FE-1624: Implement split-ownership Voice conversations with Brunch - #9571

Make the mounted /agents/chat/:instanceId route the only product door for
both the typed Petrinaut panel and Voice. The typed panel gets a
host-supplied browser ChatTransport over @flue/sdk that reuses the existing
chunk projector; the server-side /api/chat door and its in-process
dispatch path are removed, and transport-aisdk is repurposed as the
browser-side adapter with ai + @flue/sdk as its only runtime dependencies.
Records the boundary inspection that rejected a Hono-level relocation.

Restate the production door as the browser Flue transport at the mounted
route, mark the Mission 8 restricted-ingress rule and /api/chat service
contract as superseded pending re-expression at the release gate, consume
the adapter-removal precondition, and point drafts 6, 7, and 10 at the
successor of the /api/chat integration scenario.

State the release note, no-engineer demo script on the local deployment
posture, and previously-impossible delta (Stop that really stops; one
shared typed/spoken conversation), pin completion to the contract stratum
rather than the first green tracer, and mark the single-route
consolidation as internal sequencing rather than the visible advance.

Name Mission 5's surface as the Petrinaut Brunch panel's typed and Voice
route and record that the live branch adopted the litmus on restack.

Now that the panel composer is itself Flue transport, let Voice enter
either through it (preferred, one visible store) or by a direct send();
reword proof leaf 3 to forbid only non-Flue submission and record the
choice and its fallback criterion on the fog-line.

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Update the living Petrinaut integration spec and topology reference to name
the guarded Flue conversation mount, browser ChatTransport projection, and
current transport-package dependency boundary. Narrow the Mission 5 route
scan claim to its actual production paths while preserving superseded
/api/chat references as historical provenance.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…n projections

Review of PR #9528 read the ten bot findings as samples of three faults.

Stop was not bound to the turn it targeted: a Stop during an in-flight
admission now waits for that admission before the conversation-wide abort, a
durable Stop result that lands after a newer turn started is ignored, and a
Voice turn whose submission settles aborted closes its Realtime call without
speaking, driven by Flue's settlement index because the AI SDK reports ready
between a step and its automatic client-tool follow-up.

The live-stream and snapshot projections encoded the same rules twice: the
snapshot keeps providerExecuted on a running server tool and folds a
client-tool continuation into the assistant message it resumed; the transport
reports the resumed assistant id and the tracker keeps the originating
submission for it; one client-tool catalog feeds the panel transport and the
history projection; host history hydrates only once it carries every locally
streamed reply.

A retained Voice input can be withdrawn through an AbortSignal, a consumer
stream cancel no longer writes to a closed controller, and first-canonical-text
latency is recorded when the first completed text block appears.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

A client-tool continuation is projected onto the assistant message it resumes,
so one message can be written by several submissions, and either side may have
admitted the continuation: the panel after a readPetrinautDoc call, or Voice
when it answers a pending brunch_ask. Keeping only the first submission served
one direction and broke the other. The tracker now records every submission
per message, segments carry that set, and the bridge matches by membership
while excluding segments that predate the answer.

The Stop generation guard also covers the rejection path, so a durable Stop
that fails after a newer turn started no longer records an error on that turn.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

…ld it

The AI SDK reports ready between a step that ended in client tool calls
and the follow-up it sends automatically. Hosts read that gap as the end
of the turn: the Voice bridge closed its Realtime call on the step's
partial text, and a Stop whose durable abort landed already-settled did
nothing while the follow-up went out anyway. The panel now keeps its
composer status busy until the follow-up starts, and a Stop pressed
during the step withholds the follow-up and marks the response stopped.

Amp-Thread-ID: https://ampcode.com/threads/T-01a07d12-9d2b-730f-a20f-b2ba85ca102f
Co-authored-by: Amp <amp@ampcode.com>

Amp-Thread-ID: https://ampcode.com/threads/T-01a07d12-9d2b-730f-a20f-b2ba85ca102f
Co-authored-by: Amp <amp@ampcode.com>