docs(server): a rejected apply reports what the provider moved after the call ends

docs/providers.md

@@ -45,7 +45,9 @@ or without a control.
   reject. It returns the options it ended up with when they differ from the request. The daemon
   stores the patch and that result in one step after the call resolves, onto the agent's options
   as they are at that moment, so the last write wins. Throwing rejects the whole patch and
-  nothing is stored. Emit nothing from inside the call.
+  none of it is stored. Emit nothing from inside the call. If the provider's own state moved
+  before it refused, it reports the moved values once as `options_changed` after the call has
+  ended, because the stored options must match what runs.
 - **Provider-initiated changes.** A setting the provider changes on its own is an
   `options_changed` event. The daemon stores and forwards it and does not push the old value back.
 

packages/server/src/server/agent/agent-sdk-types.ts

@@ -735,7 +735,9 @@ export interface AgentSession {
    * value; the daemon stores the patch only when this resolves, so the call is all-or-nothing.
    * Emit nothing from here. Return the options the session ended up with when they differ from
    * the request (a patch, `null` removes a key), for example a value it kept because it could not
-   * be reverted; the daemon stores it together with the patch.
+   * be reverted; the daemon stores it together with the patch. When a throw leaves the session's
+   * state moved anyway, report the moved values once as `options_changed` after the call has
+   * ended, so the stored options still match what runs.
    */
   applyOptions?(options: ProviderOptions): Promise<Record<string, unknown> | void>;
   revertConversation?(input: { messageId: string }): Promise<void>;