stage-346: 10-PR contributor batch — stale-stream guard extension + guarded worktree remove + CSP report collector + perf + i18n + ctl fix

[nesquena-hermes]

stage-346 — 10-PR contributor batch (v0.51.53)

Nathan's "no high-risk merges today" directive: 10 low/medium-low-risk PRs ship; 6 deferred to tomorrow; 10 still on hold.

Composition

PR	Author	LOC	Closes	Surface
#2158	franksong2702	43	#2154	api/streaming.py — stale-stream guard extension (closes my Opus follow-up issue from yesterday)
#2156	franksong2702	710	refs #2057	Guarded POST /api/session/worktree/remove with 5 fail-closed checks
#2159	franksong2702	135	#2157	Clear stale active_stream_id on /api/sessions
#2160	franksong2702	200	#2095	CSP report collector endpoint + Report-To header
#2161	franksong2702	160	#2098	Localize 5 Logs severity keys for 8 locales
#2166	franksong2702	127	—	Consolidate session post-render into single pass (perf)
#2170	franksong2702	119	—	Skip CLI metadata lookup for native session loads (perf)
#2173	franksong2702	20	#2172	ctl.sh: recognize wrapper-launched daemons via persisted PYTHON_EXE
#2175	Michaelyklam	31	refs #2155	Soften "X segments" → "X prior turn(s)" English copy
#2176	MrFant	3	—	Handle dict model entries in _apply_provider_prefix

Total: +1567 / -150 across 29 files + 1 stage-346 maintainer-fix commit.

Stage-346 maintainer fix

• server.py CSP-report auth carve-out scoped to POST only — Opus SHOULD-FIX defense-in-depth. PR Add CSP report collector endpoint #2160's carve-out (parsed.path != "/api/csp-report" and not check_auth) bypassed auth for all write methods on that path. Currently harmless (PATCH/DELETE fall through to CSRF 403 or routing 404), but scoping the bypass to POST is a one-line clarity win. 6-test CSP suite still passes.

What's deferred to tomorrow

PR	LOC	Why defer
#2149	464	CLI session-scan cache invalidation — high-risk.
#2151	599	CONFLICTING with #2158. Needs rebase after master settles.
#2167	381	Security-critical api/auth.py rewrite (PBKDF2 caching + key separation + Secure cookie + rate-limit locking) with a documented breaking change for settings.json.password_hash users. Needs explicit maintainer policy decision.
#2164	35	CI 3.11+3.13 FAILED (real test failures, not master drift).
#2171	230	CI 3.13 FAILED on test_ctl_script.py that #2173 fixes — after #2173 lands, contributor can rebase.
#2174	37	Behavior-policy change (show_cli_sessions default flip + auto-import). Needs explicit OK.

Verification

• Full pytest: 5332 passed, 11 skipped, 1 xfailed, 2 xpassed in 99s (was 5307 — +25 net new tests)
• run-browser-tests.sh: 20/20 QA + 11/11 API checks PASSED
• Live UI smoke test on 8789 (fresh isolated env, zero JS errors):
  • CSP report endpoint: POST /api/csp-report returns 204 ✓; Report-To header advertised ✓; report-uri /api/csp-report in CSP header ✓
  • Worktree remove: 400 on missing session_id ✓; 154 i18n entries for worktree-remove keys across all locales ✓
  • Lineage badge: ${n} prior turn${n === 1 ? '' : 's'} template visible ✓
  • 30 occurrences of logs_severity_* localized values ✓
  • postProcessRenderedMessages in ui.js (3 refs) ✓
  • /api/models returns 200 with dict-shaped entries ✓
• python -m py_compile clean on all modified .py files
• node --check clean on all modified .js files
• Merge-conflict markers: zero in any modified file
• Opus advisor: SHIP. Three nits, one applied inline (CSP carve-out scoping). Two deferred to follow-up issues (per-IP key growth in CSP rate-limit dict; worktree-remove race window documented as known limitation for any future UI force toggle).

Stats

30 files changed, 1580 insertions(+), 151 deletions(-)

Closes

• Closes #2154 (via Fix stale stream exception writeback guards #2158)
• Closes #2157 (via Fix stale stream state in session list #2159)
• Closes #2095 (via Add CSP report collector endpoint #2160)
• Closes #2098 (via Localize logs severity filters #2161)
• Closes #2172 (via Fix ctl Python wrapper ownership #2173)

Refs #2057 slice 2 (via #2156); refs #2155 (via #2175).