refactor(tui): delete the session store of pi-shell (plan decision 10) - #26

…n 17)

The agent now writes a session file with the first user message. Three
checks that drive the real pieces had to change with it:

- scripts/tui_pty/resume_matrix.py (zypi under a pseudo-terminal): the TUI
  makes a session at once, with no message, for `--session-id` and for
  `/new`. (A start with no flag makes none until the first message.) Two new
  cases leave such a session with no message and require that no session
  file exists. The first one comes first on purpose: under an agent that
  writes at once, its empty session is the newest one, so `--continue` and
  `--resume` with no argument take it and fail too. Two cases type a message
  and look for the file after it: `--session-id <fresh uuid>`, and `/new`
  and then a message. A case can have steps (`Step`). wait_for_run types the
  first one when the TUI is up (the model name on the border of the input
  box), and each next one when the screen shows that the one before took
  effect. The `/new` cases start with `--resume <id>`, so they do not depend
  on which session is the newest. scripts/tests/test_tui_pty.py tests the
  cases and wait_for_run with a fake terminal.
  Mutation check: with either of the two `repo.create` calls in agent.py
  made to write at once, the case for that call fails (and for the call that
  serves `--session-id`, the two cases that take the newest session fail too).
- scripts/tui_pty/smoke.py: after a restart, the /resume picker used to
  list the new empty session first and the script pressed Down to skip it.
  That session has no file now and is not listed, so the earlier session is
  the first row and the script no longer presses Down.
- python_agent_e2e.rs (the Rust ACP client against the real Python agent):
  the sessions that must be listed (51 for the paging test, the `existing`
  one for the id check) now get a first message. The id check also asserts
  what the agent does for a session that has no file yet: it refuses a
  second `session/new` with the same id (InvalidParams), and once the first
  message is sent the pager's own check finds the id through session/list.

No test is added or removed on the Rust side (the count of
python_agent_e2e stays 14).

A run of 15 one-line changes to the production code of this PR, each
against the tests that watch it, found two that no test noticed:

- The header of a deferred session took its time from a second look at
  the clock and not from the time in the file name. The test compared the
  two, but both looks fell in the same millisecond, so it passed by
  chance. It now gives every look at the clock a new time.
- The second look at a chosen id (before the first message) also refused
  a session whose own file was there. No test sent a second message in a
  session with a chosen id. A new test sends three.

After the change, both are caught. The other 13 were caught before.

…st message) and r14

- CHANGELOG.md, [Unreleased]: the agent writes the file of a session with
  its first message. It lists the behaviour changes (no flag: no session
  until the first message; `--session-id` and `/new`: a session at once,
  with no file; a chosen id stays reserved while its session is open),
  what library users get (`JsonlSessionRepo.create({"deferred": True})`),
  and the tests. The entry for the cost of paging says it is left as it is.
- The embedded user guide (17-sessions.md), packages/pi-agent-cli/AGENTS.md
  and docs/DESIGN.md section 6.1: a session in which nobody typed has no
  file, so it is not listed and cannot be loaded.
- scripts/tui_pty/README.md (16 cases) and docs/baselines/tui.md.
- The plan (r14): the status, the answers to the four questions (#23 and
  #24 merged, decision 18 not done, decision 17 done, decision 10 to do),
  and the index of section 10.
- The execution log: section 10.17 (the merges, the design of decision 17,
  what each ACP method does for a session without a file, the facts about
  the TUI, the tests, two mutation runs and the two gaps they found, the
  numbers, what is not verified), B.9 (how to repeat it) and the revision
  record. One old line (about the empty first row of the /resume picker)
  points to section 10.17.

Since ADR1 (PR 3) the pager reads no session file. The code in pi-shell
that wrote and read those files has no caller left: session::storage
(14 files) and session::persistence (12 files, 11 of them tests).

Deleted with it, because the compiler then reported it as unused (41
dead_code warnings; the ceiling is 0): the session signals, the plan
mode snapshot, the announcement state, the goal and workflow state types,
the wire tags for replay, the image checks of the load path,
fork_filter_chat, session::helpers::session_summary, and the test files
that only tested these.

Kept: the two helpers that clean a session title and that the pager uses
on purpose (sanitize_and_cap_title, is_forbidden_title_char). They move
to the new session::title, with 8 unit tests. GoalClassifierVerdict moves
to extensions::notification, and ImageCompressionInfo stays in
session::image_normalize.

tui/: 52 files, +185 / -14,165 lines (38 files deleted, 1 added). The
tests of pi-shell go from 1,056 to 864. No behaviour change. The
[storage] cleanup_ttl_days setting is still accepted; nothing reads it
now. tui_baseline.toml has the new numbers for pi-shell, and
tui-support.md is generated again.

…ROK_HOME tests

`set_consent_answer_is_monotonic_per_account` set GROK_HOME under the named key
`serial(GROK_HOME)`. `EnvGuard` has no lock of its own, and every other test that
sets GROK_HOME uses the default `serial` key, so only the consent test could run at
the same time as the tests that read GROK_HOME without a guard
(`session::worktree::tests::resolve_worktree_by_id_or_path_*`).

When the two overlapped, the worktree test opened `worktrees.db` in the temporary
home of the consent test. The consent test then deleted that home at its end, and
the open connection failed with SQLite error 1802 ("disk I/O error", a failed stat
of the database file).

An LD_PRELOAD trace of one failing run showed it: the worktree test's thread opened
`<tmp>/worktrees.db`, a thread that ran the consent test removed the directory 130 ms
later, and no `fstat` call failed. Before the fix the failure was deterministic in
the full lib run with 12 test threads; at 4 threads it did not appear.

The fix is one attribute. No production code changes.

…ed) and r15

Decision 10, storage-layer part: the plan, the execution log (section 10.18, the
pointer in appendix B.10, revision r15), the TUI baselines and the CHANGELOG now say
that `session::storage` and `session::persistence` of `pi-shell` are gone, with the
numbers (53 files under `tui/`, +190 / -14,166; `pi-shell` tests 1,056 -> 864; the sum
of `reference_passed` 8,706 -> 8,514) and what was verified and what was not.

Section 10.18 also holds the finding behind the test commit 332ba75: the consent test
used the named serial key `GROK_HOME`, so it ran at the same time as the
`session::worktree` tests and deleted the temporary home that their database lived in.
The race is older than this PR (15 of 15 filtered runs fail at c74cc18). Plan D.9
now names one source of `worktrees.db` in the real home.

`docs/baselines/tui-support.md` is regenerated (only the commit line changes).
`scripts/tui_baseline.toml`: comment only (`pi-shell` 1,056 - 201 + 9 = 864).

…execution log

The CI of 69932cf (it differs from 332ba75 by documents only) passed: `TUI CI`
8,514 passed / 0 failed / 21 ignored, `Gates + cargo check` green (graph 980,
0 warnings), `CI` (Ruff, pytest on Python 3.11, 3.12 and 3.13: 2,559 / 39 / 31).

The execution log says what this does not show: the runner has 4 vCPU and runs 4
test threads, and the race between the consent test and `session::worktree` does not
appear at 4 threads (before the fix as well). The proof of the fix is the 12-thread
runs of section 10.18.