fix(opencode): preserve owned turns during server recovery#25596

Problem

A slow but live T3-owned OpenCode 2 server can exhaust five recovery attempts and fail active turns that are still running. Recovery also holds the event lock across history reads, delaying Stop.

Change

Preserve @Zheruel's recovery design on current main: retry owned recovery with backoff capped at 30 seconds until process exit, Stop, or shutdown; retain bounded external-server recovery. Keep HTTP reads outside the state lock, recheck turn/request ownership before applying snapshots, isolate deleted sessions, and scope unread SSE requests to their connection. Recovery never resends prompts.

The policy deliberately has no elapsed-time cutoff for a live owned process. This is the maintainer decision to review.

Compared with the original diff, all recovery mechanisms and regression cases remain. Main's surrounding changes are retained, the history comment is shorter, and a test now asserts terminal status in its main fiber so a failure cannot strand a Deferred.

Verification

• Regression fails on current main: stalled recovery ends failed instead of completed.
• 120 focused tests pass, covering recovery, Stop, process exit, shutdown, pending requests, deleted sessions, SSE cancellation, server ownership, orchestration and text generation.
• Blacksmith vp run check:changed passes: format, lint, both knip checks, GraphQL, affected-package typechecks and adjacent tests. The isolated worker's origin/main ref was set to the exact baseline commit because its snapshot has no remote refs.
• Real OpenCode 2.1.0 on Linux x64, Node 24.22.1: main fails both active turns while native history reports success on the same live PID; the replacement completes both. Both runs pause the captured owned process for 65 seconds and delay each reconciliation response by 8 seconds. Two initial prompts, no resubmission. Uses a local model fixture and real shell tools, isolated provider state, no credentials or live user data.
• Real process death fails both turns. Runtime harness, adapted from the original author's harness.
• Two independent GPT-6.1-Sol reviews approve head b8a9888760628cfd256049ab9e374ec7aadb1ac4 with no findings. All 28 CI/check contexts are successful, with no pending or failing checks. Macroscope correctness and Effect checks pass; its approvability result requests human review of the production recovery policy. CodeRabbit reports success but skipped review because its included review budget was exhausted. No unresolved correctness findings remain.
• Unverified: exact NixOS/systemd/zram starvation, upstream database-lock cause, desktop/mobile and rendered web client. No UI rendering code changes; provider runtime transcripts are the behavioral evidence.

Takeover

Replaces #24158, with thanks to @Zheruel for the original implementation.

The fork has maintainerCanModify: false, so this is a new branch from current main with the contributor credited in the commit trailer. The original PR remains open.

Built with GPT-6.1-Sol in the Codex harness on T3 Code.