refactor(cli): route Peer Host through the assembled runtime

[limityan]

Summary

• Route CLI Peer Host session, snapshot, dialog, cancellation, and event paths through the invocation-scoped assembled runtime and existing compatibility facades instead of constructing parallel Core owners.
• Keep controller detach/submit, destructive maintenance, background-result delivery, and terminal fanout on explicit ownership boundaries with exact turn/task correlation.
• Bound Peer-owned lifecycle state and fail closed on continuity loss without changing HostInvoke, DeviceEvent, Relay, model, prompt, or tool schemas.
• Update existing architecture and CLI documentation to match the implemented ownership boundary; no standalone design-spec document is added.

Type and Areas

Type: refactor / regression hardening / tests / docs

Areas: CLI Peer Host, shared agent runtime coordination, background sub-agent delivery, existing architecture docs, Peer detach policy

Motivation and Impact

Peer Host previously assembled persistence, scheduler, event-queue, and snapshot owners beside the product runtime. That duplicated lifecycle ownership and allowed cancellation, detach, terminal delivery, and background-result handoff to diverge from the shared runtime.

Area	Before	After
Runtime ownership	Peer Host could construct parallel Core owners	One invocation-scoped assembled runtime is reused through SDK/facade boundaries
Controller lifecycle	Detach and concurrent submit could cross	Controller leases and exact turn ownership make the boundary explicit
Terminal delivery	Duplicate or late terminal events could finish reused state	Atomic terminal claims plus bounded interrupted-turn quarantine fail closed
Background results	Delivery, cancellation, and parent lineage could race	Exact task/source correlation and the existing session-operation lock serialize handoff
Capacity	Lifecycle collections had incomplete bounds	Live turns 256, background authorizations 256, interrupted IDs 256, Task cancellations 256, confirmations 512, delivery queue 512
Agent/model effect	Existing execution path	Unchanged; no prompt, model adapter, inference policy, or tool manifest change

No throughput improvement is claimed. The model execution hot path is unchanged. Added work is bounded hash-map/set lookup on Peer lifecycle events and per-session serialization only for background delivery, cancellation, and destructive maintenance.

Correctness Hardening

• Preserve ordinary caller metadata while stripping only Peer-reserved transport and exact background-lineage identifiers.
• Deduplicate terminal delivery and quarantine interrupted root, child, and follow-up IDs across stream interruption and explicit drains.
• Require an observed exact Peer turn start before session-scoped events are eligible for fanout, so a queued root cannot authorize unrelated local-session events.
• Hold background task control until the exact-turn injection is actually consumed, then acknowledge it by opaque task ID; if the turn finishes first, recover the retained result through the existing locked follow-up path, while cancellation and destructive maintenance discard it.
• Attempt every claimed background-result cancellation and return the first error only after later IDs have also been processed.
• Keep foreground Task children, completed background history, and interrupted IDs on separate bounded budgets so normal live-turn capacity does not regress.

Verification

• cargo +nightly test -p bitfun-cli — passed: 123 unit tests plus 16 CLI integration/contract tests.
• cargo +nightly test -p bitfun-cli peer_host:: -- --nocapture — passed: 50 Peer Host tests.
• cargo +nightly test -p bitfun-core --lib background_ -- --nocapture — passed: 25 targeted background lifecycle tests.
• cargo +nightly test -p bitfun-agent-runtime --test scheduler_contracts — passed: 28 scheduler contract tests.
• cargo +nightly check --workspace --exclude bitfun-desktop — passed; only existing dependency/WebDriver warnings were reported.
• node --test scripts/check-core-boundaries.test.mjs — passed.
• pnpm --dir src/web-ui run test:run — passed: 251 files / 1549 tests; no Web files changed after this run.
• pnpm run type-check:web and pnpm run lint:web — passed; lint reported 11 existing warnings and no errors.
• git diff --check gcwing/main...HEAD — passed.

The desktop-inclusive workspace check remains unavailable because this worktree does not contain the generated src/mobile-web/dist artifact. The non-desktop workspace and all affected CLI/Core paths pass.

Scope Boundary

• No new UI flow, external event type, wire protocol, configuration option, or schema.
• Relay ACK, replay, reconnect, source identity, and envelope changes remain out of scope.
• No change to model selection, prompts, agent definitions, tool manifests, or AI adapter behavior.
• Independent adversarial architecture and product reviews found no remaining P0, P1, or P2 issue after the final fixes.

Checklist

• One commit, rebased on the current upstream main.
• No secrets, temporary plans, generated scratch files, or unrelated artifacts.
• Existing docs describe the implemented boundary without adding a standalone design specification.
• Relevant validation and known environment limitation are recorded above.