fix(turn-handoff): discard saved handoff at conversation boundaries (C4 backfill)

[ang-fleet-workers]

FleetReview retro-backfill 2026-09-27, class C4 (authz/ownership/guard bypass), slice 1 of hermes-agent.

Instances fixed (re-verified at HEAD 5a9d284):

• feat(turnover): skip registry-known-exhausted subs, and leave a durable handoff when a turn is cut #813 agent/turn_handoff.py:425 — handoff records session_id but consume checks only the chat key
• feat(turnover): skip registry-known-exhausted subs, and leave a durable handoff when a turn is cut #813 agent/turn_context.py:1694 — same bug seen from the prologue injection site

Fix: SessionStore deletes the key's handoff wherever it mints or switches the session id (reset_session, switch_session, get_or_create new candidate incl. idle/daily auto-reset). Compression advances through advance_compression_session and is untouched, so the same conversation still resumes after a cut turn.

Tests: tests/gateway/test_turn_handoff_session_boundary.py — 3 of 4 FAIL on base (manual reset, /resume switch, auto-reset); keep-case passes on both. With fix 4/4, plus existing turn_handoff wiring + resume-handoff command tests (23 passed, narrow run).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[ang-fleet-lander]

🤖 merged-by: apollo · lane: kanban-merge-pass · gate: ADVISORY (FleetReview not green for 524a708): fleetreview-advisory-20260927-standing.md · why: t_a2bf7813: Backfill C4 [P1] authz / ownership / guard bypass — 92 instances (hermes-agent 4; Argus off card review (Ace 13:08), CI green

[ang-prism]

FleetReview

Review: post-merge · head 7d803a6f252e · duration 10m 19s
Profile: light (merit: default light: lines 166<800, files 3<1000000, hunks 6<1000000, no hot path) · policy: below-size-and-path-gates
Roster: B-assert-ctx → gpt-6-sol (openai), C-assert-xhigh → claude-code-opus-5-5 (anthropic), G → grok-4.6 (xai), L6 → gpt-6-sol (openai)

Post-merge review (fleetreview:post-merge override): this reviewed the merge commit against its first parent — the bytes that already shipped. It is not a pre-merge gate pass.

profile: light (rule: default light: lines 166<800, files 3<1000000, hunks 6<1000000, no hot path) · round 0 · members: B-assert-ctx, L6, C-assert-xhigh, G · families: anthropic,openai,xai

Confidence: 3/5

Findings

• P1 agent/turn_handoff.py:367 — Failed discard · agreed: B-assert-ctx (openai)
• P1 gateway/session.py:5105 — Same-session discard · agreed: B-assert-ctx,C-assert-xhigh (openai, anthropic)

---

FleetReview provenance · models: B=gpt-6-sol, C=claude-code-opus-5-5, D=grok-4.6 · cost: $1.24 · duration: 10m 16s · rounds: 1 · files examined: 3