Scope task actors and handoff concurrency

[wolfiesch]

Why

The current ownership scheduler is intentionally conservative, but its global barriers make independent tasks block each other. Numeric Chrome tab IDs and cosmetic tab groups also need stronger lifecycle semantics if AgentTab is going to run several unattended actors safely and efficiently.

What changes

• Adds durable task-scoped ownership with a browser-session epoch so persisted numeric tab IDs are revoked before they can bind to reused IDs after Chrome restarts.
• Treats Chrome tab groups as cosmetic; moving/ungrouping a tab is no longer an authority escape, and stale/reused group IDs are cleared instead of renaming user-only groups.
• Replaces the global ownership transition tail with sorted task/tab actor lanes so unrelated tasks progress concurrently while global reconcile remains a barrier.
• Serializes task status, grouping, grant, revoke, child adoption, and close across the exact task/tab keys they mutate.
• Adds close tombstones and a two-phase block/drain barrier so queued opens cannot recreate a closed task.
• Holds tab lanes through durable task deletion and physical tab removal, preventing cross-task adoption during close.
• Scopes Your Turn handoff to the exact task/tab; an unknown disconnect still fails closed.
• Resolves staged Commit token → tab before host scheduling so handoff, Commit, and tab mutations share same-tab ordering.
• Preserves apply-before-ack durability for handoff transitions.

Review decisions

• Ownership model: the durable ledger is authoritative; tab-group appearance is not.
• Restart policy: a reset/mismatch of chrome.storage.session intentionally revokes persisted ownership instead of guessing that reused tab IDs are safe.
• Concurrency: independent task/tab actors are allowed to overlap; reconciliation and unknown disconnects remain conservative barriers.
• Tombstones: closed task IDs remain tombstoned until the protocol gains an explicit host retirement acknowledgement. This is intentionally unbounded for correctness.
• Handoff scope: exact-tab handoff removes the current global blackout but relies on every mutation path carrying/resolving its tab identity.

Validation

• Extension: 111 tests, 620 assertions; TypeScript check and build
• Deterministic group-update/revoke, child-adoption/revoke, active-wait/close, and cross-task adopt/close races
• Rust formatting/check plus 63 host and 19 protocol tests
• Permission, identity, and forbidden-surface gates
• Exact-head independent lock/order review

Remaining review risks

• Needs a live-Chrome MV3 restart/reused-ID soak and real multi-client concurrency run.
• Storage-session reset deliberately sacrifices continuity for correct ownership.
• Staged Commit admission adds one small SQLite token-to-tab lookup.
• Unix-socket suites could not run in the managed local sandbox; hosted CI is the platform gate.

Why draft

This changes task authority, close semantics, and concurrency ordering across the extension and Core. It is implementation-complete but should be approved as an architectural choice and soaked under real multi-agent workloads.