chore(sync): integrate pinned maintenance with session retry holdback - #13

Summary

Integrates the reviewed maintenance delta through upstream a5b34b25378fbbf90ce36ee101a11528ccf11c7e onto fork main 32fad420deae7c7deebef651ee9b726bae4bc159. Refs #11. This is a bounded partial integration, not complete upstream adoption.

• Retains the fork's CI/release safeguards, provider defaults, supervised external ACP adapter, one-shot permission responses, transport-ack deadline, workspace boundary and DSH telemetry-off settings
• Resolves the V2 metadata conflict by retaining external ACP resume identity alongside upstream provider model-display metadata
• Restores explicit remote restart/desktop relaunch confirmation for the new outdated-server update path, and checks the restarted environment identity before re-enabling a connection
• Fixes the upstream POSIX mode-only Git diff fixture so disk and index agree

Explicit holdback

The ProviderSessionManager.ts release-retry changes from upstream pingdotgg#15048 (6108ef3d3d) are deferred. Its production implementation remains byte-identical to stable fork main (blob 786eb5a6bf0ae71772bc05bea685fe98be3123a5); its tests are retained at fed41fa88b, including the earlier ingestor test-layer dependency update.

The upstream timestamp cutoff can cancel a new same-ID session's pending request when timestamps tie. A proposed immutable-snapshot repair was tested and rejected because it misses old run-scoped requests persisted after the snapshot. That repair is not included. The retained baseline's pre-existing late-request cleanup limitations are not claimed fixed. The independent event publication, outbox ordering, and ownership-read fixes do not require the deferred manager changes.

Validation

Passed locally on the retained-baseline candidate:

• 387 persistence/runtime/provider/telemetry tests across 15 focused suites
• 56 V2 contract, fork provider contract and restart-confirmation tests
• 144 connection, authorization, restart identity and update-state tests
• 867 other changed-behavior tests across 24 suites, including all 113 Git VCS core tests after the fixture correction
• 214 changed adapter and legacy-import tests
• 101 fork maintenance tests
• Contracts, client-runtime, web and desktop typechecks; focused retained-manager typecheck with inherited strict server settings
• Final server bundle (cd apps/server && vp pack)
• Targeted changed-source lint (warnings only), targeted formatting and git diff --check

Representative exact focused commands:

node --test .github/scripts/opent3code-*.test.cjs
vp test run --maxWorkers=2 apps/server/src/orchestration-v2/{FoundationPersistence,ProviderSessionManager,ProviderTurnStartService,RunExecutionService,ProviderEventIngestor,runtimeLayer,ProjectionStore,ProjectionSettlement,PullRequestSyncReactor}.test.ts apps/server/src/provider/Drivers/ExternalAcpDriver.test.ts apps/server/src/provider/acp/ExternalAcpPolicy.test.ts apps/server/src/provider/{providerCompatibility,providerMaintenanceRunner,ModelManifest}.test.ts apps/server/src/telemetry/AnalyticsService.test.ts
vp test run --maxWorkers=2 packages/contracts/src/{orchestrationV2,opent3codeProviders}.test.ts apps/web/src/components/ServerUpdateAction.test.tsx
vp test run --maxWorkers=2 packages/client-runtime/src/connection/{compatibility,resolver,outdatedHostUpdate,onboarding,registry,supervisor}.test.ts packages/client-runtime/src/state/server.test.ts packages/client-runtime/src/rpc/client.test.ts
vp test run --maxWorkers=2 apps/server/src/orchestration-v2/Adapters/{ClaudeAdapterV2,OpenCode2AdapterV2}.test.ts apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.test.ts

Native ACP verification is not a local all-pass: the expanded process tests passed 139 cases and failed 3 process-observation/reaping fixtures in this sandbox. All three failures were reproduced on the identical pre-integration fork-main tree. Their production controls and tests are unchanged; fresh exact-head fork CI is required before merge. No live providers, real credentials, production databases, UI browser sessions, tags, releases or deployments were used.

The full server typecheck was killed locally with exit 137 before diagnostics on the final candidate; this is not a pass. Fresh exact-head CI subsequently passed the full typecheck, build, all three server shards, aggregate tests and PR Gate. Retained-baseline differential tests also verify that no retry cancels a new same-ID request and that a stale request without an active provider is rejected; they explicitly preserve the known late-old-request cleanup limitation.

Prepared with an OpenAI assistant in the Codex harness; the model identifier is not exposed in this workspace.

Exact-head CI receipt

CI run 37114687133 succeeded for head bd92b085a9b6006e747df6796b6176ebaab1ba67. Test merge 837541fe37f17555af3b903bc7c32cc51dcf878d has the validated tree 7f39a8d9da2783aace0006d982430513f949d014 against base 32fad420deae7c7deebef651ee9b726bae4bc159. Mobile Fingerprint Check passed. The thread-transfer report remains within every enforced ceiling.