[benbrandt]

Summary

Follow up #711 with a publication fence for closed sessions on ACP v1 and v2.

• Suppress late session updates and reject new session interactions after teardown, including registered child views and direct v2 state/replay paths. Ordinary request responses are not filtered.
• Preserve an inserted prompt's successful response even if it follows the close response, while sending the final idle/cancelled state before close responds.
• Track URL elicitation scope in shared client delivery. Suppress completions for closed-session, declined, duplicate and unknown flows, including after the same session ID resumes. Request-scoped login completion remains independent of session close.
• Discard queued publication from disposed v2 foreground states and prevent late closed-state calls from recreating state that could contaminate a later resume.
• Reopen root delivery when session state is installed and child delivery after a fresh announcement.
• Preserve AIR archive's final metadata update inside the existing outer close fence. The operation finishes its required update before publication closes, rather than adding an exception to the post-close rule.
• Do not infer session scope from arbitrary custom-extension payloads.

Validation

• npm run typecheck — passed, including examples.
• npm test — 2,293 passed, 39 skipped.
• npm run test:integration — all 19 passed across 8 files.
• npm run build and git diff --check — passed.
• Final focused delivery/foreground/wire regression run — 27 passed.
• Real Codex smoke: npm run codex-test -- -p "Reply with exactly OK. Do not use tools or modify any files." -o summary — completed with end_turn.
• Opt-in E2E suite was not run.

Wire regression coverage includes v1/v2, standard and AIR child views, close/delete, resume, direct v2 sends, URL completion, and a deliberately delayed inserted-prompt response. Existing notification-order snapshots are unchanged.

Remaining follow-ups

Resume snapshots and metadata resynchronization, setup-response ordering, configuration publication, subagent directories, and authentication/MCP delegation remain separate changes. Active-resume environment replacement still needs the protocol decision about in-flight operations using removed roots or MCP servers. No internal review document is included.