fix: resolve 8 behavioral bugs from audit (session reset, symlink roots, budget overflow, precedence, TOCTOU, banner, /rules show)

[code-yeongyu]

Summary

Resolves all eight independently reproduced behavioral issues from the audit.

RED-first evidence

1. Disabled session reset: expected undefined to match object { systemPrompt: StringContaining{…} }
2. Symlinked project root: expected null to be '/var/folders/.../repo'
3. Formatter result budget: expected 278 to be less than or equal to 200 (static) and expected 313 to be less than or equal to 200 (dynamic)
4. Dynamic root-file precedence: expected [ 'AGENTS.md', 'CLAUDE.md' ] to deeply equal [ 'AGENTS.md' ]
5. User-home file precedence: expected [ Array(2) ] to deeply equal [ '~/.config/opencode/AGENTS.md' ]
6. Project-root TOCTOU: Error: No such file or directory
7. Banner diagnostic indicator: expected false to be true
8. /rules show missing ID: expected [ { message: 'Rule body', …(1) } ] to deeply equal [ { …(2) } ]

Verification

• npm test - 14 files, 252 tests passed in one run
• npm run check - passed (tsgo --noEmit and biome check .; Biome reports its existing deprecated-config info only)

Atomic commits

• 19d7a14 fix(session): reset state when disabled
• 0f15eb4 fix(project-root): resolve symlinked start paths
• 519fa4f fix(formatter): include framing in result budget
• 1607f33 fix(engine): honor dynamic root rule precedence
• d44c48f fix(finder): honor user-home file precedence
• c907414 fix(project-root): tolerate disappearing start paths
• 49ec7a5 fix(ui): match diagnostics by absolute rule path
• 68b27aa fix(commands): reject missing rule show ids

---

Summary by cubic

Fixes eight audit-reported bugs to make rule discovery, formatting, and UI more reliable. Improves precedence handling, symlinked root resolution, and command validation.

• Bug Fixes
  • Reset session state on every session_start, even when disabled, so re-enabling works correctly.
  • Resolve symlinked start paths and return the canonical project root; tolerate TOCTOU (disappearing paths) without throwing.
  • Include block headers in the formatter’s result budget to prevent overflow in static and dynamic blocks.
  • Enforce dynamic root single-file precedence: at project root, select only the highest-priority file once (e.g., prefer AGENTS.md over CLAUDE.md).
  • Honor user-home single-file precedence by returning only the highest-priority candidate.
  • Show a warning indicator in the banner when diagnostics match by absolute rule path or relative path.
  • Require an ID for /rules show; notify with an error when omitted.

^{Written for commit 484b305. Summary will update on new commits.}