feat(runtime-host): broker nested capability forms

[me2seeks]

Summary

• add strict Client Capability interaction request/result frames and expose a provider-neutral requestInteraction(form) callback after invocation admission
• route nested forms through the existing Runtime-owned form callback and exact hosted Run authority instead of creating Client Capability-owned durable state
• let a hosted Run withdraw only the exact producer-owned form when the provider fails or disconnects
• pause provider execution time only while the canonical form is pending, bound answer delivery, and rearm a fresh execution timeout after delivery

Why

#4379 establishes the durable, provider-neutral form interaction contract. Client Capability providers still need a bounded way to pause an admitted tool call, collect structured user input through the active Maka surface, and continue the same invocation.

The Runtime Host remains the only canonical Interaction authority. The Client channel owns only provider-local correlation, while the invocation broker owns the transient execution timer and ensures provider failure, cancellation, release, and connection loss close the nested form before the outer call settles.

This PR is a sibling of the Desktop adapter in #4384 and the TUI adapter in #4392. All three depend directly on #4379; none of the siblings depends on another.

Part of #4364.

Compatibility

• advance the Runtime Host compatibility epoch to 84 because older peers cannot decode the nested Client Capability request/result frames
• keep MCP/provider-specific mapping outside this protocol layer; a later adapter can translate its native interaction request into the same provider-neutral form contract

Screenshots

No visual changes. Desktop and TUI rendering are covered by the sibling surface PRs #4384 and #4392.

Test plan

• npx biome check on all changed files
• npm run build
• 131 focused Runtime and Runtime Host tests covering canonical form withdrawal, strict frame decoding, one-pending correlation, timeout pause/rearm, delivery races, provider failure, cancellation, and connection loss

Generated-by: OpenAI Codex

[Astro-Han]

PR #4397 — e07c040 — blind review sealed

Summary: Runtime Host brokering for nested capability forms (tail of #4379 stack). Exact head e07c040759c6483ac52e5bb2a6bdefbb8d4a092d frozen, stacked-base CLEAN, 0 checks/0 reviews/0 threads on stacked base. Source is approvable with comments; inherits #4379's 2×P2+1×P3. No simplify finding. Directly affected tests 141/141, Runtime 3121/7/0, Runtime Host 1501/12 (1 transient timing case isolated) all green.

Findings (reproducible production seams):

• P2 — cancellation-before-admission ghost form — if producer cancellation publishes before form admission, withdraw succeeds early (“no record”), later admission still publishes and leaves ghost pending form of a failed provider until Run close. Deferred-admission seam: expected 0 pending, actual 1. Fix: share ordered fence between admission/cancellation or re-withdraw after successful admission.
• P2 — HostClientCapabilityCoordinator.close() drops cleanup promise — new async releaseConnection()interaction-cleanup promise is discarded, only registry mutation awaited; pending form withdrawal slightly slower → broker.close() early with active invocation. Deferred-withdrawal coordinator seam: expected wait, actual early failure. Fix: collect and await all connection-release promises in coordinator close.

Gating: current-main da84f88de merge tree has only explicitly ignored epoch conflict; stacked-base CLEAN.

Automated review notice: This comment was posted by an automated review agent operated by AstroHan. It is not an independent human review and does not replace one.

---

简体中文

本条结论来自 @捣蛋鬼 在 exact head e07c040 的独立盲审，已按 @me2seeks 指示排除 compatibility epoch 冲突的计分。编排仅核对 head 未漂移与 CI 状态。

[me2seeks]

Fixed both findings across f07fe90 and eeb37b8. Producer cancellation now orders withdrawal after successful Host admission, and connection release/close waits for nested interaction cleanup, including a release that started before coordinator shutdown.

While rebasing, I also preserved main's accepted → admitted grant boundary and added a prepared-execution regression so forms are forwarded only after admission (4ac7785). Added deferred-admission and close-barrier coverage.

[me2seeks]

Rebased onto the updated parent head (cd16fd613d) in 5949e0368.

The parent now owns epoch 94 for the provider-neutral form contract, so the nested Client Capability interaction round trip advances to epoch 95; the epoch history comments are retained. A style commit reformats three nested-form files whose formatting predates the rules now on main — no semantic change.

Validation on 5949e0368: full npm run build; focused Runtime Host suites 134/134 (capability channel, coordinator, interaction broker, protocol, interaction coordinator); focused Runtime suites 253/253 (interaction authority, kernel interaction, session manager, tool runtime form/sandbox); Desktop capability tests 50/50; CLI capability provider command 3/3.

[me2seeks]

Rebased onto the updated parent head (3dd69e776, answer-envelope byte-domain fix) in 9ff82bfdb. No conflicts; the nested-form lifecycle fixes are patch-equivalent to the previously reviewed head, and the compatibility epoch remains 95 on top of the parent's 94. Validation: full build; focused Runtime Host suites 108/108; Runtime form suites 14/14.

[me2seeks]

Rebased onto the updated parent head (51bacd210, strict escaped-envelope admission) in 042d203b7.

Nested-form fixtures now declare an explicit maxLength, matching the contract admission enforces at the protocol seam: an unconstrained string form frame is rejected as an invalid Client Capability form request instead of stranding the invocation, while a bounded one publishes and settles normally (verified against the built protocol decoder). Validation: full build; Runtime Host coordinator/broker 35/35; Runtime MCP tools 9/9; biome clean.

[me2seeks]

Rebased onto the current parent head (9ec0c5f9a) in 62d04e317. The only conflict was the compatibility epoch: the nested Client Capability form round trip now owns 103 on top of the parent's 102. Validation: full build; Runtime Host focused suites 136/136; Runtime form suites 23/23; biome clean.

[M4n5ter]

Reviewed at exact commit e27d47d363584428e35e29c81afcf3f675adbf4c.

Nested Client Capability forms now join their exact admission before cancellation can withdraw them, and connection/Host shutdown waits for interaction withdrawal before closing the invocation broker. The current affected builds and lifecycle tests pass, including cancellation-before-admission and delayed-cleanup regressions, and I found no blocking correctness or design issue in this change.

---

Automated review notice: This comment was posted by an automated review agent operated by M4n5ter. It is not an independent human review and does not replace one.