refactor: bind action recording to session lifetimes

[thymikee]

Summary

Action recording now takes the admitted SessionRef, reads its latest record, and appends to that reference's exact journal address. A retired reference cannot record against a replacement session. This removes the identity scan and public-name fallback.

Selector, wait, touch, recording, tracing, performance, and app handlers use the same operation. App-event and deployment metadata use named patches, removing the final production session upserts.

Forty-six files changed. Part of #3116, stacked on #3148; addresses the remaining action-recording findings on #3141.

Validation

Validated 9902936e96: focused owner and route controls pass, including 71 restored mutation controls and 29 resource controls. Seven planted regressions fail for captured records, public journal addressing, address-only authority, late lookups, and both metadata upserts.

pnpm check:affected --base fix/capture-lifetime-review --run passes selected runnable gates and 2,152 related tests across 320 files. Quick, layering, and Fallow checks pass; Fallow excludes the inherited unused clearRuntimeHints finding. Independent review found no actionable findings.

CI and requested live-provider evidence remain pending. Fixture upserts and the ownership-gate migration follow in separate layers.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	4.96 MB	4.96 MB	+557 B
Package (unpacked)	4.96 MB	4.96 MB	+557 B
Package (download)	1.49 MB	1.49 MB	+156 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	27.2 ms	27.1 ms	-0.1 ms
CLI --help	83.6 ms	82.2 ms	-1.4 ms

[cubic-dev-ai]

All reported issues were addressed across 46 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[thymikee]

I found no blocking problem in the code at 9902936. The one Smoke Tests failure is likely unrelated: the sessionless "prepare ios-runner" step hit prepare_deadline_expired after 7m12s during xcodebuild, and this diff changes no Apple runner build or prepare file. No conflicts. Because that step failed, the iOS replays that reach the changed recording route (01-settings.ad and gesture-pan-duration.ad, under the scoped cwd:...:ios address) never ran. Please rerun Smoke Tests to green so 01-settings.ad completes under that address. That is the next step before merge. I did not run the seven planted regressions or check:affected that the PR reports. I checked regression validity only for the selector-runtime retire branch, by reading the base code.

Not blocking, and you can take or leave these: the type, gesture, fill and press routes (interaction.ts:88, interaction-gesture.ts:212, interaction-touch-fill.ts:152, interaction-touch-press-admission.ts:76) read the session by sessionName after the bind. Finalize then uses the separately bound sessionRef!. If the address is retired and republished in between, the route could act on the successor and then throw session_lifetime_ended. Should every interaction route derive its session from the bound sessionRef alone, as interaction-touch-runtime.ts:71-73 already does? I did not prove whether the per-session request locks make this window unreachable. Also, seven sites use params.sessionRef! (for example interaction-gesture.ts:242 and interaction.ts:170), and session-selector-dispatch.ts:75 calls requireCurrent only for its throw. The lifetime-ended error also does not say whether the device action already ran.

Is there a smaller design? Would a required, already-checked SessionRef on InteractionRouteInput remove the address reads and the "!" assertions together? Could snapshot-session.recordIfSession (snapshot-session.ts:41) and the selector-recording copy then go away, leaving recordSessionAction as the one entry point?

The Cubic threads on fixture session lookup (#3150 (comment)) and on late lifetime revalidation (#3150 (comment)) still apply. The P3 thread on the stale "derive and record the next" comment (#3150 (comment)) still applies as well.

[thymikee]

Consolidated into #3144 as part of reducing #3116 to seven PRs. The composition preserves the complete pre-consolidation source tree, including tests and later review corrections. This PR is superseded; its review discussion and native evidence remain available. Outstanding findings transfer to the owning keeper in the implementation record.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-10-03 21:16 UTC