Merge remote-tracking branch 'origin/master' into worktree/pr742-retarget-20260728

# Conflicts:
#	docs/event-producer-consumer.md

packages/ui/jsonrpc/README.i18n.yaml

@@ -1,6 +1,6 @@
 # Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write
-README.md: 96dae46c9c6ecce6643bb408a5e57c2db2275a83
-README.zh.md: 2c257b13a15ad3c6c1bf0c4dd44a04e308e8f0b0
+#   pnpm run verify-translation-pairing --write packages/ui/jsonrpc/README.md
+README.md: 48eb6106fe4b015f114b264a312249a92128266f
+README.zh.md: 8ec2d57a206d770d0b77ee69036457e3b2864303

packages/ui/jsonrpc/README.md

@@ -22,7 +22,7 @@ The plugin answers `shutdown`, disposes SDK-owned agents and subscriptions to qu
 
 ## Wire notes
 
-`initialize.serverInfo.name` is the wire-stable `deepseek-harness-sdk-runtime`. A session accepts one in-flight prompt; overlap fails immediately, other sessions remain independent, and the session is reusable after settlement. `session.finished` reports that prompt's message-triggered turn outcome; later injection or plugin-owned zero-step turns still stream as `session.event` notifications but cannot replace the prompt status. Persistence roots and persona come from `cordis.yml`.
+`initialize.serverInfo.name` is the wire-stable `deepseek-harness-sdk-runtime`. A session accepts one in-flight prompt; overlap fails immediately, other sessions remain independent, and the session is reusable after settlement. `session.finished` reports that prompt's message-triggered turn outcome; later between-turn records still stream as `session.event` notifications but cannot replace the prompt status. Persistence roots and persona come from `cordis.yml`.
 
 ## Model Experience
 

packages/ui/jsonrpc/README.zh.md

@@ -22,7 +22,7 @@ Stdout 只承载 JSON-RPC 帧。部署不得组合 stdout logger；诊断应写
 
 ## 协议说明
 
-`initialize.serverInfo.name` 的协议稳定值为 `deepseek-harness-sdk-runtime`。一个会话只接受一个进行中的提示词；重叠请求会立即失败，其他会话保持独立，当前请求结算后该会话可再次使用。`session.finished` 报告由该提示词消息触发的轮次结果；后续注入或插件持有的零步骤轮次仍会作为 `session.event` 通知流式发出，但不能替换该提示词的状态。持久化根目录和 persona 由 `cordis.yml` 提供。
+`initialize.serverInfo.name` 的协议稳定值为 `deepseek-harness-sdk-runtime`。一个会话只接受一个进行中的提示词；重叠请求会立即失败，其他会话保持独立，当前请求结算后该会话可再次使用。`session.finished` 报告由该提示词消息触发的轮次结果；后续轮次间记录仍会作为 `session.event` 通知流式发出，但不能替换该提示词的状态。持久化根目录和 persona 由 `cordis.yml` 提供。
 
 ## 模型体验
 

packages/ui/tui/tests/tui.spec.ts

@@ -3040,12 +3040,14 @@ describe('pi-tui chat lifecycle and transcript', () => {
     expect(result.terminal.output).toContain('advertised by multiple providers')
     expect(result.terminal.output).toContain('already alpha/a1')
 
+    const firstSelectorOutput = result.terminal.output.length
     result.terminal.send('/model')
     result.terminal.send('\r')
     result.terminal.send('/model')
     result.terminal.send('\r')
-    await tick()
-    expect(result.terminal.output).toContain('Select model')
+    await vi.waitFor(() => {
+      expect(result.terminal.output.slice(firstSelectorOutput)).toContain('Select model')
+    })
     result.terminal.send('\x1b')
     await tick()
 

packages/ui/user-approval/src/invariant.ts

@@ -18,19 +18,26 @@ type ApprovalTransition =
   | { kind: 'asked'; id: ApprovalRequestId }
   | { kind: 'decided'; id: ApprovalRequestId }
 
