Harden generation commits, session expiry, and frontend builds

[dovvnloading]

Summary

This second bounded QA pass closes three high-confidence reliability gaps in generation lifecycle handling, session expiry recovery, and source frontend builds.

• Linearize cancellation against the first durable assistant write so a job can no longer report cancelled after persisting generation side effects.
• Unwind an active generation when its SSE session expires, clear only the matching persisted/store job, and return the app to onboarding.
• Build from an isolated frontend snapshot and record that exact snapshot's digests, preventing a concurrent source edit from making stale output appear current.
• Surface post-commit generation work as non-cancellable “Finishing response” state and guard both button and Escape-key stop paths.
• Keep the checked-in web icon self-contained in staged builds while testing it against the canonical asset for drift.

Root cause and impact

Cancellation previously remained authoritative after assistant, memory, code-proposal, or title writes. A late stop could therefore leave durable output behind while the job's terminal state claimed cancellation. The registry now exposes an atomic commit barrier: cancellation wins before it, while persistence wins after it. The canonical assistant turn is the first derived durable write; optional memory and code-proposal failures no longer invalidate an answer that already exists.

The generation stream treated HTTP 401 as a reason to stop reconnecting but did not clear the tracked job or notify the app's session boundary. That left the composer generating indefinitely and replayed the stale job after re-authentication. Both direct-stream and status-fallback 401 paths now clean matching state and expire the UI session exactly once.

The source launcher staged frontend inputs for the build, then wrote a digest from the live tree after the build. A concurrent edit could make a bundle built from snapshot A claim snapshot B's digest. Digests now come from the staged tree actually compiled. Vite no longer reaches outside that staged tree during buildStart.

Validation

• ./scripts/check.ps1 -Tier full
  • Ruff: passed
  • Backend: 514 passed, 1 platform-specific skip
  • Generated contract drift: passed
  • Python compile check: passed
  • TypeScript typecheck: passed
  • ESLint: passed
  • Frontend unit tests: 165 passed
  • Playwright browser tests: 18 passed
  • Production frontend build: passed
• Repository pre-push quick gate: passed after rebasing onto current main
• Deterministic regressions cover cancel-before/after-commit ordering, shutdown ordering, late cancellation UI, direct and fallback session-expiry paths, staged-build source mutation, and icon drift.
• Independent final diff review: no outstanding findings.

Base alignment

#123 has merged. This branch was rebased onto that exact main tree and now contains only the follow-up commit eda80ad; the rebased source tree is byte-for-byte identical to the fully tested pre-rebase tree.

Operational notes

No dependencies, migrations, or stored-data formats change. Rollback is a normal revert of the follow-up commit.