iter-101: daemon session correctness — re-watch, concurrent clients, type-aware buffer, --since parity

[ractive]

Summary

Closes the daemon session-correctness gaps from the 2026-07 deep review. Five themes, all with deterministic unit/e2e coverage:

• A — Target-switch re-watch. handle_target_event now branches on is_top_level; a cross-process top-level switch purges the destroyed target's stale buffered resources via ResourceBuffer::purge_destroyed_target. Tab-scoped watchResources makes per-target re-watch implicit — documented (with what the watcher does/does not re-deliver) in kb/rdp/actors/watcher.md.
• B — Concurrent-client safety. The single RPC-writer slot is now claimed lazily (try_claim_rpc_slot) only when a client forwards its first Firefox-bound message; a second concurrent client gets a structured daemon_busy frame and is not forwarded, so RDP responses (no correlation IDs) can never cross-deliver. Stream-only --follow clients never touch the slot. Daemon-local responses now route to the requesting client's own connection. recv_reply_from/recv_event_from surface a from:"daemon" control-error promptly instead of hanging. The unused DemuxReader/split_demux/Packet pub API and the _demux decoy that gamed check-dead-primitives are deleted.
• C — Type-aware buffering. ResourceBuffer tracks per-type counts and evicts type-aware with a TYPE_RESERVED_FLOOR (500) so a network burst can't evict console/error entries below their floor. The floor is a soft reservation (a single type can still fill the buffer).
• D — --since parity. One-shot network --since now fails loudly with AppError::Unsupported { error_type: "since_requires_daemon" } (exit 1) instead of a silent no-op; the refusal fires before any connection opens. --since -1 parses as space-separated via allow_hyphen_values.
• E — Atomic registry + parity tests. Registry::register uses the DashMap::entry API so a concurrent invalidate_target can no longer revive a dead actor. Added e2e_error_shape_parity_daemon asserting byte-identical error_type/exit code (connection-refused) daemon vs --no-daemon.

Design decisions recorded in the plan: busy over queue for Theme B; delete the DemuxReader pub API for Theme B task 2.

Carry-over (live cross-process follow test + extended daemon error-parity scenarios) filed as kb/iterations/iteration-102-daemon-live-coverage.md.

Test plan

• cargo fmt --check clean
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo test --workspace green (1551 tests, 0 failures)
• check-iteration-ready 10/10 PASS (with FF_RDP_LIVE_TESTS=1)
• unit_registry_register_atomic_no_revive — hammer register/invalidate from two threads + observer asserting monotonic-death
• unit_buffer_eviction_per_type — 50 console msgs survive a 10× MAX_EVENTS network flood
• unit_concurrent_clients_no_cross_delivery + recv_reply_from_surfaces_daemon_busy_control_error
• top_level_switch_purges_buffer — purge only on a genuine cross-process switch
• e2e_network_since_no_daemon_explicit — exits 1 with since_requires_daemon, no results payload
• e2e_error_shape_parity_daemon — identical error shape daemon vs --no-daemon
• deferred to iter-102: live_daemon_follow_survives_cross_process_nav (Firefox-only)

🤖 Generated with Claude Code## Claims vs code
<generated 2026-07-09T11:42:40Z by ralph-loop>

• ResourceBuffer::purge_destroyed_target → ✅ matched in diff
• AppError::Unsupported → ✅ matched in diff
• Registry::register → ✅ matched in diff
• TYPE_RESERVED_FLOOR → ✅ matched in diff
• target-switch → ✅ matched in diff