refactor(cli): route Peer Host through the assembled runtime - #1557

Summary

• Route CLI Peer Host session, snapshot, dialog, cancellation, and event paths through the invocation-scoped assembled runtime and existing compatibility facades instead of constructing parallel Core owners.
• Keep controller detach/submit, destructive maintenance, background-result delivery, and terminal fanout on explicit ownership boundaries with exact turn/task correlation.
• Bound Peer-owned lifecycle state and fail closed on continuity loss without changing HostInvoke, DeviceEvent, Relay, model, prompt, or tool schemas.
• Update existing architecture and CLI documentation to match the implemented ownership boundary; no standalone design-spec document is added.

Type and Areas

Type: refactor / regression hardening / tests / docs

Areas: CLI Peer Host, shared agent runtime coordination, background sub-agent delivery, existing architecture docs, Peer detach policy

Motivation and Impact

Peer Host previously assembled persistence, scheduler, event-queue, and snapshot owners beside the product runtime. That duplicated lifecycle ownership and allowed cancellation, detach, terminal delivery, and background-result handoff to diverge from the shared runtime.

No throughput improvement is claimed. The model execution hot path is unchanged. Added work is bounded hash-map/set lookup on Peer lifecycle events and per-session serialization only for background delivery, cancellation, and destructive maintenance.

Correctness Hardening

• Preserve ordinary caller metadata while stripping only Peer-reserved transport and exact background-lineage identifiers.
• Deduplicate terminal delivery and quarantine interrupted root, child, and follow-up IDs across stream interruption and explicit drains.
• Require an observed exact Peer turn start before session-scoped events are eligible for fanout, so a queued root cannot authorize unrelated local-session events.
• Hold background task control until the exact-turn injection is actually consumed, then acknowledge it by opaque task ID; if the turn finishes first, recover the retained result through the existing locked follow-up path, while cancellation and destructive maintenance discard it.
• Attempt every claimed background-result cancellation and return the first error only after later IDs have also been processed.
• Keep foreground Task children, completed background history, and interrupted IDs on separate bounded budgets so normal live-turn capacity does not regress.

Verification

• cargo +nightly test -p bitfun-cli — passed: 123 unit tests plus 16 CLI integration/contract tests.
• cargo +nightly test -p bitfun-cli peer_host:: -- --nocapture — passed: 50 Peer Host tests.
• cargo +nightly test -p bitfun-core --lib background_ -- --nocapture — passed: 25 targeted background lifecycle tests.
• cargo +nightly test -p bitfun-agent-runtime --test scheduler_contracts — passed: 28 scheduler contract tests.
• cargo +nightly check --workspace --exclude bitfun-desktop — passed; only existing dependency/WebDriver warnings were reported.
• node --test scripts/check-core-boundaries.test.mjs — passed.
• pnpm --dir src/web-ui run test:run — passed: 251 files / 1549 tests; no Web files changed after this run.
• pnpm run type-check:web and pnpm run lint:web — passed; lint reported 11 existing warnings and no errors.
• git diff --check gcwing/main...HEAD — passed.

The desktop-inclusive workspace check remains unavailable because this worktree does not contain the generated src/mobile-web/dist artifact. The non-desktop workspace and all affected CLI/Core paths pass.

Scope Boundary

• No new UI flow, external event type, wire protocol, configuration option, or schema.
• Relay ACK, replay, reconnect, source identity, and envelope changes remain out of scope.
• No change to model selection, prompts, agent definitions, tool manifests, or AI adapter behavior.
• Independent adversarial architecture and product reviews found no remaining P0, P1, or P2 issue after the final fixes.

Checklist

• One commit, rebased on the current upstream main.
• No secrets, temporary plans, generated scratch files, or unrelated artifacts.
• Existing docs describe the implemented boundary without adding a standalone design specification.
• Relevant validation and known environment limitation are recorded above.