feat(observability): emit run and reaction baseline audit events

Diagrams reviewed: docs/architecture/AGENT_DIAGRAM.md, docs/architecture/GATEWAY_SESSIONS_AND_QUEUE.md, docs/api/PROTOCOL.md (no changes required).

src/gateway/handlers/agent.test.ts

@@ -50,6 +50,8 @@ describe('createAgentHandlers command fast-path', () => {
   const mockAuditLogger = {
     userAction: vi.fn(),
     queuePreempt: vi.fn(),
+    runState: vi.fn(),
+    runCancel: vi.fn(),
   };
 
   const handlers = createAgentHandlers({
@@ -237,6 +239,21 @@ describe('createAgentHandlers command fast-path', () => {
     await handlers['agent.send'](req, send);
 
     expect(sessionBridge.cancel).toHaveBeenCalledWith('conn-1');
+    expect(mockAuditLogger.runCancel).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'ws:conn-1',
+        source: 'gateway',
+        requested: true,
+        acknowledged: true,
+      }),
+    );
+    expect(mockAuditLogger.runState).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'ws:conn-1',
+        source: 'gateway',
+        state: 'cancel_requested',
+      }),
+    );
     expect(mockAgent.process).not.toHaveBeenCalled();
     expect(((sent[0] as GatewayEvent).data as { content: string }).content).toContain('Cancellation requested');
   });
@@ -368,6 +385,62 @@ describe('createAgentHandlers command fast-path', () => {
         sender: 'conn-1',
       }),
     );
+    expect(mockAuditLogger.runState).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'ws:conn-1',
+        source: 'gateway',
+        state: 'start',
+      }),
+    );
+    expect(mockAuditLogger.runState).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'ws:conn-1',
+        source: 'gateway',
+        state: 'complete',
+      }),
+    );
+  });
+
+  it('emits cancelled run state when agent returns cancellation text', async () => {
+    mockAgent.process.mockResolvedValueOnce('Operation cancelled by user.');
+
+    const sent: OutboundMessage[] = [];
+    const send = vi.fn((msg: OutboundMessage) => sent.push(msg));
+    const req: GatewayRequest = {
+      id: 15,
+      method: 'agent.send',
+      params: { message: 'cancel me', connectionId: 'conn-1' },
+    };
+
+    await handlers['agent.send'](req, send);
+
+    expect(mockAuditLogger.runState).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'ws:conn-1',
+        source: 'gateway',
+        state: 'cancelled',
+      }),
+    );
+    expect((sent[0] as GatewayEvent).event).toBe('done');
+  });
+
+  it('emits run.cancel telemetry for agent.cancel requests', async () => {
+    const result = await handlers['agent.cancel']({
+      id: 16,
+      method: 'agent.cancel',
+      params: { connectionId: 'conn-1' },
+    });
+
+    expect(sessionBridge.cancel).toHaveBeenCalledWith('conn-1');
+    expect(mockAuditLogger.runCancel).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'ws:conn-1',
+        source: 'gateway',
+        requested: true,
+        acknowledged: true,
+      }),
+    );
+    expect((result as { result: { cancelled: boolean } }).result.cancelled).toBe(true);
   });
 
   it('handles /queue command via fast-path and persists queue session config', async () => {