fix(session): skip runtime handoffs when deriving the auto title

[SparkofSpike]

Summary

Session titles auto-generated from the conversation were showing internal runtime envelopes such as <codewhale:runtime_event kind="operate_contract" ...> instead of the real prompt. Chat-template compatibility forces runtime-owned control traffic (sub-agent handoffs and completions, the Operate contract, restore checkpoints) through role = "user", and create_saved_session_with_id_and_mode derived the title from the first role == "user" message with only a <turn_meta> prefix stripped. In Operate/automation sessions whose transcript opens with an internal envelope, the envelope text became the title (truncated to 50 chars with ...), and once such a title was persisted the snapshot priority rules kept it pinned until a manual /rename. SavedSession::import_foreign carried the same stale logic, so importing such an exported session re-derived the envelope as its title.

Changes

• fix(session): skip internal runtime handoffs during title derivation (session_manager.rs): the auto-title now comes from the first message that is both role = "user" and not is_internal_runtime_handoff(m), reusing the exact recognizer the session peek already uses (runtime_handoff.rs), so title generation and preview agree about what counts as conversation. When no real user message exists yet, the DEFAULT_SESSION_TITLE placeholder is kept and the existing snapshot healing logic promotes a real prompt title once one arrives.

• fix(session): apply the same derivation on foreign import (session_manager.rs): the logic is extracted into a shared conversation_derived_title() used by both create_saved_session_with_id_and_mode and SavedSession::import_foreign, closing the import-side copy of the bug (review follow-up).

• test(session): regression coverage (session_manager.rs tests): create_saved_session_skips_runtime_handoffs_when_deriving_title — an Operate-contract-first session titles from the real prompt that follows it; create_saved_session_with_only_runtime_traffic_keeps_placeholder_title — covers every handoff shape the peek filters (Operate contract, waiting/restored checkpoint, shell completion) and asserts the placeholder is kept; plus two import_foreign tests for the same guarantees on the import path. All fail on the old code.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Tests

Testing

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked (not run: full-workspace gate; the change is a shared title-derivation helper plus unit tests, and the crate compiles cleanly through the test build)
• cargo test -p codewhale-tui --lib create_saved_session — 3 passed (regression tests + existing turn_meta title test)
• cargo test -p codewhale-tui --lib "session_manager::" — 72 passed (incl. new import_foreign tests)
• cargo test -p codewhale-tui --lib import_foreign — 2 passed
• cargo test -p codewhale-tui --lib "import" (RUST_MIN_STACK=16MB) — 52 passed (contract import integration surface unaffected)
• cargo test -p codewhale-tui --lib "runtime_handoff::" — 14 passed
• cargo test -p codewhale-tui --lib "session_peek::" — 15 passed
• cargo test --no-fail-fast -p codewhale-tui --lib (RUST_MIN_STACK=16MB) — 11651 passed; 9 failures verified unrelated on the unmodified baseline via git stash (missing sh/bash on this Windows host, live-network Anthropic SSE test, one rendering-surface baseline, one zai-stream thread test). One additional acp_server test overflows the default Windows test-thread stack and passes with RUST_MIN_STACK=16MB — also reproduced on the unmodified baseline.

Independent review: a reviewer sub-agent returned APPROVE-WITH-NITS; its single MAJOR finding (stale duplicate logic in SavedSession::import_foreign) was fixed in the follow-up commit above, and its suggested test-coverage extension (all peek-filtered handoff shapes) was folded into the runtime-traffic regression test.

Checklist

• Updated docs or comments as needed (doc comment on the title-derivation lookup explaining why runtime handoffs are skipped and that the recognizer is shared with the session peek)
• Added or updated tests where relevant (2 regression tests, both shown failing without the fix)
• Verified TUI behavior manually if UI changes (title derivation is exercised by automatic snapshots in automation/headless flows; covered by the unit-level regression tests above)
• Harvested/co-authored credit uses a GitHub numeric noreply address (N/A — no external contributor work is landed here)

Related Issues

No-Issue: auto-generated session titles leak <codewhale:runtime_...> internal envelopes when runtime control traffic is the first user-role message (reported in-session 2026-09-08; no matching GitHub issue or PR found at report time; branch codex/fix-title-runtime-envelope, commits eeee8b9 and 14147f6).

[SparkofSpike]

Ugh, I'm so confused by this CI. It's either a Test timeout or the Smoke failing. No idea what to do, but it doesn't seem like my problem. Just gonna wait for a manual merge.