refactor(session): enforce canonical UI projection boundaries

[flazouh]

Summary

• Route queue, kanban, session item, tab, urgency, agent panel, composer, and telemetry surfaces through narrow session selectors instead of broad session hot/runtime objects.
• Quarantine remaining transcript compatibility paths behind explicit Compatibility names while keeping canonical snapshot/delta paths as product transcript truth.
• Document the GOD boundary for duplicate provider-id/order bugs: provider ids are metadata unless canonical logic promotes them, and UI renders canonical display entries only.

Verification

• cd packages/desktop && bun run check
• git diff --check
• deletion scan: no broad session hot/runtime reads in migrated UI surfaces
• deletion scan: no old generic compatibility writer names in ACP store/component/service paths
• cd packages/desktop && bun test ./src/lib/acp/store/queue/__tests__/queue-utils.test.ts ./src/lib/acp/store/__tests__/tab-bar-store.test.ts ./src/lib/acp/store/__tests__/tab-bar-utils.test.ts ./src/lib/acp/store/__tests__/urgency-tabs-store.test.ts ./src/lib/acp/store/__tests__/live-session-work.test.ts ./src/lib/acp/store/__tests__/session-store-projection-state.vitest.ts ./src/lib/acp/components/agent-input.test.ts ./src/lib/acp/store/__tests__/session-entry-store-streaming.vitest.ts ./src/lib/acp/store/services/__tests__/chunk-aggregator.test.ts ./src/lib/acp/store/services/__tests__/transcript-tool-call-buffer.test.ts ./src/lib/acp/store/__tests__/assistant-chunk-aggregation.test.ts ./src/lib/acp/store/__tests__/chunk-fragmentation-scenarios.vitest.ts ./src/lib/acp/store/__tests__/chunk-aggregation-bug.test.ts ./src/lib/acp/store/__tests__/tool-call-event-flow.test.ts
  • 329 pass, 0 fail

Notes

Rust checks were not rerun for this final slice because the committed work touched desktop TypeScript/Svelte/docs only.

---

Summary by cubic

Refactored session UI to use canonical selectors end-to-end and quarantined legacy transcript paths under explicit Compatibility APIs to prevent provider-id/order drift in rendering.

• Refactors

  • Routed queue, kanban, session item, tab bar, urgency tabs, agent panel, composer, and telemetry chip through narrow canonical selectors instead of hot/runtime objects.
  • Moved permission visibility to permission-operation-projection (operation-derived), and removed permission-visibility.ts.
  • Removed OperationStore Svelte context; UI no longer pulls the store directly. Access operation-driven state via session store helpers and projections.
  • Prefixed legacy transcript writers/aggregators with Compatibility and restricted direct entry mutations (appendCompatibilityEntry, replaceCompatibilityEntry, etc.).
  • Tightened service interfaces: canonical gates are explicit (sendability, lifecycle, transcript rev, capabilities); streaming hot-state hooks were removed.
  • Added docs: plan, best practices, and authority boundary notes for canonical UI projections.

• Migration

  • Replace hot/runtime reads with session selectors: use getSessionLifecyclePresentation, getSessionUsageTelemetry, getCanonicalSessionProjection, and related getters.
  • Replace permission helpers with permission-operation-projection:
    • visiblePermissionsForOperations, isPermissionRepresentedByOperation, shouldHidePermissionBarForExitPlanFromOperations.
  • Stop using createOperationStore/getOperationStore in UI; do not inject OperationStore via context.
  • Update entry/chunk APIs to Compatibility names:
    • preloadCompatibilityEntriesAndBuildIndex, recordCompatibilityToolCallTranscriptEntry, updateCompatibilityToolCallTranscriptEntry, aggregateCompatibilityAssistantChunk, aggregateCompatibilityUserChunk, appendCompatibilityEntry, replaceCompatibilityEntry.
  • Update tab/queue/urgency inputs to drop runtime/hot fields; derive from canonical projection and live session work selectors.
  • Implement required canonical methods in ISessionStateReader; remove calls to streaming-specific handlers.

^{Written for commit 79c0dee. Summary will update on new commits. Review in cubic}