.

Also close the catalog short-circuit amplifier: session.configuration.update
now requires the durable boundary to match the requested mode before
treating the update as a committed no-op, so a header/boundary divergence
is repaired instead of blessed. executionBoundaryMatchesPermissionMode
moves to core next to the display-mode derivation.

Legacy 'execute' is audit-safe: compilePermissionProfile and the
filesystem worker treat it identically to 'ask', and the subagent
snapshot's permissionMode is unused by tool building.

Generated-by: ZCode (Z.ai GLM)

…pache#3349)

Commits 1-3 rely on every config write disposing the backend before it
commits. Keep that convention from staying implicit: each generation now
records the boundary revision it was composed against, and ensureActive
compares it against the store before reuse. On drift with no active runs
the generation is disposed and rebuilt in the same activation; with runs
still live it is only marked for invalidation — the existing flush path
retires it when they exit and the next activation composes fresh. Tools
stay correct during the grace turn: they read the boundary live on every
call. An unreadable boundary leaves the guard dormant; a self-heal test
drives a stray revision bump through both the idle and the live-run
branches.

Generated-by: ZCode (Z.ai GLM)

…sweep (apache#3349)

Complete the verification plan: the plain-session case the reporter asked
for drives an ordinary turn, an idle Auto→Bypass switch, and the next
turn, asserting the successor is composed from the committed mode and
that a probe tool call — resolving the boundary through the session's own
store, the same read a real dispatch performs — sees
executionBoundary.kind === 'bypass' and permissionMode === 'bypass' at
once. A seeded sweep then alternates ask/bypass (both widening and
narrowing, the latter through the shell-run fence) across interleaving
classes — idle, mid-turn, racing the turn's release — asserting the
invariant that every turn started after a switch resolved observes the
committed configuration. Every checkpoint awaits a deterministic event;
the seed is fixed, so failures reproduce.

Together with the earlier suites this closes the matrix: mid-turn,
gap/idle, successor-claim-pending, waiting_for_user, mid-dispatch
boundary flips, and stray revision bumps.

Generated-by: ZCode (Z.ai GLM)

…le awaiting quiescence (apache#3349)

Review finding (P0): the queued quiescent mutation held the session's
mutation tail for its entire wait, and a running turn can depend on an
admission mutation enqueued on its own session's tail — graph operator
provisioning runs on the supervisor's session exactly when the
supervisor's yield tool is waiting on a reconciliation milestone that
needs it. Tail held + run drained + run waiting on the tail = deadlock.

Decouple the two: the mutation now closes a per-session admission gate
(new claims capture it in their admission barrier) and waits for
quiescence WITHOUT the tail, so admission mutations a running turn
depends on still pass. Only after quiescence does the operation join the
tail, still serialized with other mutations; claims created after the
request stay gated until it completes. Session-manager side, the wait is
now scoped to the primary session only — waiting on descendants could
deadlock the same way through gated child claims — and descendant
activity is rejected at commit time instead, restoring the pre-queue
session_busy guard as a truthful failure rather than a hang.

Also corrects the falsified invariant in the doc comment: a running turn
CAN enqueue a mutation on its own session's tail; the kernel regression
test drives exactly that interleaving.

Generated-by: ZCode (Z.ai GLM)

…pache#3349)

Review finding (P1a): executionBoundaryMatchesPermissionMode judged
read-only-ness by profile NAME while the authoritative display mode
judges it structurally (apache#1611). A read-only-named profile widened by an
approved expansion therefore read as explore to the matcher while
presenting as ask — the catalog short-circuit could bless exactly the
profile-level divergence this series set out to repair — and a custom
structurally-read-only profile forced a transition that silently reset
it to the canonical explore profile.

Derive the match from executionBoundaryDisplayMode so both answers come
from one implementation: a widened read-only no longer matches explore
(repaired through the transition instead), custom read-only profiles
match and are preserved, legacy 'execute' never matches (forcing the
transition is the safe direction), and an external boundary stays
unverifiable.

Generated-by: ZCode (Z.ai GLM)

…solated sessions (apache#3349)

Review finding (P1b): the new boundary-consistency condition in the
session.configuration.update short-circuit made an external boundary
(always unverifiable) fail the check on every update, so even a no-op
re-apply went through transitionSessionConfiguration and hit the store's
refusal to move an externally isolated boundary — a regression for
sessions whose configuration had matched.

Skip the boundary comparison when the boundary is external: the header
comparison alone decides the no-op there, as it did before the
divergence repair.

Generated-by: ZCode (Z.ai GLM)

…action (apache#3349)

Review finding (P2): setPermissionMode and setExecutionBoundaryKind only
inspected waiting_for_user at request time. A turn that pauses on an
approval after the switch was queued never settles until the user
answers, so the queued commit waited indefinitely — the D1 'reject while
the user holds a pending decision' semantics degraded into an unbounded
hang in that window.

