fix: close five composition seams found in review round five

goal-session rides retry turns and survives admission failures. A
recovery policy closes a goal round's failed turn and reopens its
history under a retry trigger; the attempt now adopts that turn and
drops the failed turn's provisional reason, so the round settles from
the retry's own outcome instead of blocking an armed goal with
turn-error after a successful response. A downstream admission hook
that throws (rather than blocks) used to strand the queued reservation
forever; the listener now clears a still-turnless matching attempt on
the rejection path and reschedules the round.

agent-loop contains a persistently rejecting step close in the catch
path the same way the finally contains the turn close, so the
post-finally tail always publishes the terminal status — previously a
double veto escaped run(), leaving status at running while whenIdle()
resolved. The whenIdle catch arm is annotated as the backstop it now
is: every driver rejection path is contained today.

workspace-context folds an already-appended baseline from the session
log when the plugin is hot-remounted over a live session, instead of
injecting a duplicate from its fresh mount-local guard.

The TUI's reference-admission discard listener installs before
followup(): admission runs synchronously inside it on the common path,
so a listener installed afterwards missed its own cleanup and leaked
one callback per referenced prompt.

packages/core/agent-loop/src/agent.ts

@@ -186,8 +186,11 @@ export class ReactLoopAgent implements Agent {
 
   /** Resolve at idle quiescence: no run driving and no waking prompt waiting. */
   async whenIdle(): Promise<void> {
-    // `done` is replaced per activity, so re-reading it follows chained turns;
-    // a run failure still counts as quiescence for the waiter.
+    // `done` is replaced per activity, so re-reading it follows chained turns.
+    // Every driver failure today is contained before it can reject `done`,
+    // but the waiter must not gamble quiescence on that: a future escape
+    // still counts as settled activity.
+    /* v8 ignore next 3 -- the catch arm backstops rejection paths that are all currently contained */
     while (this.abort !== undefined || this.queued.some(item => item.wakeup)) {
       await this.done.catch(() => undefined)
     }
@@ -357,9 +360,18 @@ export class ReactLoopAgent implements Agent {
         if (!this.drainOutbox(turn)) break
       }
     } catch (caught: unknown) {
-      if (this.stepOpen) {
-        this.stepOpen = false
-        this.session.append('step/end', { turn, step })
+      try {
+        if (this.stepOpen) {
+          this.stepOpen = false
+          this.session.append('step/end', { turn, step })
+        }
+      } catch (closeError: unknown) {
+        // Contained like the finally's turn close: a persistently rejecting
+        // step boundary must not escape run(), or the post-finally tail would
+        // never publish the terminal status and observers would see a
+        // permanently running agent whose whenIdle() already resolved.
+        this.loopCtx.logger.warn(`agent "${this.id}": closing step ${turn}/${step} failed: ${errorChain(closeError)}`)
+        emitAgentEvent(this.loopCtx, this, 'agent/error', turn, step, closeError)
       }
       ({ reason, idle } = this.settle(turn, step, caught, signal))
     } finally {