chore(sync): merge upstream main through acd873d41c

[dreampiler]

Synchronize the fork through upstream acd873d41c (13 commits after 179fc69cc6) before the 20261012d release swap. Integrate with a merge commit, never squash or rebase, so upstream/main becomes an ancestor of fork main.

70f5913c2d records the squash-merged release history (c5bd1d52ea, #236) with -s ours so the upstream merge base is 179fc69cc6 rather than the older pre-release base. It changes no files.

Upstream commits brought in

kdlbs#4433 delivery backlog drain and compaction-free backups, kdlbs#4432 interrupted shutdown delivery, kdlbs#4420 archive identity without checkout metadata, desktop window size basis, kdlbs#4435 prepared prompt admission, kdlbs#4434 macOS process identity, kdlbs#4436 resumed first-generation delivery, kdlbs#4408 Resume cleanup failures, kdlbs#4414 prompt lifecycle lock order, kdlbs#3898 automation retry policy and run history, kdlbs#4438 quiet late MCP attachment writes, kdlbs#4437 removed terminal environments, acd873d41c focus-driven idle resume admission.

kdlbs#4406, kdlbs#4414, kdlbs#4420 and the desktop window fix are the upstream versions of fork originals; the merged tree keeps upstream's code for them, with no duplicate fork copy left (the touched files match upstream except for fork-only additions such as pending-permission deadlines and stop markers).

Conflict decisions (both intents kept)

• deliveryretention/worker.go, persistence/snapshot.go, persistence/requiredstores/catalog.go, agent_delivery_retention_storage_rate_test.go, docs/public/operations.md: upstream's sleep-free batches and immediate continuation of a pass that is still committing cleanup (perf: drain delivery backlog and copy backups without compaction kdlbs/kandev#4433), with the fork's five-second catch-up for passes that leave backlog (fix(retention): compact superseded in-progress tool_update payloads #243/fix(retention): retire session-state rows so delivery inbox rows stop growing #251) and its boot staging sweep (fix(backups): reclaim abandoned boot backup staging directories #88).
• lifecycle/streams.go, agent/runtime/errors.go: the fork's update-stream reattach fencing with upstream's per-connection processor failure (fix: recover resumed first-generation delivery kdlbs/kandev#4436); both error types kept.
• automation/service.go, event_handlers_automation.go: upstream retry groups and unbound-run recovery with the fork's exact-turn outcome settlement (fix(automation): classify restart run settlement from the exact-turn outcome #254), failed-run task archival (fix(automation): archive generated task when a run fails terminally #248) and single start owner (fix(automation): single start owner for feeder-created tasks #191). Upstream's markAutomationRunTerminalForTurn is unchanged; the fork records the turn outcome in a wrapper that calls it.
• ceiling_dispatch_admission.go, ceiling_replay.go, idle_session_focus*.go, task_operations.go: upstream's focus resume admission and retry launch options with the fork's dispatch claim, replay gate and Office credential re-mint.
• task/repository/sqlite/session.go: the fork's session writes with upstream's manual-creation authorization. worktree/manager_cleanup.go: upstream.

Compile-only follow-ups inside the merge: upstream's new snapshot_copy_test.go passes the fork's added logger argument (nil), upstream focus tests pass the fork's replay gate (nil), settleFailedRunTask passes the run's task to upstream's widened runTaskHasReferences, the clarification completion records its turn outcome.

Follow-up commits

• 93ec2ba7d9 test: upstream's focus lease-loss test compares the fork's replay result by its outcome.
• d5acfcd53d lint: names gocognit/cyclop on upstream's existing nolint line (the fork lint compares against the older merge base).
• 2eb7036aa1 fix(automation): restart reconciliation settles a non-live retry-group run through the retry group (recorded success → retry success; otherwise the retry failure boundary, which records unresolved acceptance without terminal evidence). Standalone runs keep fix(automation): classify restart run settlement from the exact-turn outcome #254's exact-turn classification. This makes upstream's TestReconcileOpenRetryRunsChecksExactTurnLiveness and TestReconcileStaleLegacyRetryRunCannotScheduleWithoutTerminalEvidence pass with fix(automation): classify restart run settlement from the exact-turn outcome #254's tests.

Validation (Windows, local only)

• go build ./... and go vet ./... pass for the backend; scoped golangci-lint passes in the commit hooks.
• Package tests on this branch against detached fork main 3576ea6cb8 (same machine):
  • pass: agent/runtime, persistence/requiredstores, task/deliveryretention.
  • orchestrator: only the two passthrough attachment tests fail (Windows path separators, known baseline). Upstream's focus admission tests pass with the fork's replay gate.
  • agent/runtime/lifecycle (Cursor MCP retry tests skipped; they hang on Windows on fork main too): the same 79 failures on both trees, no new failure. Upstream's lock order test passes.
  • automation: everything passes except upstream's new TestListRunPageReturnsOlderStandaloneRunsByStableCursor, which fails 3 of 5 runs on Windows because CreateRun overwrites CreatedAt with time.Now() and Windows timestamps tie.
  • persistence: 4 baseline failures plus upstream's 2 new snapshot_copy_test.go cases (POSIX permission bits, ? in a Windows file name).
  • task/repository/sqlite: TestPatchRepositorySetPresence (UpdatedAt.After tie on Windows); everything else passes.
  • worktree: 28 failures, 27 reproduced on fork main; the other is upstream's new TestCaptureCleanupHeadOIDs_RelativeCheckoutPath (temp dir and checkout on different Windows drives). The package exceeds the 25-minute timeout on this machine.
• No CI, runtime launch or model call.

🤖 Generated with Claude Code