fix: CLI session-restore hardening — TERM-25 wrong-thread guard, compound-restart coverage, flake/open-item closure

[danshapiro]

CLI session-restore hardening (parallel-wave track 2)

Four commits, each TDD'd and gate-verified, closing restore-hardening gaps against origin/main (ec9970c).

1. TERM-25 — reject wrong-thread Codex resume loudly (1b2aba60)

thread/resume answering with a DIFFERENT thread id than requested was silently tolerated at all three Rust resume sites in crates/freshell-freshagent/src/codex.rs (debug_assert_eq! — a no-op in release — or no check at all), leaving the sidecar on the wrong thread while the session stayed registered under the requested id. All three sites (create-with-resume, not-tracked attach, crash recovery) now reject the mismatch loudly: sidecar torn down + reaped, explicit error frame, tracing::error!, wrong id never adopted.

Unit pins (RED before fix, GREEN after):

• handle_create_with_resume_wrong_thread_id_fails_create_and_never_adopts
• handle_attach_unknown_session_wrong_thread_id_is_rejected_not_adopted
• crash_recovery_resume_wrong_thread_id_is_rejected_not_silently_recovered

Root cause found in the pinned e2e itself: restore-matrix SCENARIO 7's blanket test.fail() was an artifact of a TEST BUG, not product behavior — originalSessionId was assigned the void result of expect.poll(...).toBe(...), so the final assertion compared the leaf id against undefined and could never pass on either server kind. With the capture fixed, the pane-level contract (thread-B never rendered/adopted) holds on BOTH kinds; pin removed, frozen-legacy internal gap (no adapter-level guard, unobservable at this UI level) documented in the spec header. Checklist TERM-25 evidence updated accordingly.

2. Compound-restart coverage (bd94023c)

Closes the two never-tested disruption modes from docs/plans/2026-07-19-state-sync-resilience-assessment.md §7 (new test/e2e-browser/specs/compound-restart-rust.spec.ts, rust-chromium):

• MODE A — abrupt SIGKILL death + revival (WSL-restart-like), no page reload: sidebar-resumed codex terminal pane recovers via the client's own reconnect — same durable sessionRef, resume <id> argv re-applied (argv-log delta), pane re-anchored + non-blank, sidebar row linked (data-has-tab="true"), terminal_identity_unresolved never fires.
• MODE B — server and browser restarting together: abrupt death + revival, then an immediate page.reload() interrupting the in-flight restore; same contract plus an idempotency re-check (second reload doesn't revert recovery).

New fixture capability: RustServer.restartAbrupt() (SIGKILL + reboot on same home/port/token; fixture-side ownership-safe descendant sweep is the primary PTY reap in this mode). Both modes are GREEN — the current product handles both compounds; the specs now pin that permanently. Assertion shapes inherit codex-terminal-bounce-rust.spec.ts's proven-discriminating pattern (RED against the real 2026-07-22 incident).

3. restore-matrix scenario 3 + multi-client flake (4b992f8d, docs)

• Scenario 3 (campaign open item 3): already fixed on main by 8fd9233a; re-verified GREEN at this base (opening a seeded historical session…, rust-chromium). Doc annotated RESOLVED with evidence.
• Multi-client reconnect flake (campaign open item 4): NOT reproducible at this base — deflaked by 031a7c12 (over-constrained exact-attach-intent assertion, relaxed with in-spec evidence). multi-client.spec.ts green 3x on BOTH kinds, including one run under concurrent cargo-build load. Doc annotated with evidence.

4. OpenCode restore gap check (verification record — no gaps found)

Compared docs/plans/2026-07-18-opencode-terminal-restore-spec.md slices A–D against the implementation:

• Slice A (crates/freshell-sessions/src/opencode_locator.rs): present, 18 unit tests covering spec test-list items 1–16 including BOTH row-timing shapes (row_created_at_spawn_before_any_enter_resolves_via_spawn_window, row_created_lazily_at_first_enter_resolves_via_enter_window), ambiguity refuse, idle short-circuit (tick_while_unarmed_performs_zero_db_scans), missing-DB tolerance.
• Slice B (crates/freshell-ws/src/opencode_association.rs): present, 6 tests covering spec items 17–20 (submit recognition, arm/skip rules, drain+broadcast on a real seeded DB row).
• Slice C (wiring): WsState.opencode_locator (lib.rs:219,669), submit/arm hooks in terminal.rs, construction + sweep in main.rs:335-508, list_sessions_since in parse/opencode.rs:348.
• Slice D (client): no client changes, as mandated.
• e2e (spec item 21): opencode-terminal-restore-rust.spec.ts proves restart restore via opencode --session <id> argv AND fresh restore for a never-submitted pane.

Conclusion: all slices implemented with the spec's full test list; no real gaps to close.

Verification

• cargo fmt --all --check GREEN (incl. one pre-existing whitespace fix, 6f4aa9fb); cargo clippy --workspace --exclude freshell-tauri --all-targets exit 0 (warnings pre-existing at base, none in changed code); cargo test --workspace --exclude freshell-tauri all green (freshell-freshagent 240/240).
• Playwright: restore-matrix full suite 20/20 (both projects) 2x; compound-restart-rust 2/2 3x; multi-client 12/12 3x (both kinds, incl. under load); codex-terminal-bounce-rust green (touched-helper sanity).
• Coordinated gate: FRESHELL_TEST_SUMMARY="track2 restore hardening pre-PR" npm test → full-suite success exit=0 at 6f4aa9fb (dirty:0).

🤖 Generated with Amplifier