fix(session): contain post-commit observers

packages/ui/user-approval/README.md

@@ -2,7 +2,7 @@
 
 User-approval seam. Owns the `ctx.approval` service ([`ApprovalService`](src/index.ts)) and the one-shot permission vocabulary the harness shares: `ApprovalRequest` (agent + tool identity + reason + abort signal), the closed `ApprovalOutcome` union (`allowed-once` / `rejected` / `cancelled` / `unavailable`), the `ApprovalRequestId` brand pairing the two log-only audit events (`approval/asked` / `approval/decided`), and the `approval/request` waterfall the answerers listen on. It lives in the UI group because its purpose is human permission, while remaining channel-neutral: it depends only on Cordis and core vocabulary packages, never on a concrete UI.
 
-The contract in one line: `ctx.approval.request(req)` puts exactly one question — "may this specific action proceed?" — to whatever answerers the deployment composed, and its decision phase always resolves to an outcome: an aborted signal yields `cancelled`, a throwing or missing answerer yields `unavailable`, and `allowed-once` is a grant for the single asked-about action, never a class of future ones. Acceptance is synchronous: the service reads the request fields and `agent.session` binding once, requires object agent/session identities, a string `toolName`, optional string `callId`/`reason`, and an AbortSignal-shaped live capability, then shallow-freezes a detached request record while preserving the exact `agent` and signal identities. A malformed request rejects before any audit append; later caller mutation cannot redirect scope, payload, cancellation, policy lookup, or either audit event. The other precondition is an open turn on the captured session — the audit pair is turn-enclosed by contract (the turn is the durable log's commit/replay boundary; a bare event between turns is crash-tail garbage on reload), so an idle ask also rejects before appending. Session observers run after an event enters the append-only log; if one throws, the service recognizes that the audit is already authoritative, contains the observer failure, and completes the pair.
+The contract in one line: `ctx.approval.request(req)` puts exactly one question — "may this specific action proceed?" — to whatever answerers the deployment composed, and its answerer phase always produces an outcome: an aborted signal yields `cancelled`, a throwing or missing answerer yields `unavailable`, and `allowed-once` is a grant for the single asked-about action, never a class of future ones. Acceptance is synchronous: the service reads the request fields and `agent.session` binding once, requires object agent/session identities, a string `toolName`, optional string `callId`/`reason`, and an AbortSignal-shaped live capability, then shallow-freezes a detached request record while preserving the exact `agent` and signal identities. A malformed request rejects before any audit append; later caller mutation cannot redirect scope, payload, cancellation, policy lookup, or either audit event. The other precondition is an open turn on the captured session — the audit pair is turn-enclosed by contract (the turn is the durable log's commit/replay boundary; a bare event between turns is crash-tail garbage on reload), so an idle ask also rejects before appending. Either audit append may reject before commit because returning an unlogged decision would violate the pair. Session contains post-commit observer failures, so an authoritative audit append cannot reject the request or suppress its matching event.
 
 The service is the mechanism, answerers are the policy. Answerers are `approval/request` waterfall listeners occupying a single decision slot: answer for an agent you own by returning an outcome without calling `next()`, or delegate an agent you don't recognize by calling `next()` — the chain's built-in default is `unavailable`, so a deployment with no answerer (headless, CI) fails closed with zero configuration. Dispatch is keyed by `req.agent`: a listener registered through `agent.ctx` receives only that agent's questions, while a plain-context listener receives every agent's. Registration order across sibling plugins is not load-order deterministic; compose one terminal answerer per deployment and use `prepend` listeners only for decide-or-delegate gates.
 

