session(action='resume', {choice:'ABORT'})` does not abort the scan

What happens

Calling session(action="resume", options={"choice": "ABORT"}) records the choice and returns the scan to running. The scan does not terminate, and the same HIR re-fires.

The only thing that actually ended the scan was hitting the API directly:

POST http://localhost:7777/api/intervention/respond
Authorization: Bearer <logs/dashboard.token>
{"choice": "ABORT"}

Note

core/api_server/routes/scan_state_routes.py:153-168 already documents and fixes exactly this for the HTTP route — it explicitly consumes terminal choices because "resolve_intervention only RECORDS the choice and returns the scan to 'running' — so without this, ACCEPT_PARTIAL / ABORT just bounce the agent back into the same blockers and re-fire the HIR (the write-only-resolution loop)".

The MCP session(resume) path appears to lack the equivalent consumption step, so the fix exists on one caller but not the other.

Expected

ABORT / ACCEPT_PARTIAL / FORCE_COMPLETE / COMPLETE via the MCP tool terminate the scan the same way the HTTP route does.

Suggested fix

Factor the terminal-choice handling out of scan_state_routes.py and call it from both paths.

Start with core/api_server/routes/scan_state_routes.py:153-168 to understand how terminal choices are consumed, then locate the MCP session(action="resume") handler and compare its flow. Verify that ABORT, ACCEPT_PARTIAL, FORCE_COMPLETE, and COMPLETE through MCP terminate the scan rather than returning it to running or re-firing the HIR.