feat(kap-server): expose session deletion with serialized cleanup

[wbxl2000]

Related Issue

Resolves #3543. Replaces the deletion API portion of #3544; indexed-search visibility is handled independently in #3631, which can merge first.

Problem

The core and SDK support deleting sessions, but GUI clients have no REST delete action or deletion notification. Simply exposing the core operation leaves the broadcaster's cached transcript and event journal available, and detached journal retries can delete a newly created session that reuses the same ID.

What changed

• Add POST /api/v1/sessions/{id}:delete, its response/OpenAPI schemas, event.session.deleted fan-out, and the Kimi Inspect activity handler. Missing sessions return 40401.
• Run journal/cache cleanup inside the manager's existing per-session lifecycle serialization after closing the old session and before deleting its persisted data. Cleanup failure rejects the request while the session remains available for retry; no deletion event is emitted on that failure. There are no detached deletion timers.
• Resolve queued creation's controller when the operation actually runs, and reject pending broadcaster state creation if its session handle has disappeared or changed. Reusing an ID cannot race with the old session's cleanup within the manager.

This PR does not add a search deletion ledger or promise synchronous removal of every derived copy. Search-index visibility is handled separately. The existing core deletion operation's later persistence failures retain their existing error behavior; retryability here specifically covers journal cleanup before core deletion.

Validation

• kap-server and related session-manager/lifecycle suites: 1,344 passed, 1 pre-existing skip; after adding the pending-state regression and finalizing the fixtures, both affected server suites passed again (171 tests).
• A combined integration smoke test with fix(kap-server): verify indexed search results against session sources #3631 passed: real REST deletion, a stale read-only search worker, deleted journal removal, WebSocket notification/re-subscription, and same-ID recreation.
• Kimi Inspect activity store: 7 passed.
• TypeScript checks: kap-server, agent-core-v2, and Kimi Inspect passed.
• Root lint and comment policy passed (existing warnings, no errors).
• Deterministic regressions cover cleanup failure and retry, creation queued during close or cleanup, pending state creation, live/cold deletion, deleted journal removal, event payloads, and OpenAPI.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue (external PRs: the issue must have a maintainer's /approve).
• I have added tests that prove my feature works.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update. No CLI invocation or CLI user guide changes; the REST operation is covered by the OpenAPI projection.

[changeset-bot]

🦋 Changeset detected

Latest commit: 63000cc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@moonshot-ai/kimi-code	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[wbxl2000]

@codex review

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@moonshot-ai/kimi-code@63000cc

npx https://pkg.pr.new/@moonshot-ai/kimi-code@63000cc

commit: 63000cc

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 63000ccaf2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".