Add controlled-session lifecycle state machine

docs/CONTROLLED_SESSION_DESIGN.md

@@ -464,7 +464,16 @@ cleanup and no canceled request is replayed.
 Host Reploy emits the authoritative lease lifecycle result:
 
 - `terminated(cause, workload_status, workload_output_finalization_status,
-  controller_finalization_status, cleanup_status, recovery_action)`.
+  runtime_observation_status, controller_finalization_status, cleanup_status,
+  recovery_action)`.
+
+`runtime_observation_status` is `maintained` only when Host Reploy retained
+authoritative runtime observation through terminal-result creation. It is
+`lost` when observation failed at any earlier point, including after workload
+outputs were finalized or the controller completed. This independent monotonic
+fact prevents a late observation failure from being hidden by an earlier
+termination cause or otherwise successful statuses. A `lost` status always
+makes the session invalid, regardless of every other terminal field.
 
 `controller_finalization_status` reports the controller protocol outcome:
 `completed`, `lost`, `finalization-timeout`, `not-completed`, or
@@ -1003,14 +1012,18 @@ The first accepted termination cause is latched and never rewritten. Causes
 include controller-requested termination, workload exit, host cancellation,
 controller loss, Docker-observation loss, and startup failure. Later events
 remain diagnostic observations. Workload status, workload-output-finalization
-status, controller finalization status, and pre-delivery cleanup success are
-reported separately in the session result, so a cleanup failure can fail the
-operation without hiding its original cause. Controller exit and delivery-tail
-cleanup are reported separately by the invoking host operation after teardown.
-
-Channel closure is never successful completion. The controller must explicitly
-send `complete` after receiving `workload_outputs_finalized` and finalizing its
-client-owned results; for OmegaFlow these include the recording artifacts.
+status, runtime-observation status, controller finalization status, and
+pre-delivery cleanup success are reported separately in the session result, so
+a late observation or cleanup failure can fail the operation without hiding
+its original cause. Controller exit and delivery-tail cleanup are reported
+separately by the invoking host operation after teardown.
+
+Channel closure is never successful completion. A controller granted the
+`complete` operation must explicitly send `complete` after receiving
+`workload_outputs_finalized` and finalizing its client-owned results; for
+OmegaFlow these include the recording artifacts. Host Reploy does not open a
+controller-finalization wait when `complete` was not granted and records that
+controller as `not-completed` in the terminal result.
 Repeated terminate or host cancel operations are idempotent. Input and resize
 are rejected after `terminating` begins. A single `complete` remains valid
 during termination while Host Reploy is waiting for controller finalization. A
@@ -1028,16 +1041,19 @@ Normal completion is:
 5. Host Reploy drains and closes every declared workload-output surface under
    the finite output-finalization deadline, then emits the one ordered
    `workload_outputs_finalized` outcome.
-6. Host Reploy gives the live controller a bounded finalization period in which
-   to close its client-owned output and send `complete`. A failed output outcome
-   remains a session failure even when partial client artifacts are finalized.
+6. When the live controller was granted `complete`, Host Reploy gives it a
+   bounded finalization period in which to close its client-owned output and
+   send `complete`. Without that grant, Host Reploy skips the wait and records
+   `not-completed`. A failed output outcome remains a session failure even when
+   partial client artifacts are finalized.
 7. Host Reploy removes the workload container, temporary mounts, networks, and
    every other lease resource not required to deliver the final result. It
    keeps the controller and private session channel alive.
 8. Host Reploy records the original cause, workload status,
-   workload-output-finalization status, controller-finalization status, and
-   pre-delivery cleanup result, then emits the one authoritative `terminated`
-   event. Only successful event delivery arms the acknowledgement wait.
+   workload-output-finalization status, runtime-observation status,
+   controller-finalization status, and pre-delivery cleanup result, then emits
+   the one authoritative `terminated` event. Only successful event delivery
+   arms the acknowledgement wait.
 9. Host Reploy waits for a bounded `acknowledge_terminated` response. Channel
    closure is not an acknowledgement. Timeout or disconnect does not block
    teardown.