test(server): specify OpenCode lifecycle reconciliation

[teamleaderleo]

Purpose

Provide executable, test-only contracts for the T3/OpenCode lifecycle boundaries identified by Fieldwork campaign teamleaderleo/fieldwork#71.

Canonical dossier: teamleaderleo/fieldwork#75
Completed independent disposition: teamleaderleo/fieldwork#178
Current actual review queue: teamleaderleo/fieldwork#213

Current scope

This branch remains test-only. Current head:

cae5d869f3ca441b4117197e34796a7d8b9466af

No production implementation is committed here.

The branch contains deterministic controls for:

• resumed-session recovery and exact active-turn affinity;
• bounded status/history recovery behavior;
• canonical interrupted completion and projection closure;
• stale explicit interrupt IDs;
• duplicate interrupt callers;
• caller cancellation while provider abort remains in flight;
• prompt rejection and stopSession overlap while cancellation owns a turn;
• abort transport failure;
• matching and delayed MessageAbortedError ordering;
• provider-session generation replacement during an old abort;
• visible OpenCode skill approval;
• pending permission/question expiry after interruption, normal completion, provider error, provider exit, and explicit stop;
• late response rejection;
• ProviderSessionReaper check-then-stop ordering.

Independent disposition

A — local interrupt ownership

Accepted only with a generation fence. Any production slice must key cancellation ownership to:

• the exact adapter/session generation;
• the exact OpenCode session ID;
• the exact active T3 turn ID.

It must emit exactly one canonical turn.completed with state: interrupted, because the current ingestion path does not close persisted lifecycle state from turn.aborted alone.

B — pending interactive requests

May proceed separately after truthful expiry semantics. Interruption or teardown must not be represented as a user decline or empty submitted answer. Expiry needs machine-readable origin/reason data that downstream projection can distinguish from user-authored input.

C — restart and delayed-event correlation

Held. Session status and timing do not prove exact old-run outcome. Do not invent caller-generated OpenCode message IDs or infer affinity from busy/idle timing.

D — reaper ordering

Held. A second read is not atomic authorization for an external provider stop. A real serialization, lease/revision, or conditional-stop boundary is required.

Execution state

The unpatched exact-head Fieldwork workflow executed and failed on the intended current assertions, including session-generation replacement and canonical interrupted settlement.

The first candidate A/B/composed workflows did not reach tests: their stored patch carriers had malformed hunk metadata and stopped at git apply. Those runs are harness failures, not candidate behavior evidence.

Fieldwork has repaired the three carriers and added integrity validation with negative controls so malformed unified diffs fail before target jobs. Repaired exact runs are queued. No candidate green claim is made.

Focused test surfaces

vp test run \
  apps/server/src/provider/Layers/OpenCodeAdapter.restart.test.ts \
  apps/server/src/provider/Layers/OpenCodeAdapter.interrupt.test.ts \
  apps/server/src/provider/Layers/OpenCodeAdapter.interrupt-projection.test.ts \
  apps/server/src/provider/Layers/OpenCodeAdapter.interrupt-generation.test.ts \
  apps/server/src/provider/Layers/OpenCodeAdapter.interrupt-error.test.ts \
  apps/server/src/provider/Layers/OpenCodeAdapter.interrupt-error-ordering.test.ts \
  apps/server/src/provider/Layers/OpenCodeAdapter.interrupt-owner-cancellation.test.ts \
  apps/server/src/provider/Layers/OpenCodeAdapter.pending-request.test.ts \
  apps/server/src/provider/Layers/OpenCodeAdapter.pending-request-stop.test.ts \
  apps/server/src/provider/Layers/OpenCodeAdapter.pending-request-completion.test.ts \
  apps/server/src/provider/Layers/ProviderSessionReaper.race.test.ts

Candidate gates additionally include the existing OpenCode adapter suite, ProviderRuntimeIngestion compatibility, server typecheck, and complete-diff review.

Boundaries

• Draft and test-only.
• Do not treat this PR as a combined production proposal.
• No production source is committed.
• No browser or live-user data.
• No upstream issue, pull request, discussion, review, comment, reaction, or message.
• Upstream contact remains unauthorized.

Prepared under Fieldwork campaign pingdotgg#71.

[teamleaderleo]

Legacy test-carrier closeout

State: complete — evidence transferred; legacy landing held

Exact test-only head: cae5d869f3ca441b4117197e34796a7d8b9466af.

Fieldwork review pingdotgg#234 has completed with this disposition:

• interruption and idle-release ownership transfer to Orchestration V2;
• pending-request landing target transfers to V2 after direct terminal-request cancellation and late-response controls;
• restart semantics become explicit cancel-on-restart;
• legacy production slices are held and retired.

Branch-specific V2 receipts:

• core ownership head 0d61f31820f8254338571ac3049e7dc0ac621f7c, run 30556506779: outbox 2/2, process-loss, session release/replacement, and server typecheck passed;
• V2 OpenCode head 4f94ecabee645bafeffcc6d620905bd0b7ad6d13, run 30557111582: adapter lifecycle 10/10, selected replay fixtures 3/3, outbox controls, and server typecheck passed.

This PR remains valuable as historical regression evidence and has no product merge path. Close after evidence transfer.

Public upstream interaction: none.