PiLoop seam: abort() + typed event stream (M1-K5a)

[akminx]

Extends the PiLoop seam so the real Pi adapter and the deferred grants §7.3
hard budget layer can be built next. Interface, test double, and oracles only —
no adapter code.

Doing this before the adapter was deliberate: the seam is the shape every later
consumer codes against, and it is cheap to change now and expensive later.

What lands

• abort(): Promise<void> — cooperative, matching Pi 0.80.10 exactly:
  in-flight tools are awaited rather than discarded, idle aborts resolve
  immediately, repeats are idempotent. The aborted run is durably finalized, so
  its turn is checkpoint-safe and the resume cursor advances; the event-log §5.2
  poisoned-cursor guard stays scoped to failed turns.
• onEvent(listener) => Unsubscribe — a 7-variant union of our own types,
  never Pi's raw AgentSessionEvent (Pi minors are breaking; the wrapper is the
  insulation). tool_start/tool_end/settled serve the §7.3 budget watcher;
  message_start/message_delta/message_end/tool_update map 1:1 onto
  surface-protocol §7's stream bridge. Every admitted variant names its
  consumer; every exclusion names its reason.
• dispose() — teardown is a distinct operation from abort, as it is in Pi.
• Abort cancels parked approvals (grants §6.1/§10.19): without this, aborting
  a session parked in awaiting_approval deadlocked — the parked dispatch
  promise never settled, so the loop never reached idle — and left
  approval.requested with no partner row.
• FakePiLoop implements all of it, and Session gains abort() so the
  seam is proven against its real consumer rather than only the double.

Spec amendment (reviewed and approved 2026-07-19)

event-log.md §3.1 gains two members. grants §6.1 mandates that session abort
produce cancelled approval rows, but decidedBy was a closed list with no tag
for that producer, and task.resumed — the only legal transition out of
waiting_for_user — reads as "the user answered" when an abort ended the wait.
decidedBy gains abort; task.resumed gains cause?: answered|cancelled.
cause is optional, so every pre-amendment row stays valid.

INVARIANTS.md gains #14 turn ≠ ambient: every Pi run is driven through
Session.runTurn/followUp, so no loop-, queue-, or steer-originated turn can
exist outside the budget gate and the audit trail.

Also in scope

• CI ran on Node 20 while core requires ≥22 (Pi needs ≥22.19) — bumped, so the
  gate actually matches the engine the sidecar runs on.
• scripts/gen-protocol.mjs now formats its emitted TypeScript, so generated
  protocol types stay fully under the lint gate instead of being excluded from
  it. Verified formatting-only: a renamed schema field still produces 36
  differing lines through the same formatter, so invariant 9 still catches real
  drift.
• specs/recon/pi-types-0.80.10.md transcribes the SDK's actual .d.ts,
  including the four fields getSessionStats() does not provide
  (model, route, compactions, retries) — the adapter must supply all
  four itself.

Oracle

336 tests (up from 317). New oracles pin: cooperative abort ordering, abort
idempotency, aborted-turn checkpoint semantics, the §10.19 cancel-on-abort
sequence, tool_end completion ordering, turn re-entry refusal, queue drain on
abort, subscription-order fan-out, throwing-subscriber isolation, token-keyed
subscriptions, and the idle-steer refusal that guards invariant 14.

Review found four defects that tests alone did not: a spec violation written
into the seam's own contract comments, a double that was safer than real Pi on
tool_end ordering, an unhandled rejection introduced by a fix, and the
idle-steer hole. Each is closed here.