+interface ApprovalTrace {
+  openTurn: number | null
+  pending: Set<ApprovalRequestId>
+}
+
 /** Validate one approval event against committed unmatched questions. */
 function validateApprovalEvent(
-  pending: ReadonlySet<ApprovalRequestId>,
+  trace: ApprovalTrace,
   event: SessionEvent,
   fail: InvariantFailure,
 ): ApprovalTransition | undefined {
   if (event.type === 'approval/asked') {
+    if (trace.openTurn === null) fail('approval/asked appended outside any open turn')
     if (event.data.toolName.length === 0) fail('approval/asked toolName must be non-empty')
-    if (pending.has(event.data.id)) fail(`approval/asked repeated open id ${JSON.stringify(event.data.id)}`)
+    if (trace.pending.has(event.data.id)) fail(`approval/asked repeated open id ${JSON.stringify(event.data.id)}`)
     return { kind: 'asked', id: event.data.id }
   }
   if (event.type === 'approval/decided') {
-    if (!pending.has(event.data.id)) fail(`approval/decided has no matching approval/asked for id ${JSON.stringify(event.data.id)}`)
+    if (trace.openTurn === null) fail('approval/decided appended outside any open turn')
+    if (!trace.pending.has(event.data.id)) fail(`approval/decided has no matching approval/asked for id ${JSON.stringify(event.data.id)}`)
     if (!APPROVAL_OUTCOMES.includes(event.data.outcome)) {
       fail(`approval/decided carries unknown outcome ${JSON.stringify(event.data.outcome)}`)
     }
@@ -52,28 +59,39 @@ function applyApprovalTransition(pending: Set<ApprovalRequestId>, transition: Ap
 // Event owners keep precommit staging local so their vocabularies never move into a central helper.
 /* jscpd:ignore-start */
 const install: InvariantInstaller = Object.assign((ctx: Context, fail: InvariantFailure) => {
-  const traces = new WeakMap<Session, Set<ApprovalRequestId>>()
+  const traces = new WeakMap<Session, ApprovalTrace>()
   const staged = new WeakMap<SessionEvent, { session: Session; transition: ApprovalTransition }>()
-  const seed = (session: Session): Set<ApprovalRequestId> => {
-    const pending = new Set<ApprovalRequestId>()
-    traces.set(session, pending)
+  const seed = (session: Session): ApprovalTrace => {
+    const trace: ApprovalTrace = { openTurn: null, pending: new Set() }
+    traces.set(session, trace)
     for (const event of session.events) {
-      const transition = validateApprovalEvent(pending, event, fail)
-      if (transition !== undefined) applyApprovalTransition(pending, transition)
+      if (event.type === 'turn/start') trace.openTurn = event.data.turn
+      else if (event.type === 'turn/end') trace.openTurn = null
+      const transition = validateApprovalEvent(trace, event, fail)
+      if (transition !== undefined) applyApprovalTransition(trace.pending, transition)
     }
-    return pending
+    return trace
   }
-  const traceFor = (session: Session): Set<ApprovalRequestId> => traces.get(session) ?? seed(session)
+  const traceFor = (session: Session): ApprovalTrace => traces.get(session) ?? seed(session)
 
   for (const session of ctx.sessions.list()) seed(session)
   ctx.on('session/created', (session) => { seed(session) }, { global: true })
   ctx.on('session/event', (session, event) => {
+    const trace = traceFor(session)
+    if (event.type === 'turn/start') {
+      trace.openTurn = event.data.turn
+      return
+    }
+    if (event.type === 'turn/end') {
+      trace.openTurn = null
+      return
+    }
     if (event.type !== 'approval/asked' && event.type !== 'approval/decided') return
     const candidate = staged.get(event)
     /* v8 ignore next -- internal/dispatch stages every package-owned pair event */
     if (candidate === undefined || candidate.session !== session) return fail('approval audit event published without pre-commit validation')
     staged.delete(event)
-    applyApprovalTransition(traceFor(session), candidate.transition)
+    applyApprovalTransition(trace.pending, candidate.transition)
   }, { global: true })
   ctx.on('internal/dispatch', (_mode, eventName, args) => {
     if (eventName !== 'session/event') return

packages/ui/user-approval/tests/invariant.spec.ts

@@ -13,10 +13,15 @@ async function setup(): Promise<Context> {
   return ctx
 }
 
+function startTurn(session: Session): void {
+  session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+}
+
 describe('approval invariants', () => {
   it('accepts paired audit events and closed policy values', async () => {
     const ctx = await setup()
     const session = ctx.sessions.create()
+    startTurn(session)
     const id = ApprovalRequestId('ask-1')
     session.append('approval/asked', { id, toolName: 'bash' })
     session.append('approval/decided', { id, outcome: 'allowed-once' })
@@ -47,14 +52,43 @@ describe('approval invariants', () => {
       type: 'approval/decided', seq: 1, time: 1, data: { id, outcome: 'rejected' as const },
     } as const
     expect(() => {
+      ctx.emit('session/event', session, {
+        type: 'turn/start', seq: 0, time: 0,
+        data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } },
+      })
       ctx.emit('session/event', session, asked)
       ctx.emit('session/event', session, decided)
     }).not.toThrow()
   })
 
+  it('rejects audit events outside any open turn', async () => {
+    const ctx = await setup()
+    const session = ctx.sessions.create()
+    expect(() => session.append('approval/asked', {
+      id: ApprovalRequestId('ask-1'), toolName: 'bash',
+    })).toThrow(/outside any open turn/)
+    expect(() => session.append('approval/decided', {
+      id: ApprovalRequestId('ask-1'), outcome: 'rejected',
+    })).toThrow(/outside any open turn/)
+  })
+
+  it('rejects an unenclosed audit event when replaying an existing session', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const session = ctx.sessions.create()
+    startTurn(session)
+    session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
+    session.append('approval/asked', {
+      id: ApprovalRequestId('ask-replay'), toolName: 'bash',
+    })
+    await ctx.plugin(InvariantService)
+    await expect(ctx.plugin(ApprovalInvariant).then(() => undefined)).rejects.toThrow(/outside any open turn/)
+  })
+
   it('rejects malformed and unpaired audit events', async () => {
     const ctx = await setup()
     const session = ctx.sessions.create()
+    startTurn(session)
     const id = ApprovalRequestId('ask-1')
     expect(() => session.append('approval/asked', { id, toolName: '' }))
       .toThrow(/toolName must be non-empty/)