refactor(apple-runner): separate command exchange from session resource ownership

[thymikee]

Separate Apple runner command exchange from session resource ownership

Deletion-first acceptance

This is part of #2803's simplify-and-shrink initiative. Before production simplification, name the production mechanism, duplicated decision, state, fallback, forwarding layer, or public/internal interface this change removes. Compare deletion and inlining against extraction. Moving the same state into another file is not a deletion case.

Every PR reports baseline/final SHAs; added, deleted and net production lines; test/fixture/documentation changes separately; and the exact mechanisms removed. Use a rename-aware diff (git diff --numstat -M BASE...HEAD) and account for all affected production paths, including destination packages. Moving tests out of production files, generated output, formatting churn, and moving code elsewhere are not production-code deletion. Preserve readable code; no compressed formatting to hit a number.

Default for simplification work: net production reduction. A required behavior-preserving size split may be line-neutral. Growth needs an explicit, quantified explanation of the correctness or type guarantee it buys, why deletion/inlining cannot achieve it, and what old mechanism is removed; it is not automatically acceptable because ownership looks cleaner. If the only benefit is relocating fields or adding a wrapper, defer the change. Required regression tests and a minimal correctness fix are allowed to grow without inventing unrelated deletion to offset them.

Priority and scope gate

Schedule after #2965 and the overlapping #2963 changes have merged. This is the required size/ownership split, not permission to add a service layer. Target net-neutral or negative production lines; remove superseded helpers, forwarding exports and duplicate input projection as part of the same scoped move. Do not invent extra deletions or change behavior merely to force a negative count. The inherited accounting regression remains mandatory.

Purpose and readiness

Child of #2803. Blocked by: #2965 merged, including its accounting-model decision and regressions. Start from the exact merged prerequisite head or a later main containing it; do not implement against an uncommitted sibling or invent settlement semantics here. Once that gate is satisfied, this is a behavior-preserving implementation task.

Audited at 1206495222385424d96b11bd9c9be25eb267455e; rechecked against 5712a3552e209c9c853bc1f42cb3e007f1213139, with no intervening changes to this TS runner scope. Re-audit the prerequisite's actual result before extracting.

packages/platform-apple/src/runner/runner-session.ts currently has 1,353 lines and answers unrelated questions: session registration/locking at line 98, adoption/build/launch at 167, retention/handoff at 591–820, and command preflight/send/response accounting at 876–1295. runner-lifecycle.ts:264 orchestrates recovery around that exchange; runner-command-recovery.ts:140 re-enters it for status. Command tests therefore inherit process/artifact scaffolding, and command-evidence changes overlap resource ownership.

Required boundary

Keep the existing session registry, keyed lock, lease coordination, state transition owner, and startup/adoption/disposal paths authoritative. Extract the cohesive command exchange into a sibling module, with its corresponding tests: readiness decisions, transport send, response decoding orchestration, diagnostics, healthy-mutation evidence, and calls into the accounting owner established by #2965.

The exchange consumes an already-owned session and an explicit attempt input containing command, timeout/deadline, cancellation, and log context. It neither looks up sessions nor launches, adopts, stops, or replaces runners. Use a small named session view for fields it actually needs, rather than forwarding the entire registry or a generic services object. For example, its entry boundary answers executeRunnerExchange(sessionView, attempt); exact names are implementation choices.

The existing lifecycle/resource owner must apply any required fatal-session invalidation at the same awaited point before exposing the result. Express that obligation explicitly in the boundary; neither a new registry nor a success-shaped result that silently skips invalidation is acceptable. Keep status recovery and prepare on the same exchange implementation. Preserve the original error object/details and response data where callers rely on them.

Do not recreate the client factory removed by #2822, add internal barrels, split into forwarding-only helpers, or unify connection retry, busy resend, pre-send restart, and post-send recovery into a generic retry mechanism. Response decoding and session-state ownership from #2662 are already implemented. Further transport-verdict redesign is outside scope.

Completion criteria

• Before: one module owns process resources and command exchange. After: runner-session.ts contains no command transport send, response-body decoding orchestration, or preflight policy; the exchange contains no registry or process/lease mutation.
• runner-session.ts falls below 1,000 lines; no new production/test file exceeds that threshold. Report before/after line counts and the moved responsibilities, without using file count as a quality claim.
• Exchange tests use the existing real HTTP fake without mocking artifact/build/lease modules. Resource-owner tests preserve ownership, generation fencing, cleanup, and handoff coverage. Move existing assertions with their owner rather than deleting them or rewriting them as implementation mirrors.
• Preserve fix(apple-runner): inline status probes must not clear outstanding command charges #2965's exact accounting transitions; command IDs, mutation single-send, preflight freshness/app matching, structured-busy bypass of status recovery, fatal invalidation, and cancellation all retain their outcomes.
• Preserve healthy handoff, physical-device eligibility, scoped simulator-set lifetime, detached log ownership, and macOS teardown. No latency or device-support improvement is claimed.

Validation

For a fresh worktree run pnpm install --frozen-lockfile && pnpm build. Read docs/agents/testing.md; run the affected dependency report before changing shared entrypoints. Run focused exchange, recovery-wiring, recovery, readiness-preflight, accounting, session-lifecycle, and disposal tests under the apple-runner Vitest project. Run repository-wide pnpm format; stage new modules before trusting layering checks; run pnpm check:affected --run on the final diff. Carry selected CI/native/device obligations forward and report unavailable evidence explicitly. An independent review must confirm one state/resource owner and unchanged #2965 outcomes.