Close the two finished-session races the E2E stories surfaced

[brillout]

What

The two product findings documented in #1527 (src/e2e/spec.md) are now fixes, and the stories that found them act inside the old race windows on purpose — they are the regression tests.

1. Acting on a session the moment it flips done no longer races teardown

The child writes status: done and exits; the daemon's teardown then archives the history, commits the bookkeeping to the run branch, and retires the worktree. A Push / Open-PR / Remove / Delete / Resume fired inside that window ran its own git against the same checkout: the loser reported "could not commit the work this session left uncommitted", and a teardown that lost stranded a worktree it should have removed.

Fix: every mutator of one run's checkout serializes on a per-run lock (src/run-locks.ts, keyed by resolved checkout path):

• tearDownWorktree and continueWorkspace (daemon-runtime),
• the commit step of sendPushBranch / sendOpenPullRequest,
• sendRemoveWorktree / sendDeleteSession.

Both actors live in the daemon process by design (RPCs are served in-process; only the daemon writes to the project checkout), so an in-process lock is the whole fix. Whichever side wins commits the entire pending state (add -A); the other finds a clean tree — or no checkout, which commitSessionWork already reads as "the branch is authoritative".

2. The live event feed follows the journal into the archive

Teardown copies events.jsonl verbatim into the archive and removes the worktree. When fs.watch missed the final appends, the 1s poll found the file gone and the tail never delivered anything again — including the end the transcript needs.

Fix: tailRunEvents (events-tail.ts) re-resolves the journal's home when the tailed file disappears after having existed, and retargets the same tailer, carrying its read offset — the copy is content-identical, so exactly the missed lines arrive, once, with no replay. Details that matter:

• JsonlTailer.retarget adopts the new home's mtime on its first pull, so the The dashboard's event tail silently drops a same-length rewrite #567 same-length-rewrite check can't misread the move as a truncation and replay the whole feed;
• onEvents refuses to relocate onto the project-root journal (after a Delete that's all the resolver has left, and it is another run's feed, Run-scoped events subscribe for an ended run tails the project ROOT journal #1472) while keeping the permissive initial attach a non-git fallback run needs;
• wired into the dashboard's onEvents, the device relay tail (tailRelayEvents), and the E2E harness — which drops its private archive-swap workaround for the product seam.

Test changes

• The publish story now clicks Push the instant the row flips done and asserts the push succeeds and teardown still retires the worktree; the resume story fires its continuation at done the same way.
• The harness's close() drains in-flight teardowns by acquiring each run's lock before deleting fixture repos — the stranded-worktree noise in stress runs turned out to be the harness deleting repos under mid-flight teardowns, not a product fault.
• New unit tests: 4 for withRunLock (ordering, isolation, failure hygiene, key normalization), 3 for tailRunEvents (missed lines exactly once across the move; no replay of a fully-consumed journal; idling while the resolver has no better answer).

Verification

• Full suite: 1713 tests, 0 failures (7 new).
• Stress: lifecycle story file 15×, each other story file 6× — all green with zero "keeping worktree" warnings (previously 1–2 per run).
• Raw-git probe confirmed sibling-worktree commits don't contend on their own — the serialization is only needed against teardown, which is exactly what the lock scopes.
• dist/ ships run-locks.js; src/e2e stays excluded from the publish build. Changeset included (patch).

---

Generated by Claude Code