fix: make shared-state transitions unwind-safe

[danielkov]

Summary

Require invariant-driven handling of lock-protected shared state and repair existing publication, cancellation, and poison-handling failures. Failed transitions now preserve ownership or isolate uncertain state instead of publishing partial success or pretending work has completed.

Impact

Interrupted filesystem and credential-refresh operations return explicit unavailability rather than silently recovering uncertain external effects. Filesystem handle reads now share service-state exclusion, and cancelled or timed-out child forks retain serialization until the outstanding remote request settles.

Normal protocol and durable artifact formats are unchanged; global panic enforcement remains outside this change.

Technical details

Session publication and teardown

ACP v1 and v2 publication use ownership-aware unwind rollback, reject invalid admissions and duplicate identities, and isolate poisoned connection maps. Registry teardown requires positive actor completion before credential reset or reopening admission. Fork responses use privately prepared creation ownership, preserving cleanup on failed submission without a fallible commit after success.

Cancellation and callbacks

Background-job bookkeeping retains real activity and terminal debt across poison, moves notifications and cancellation effects outside guards, and rejects stale relay ownership. Activity projection claims fence abandoned execution. Child request workers retain serialization, and MCP authorization publishes its worker and pending status without an intervening suspension; live operation gates survive server deletion and re-addition.

Recovery boundaries

The mandatory shared-state skill requires all-writer invariant arguments, safe drop ordering, and failure-path coverage. Recovery is limited to audited in-memory owners; filesystem/backend and transcript uncertainty instead fence the affected owner, including subsequent writes and creation publication.

[kit-code-agent]

ACP v2 can execute an overlapping prompt instead of rejecting it as busy when configuration requests fill the command mailbox.

[kit-code-agent]

No issues found. The changes look good to merge.