The quiescence wait now treats an active interaction as busy: it throws
SessionQuiescentMutationBusyError, interaction registration wakes the
waiters so the rejection is timely, and the session-manager wrapper maps
it to the same session_busy outcome transitionSessionConfiguration
already produces for the same condition. Request-time checks stay as
fast-fail; the regression test drives a switch queued behind a gated
turn that then opens a sandbox boundary approval.

Generated-by: ZCode (Z.ai GLM)

Document the boundary-revision stamping race (the stamp may trail the
revision actually composed against — safe direction, one extra rebuild),
the one-read-per-activation cost choice in the revision guard, and the
operation_unavailable cliff a kernel without the queued primitive would
create. Grow the seeded interleaving sweep from 12 to 100 iterations,
closer to the stress volume the plan promised.

Generated-by: ZCode (Z.ai GLM)

…target (apache#3349)

Main removed 'execute' from the permission-mode vocabulary, so the
P1a regression assertion now passes the legacy value through a type
cast: the runtime property it protects — a stale persisted mode never
matches, so it always routes through a transition — is unchanged.

Generated-by: ZCode (Z.ai GLM)

Generated-by: ZCode (Z.ai GLM)

…e next turn (apache#3349)

Review finding: the queued quiescent mutation waited out the live turn
before any tightening began, so a mid-turn Bypass→Auto request left the
durable boundary unrestricted — and every later tool call in that same
turn read the old authority — for a wall-clock-unbounded window.

Split widening from tightening. Widening keeps the inter-turn-gap
semantics: a delayed grant only affects turns that start later. A
tightening transition now commits on the mutation tail alone —
serialized with other transitions, never waiting for claims or runs —
so the narrower durable boundary lands immediately and the running
turn's next tool dispatch reads it; lineage shells are fenced at once;
backend disposal defers to idle-time invalidation with the
boundary-revision guard rebuilding stale generations, so nothing in the
flow needs an idle session anymore. The lineage race guard moves inside
the tail with a fresh listing: a descendant provisioned while the
request queued still rejects operation_conflict, and the retry fences
the full lineage.

The reviewer-specified regression drives a gated turn under bypass,
requests Auto mid-turn, and asserts the switch resolves before the turn
ends, a write-capable dispatch before completion reads managed+ask,
shell fencing fired, the turn was not stopped, and the successor turn
composes from the committed mode as a separate invariant. On the
pre-fix code that test times out waiting for the turn to end.

Generated-by: ZCode (Z.ai GLM)

…iles

The two test files added by this PR predate main's repo-wide header pass
and were never covered by it; write:asf-headers fills them in.

Generated-by: ZCode (Z.ai GLM)

…tures (apache#3349)

Main removed SessionHeader.lastUsedAt; the two fixtures this PR adds
still set it, so TypeScript compilation (and therefore every claimed
suite) failed on the rebased head.

Generated-by: ZCode (Z.ai GLM)

…e#3349)

Review finding: session.configuration.update is a full configuration
operation, but the fast tightening path commits the entire record while
the live backend keeps its frozen composition. For bypass/agent →
ask/plan the permission half applies per dispatch while the stale agent
collaboration keeps combining with the fresh ask boundary — so a
write-capable dispatch can still be admitted after the stored
configuration already says the session is read-only Plan.

A tightening that also changes any backend-composed field (backend,
connection, model, thinking level, collaboration mode, orchestration
mode) now rejects session_busy while a run is live — never partially
committed; the retry lands whole once the run ends and the queued path
recomposes the backend with every field. Permission-only projections
keep the immediate-revocation path. The regression drives the reviewer's
scenario end to end: live rejection with zero partial commit, then a
read-only dispatch (plan downgrades ask to explore) after the retry.

Generated-by: ZCode (Z.ai GLM)

…#3349)

Review finding: the boundary revision is not a backend-composition
fingerprint — an approved sandbox expansion increments it too, and
expansions are consumed live per dispatch by design, changing neither
model nor backend-composed configuration. The watcher therefore paid a
durable read on every activation and rebuilt backend, transport and
composer state after every valid expansion, while defending against a
writer that does not exist: configuration transitions already own their
backend disposal and invalidation.

Remove boundaryRevision, readBoundaryRevision and
resolveReusableGeneration (ensureActive returns to plain reuse), the two
forced-revision self-heal tests, and the fixed-seed sweep — its
interleaving classes stay covered by the direct deterministic tests:
claim/run waiting, successor admission, the admission-gate deadlock,
immediate tightening at the current dispatch, shell lineage fencing, and
the mixed-configuration regression.

Generated-by: ZCode (Z.ai GLM)

…pache#3349)

Generated-by: ZCode (Z.ai GLM)