[Fix] Address review findings on the transcript convergence and question panel fixes

[daniel-lxs]

What problem this solves

Follow-up addressing the three outstanding openmote review findings on already-merged PRs #33 and #37:

1. [Fix] Live transcript converges to persisted envelopes on every history refetch #37: acpService.setMessages after the history rebuild reset the whole protocol service, discarding the pending request_user_input lookup populated from history — a live request_user_input_response after a refetch formatted with request === null, so secret answers could render raw in the transcript.
2. [Fix] Live transcript converges to persisted envelopes on every history refetch #37: rebuilt.todos.length > 0 ? rebuilt.todos : state.todos kept stale todos when the server history's latest plan state was intentionally empty — refetches couldn't converge todos to server truth.
3. [Fix] Pending question panel stays answerable when the reported phase flips #33: with the question panel no longer phase-gated, a cancel/session error cleared the worker-side pending map but the client kept its pendingUserInputRequests — the aborted question stayed answerable and free-text sends could be swallowed as answers to a dead request.

What changed

• New AcpProtocolService.rebindMessages re-points only the id/position indexes; the merge path uses it instead of setMessages (removed), so request/user/tool lookups built by loadAcpEnvelopes survive. Two service tests that emulated the old merge now call reset() + rebindMessages() explicitly.
• loadAcpEnvelopes returns hasPlanHistory; the merge treats fetched todos as authoritative (including empty) whenever history carries plan state.
• _setTaskStatus drops pending user-input requests (store + service map) when taskStateEvent === 'taskAborted'.

Validation

Three new regression tests (secret masking after refetch-over-pending-request, todos converging to an empty plan, abort clearing the pending question). Full src/app/(sandbox)/task/ suite green — 486 tests. Lint + typecheck clean.

🤖 Generated with Claude Code

[roomote-roomote-v1]

3 issues outstanding. See task

• apps/web/src/app/(sandbox)/task/[taskId]/hooks/use-sandbox-store.ts:832 _mergeAcpHistory rebuilds with loadAcpEnvelopes(sorted) using the default trailing-completion behavior, so the live provider's immediate post-hydration refetch can flip an active trailing assistant message to isTurnCompletion even when initial hydration explicitly suppressed that for a still-running task.
• apps/web/src/app/(sandbox)/task/[taskId]/hooks/services/acp-protocol-service.ts:1724 History todowrite events processed through the ToolCall/ToolCallUpdate branch update todos but never set hasPlanHistory, so _mergeAcpHistory treats that server plan state as absent and can keep stale live todos instead of converging to persisted history.
• apps/web/src/app/(sandbox)/task/[taskId]/hooks/use-sandbox-store.ts:247 The merge coverage key for tool messages is only the shared toolCallId; if a refetch has the persisted tool call but not the persisted terminal result yet, the live-only tool result is considered covered and is dropped instead of being carried over.
• apps/web/src/app/(sandbox)/task/[taskId]/hooks/use-sandbox-store.ts:906 _mergeAcpHistory treats any rebuilt tool_result for a call as terminal coverage. If history includes a persisted in-progress ToolCallUpdate but not the final terminal update yet, a live terminal result is still considered covered and dropped, leaving the transcript stuck on the stale in-progress output until the terminal envelope persists.
• apps/api/src/handlers/ado/index.ts:100 Flat Azure DevOps comment normalization calls getAdoPullRequest before recordWebhook claims the delivery; if that external fetch fails or the delivery is retried, the failure bypasses the idempotency/error-recording path and ADO can keep retrying the same unrecorded delivery.
• apps/web/src/components/settings/CommsProviderSection.tsx:527 Clearing a saved optional communications field enables Save, but handleSave submits only non-empty values and saveCommsAuthConfigCommand only upserts, so a successful-looking save leaves optional saved values like TELEGRAM_WEBHOOK_SECRET or TELEGRAM_BOT_USERNAME stored and active.
• packages/cloud-agents/src/server/__tests__/opencode-runtime.test.ts:301 The signal-handler test relies on the previous test leasing a server to register process-global handlers, so running this test alone or after ordering/sharding changes can fail; the test should lease/register its own server or move that setup into shared test setup.