Story-2842: App rail rewire — HTTP launch for all 4 builders; WS bidirectional for query/replay

Every agent run in the app used to LAUNCH over the WebSocket rail: the chat message rode the socket itself. RFD-AGT-013 (T1b) moves the launch onto the channel-neutral HTTP endpoint POST /app/agents/{agent_key} (pramaan-functions Story-2840/2895, merged as #777/#785) so the app and future channels share one guarded launch. This story rewires all four app launch builders — add-matter wizard intake, Agent Dock chat, Mira converse, Mira command — through the ONE shared rail-store path, while the already-open WebSocket stays bidirectional for streaming and query/replay.

Open the socket (as today) → launch via HTTP through the BFF → deltas and terminal frames keep arriving on the same socket exactly as before.

What changed, layer by layer

The BFF proxy (browser never talks to the gateway)

• src/app/api/internal/agents/[agentKey]/route.ts — new BFF launch route. Validates the browser payload against the generated request schema for the key (HR-21), forwards via agentGateway.launchAgent, returns the upstream AgentLaunchResponse with 202; unknown keys are a typed 404 mirroring the upstream static mapping.
• src/lib/agent/gateway.ts — launchAgent() POSTs to the gateway and parses the response against agentLaunchResponseSchema (assertContract, HR-21).
• src/lib/kubb-client.ts — toBrowserRoute maps /app/agents/{mira,atlas_intake_review,atlas_dock_chat} onto /api/internal/agents/<key>.
• openapi/app-api.json + src/gen — mirror synced to pramaan-functions main (post-#785) and regenerated per the openapi mirror guard.

Contract notes a reviewer should know

• History vocabulary differs per rail. The thread speaks counsel/atlas; the Mira HTTP contract's AgentLaunchHistoryTurn speaks counsel/mira. buildMiraConverseLaunchRequest maps every non-counsel turn to mira. Dock history keeps counsel/atlas (the HistoryMessage contract's own vocabulary).
• matter_meta is gone from the wire. The WS broker's _translate_mira_launch already discarded it server-side; the HTTP request carries only the matter UUID + the live turn.
• Mira command needs no socket-side support anymore. It was rejected over WS (pramaan.websocket.mira_command_unsupported); over HTTP it launches with intent:"command" + scope and the frame is server-derived (RFD-AGT-013 D4).
• Surface stamping is unchanged — stampSurfaceContext now stamps the HTTP body; query is still never stamped.
• Hydration stays once-per-session (Story-2223 path untouched); thread-sync / cross-channel refresh is T2m-a, out of scope.

Test evidence

pnpm vitest run src/lib/agents/__tests__/atlas-rail-store.test.ts \
  src/lib/agents/atlas-rail-store.test.ts \
  src/lib/agents/mira-rail.test.ts \
  src/lib/agents/__tests__/atlas-rail.test.ts \
  tests/unit/agent-launch-proxy.test.ts

• All four launch paths (atlas-rail-store.test.ts → "HTTP launch for all four builders"): wizard → /api/internal/agents/atlas_intake_review (formId + input); dock → /api/internal/agents/atlas_dock_chat (dockChat context); Mira converse → /api/internal/agents/mira (intent:"converse" + mapped history); Mira command → same URL (intent:"command" + scope, no message). Each asserts the socket carried NOTHING at launch.
• Launch outcomes: accepted → running with the reserved run id; deduped → adopts the existing run id; blocked (accepted:false) → immediate honest error with the server's message + retryable; failed POST → retryable transport error.
• WS query/replay unchanged: the mid-run reconnect → query replay tests, resume-on-rehydrate tests, and the Story-2181 thinking-ceiling tests all stay green against the same frame sequences.
• BFF proxy (tests/unit/agent-launch-proxy.test.ts): generated clients map all three keys onto /api/internal/agents/*; the route 202-forwards, 404s unknown keys, 400s bad JSON, 422s contract violations, and passes GatewayError statuses through.

CC-54 (refresh mid-answer loses nothing)

CC-54 is covered by the replay path, which this story deliberately does not touch: a refresh drops the socket, the store's resume(runId)/query reconnect-refetch replays the run's persisted truth (turn.completed + run.done, or run.accepted while still running), and thread hydration re-seeds committed turns from agents.chat_turn (Story-2223). The rewire changes only WHERE the launch goes; the run's truth is still persisted server-side and the same replay frames flow through the same reduceFrame. The replay tests above pin this. Manual UAT script for the human check: open a matter, ask Mira a long question, refresh mid-stream — the panel reopens, the thread hydrates, and the answer lands complete.