feat(restore): persist Yolo and session expansion state

[pascalandr]

Summary

• Persist server-owned Yolo state through OpenCode session metadata so it survives workspace and CodeNomad restarts.
• Restore expanded and collapsed parent/subsession state from the desktop client snapshot.
• Serialize CodeNomad metadata mutations so Yolo and worktree metadata cannot overwrite each other.

Yolo persistence

• Stores state under metadata.codenomad.yolo with enabled and rootSessionId fields.
• Accepts a persisted marker only when it is owned by that session, preventing copied fork metadata from enabling an unrelated family.
• Hydrates the project session tree before processing permission events and queues events while hydration is pending.
• Keeps the server authoritative for family inheritance, permission replies, toggles, and cleanup.
• Uses get/merge/update writes that preserve worktreeSlug and third-party metadata.
• Serializes writes by session across CodeNomad instances and routes worktree slug updates through the same server-owned path.
• Reconciles late ancestry and repeated root migrations without re-enabling a family after a concurrent disable.

Expansion restoration

• Captures bounded, deduplicated expanded session IDs per workspace in the local desktop snapshot.
• Restores explicit expanded and collapsed state while preserving IDs that are temporarily unavailable during startup reconciliation.
• Gives live user changes, deletions, and loaded-session authority precedence over preserved state.
• Cleans expansion state when sessions or instances are removed.
• Keeps the active child visible when loading legacy snapshots that predate expansion persistence.

Validation

• 39 focused server permission and metadata tests pass.
• 66 focused client snapshot and restoration tests pass.
• Server and UI TypeScript typechecks pass.
• git diff --check passes.

Limits

• Project hydration follows the existing 10,000-session list ceiling.
• Snapshot expansion persistence is capped at 256 session IDs.

Closes #607

Depends on anomalyco/opencode#23068.

[github-actions]

PR builds are available as GitHub Actions artifacts:

https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/29663049868

Artifacts expire in 7 days.
Artifacts:

• pr-611-a1e71bb9cce49575d6a11f6f2e34c88eefd5df95-tauri-windows
• pr-611-a1e71bb9cce49575d6a11f6f2e34c88eefd5df95-tauri-macos
• pr-611-a1e71bb9cce49575d6a11f6f2e34c88eefd5df95-tauri-linux
• pr-611-a1e71bb9cce49575d6a11f6f2e34c88eefd5df95-electron-macos
• pr-611-a1e71bb9cce49575d6a11f6f2e34c88eefd5df95-tauri-macos-arm64
• pr-611-a1e71bb9cce49575d6a11f6f2e34c88eefd5df95-electron-linux
• pr-611-a1e71bb9cce49575d6a11f6f2e34c88eefd5df95-electron-windows

[pascalandr]

Gatekeeper review: PASS

Reviewed the complete origin/dev...a1e71bb9 diff: 26 files, 1 commit. This is a full-PR review, not a latest-file spot check.

Findings

No merge-blocking correctness, data-loss, security, or behavioral findings remain.

The final review covered:

• server ownership and startup hydration of persisted Yolo state;
• OpenCode metadata ownership, merge preservation, workspace scope, and serialized Yolo/worktree writes;
• concurrent toggles, persistence failures, cleanup generations, and repeated family-root migration races;
• expanded/collapsed session capture, legacy snapshots, pagination/unavailable IDs, explicit collapse authority, deletion, and instance cleanup;
• current user expansion priority at the snapshot codec boundary.

Validation

• Focused server permission/metadata suite: 39 passed.
• Focused client snapshot/restoration suite: 66 passed.
• Server TypeScript typecheck: passed.
• UI TypeScript typecheck: passed.
• git diff --check: passed.
• GitHub tests and all Linux, macOS, Windows, Electron, and Tauri build jobs: passed.
• PR reports MERGEABLE.

Accepted non-blocking limits

• Project session hydration follows the existing 10,000-session ceiling.
• Expanded-session persistence is capped at 256 IDs and the shared snapshot string budget.
• The metadata adapter has focused concurrency coverage; the HTTP worktree metadata route does not yet have a dedicated integration test.

Final decision: PASS.

[pascalandr]

@shantur LGTM