refactor: Phase 2 — less ceremony in the application layer

[vriesd]

Summary

Phase 2 of the runtime refactor plan (.agents/plans/13-runtime-refactor/README.md). Stacked on #89; retarget once that merges.

Four behavior-preserving commits plus one small follow-up from the final review:

• One mutate spine in flow-service.ts. planApprove, runStart, featureReset, and reviewStart share the parse → lock → load → transition → save → project sequence. The helper maps approvePlan's null value to undefined so the operation.entity field stays absent exactly as before. planSave, featureComplete, featureCompleteReplay, sessionClose, status, and requestAnchor are untouched.
• Feature-complete replay is checked only under the lock. The pre-lock repository.read() optimization is gone; the under-lock check was always the correct one. This is the one deliberate behavior change in the phase: an exact flow_feature_complete replay now acquires the session lock once where it previously did not. The response is byte-identical. featureCompleteReplay deliberately stays lock-free: it is read-only and the operation ledger is append-only, so a stale read can only fail to find a replay, never fabricate one. The MemorySessionRepository test double now serializes transact like the production file lock; the bespoke CompletionRaceRepository is deleted and two transactionCount assertions moved from N to N+1 accordingly.
• Close recovery responses collapse to one CloseState shape with two builders (closeFailure, archiveLookupFailure) and one recoveryResponse envelope. Every summary, closeState field, projection, delivery/operation presence, and recovery string was traced site by site against the old builders. The plan's brief deleted helpers that the status path still used; those were inlined.
• One sameSession helper (canonical-JSON equality) replaces one JSON.stringify comparison in session-close.ts, three digest comparisons in workspace.ts, and one in the test double. The session-close.ts site becomes key-order tolerant, which is non-manifesting: every Session producer converges on schema key order.
• Follow-up commit: drop a dead arm of the close projection union (a strict subtype of CompactProjection), rename the queued-replay test to say what it now proves.

No prompt text, guidance, Zod schema, tool name, tool response field, or Session v5 shape changes.

Test plan

• bun run check at f3494a2: 1230 pass, 1 skip, 0 fail across 81 files
• Task-scoped review of each commit (spec compliance and quality), all approved
• Whole-branch review with per-commit behavior-preservation verdicts: ready to merge, no Critical or Important findings; two minor fixes applied and re-reviewed

Deferred follow-ups (not blocking)

• closeFailure ignores durableAccepted on the non-collision path (unreachable today, gated by instanceof ArchiveCollisionError at the only false call site). Split into two functions so the type system carries the contract.
• Tighten mutate: constrain Request to { operationId: string }, drop the identical operationId callback at all four call sites and the unused request parameter of respond.
• The delivery/operation absence on unconfirmed recovery responses moved from a compile-time ?: never to one runtime assertion in tests/runtime-close.test.ts. Re-add a compile-time guard if a new close-failure path is introduced.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T06:39:30.505882Z	f3494a2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.