packages/ui/user-approval/src/index.ts

@@ -383,20 +383,23 @@ export class ApprovalService extends Service {
    * contract (the turn is the log's commit/replay boundary; an idle append
    * would be dropped as crash tail on reload) — and likewise throws before
    * appending anything when called idle; asking outside a turn is a deferred
-   * design. Once accepted it always resolves to an outcome, never rejects: an
-   * aborted signal yields `'cancelled'`, a missing or throwing answerer yields
-   * `'unavailable'` (fail closed), and a rogue non-vocabulary return value is
-   * normalized to `'unavailable'`. The caller-owned request is synchronously
+   * design. The answerer phase always produces an outcome: an aborted signal
+   * yields `'cancelled'`, a missing or throwing answerer yields `'unavailable'`
+   * (fail closed), and a rogue non-vocabulary return value is normalized to
+   * `'unavailable'`. A failure that prevents either audit append from committing
+   * still rejects; returning an unlogged decision would violate the audit pair.
+   * The caller-owned request is synchronously
    * snapshotted, so later mutation cannot split routing, dispatch payload,
    * cancellation, policy lookup, or the audit pair across agents/sessions.
    * Appends the
    * `approval/asked`/`approval/decided` audit pair (log-only) around the
-   * decision regardless of outcome. A synchronous session observer failure
-   * after an audit event entered the append-only log is contained; the event
-   * is already authoritative, so the pair still completes and the request
-   * still resolves.
+   * decision regardless of outcome. Session contains each post-commit observer
+   * failure, so an already authoritative audit event cannot make this request
+   * reject or suppress its matching event.
    * @param req - the pending decision (agent, tool identity, reason, signal).
    * @returns the closed outcome; `'allowed-once'` is the only grant.
+   * @throws when request acceptance fails, no turn is open, or either audit
+   *   event fails before the session append commit point.
    */
   async request(req: ApprovalRequest): Promise<ApprovalOutcome> {
     // Accept one immutable request shape before the first async boundary. The
@@ -476,47 +479,17 @@ export class ApprovalService extends Service {
       )
     }
     const id = ApprovalRequestId(randomUUID())
-    this.appendAudit(session, 'approval/asked', id, () => {
-      Reflect.apply(append, session, ['approval/asked', {
-        id,
-        toolName: accepted.toolName,
-        ...accepted.callId !== undefined ? { callId: accepted.callId } : {},
-        ...accepted.reason !== undefined ? { reason: accepted.reason } : {},
-      }])
-    })
+    Reflect.apply(append, session, ['approval/asked', {
+      id,
+      toolName: accepted.toolName,
+      ...accepted.callId !== undefined ? { callId: accepted.callId } : {},
+      ...accepted.reason !== undefined ? { reason: accepted.reason } : {},
+    }])
     const outcome = await this.decide(accepted, session, acceptedSignal)
-    this.appendAudit(session, 'approval/decided', id, () => {
-      Reflect.apply(append, session, ['approval/decided', { id, outcome }])
-    })
+    Reflect.apply(append, session, ['approval/decided', { id, outcome }])
     return outcome
   }
 
-  /**
-   * Append one audit event while distinguishing a post-append observer throw
-   * from a failure that prevented the event entering the log. `Session.append`
-   * pushes first and then notifies synchronously, so log growth proves the
-   * event is already authoritative; that observer failure is reported and
-   * contained so it cannot reject the approval or suppress its matching event.
-   * @param session - the captured session receiving both audit events.
-   * @param type - the audit event currently being appended.
-   * @param id - the request id, used to identify the contained failure.
-   * @param append - the single concrete `Session.append` call.
-   */
-  private appendAudit(
-    session: Session,
-    type: 'approval/asked' | 'approval/decided',
-    id: ApprovalRequestId,
-    append: () => void,
-  ): void {
-    const length = session.events.length
-    try {
-      append()
-    } catch (error) {
-      if (session.events.length === length) throw error
-      this.ctx.logger.warn(`approval request "${id}": ${type} observer threw after the event was appended`)
-    }
-  }
-
   /**
    * The session's effective policy: its own `approval/policy` fold, else the
    * configured default (the schema already defaulted an omitted policy to

packages/ui/user-approval/tests/approval.spec.ts

@@ -323,7 +323,7 @@ describe('ApprovalService.request', () => {
     const decided = session.events.find((event): event is SessionEvent<'approval/decided'> => event.type === 'approval/decided')
     expect(audit.map(event => event.type)).toEqual(['approval/asked', 'approval/decided'])
     expect(decided?.data.id).toBe(asked?.data.id)
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('approval/asked observer threw'))
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('session/event listener threw: Error: observer failed after asked append'))
   })
 
   it('contains an approval/decided observer throw after append and still resolves', async () => {
@@ -346,10 +346,10 @@ describe('ApprovalService.request', () => {
     const decided = session.events.find((event): event is SessionEvent<'approval/decided'> => event.type === 'approval/decided')
     expect(audit.map(event => event.type)).toEqual(['approval/asked', 'approval/decided'])
     expect(decided?.data).toMatchObject({ id: asked?.data.id, outcome: 'rejected' })
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('approval/decided observer threw'))
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('session/event listener threw: Error: observer failed after decided append'))
   })
 
-  it('does not misclassify a pre-append failure as an observer failure', async () => {
+  it('propagates an append failure that prevented audit log growth', async () => {
     const ctx = await mounted()
     const failure = new Error('append failed before log growth')
     const agent = {