Add the operator kill switch, stop (A4)

`stop` could not have worked by adding the command alone. Planning
turns, milestones and review responses ran synchronously on the thread
that delivered the message, so the Matrix sync loop read nothing until
the work finished. The state store was also opened on the main thread
and used from the transport and poller threads, which SQLite refuses
with its default same-thread check; the in-memory test transport never
showed it.

A single worker thread now runs every handler and owns the store:

- The worker opens the store, so the same-thread check stays on and
  fails loudly if anything touches the store from elsewhere
- Matrix messages are handed to the worker; pollers hand over and wait,
  so their cursor never passes an unhandled comment
- A message that arrives during long work gets an immediate "busy; say
  'stop' to halt" reply and is recorded, not applied later in a state
  the operator was not answering
- Tests keep running inline through InlineWorker, which defers a job
  submitted from inside another as the real worker would queue it

`stop` sets a shared Cancel flag straight from the transport's thread.
The executor and delegation loops check it before each model call and
between tool calls; the planner checks it before each turn. Calls left
unrun get a result saying so, so the transcript still renders. A
stopped delegation is discarded like a failed one. The orchestrator
moves to AWAIT_INPUT and asks why the work was stopped. The reply is
recorded for the model, and a stopped planning turn resumes with it as
the answer. `stop` with nothing running says so and changes nothing; at
a gate it is no longer taken as rejection feedback.

Closes #40

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

nisse-dev/src/nisse_dev/agent.py

@@ -12,6 +12,7 @@ from collections.abc import Callable
 from dataclasses import dataclass
 
 from nisse_dev.approvals import PlanBoard
+from nisse_dev.cancel import Cancel
 from nisse_dev.catalog import ModelCatalog, select_client
 from nisse_dev.config import AgentConfig
 from nisse_dev.control import Orchestrator
@@ -28,6 +29,12 @@ from nisse_dev.poller import CommentPoller
 from nisse_dev.publish import MilestonePublisher
 from nisse_dev.state import StateStore
 from nisse_dev.tools import Workspace
+from nisse_dev.worker import SerialWorker
+
+# How long shutdown waits for running work before leaving the store to the
+# durability layer (A2/A3). A milestone can run far longer than a service
+# manager allows for a stop, and a hard exit mid-work is already safe.
+SHUTDOWN_WAIT_S = 10.0
 
 TOOL_DRIVING_ROLES = ("planner", "executor", "delegate")
 
@@ -67,14 +74,15 @@ class Agent:
     orchestrator: Orchestrator
     gitea: GiteaClient
     account: str
+    worker: SerialWorker
     _stopped: threading.Event
 
     def start(self) -> None:
         """Boot in the order A3 requires: reconcile against external truth
         before accepting a single operator command."""
-        self.orchestrator.start()
+        self.worker.call(self.orchestrator.start)
         self.transport.start()
-        state = self.store.get_state()
+        state = self.worker.call(self.store.get_state)
         where = state.state if state else "IDLE"
         self.transport.send_message(
             f"nisse-dev up as {self.account} — project {self.config.project}, "
@@ -87,11 +95,16 @@ class Agent:
 
     def stop(self) -> None:
         """Shut down outermost-first: stop accepting work, then stop talking,
-        then close the state store last so nothing writes to a closed file."""
+        then close the state store last so nothing writes to a closed file.
+        The store belongs to the worker, so the worker closes it."""
         self.orchestrator.stop_watching()
         self.transport.close()
         self.gitea.close()
-        self.store.close()
+        try:
+            self.worker.call(self.store.close, timeout=SHUTDOWN_WAIT_S)
+        except TimeoutError:
+            pass  # still working; exiting mid-work is what A2/A3 are for
+        self.worker.stop(timeout=SHUTDOWN_WAIT_S)
         self._stopped.set()
 
 
@@ -116,7 +129,15 @@ def build_agent(
     config: AgentConfig, *, notify: Callable[[str], None] | None = None
 ) -> Agent:
     oplog = OpLog("nisse-dev")
-    store = StateStore(config.state_db, oplog=oplog)
+    worker = SerialWorker(
+        on_error=lambda exc: oplog.emit(
+            "worker.job_failed", cause="unhandled exception", error=repr(exc)
+        )
+    )
+    worker.start()
+    # Opened on the worker, which is the only thread allowed to use it.
+    store = worker.call(lambda: StateStore(config.state_db, oplog=oplog))
+    cancel = Cancel()
     # Before the clone, before the token checks: a typo'd role name should
     # cost a second, not a repository.
     catalog = discover_models(config, oplog)
@@ -148,6 +169,7 @@ def build_agent(
         git_repo,
         model=delegate_model,
         backing_model=catalog.facts(delegate_model).backing,
+        cancel=cancel,
     )
     executor = LLMExecutor(
         normalized,
@@ -157,6 +179,7 @@ def build_agent(
         expert=expert,
         delegate=delegation,
         notify=announce,
+        cancel=cancel,
     )
     publisher = MilestonePublisher(
         store,
@@ -183,7 +206,7 @@ def build_agent(
     orchestrator = Orchestrator(
         store,
         transport,
-        LLMPlanningAgent(normalized, store, config.roles),
+        LLMPlanningAgent(normalized, store, config.roles, cancel=cancel),
         operators=config.operators,
         roles=config.roles,
         executor=executor,
@@ -193,6 +216,8 @@ def build_agent(
         delegate=delegation,
         poller_factory=poller_factory,
         catalog=catalog,
+        worker=worker,
+        cancel=cancel,
     )
     return Agent(
         config=config,
@@ -201,5 +226,6 @@ def build_agent(
         orchestrator=orchestrator,
         gitea=gitea,
         account=account,
+        worker=worker,
         _stopped=threading.Event(),
     )