- Concurrent-in-session-/model drift (Critical): add §2.2 post-roundtrip
  reconciliation — on roundtrip settle the bridge re-reads the agent's actual
  model and emits a corrective model_switched if divergent (in-session /model
  bypasses modelChangeQueue, so drop-when-suppressed could otherwise leave the
  bus on A while the session runs B).
- IDE-companion lockstep (Critical): add a one-release dual-emit transition
  (publish both generic session_update and promoted approval_mode_changed) and
  enumerate the upstream dispatch sites (daemonIdeConnection.ts /
  DaemonChannelBridge.ts) that drop unknown types and also need handlers.
- Specify the model_switched payload mapping (currentModelId→data.modelId,
  envelope sessionId→data.sessionId) — without it the SDK validator drops the
  promoted event and A1 is non-functional.
- Require demux observability (structured log: promoted/dropped/suppressed/
  generic) at every decision point.
- Correct the reviewer's "replay_complete doesn't exist": it shipped in merged
  #4484 (eventBus.ts:444); A5 phase 2 introduces only session_snapshot.
- First-attach no longer synthesizes replay_complete{0} (would widen that
  event's contract); session_snapshot is self-delimiting on first attach.
- Tighten capture-at-emission to a synchronous read+publish block.
- Specify the helper-generalization migration model; resolve Q3 (keep the
  extMethod bypass); add the A4 distinguishing test (done in #4539) to §8.

Squashed feature work from daemon_mode_b_main branch, rebased onto
latest main to establish proper merge-base and clean PR diff.

Original commits:
- perf(core): F2 cleanup PR A — R9/W11/W12/R10 (post-merge follow-ups) (#4411)
- refactor(acp-bridge): F1 test split — lift bridge.test.ts (6861 LOC) to acp-bridge (#4445)
- fix(core): F2 cleanup PR B — self-heal observability (W133-a + W134) (#4460)
- feat(sdk/daemon-ui): unified completeness follow-up to #4328 (#4353)
- docs(serve): v0.16-alpha known limits + SDK QWEN_SERVER_TOKEN env fallback (PR 27) (#4473)
- docs(deploy): local launch templates for v0.16-alpha (PR 30a) (#4483)
- feat(daemon+sdk): cross-client real-time sync completeness (#4484)
- feat(serve): add POST /session/:id/recap (#4504)
- feat(daemon): add voterClientId to permission_resolved (A4) (#4539)
- feat(serve): --allow-origin <pattern> CORS allowlist (T2.4 #4514) (#4527)
- feat(daemon): in-session model switch reaches the bus (A1) (#4546)
- feat(serve): prompt absolute deadline + SSE writer idle timeout (#4514 T2.9) (#4530)
- Feat/daemon react cli (#4380)

* feat(daemon): add voterClientId to permission_resolved (A4)

Resolve the originator/voter ambiguity on permission_resolved without
breaking wire or SDK consumers (design PR #4511, A4):

- Wire: the mediator now emits data.voterClientId alongside the envelope
  originatorClientId on permission_resolved (same value, the resolving
  voter). Both are omitted together for no-voter resolutions (timer expiry,
  session-closed, loopback voter with no clientId). permission_already_
  resolved is unchanged (deliberately stamps neither).
- SDK: the normalizer exposes an optional voterClientId on the
  permission.resolved typed event, reading data.voterClientId and falling
  back to the envelope originatorClientId for daemons predating the field.
  originatorClientId stays available on the base (no rename, no break).

voterClientId is the canonical, unambiguous name; originatorClientId on
permission_resolved is kept as a deprecated alias (it means the voter here,
unlike the prompt originator on permission_request).

Tests: permissionMediator emits voterClientId (+ omits both with no voter);
normalizer surfaces voterClientId from data, falls back to originatorClientId,
omits it for no-voter. acp-bridge 297, sdk daemon-ui 186 pass.

* test(daemon): cover the prompt-originator vs voter distinction (A4)

Add the distinguishing case wenshao asked for: client A submits the prompt
(permission_request.originatorClientId === A) while a different client B casts
the resolving vote (permission_resolved.voterClientId === B), and assert the
two differ — the disambiguation A4 exists to enable. The prior tests only
covered the same-client value.

---------

Co-authored-by: 秦奇 <gary.gq@alibaba-inc.com>