…Error detail

Replace the Effect.exit/Cause.squash wrap in KiloTextGeneration.ts:91 with a
per-tag catchTags so KiloRuntimeError, KiloTextGenerationSessionPayloadError,
and KiloTextGenerationEmptyOutputError each translate into a TextGenerationError
whose detail is derived from stable, structural attributes (operation name,
failure kind) instead of copying cause.message into the wrapper.

Cover the two new mapping branches with focused unit tests in
KiloTextGeneration.test.ts that exercise the failure paths against an
in-memory KiloRuntime test double and assert both the structural detail
and that credential/cause text never leaks into the wrapper.

…Session mutex, branch sanitization

- packages/contracts/src/model.ts: drop the bogus kilo/ prefix on the Kilo
  default model slugs in DEFAULT_MODEL_BY_PROVIDER and
  DEFAULT_GIT_TEXT_GENERATION_MODEL_BY_PROVIDER. parseKiloModelSlug expects
  two-segment provider/model, so the extra segment was being sent verbatim
  to the SDK and breaking inventory lookup.
- apps/server/src/provider/Layers/KiloAdapter.ts:
  - sendTurn: when a fresh turn's session.promptAsync rejects, emit a
    turn.completed{state:"failed"} alongside the existing rollback so
    downstream turn tracking doesn't hang on a dropped request.
  - startSession: serialize concurrent calls for the same threadId
    through a per-thread Semaphore so two overlapping startSession calls
    can't orphan their scope/server/SDK session.
- apps/server/src/textGeneration/KiloTextGeneration.ts: drop the bespoke
  sanitizeKiloBranchName in favour of the shared
  sanitizeBranchFragment from @t3tools/shared/git, matching the other
  providers so model output with illegal git ref characters is rejected
  before reaching worktree/branch creation.

Bugbot re-review flagged two issues with the prior per-thread lock:

- Racy get-then-set on the lock map could give two concurrent
  startSession calls each their own Semaphore, defeating mutual
  exclusion.
- stopSession ran unlocked, so a stop could tear down a session the
  starter was about to register as successful.

Adopt the established Cursor/Grok pattern: hold the per-thread
semaphores in a SynchronizedRef so get-or-create is atomic, and wrap
both startSession and stopSession in withThreadLock so they cannot
interleave on the same threadId.

stopSession also drops its pre-throw path and just no-ops when the
thread has no context, instead of throwing ProviderAdapterSessionNotFoundError,
since that error is no longer reachable now that we hold the same
mutex as start.

- Replace the synchronous ensureContext throw in interruptTurn,
  respondToRequest, and respondToUserInput with a typed lookupContext
  Effect that yields a ProviderAdapterSessionNotFoundError on an
  unknown thread. Callers outside the Effect runtime no longer see an
  untyped JavaScript throw, and the error flows through the typed
  channel like in the other adapters.
- When message.updated arrives for an assistant message whose role was
  unknown at the time any text/reasoning message.part.updated was
  recorded, backfill those parts through emitText so the assistant
  text is not silently dropped from the runtime event stream.
  Add a focused KiloAdapter test for the order-update-before-role
  scenario.

Bugbot flagged that emitText would silently garble or duplicate assistant
text when backfilling parts whose message role was learned late: if a
later message.part.updated snapshot was shorter than what had already been
streamed via deltas (or via an earlier incomplete snapshot), the previous
delta logic fell back to 'delta = text' (full replacement), re-emitting
the older content over the already-streamed output.

emitText now only emits a content.delta when:
  - the snapshot is a strict extension of the accumulated stream, or
  - nothing has been streamed yet for this part id.

If the snapshot is shorter than (or otherwise non-prefix-extending)
relative to , the snapshot is dropped and the
accumulator is left alone. The completion event still fires, so a
later-arriving snapshot that carries time.end can still flip the part
into the completed state.

Add a regression test that exercises the late-role + early-snapshot
sequence and verifies the duplicate prefix is not emitted.

The accumulator state was being updated even when emitText and the
message.part.delta handler suppressed synthetic snapshot-progress text,
so a suppressed progress frame could leave a phantom baseline that
caused the staleness guard to drop non-suppressed content that arrived
later. Likewise, recording suppressed progress text in the delta
handler could chain into a non-progress accumulated result that the
filter no longer matched, leaking spinner content toward the UI when
the next delta extended an unseen progress frame.

emitText and message.part.delta now only update
emittedTextByPartId when something is actually emitted to the user.
emitText's delta selection becomes:

  - text shorter than : stale snapshot — drop.
  - text extends : emit the new tail.
  - otherwise: emit full text (replacement or initial).

This keeps the accumulator aligned with what the chat UI actually
sees, so subsequent edits compute correct deltas and backfilled
message.updated events cannot garble or duplicate the
already-streamed output.