Harden OpenCode and Kilo turn completion

[yaacovcorcos]

Status: integration-ready under explicit acceptance waiver

All known P0-P3 findings are resolved at the exact hosted head below. Yaacov explicitly authorized merging this PR if the code is clean and accepted the remaining limitation that isolated authenticated OpenCode/Kilo lifecycle acceptance was not run. No unknown user credentials were used.

Outcome and provenance

This is a bounded Scient-native reimplementation of OpenCode/Kilo turn-completion reliability lessons from Synara 3eb5b1088f3189513115e389bf3b19eaffc7e821. It is not a donor cherry-pick and does not import donor identity, persistence, credentials, telemetry, updater, or release policy.

• Owned base/current main: 65a6961cc00c45ee19f21373b01e8c6017597aef
• Exact candidate: 266bac5093febd76fe56fe213c4df663be68bdc9
• Branch: agent/opencode-kilo-completion-reliability-20260724
• Delta: OpenCodeAdapter.ts plus focused tests only

Implemented reliability behavior

• Generation-aware ownership and quarantine across prompt, assistant/tool, session.next, terminal, permission/question, interrupt, provider-error, and watchdog paths.
• Generation-scoped abort handles and single-flight reply settlement for manual and automatic interactions.
• Fail-closed handling for ambiguous post-dispatch outcomes, provider cancellation failures, and resumed approval-required permission updates.
• Shared, interruption-safe session retirement for stop, replacement, shutdown, finalization, and unexpected exits.
• Confirmed managed local-process death finalizes exactly once without requiring an impossible abort against a dead endpoint; ambiguous external event-stream loss remains abort-first and quarantined/retryable when cancellation cannot be confirmed.
• Bounded autoapproval tombstones and Kilo recovery polling (limit: 256).
• Independent OpenCode/Kilo quiet-turn timeout settings, defaulting to 600000 ms with safe fallback.

Resolved review blockers

The branch resolves all previously reported P1/P2 issues, including stale interaction attribution, reply races, interrupted sends, unconfirmed stop/replace cleanup, replacement/finalizer transport cancellation, concurrent retirement deletion, unexpected-stream fail-open cleanup, finalizer scope leakage, race-loser abort failure, unbounded Kilo polling/tombstones, and the managed-process-exit dead-session regression.

Exact-head verification

bun run scient:upstream-check --intake passed at 266bac5093febd76fe56fe213c4df663be68bdc9:

• format verification;
• lint: 0 errors, 226 existing warnings;
• typecheck: 9/9 packages;
• full bun run test: 12/12 tasks, including CLI 2,330 passed / 9 skipped;
• stable browser coverage;
• desktop/server builds: 5/5 tasks;
• release smoke;
• brand and deterministic upstream checks;
• clean-worktree assertion.

The focused OpenCode adapter suite passed 158/158. Server typecheck and git diff --check also passed independently. No cross-repository agent smoke was required because shared provider protocol/contracts did not change.

Independent final-head reviews

Exactly three independent read-only reviews inspected base 65a6961cc00c45ee19f21373b01e8c6017597aef through exact candidate 266bac5093febd76fe56fe213c4df663be68bdc9 after verification:

1. Correctness, reliability, concurrency, lifecycle, performance, and regression risk: P0 0, P1 0, P2 0, P3 0.
2. Security, privacy, data loss, credentials, permissions, approvals, sessions, updater, and release safety: P0 0, P1 0, P2 0, P3 0.
3. Architecture, maintainability, ownership, donor lineage, product behavior, and test proof: P0 0, P1 0, P2 0, P3 0.

Acceptance waiver and residual limitation

Isolated authenticated OpenCode and Kilo lifecycle acceptance was not performed. Yaacov explicitly accepted this limitation for merge. Deterministic adapter, lifecycle, repository, platform, build, and release-smoke evidence remains green; fresh hosted CI on the exact head is still required before merge.

Protected lanes and rollback

No schema, stored data, credential model, permissions policy, updater state, release control, or product identity changes are included. Rollback is a bounded revert of this PR; there is no migration, credential, user-data, or publication rollback.

[yaacovcorcos]

Final hosted verification is green at exact head 9c04af92a7680274f7914432d57e2b61ffe41f07: CI run 30117403851 completed successfully. The combined format/lint/typecheck/full test/stable browser/Linux geometry/build job passed; release smoke passed; Linux and Windows HTML-preview platform smokes passed; and Windows process regression passed. This corroborates the complete local bun run scient:upstream-check --intake result and the three zero-finding exact-head recertifications recorded in the PR body. PR remains draft pending authorized isolated OpenCode and Kilo lifecycle acceptance; it has not been marked ready or merged.