fix(server): make the remaining flaky server tests deterministic#22559

Five server tests kept failing on CI under load. Each one is fixed at its root cause below. The PR adds no skips, retries, or longer timeouts.

1. Claude steer test hangs for 120s ("never answers" variant)

What raced: each repeated steerTurn did real file I/O (skill discovery) before it armed its 5s backgrounding timeout. The test advanced the TestClock in ticks, so under load every tick could run before the timer existed, and nothing moved the clock again. Status: #22523 (f9dd259) already fixed this on main. The steer now reads its deadline from the clock first, and the test forks it with startImmediately, so the deadline is read before any clock adjustment. This PR changes nothing here. I verified the fix by adding a real 300ms delay just before the timeout is armed. The test still passed, where the old code hung. 5/5 runs pass.

2. ServerSecretStore.create exposed an empty secret (product bug)

What raced: create opened the final path with wx, which made an empty file right away, and wrote, synced, and chmodded it afterwards. A concurrent creator then got AlreadyExists, fell back to get, and read an empty secret. Real callers include session signing keys. Fix: write and sync the secret to a temp file in the same directory with mode 0600, then link(temp, final). A hard link publishes a complete file atomically, or fails with AlreadyExists if another creator won, and the loser then reads the winner's complete file. The temp file is always removed. Existing test: 10/10.

3. OpenCodeServerLedger.test.ts: kill ESRCH / expected true to be false

What raced: spawnGroup assumed that a detached child leads its own process group. libuv ignores a failed setsid(), which returns EPERM when the new pid equals the id of a group that still has members, such as a sleep orphaned by an earlier group. The child then stays in the worker's group, so -pid points at the wrong group or at none. recordFromDeadServer also called process.kill(-pid) directly, so ESRCH escaped. Fix: the spawned shell first checks ps -o pgid= -p $$ against $$. If it does not lead its own group, it exits 97 before starting anything, and spawnGroup spawns again. Otherwise it prints grouped, and the test waits for that line. The wrapper test's ready signal now matches a line instead of any stdout data. All kills go through the ESRCH-tolerant killGroup, and every group is still released by its scope. 5/5 runs pass on macOS. Linux runs in CI.

4. ACP "reaps detached native work when the provider exits before explicit teardown"

What raced: the mock agent launched node -e → bash → sleep, slept 100ms of real time, then exited. T3 can reap those descendants only if its ownership observer, which polls every 25ms, recorded them before the agent exited. #22523 already gated the exit on the pid triple being written. The 100ms window for the observer was still a guess. Fix: the 100ms sleep is gone. The agent no longer exits on its own in this mode. The test wraps the Linux process-tree controller to see which pids the observer has identified. The observer adds each one to its ledger in the same synchronous pass. Once the launcher, bash, and sleep are all recorded, the test sends _test/exit with { code: 0 } (the default exit code stays 19 for existing callers). The provider exit therefore always happens after T3 owns the descendants. This test only runs on Linux, so CI provides the proof. The rest of the file passes 5/5 locally.

5. ACP replay failures said only "ACP transport operation failed."

• AcpTransportError.message now includes operation and detail when they are set. Heads-up: #3251 kept the message to a fixed template on purpose, and a test pinned that. I updated the test. detail values are written by our code, and cause is still left out of the message. Revert that commit if you want to keep the old rule.
• What raced: the stored-picks test read status.json right after its scope closed. Scope release waits only one second for the agent and does not escalate, so a slow agent could still be writing. The agent also wrote status with writeFileSync, which truncates and then writes, so any concurrent read could see an empty or partial file. Adapter-integrated replays read status while the agent is still alive.
• Fix: the replay agent writes status to a temp file and renameSyncs it into place, so every read sees a complete status. The stored-picks test also waits for the replay agent's exit, through the spawned handle's exitCode, before it reads status. AcpRegistryAdapterV2.test.ts passes 5/5, and the Grok replay tests pass too.

Before / after

Before: these tests failed intermittently on loaded CI runners (hangs, ESRCH, empty secrets, missing pid triples, and opaque transport errors). After: each one waits for an explicit event instead of a fixed time budget, and every touched file passed at least 5 runs in a row locally. The Linux-only ACP reap test still needs its CI run.

Made with Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

Rebased onto main after #22557. Main deleted the AcpAdapterV2 "reaps detached native work" test and the taskkill cases this PR had touched, so those test hunks are dropped; the mock-agent change for item 4 stays (it only matters to that test and is harmless without it). Items 1–3 and 5 are unchanged. Re-verified after the rebase: OpenCodeServerLedger 3×6/6, ServerSecretStore 3×, AcpRegistryAdapterV2 15/15, effect-acp errors 7/7, typecheck clean in all three packages.