fix(agent): close post-merge attention review gaps

[oscarlehuu]

Summary

Follow-up to #113 after delayed immutable review results surfaced blockers that were stale as certification evidence but still reproducible on merged main.

• secure ACP durable spools end to end: absolute-root descriptor-walked ancestor creation, owner/type/mode/size checks, metadata fsync ordering, root-wide quotas, bounded inter-process capacity/claim scans, and fail-closed unsupported-platform behavior
• preserve paired 46040/46042 authority through ambiguous admission, early answers, shutdown, and restart; replay the exact request before its exact terminal resolution
• quarantine malformed/duplicated recovery entries without blocking healthy siblings; never orphan-cancel a request still leased by an overlapping process, keep rescanning after release, and track cleanup of incomplete request leases through root-lock contention
• keep receipt publication outside global spool locks while retaining exact events through persistence exhaustion, bounded/fair per-entry scans, per-spool cursor ownership, secure crash-residue cleanup, progress-sensitive retries, continuing cleanup handoff, and bounded shutdown
• make durable Desktop recovery explicit and bounded: generation-fenced retries and validation, atomic approval replacement, exact-wire setup cleanup, family-isolated terminal failures and overflow recovery, self-triggered history retry, zero-floor observer replay, and producer-start session authority
• bind completed Mission Inbox receipt fallback to exact conversation/agent/trigger/session/turn authority, while preserving unrelated active sibling obligations and active turns
• fence relay sends, projections, and subscription recovery by exact transport/family owners; keep terminal approval failures isolated from reminder delivery
• omit unsupported agent sidecars from Windows desktop packaging until an equivalent secure Windows spool backend exists
• keep unsigned feed summaries below the verified-event projection boundary; derive both Inbox thread navigation and context scope from the exact signed target, fence stale row lookups, and rebuild approvals only from owner-fenced verified live/history events

User-visible flow

1. An agent requests durable user input or publishes a completion receipt.
2. Retry and restart reuse the exact owner-signed event; an early answer is persisted without blocking unrelated relay dispatch.
3. If admission remains ambiguous across restart, the request is acknowledged before its paired terminal event is published.
4. Unsafe recovery fails closed; malformed siblings are quarantined while healthy durable work continues.
5. A stalled receipt or subscription cannot block unrelated work indefinitely.
6. Mission Inbox shows a completed run for review only when every receipt matches that run's exact conversation, agent, trigger, session, and turn.

Validation

• final immutable SHA 55277c3fd6ab62772673ccf6a093426ae6ec42ae, tree b74997af3c562ae73e0edafcca6d8168b9a02aae (includes the docs-only origin/main update required by strict branch protection)
• cargo test -p buzz-acp -- --test-threads=1 — 830 unit + 9 integration tests passed
• pre-ACK durable-answer timing probe — 25/25 repeated passes; CI wall-clock headroom now covers the required fsync without weakening the withheld-ACK assertion
• pnpm test in desktop/ — 5,045 passed, 1 skipped
• pnpm run check — passed
• just desktop-tauri-test — passed
• just desktop-tauri-clippy — passed
• just ci — passed
• Mission Inbox Playwright smoke — 4 passed
• required GitHub NuncioCrew Gate — passed on final exact head
• three-way independent immutable review of final exact head — passed with no blockers

Advisory CI triage

Desktop Smoke E2E shards 1 and 3 were previously advisory failures in unrelated existing suites. Narrow, clean-build differential probes reproduced the same failures on both the prior PR head and exact base 304173e423:

• 46040/channel question-card fixtures are suppressed by the existing verified-event boundary on both revisions
• live reaction/refetch fixtures fail on both revisions

The changed Mission Inbox smoke spec is validated separately; only the required NuncioCrew Gate determines the merge gate.

Non-goals

• no new event kinds or protocol semantics
• no redesign of Mission Inbox presentation
• no migration of existing unsafe spool directories; they are deliberately rejected fail closed
• no weaker non-Unix spool fallback; agent runtime startup fails explicitly until an equivalent handle-relative owner/ACL backend exists

Related

• Agent attention & recovery: distinguish liveness from progress and surface actionable exceptions #105
• feat(desktop): add agent attention and recovery #108
• fix(agent): close attention recovery gaps #113