refactor(web): drop the permission RPC pair and turn-anchoring machinery

The session.permissions/setPermission unary pair, the PermissionOption wire
DTO, the client Session wrappers, and the fixture/fake mirrors all leave the
wire: the read side moves to the 'permissions' session projection and the
write side moves to the /permission command in follow-up commits, so the
web protocol gains no permission methods at all.

The pendingSwitches + prompt-submit flush + hasOpenTurn move also goes.
Knob events no longer need turn enclosure: the persistence scanner keeps
standalone events after the last turn/end as part of the preserved prefix
(remove-synthetic-log-only-turns), none of the three knob invariants demand
an open turn, and the setters append bare events. An idle switch commits
immediately; hasOpenTurn stays a user-approval private fold (its audit pair
is the one contract that still requires enclosure).

The old PermissionSelect chip and its mount-time fetch die with the RPCs
(the resident composer broke the mount-once assumption); the projection-fed
replacement lands with the Access seat swap.

packages/host/apiproxy/src/api/index.ts

@@ -27,7 +27,7 @@ export interface ApiProxy {
 // ---- Domain interfaces and payload entities ----
 export type {
   HistoryEntry, ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning,
-  ModelReasoningEffort, ModelTarget, PermissionOption, SessionModels, SessionProjectionsBlock, SessionsApi, SessionSummary,
+  ModelReasoningEffort, ModelTarget, SessionModels, SessionProjectionsBlock, SessionsApi, SessionSummary,
 } from './sessions.ts'
 export type { HostApi } from './host.ts'
 export type { WorkspaceApi, WorkspaceId, WorkspaceView } from './workspace.ts'

packages/host/apiproxy/src/api/rpc-map.ts

@@ -24,8 +24,6 @@ export interface RpcMethodMap {
   'session.selectModel': SessionsApi['selectModel']
   'session.prompt': SessionsApi['prompt']
   'session.cancel': SessionsApi['cancel']
-  'session.permissions': SessionsApi['permissions']
-  'session.setPermission': SessionsApi['setPermission']
   'host.describe': HostApi['describe']
   'host.pickDirectory': HostApi['pickDirectory']
   'host.openPath': HostApi['openPath']

packages/host/apiproxy/src/api/sessions.schema.ts

@@ -11,7 +11,7 @@ import type { RequestPayload, ResponseValue } from './rpc-map.ts'
 import type { Wire } from './rpc.schema.ts'
 import type {
   HistoryEntry, ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning,
-  ModelReasoningEffort, ModelTarget, PermissionOption, SessionProjectionsBlock, SessionSummary,
+  ModelReasoningEffort, ModelTarget, SessionProjectionsBlock, SessionSummary,
 } from './sessions.ts'
 import type { ToolEventView } from './events.ts'
 import type { WorkspaceId } from './workspace.ts'
@@ -207,31 +207,3 @@ export const sessionCancelValueSchema = z.object({
   accepted: z.literal(true),
 }) satisfies z.ZodType<Wire<ResponseValue<'session.cancel'>>>
 
-/** One permission select option (a preset table key, or the derived `custom`). */
-export const permissionOptionSchema = z.object({
-  value: z.string(),
-  name: z.string(),
-  description: z.string().optional(),
-}) satisfies z.ZodType<Wire<PermissionOption>>
-
-/** session.permissions request payload. */
-export const sessionPermissionsRequestSchema = z.object({
-  sessionId: sessionIdSchema,
-}) satisfies z.ZodType<Wire<RequestPayload<'session.permissions'>>>
-
-/** session.permissions response value. */
-export const sessionPermissionsValueSchema = z.object({
-  options: z.array(permissionOptionSchema),
-  currentValue: z.string(),
-}) satisfies z.ZodType<Wire<ResponseValue<'session.permissions'>>>
-
-/** session.setPermission request payload. */
-export const sessionSetPermissionRequestSchema = z.object({
-  sessionId: sessionIdSchema,
-  value: z.string(),
-}) satisfies z.ZodType<Wire<RequestPayload<'session.setPermission'>>>
-
-/** session.setPermission response value. */
-export const sessionSetPermissionValueSchema = z.object({
-  currentValue: z.string(),
-}) satisfies z.ZodType<Wire<ResponseValue<'session.setPermission'>>>

packages/host/apiproxy/src/api/sessions.ts

@@ -145,21 +145,6 @@ export interface SessionSummary {
   cwd?: string
 }
 
-/**
- * One selectable permission preset (or the derived `custom` state) as the
- * client renders it. Protocol-owned DTO (the ACP bridge precedent: each
- * protocol owns its presentation shape); the host projects it from
- * `ctx.permission` without exposing that service's types on the wire.
- */
-export interface PermissionOption {
-  /** The machine value (`session.setPermission` vocabulary): a preset table key, or `custom`. */
-  value: string
-  /** The display label. */
-  name: string
-  /** One user-facing sentence on what the value means. */
-  description?: string
-}
-
 /** Session-domain unary methods (the map keys session.* of RpcMethodMap). */
 export interface SessionsApi {
   /** Lists persisted sessions (updatedAt descending). v1 returns everything; cursor is a reserved seat, unimplemented. */
@@ -216,23 +201,4 @@ export interface SessionsApi {
   /** Stops: clears both FIFOs + aborts the current step (1:1 with agent.cancel). */
   cancel(request: RpcRequest<{ sessionId: SessionId }>): Promise<RpcResponse<{ accepted: true }>>
 
-  /**
-   * Reads the session's permission select: every switchable preset plus the
-   * effective current value (`custom` when the knobs match no preset — shown,
-   * never a switch target). A host composed without the permission service
-   * returns empty options and `custom`; clients hide the control.
-   */
-  permissions(request: RpcRequest<{ sessionId: SessionId }>):
-  Promise<RpcResponse<{ options: PermissionOption[]; currentValue: string }>>
-
-  /**
-   * Switches the session's permission preset. Mirrors the ACP bridge's
-   * turn-anchoring: inside an open turn the knob events append immediately;
-   * idle switches are held last-write-wins and flushed into the next prompted
-   * turn (approval-policy and sandbox-mode events must stay turn-enclosed for
-   * durable replay). A current-value echo is acknowledged without recording.
-   * Unknown values and a permission-less composition are bad-request.
-   */
-  setPermission(request: RpcRequest<{ sessionId: SessionId; value: string }>):
-  Promise<RpcResponse<{ currentValue: string }>>
 }