fix(reliability): contain collaboration awareness host failures

[seonghobae]

Current authoritative state

Protected shipped truth is exact main@a40b9489665bed7d95af619a6079b9c51cab299a; it does not contain this complete host-failure containment contract. Closed Draft #167 is historical evidence only.

Issue-specific Draft PR #403 / codex/awareness-host-containment-370 owns the repair. It is stacked on Office test-contract prerequisite #405 at exact base 378e03078a90f18c48317673344e4f1adb11ec8f; current exact head is 66a9caa7cb6a9aa5e399ce5ca76d987737aa7c45. This is active-PR behavior, not protected-main shipped truth.

Required behavior

Host-owned awareness acquisition, structural capability checks, collaborator counting, listener registration/removal, and teardown must not leak caller-controlled failures. Failed registration must roll back any partial host registration and leave the wrapper inert. Failed removal or disposal must deactivate the wrapper before returning, retain cleanup authority where retry is possible, attempt remaining detachments, and remain idempotent.

Remote awareness remains untrusted presentation data. Provider transport/lifecycle, authorization, tenancy, persistence, credentials, deployment, retention, migration, model policy, and durable audit remain host-owned.

Exact-head evidence

Current exact stacked head passes:

• focused awareness suite: 5 files / 38 tests;
• full TypeScript suite: 160 files / 890 tests;
• statement, branch, function, and line coverage: 100%;
• typecheck, build, and packed-package consumers.

Repository-local success is not protected integration, independent approval, or release proof. Keep #403 Draft until #405 integrates or the dependency is otherwise resolved, and while #118 owns the protected release boundary. Before lifecycle action, refetch exact head/base, reviews, threads, live rules, and every applicable workflow; do not transfer #167 evidence, self-approve, weaken gates, or fabricate release identity.

[seonghobae]

Writer supersession update (2026-09-05 KST): Draft #167 was closed because its deleted/stale branch had diverged 54 ahead / 29 behind and could not be reconciled without mixing unrelated awareness work or force-pushing. Draft #403 is now the sole active writer for this issue, based on protected main@a40b9489665bed7d95af619a6079b9c51cab299a at exact head 05fe734233e0c56fa4fe99d17f85d05e987ee448.

The replacement preserves the issue-specific provider capability, collaborator-count, listener registration/removal, and teardown failure-containment regressions; updates docs/TRD.md and docs/CONTRACTS.md; and passed local exact-head evidence: 5 focused files / 36 tests, full 160 files / 888 tests, typecheck, and production build. Hosted Checks and independent review remain required; predecessor evidence does not transfer.

[seonghobae]

Current sole-writer update (2026-09-05 KST): Draft #403 advanced normally to exact head f6c39ed0f29e76be5ec0a42a601ec2771b46bdce on unchanged protected base a40b9489665bed7d95af619a6079b9c51cab299a.

Current-head review found one additional issue-owned failure mode: a host on(...) implementation can register the wrapper and then throw. The prior adapter reported registration failure but lost the wrapper, allowing later provider events to invoke a rejected listener. The repair deactivates the wrapper before best-effort removal, so even a second host failure during rollback cannot reactivate the callback or expose a private thrown value.

Fresh exact-head evidence:

• awareness containment selection: 5 files / 38 tests passed;
• root suite: 160 files / 890 tests, 100% statements/branches/functions/lines;
• Office: 173 tests, 100% total coverage;
• typecheck, production builds, packed consumers, and diff checks passed.

The change remains active-PR truth only. Hosted checks and qualifying independent review are still pending, so issue closure and protected-main claims remain premature.