[wangtsiao]

Summary

Complete the Python orchestration path through the real kernel host, canonical session actors, and Native turn admission:

• rlm.collect(targets=None, timeout_ms=0): typed, retained direct-child snapshots; bounded waiting; partial results on timeout; cancellation; explicit recovery state; errors and progress; bounded answer text with a truncation flag.
• rlm.progress_note(message): child-owned, 512 UTF-16-unit notes with a 10-second throttle. No synthetic parent steering/model call.
• rlm.end_turn(): graceful completion after the current tool batch and durable tool-result checkpoint, without canceling children or making another model request.
• rlm.create_session(...): independently visible, durable roots with their own journal and no child/parent lifecycle. Uses canonical construction and Native turn admission, inheriting model/thinking and safety settings.

Update both Python documentation and model-facing prompts; remove the obsolete create_session denial and unsupported model-override guidance.

Lifecycle and safety

• Collect waits outside session actors and admission locks. Its short snapshot is admission-consistent and includes existing startup/mailbox/queued-turn tickets, preventing stale success while accepted follow-ups are in transit.
• Restore direct children without starting their work. Canonical saved recovery, waiting approvals, and lazily loaded queued work surface requires_resume; normal live queue transitions do not. Explicitly closed work does not request recovery.
• Wait subscriptions precede snapshots, results are non-consuming, and settlement requires actor merge plus runtime admission release.
• Root creation rejects child, ephemeral, Plan, and different-workspace callers before creation. Inherited safety/model field records precede the first metadata header in one locked create batch, so a partial creation cannot expose relaxed defaults.
• Preserve named model variants in initial admission and after journal hydration. Verify actual provider request options after restart, not only the displayed model.
• Report the created session ID if initial turn admission fails, rather than encouraging a duplicate root retry.

Verification

• Real CPython/host integration and lifecycle/model/interrupt regressions: 33 passed (8 new controls tests; 7 model-selection tests including a named-variant restart/request check; 18 existing lifecycle/interrupt tests).
• Host/control unit tests: 30 passed.
• Persistence-related server tests: 49 passed, 1 existing ignored.
• Core prompt tests: 6 passed.
• Python runtime suite: 83 run, 80 passed, 3 existing platform/optional skips.
• cargo clippy -p devo-server --tests -- -D warnings, cargo fmt --all -- --check, and git diff --check.

Tests use real CPython kernels, production host dispatch and session actors, with scripted offline providers (no paid inference). Combined-branch Factory diamond smoke also passed (1/1): #270 at d2a2ca8 plus this PR at 05495fc, with the Factory files temporarily overlaid. Two parallel predecessors completed; the review child's actual request contained both predecessor outputs as JSON; the joined output and idempotent stop were verified. The overlay was removed and no Factory implementation is included in this PR.

Deliberate boundaries

• Independent roots currently require the same canonical cwd and a durable Build-mode root caller. Cross-workspace creation needs an explicit authorization design.
• Progress is transient, not reconstructed as fresh after restart.
• Approval-replayed tools cannot request end_turn until normal model execution resumes.
• Collect bounds answer text to 128 Ki characters, exposes truncation, and never silently replays saved tools.

This supplies the collect contract used by the opt-in Factory workflow slice in #270. No Desktop changes or public Native schema expansion. Draft for review; do not merge automatically.