feat(#3278): persist Claude session per (pipeline,slice,role) across event pods (re-land of orphaned #3286)

[jwbron]

Why this PR exists (re-land)

#3278 was marked done but its code never reached main. PR #3286 ("Closes #3278", MERGED) was a stacked PR whose base was egg/3279-reseed-threshold-injection, not main. #3279 (PR #3284) merged to main at 05:25; #3286 then merged at 07:32 into the already-merged #3279 branch, which was a dead branch — so #3286's commits never propagated to main. All four of #3278's new files are absent from main today, while #3279's threshold injection is present. GitHub still shows #3286 as MERGED / Closes #3278, hence the issue looked done.

This re-applies the #3278-only diff (everything #3286 added on top of the #3279 branch tip) onto current main. The #3279 content is already on main and is excluded. Sole rebase conflict was the env-var table in docs/architecture/context-discipline.md, resolved to keep main's (#3284) EGG_RESEED_THRESHOLD row alongside #3278's new EGG_SESSION_STATE_FILE / CLAUDE_CONFIG_DIR rows.

What

Make BRC warm resume (#3200) actually fire by persisting the Claude Code session per (pipeline, slice, role) across the one-shot event pods — the durable copy is orchestrator-owned and reached only over the controlled API, so the sandbox never writes host state.

claude --resume <session_id> re-enters a session by reading its local transcript ($CLAUDE_CONFIG_DIR/projects/<cwd-slug>/<session_id>.jsonl). Under the orchestrator-owned event loop (#3164) every BRC event is a fresh pod, so that transcript dies with the pod. Persisting only the session_id+occupancy pointer (the original #3276 scope) would let the gate record below_threshold "resume" decisions while every event silently cold-starts. The transcript itself has to cross pods.

Design (constraint: sandbox never writes host state)

• Live store stays ephemeral — the agent's $CLAUDE_CONFIG_DIR is the pod's own filesystem (no host mount); Claude Code writes the transcript locally during the run, unchanged.
• Durable copy is orchestrator-owned in Redis — session_state_store.py keeps one TTL'd key per (pipeline, slice, role) holding the pointer and transcript together (no split-brain; TTL reaps abandoned state). Only the orchestrator writes it.
• Round-trip over the controlled API — egg-orch session-state pull (before the agent) re-materialises the prior transcript + pointer into the pod so --resume finds a real session; egg-orch session-state push (after) ships the updated session back. Both best-effort and timeout-bounded; a failed sync degrades to a safe cold reseed.

The existing egg_agent substrate (session.py / reseed.py / __main__.py) is untouched.

Changes

• orchestrator/session_state_store.py — Redis store (TTL, size-guarded, best-effort).
• orchestrator/routes/session_state.py — GET/POST /api/v1/pipelines/<pid>/session-state (registered in api.py).
• sandbox/egg_lib/session_state_sync.py — slug + transcript/pointer file I/O (pure).
• sandbox/egg_lib/cli_session_state.py — egg-orch session-state pull|push (best-effort); verb wired in orch_cli.py.
• orchestrator/concurrent_executor.py — inject CLAUDE_CONFIG_DIR + EGG_SESSION_STATE_FILE into event pods, gated on session_resume_enabled() (default pods byte-identical).
• orchestrator/consensus_wrapper.py — pull before / push after the agent, preserving exit code; golden regenerated.
• docs/architecture/context-discipline.md — documents the cross-pod persistence layer.

Tests

The original #3278 test suite comes along (store, route, sync, CLI, env-injection gating, wrapper golden). Per request, the suite was not re-run locally in this re-land session — relying on CI.

Verification still owed in-cluster

--resume end-to-end across two real event pods (the spike confirmed file mechanics + relocation locally; the resume call itself needs in-cluster gateway/API-key auth). Also worth measuring transcript transfer cost per resumed event.

Related

• feat(#3278): persist Claude session per (pipeline,slice,role) across event pods #3286 (orphaned, merged into a dead stacked branch) — this re-lands its content.
• Compute + inject EGG_RESEED_THRESHOLD per event spawn (feed the #3200 threshold-reseed gate) #3279 / feat(#3279): compute + inject EGG_RESEED_THRESHOLD per event spawn #3284 — the per-model reseed threshold; already on main.
• BRC context discipline: protected directive root + queryable environment, bounded by a deterministic threshold reseed #3200 / Measure + monitor + tune the BRC context-discipline knobs (route-aware reseed cap/threshold) — consumes #3200 measurement surfaces #3249 / feat(#3249): emit-only per-event context-discipline measurement surfaces #3271 — the gate + measurement that verify resume fires.
• Flip event-loop ownership to the orchestrator and retire the in-pod wait arm (gated on a live BRC proving run of #3229) #3164 / #3005 — why state must cross pods / the emptyDir-wipe hazard.

Closes #3278