fix(opencode): same-model session checkpoint without model change

CHANGELOG.md

@@ -96,6 +96,7 @@
 - Raised `hourly-review-repair.yml`'s discovery ceiling from 50 to 200 while rotating deterministic 50-PR deep-inspection windows by hourly run number. The scheduler hydrates only the selected window and stops immediately after its single dispatch, preserving access to newer PRs without quadrupling expensive review/check/comment work. See `docs/doctoring/hourly-review-repair-single-file-consolidation.md`'s 2026-09-03 follow-up.
 
 ## [Unreleased]
+- **Keep OpenCode same-model checkpoint evidence bounded, provider-neutral, and authority-driven.** PR #2284 reads only declared log prefixes, counts required markers only from assistant text parts, rebuilds the base prompt before each retry, and creates/consumes continuation state only for `contextual-orchestrator/orchestrator/free`. Missing or negative calibrated budget authority fails closed and injects no appendix. Provider/model/status route details remain inside CO and cannot enter the leaf checkpoint or prompt; the mutable consumer-side CO parser and fixtures were removed. Explicit budgets remain Proposed until A/B, fast-mlsirm, and allocator evidence exist.
 - **Bind GitHub REST redirect evidence to both production opener chains.** `.github#2279` now feeds a synthetic same-authority 302 through the CodeQL identity and Strix evidence clients' real module-level openers, proving the redirect target is never contacted and the bearer header is never forwarded. Removing `_RejectRedirects` from either opener makes the contract fail on the forbidden second request. Four stale Strix HTTP/transport/JSON fixtures now patch that same production seam; direct handler unit cases and standalone CodeQL materialization remain unchanged.
 - **Define an evidence-backed repository README quality standard.** Added `docs/repository-readme-quality-standard.md` as the shared review contract for product-first structure, code-current onboarding, authority boundaries, durable quality signals, and repository/source/dependency license due diligence. Product repositories continue to own their own README prose; the standard is linked from the root documentation map and does not centralize or generate product claims.
 - Include merge-scheduler entrypoint, core, and regression-test changes in

docs/doctoring/opencode-same-model-midabort-20260919.md

@@ -0,0 +1,143 @@
+# OpenCode same-model mid-abort and context loss (2026-09-19)
+
+## Cross-file Gap baseline preservation repair
+
+Documentation successor `33e86ea6becb754e6e3b8a98299640220ecf27d5` accidentally treated a truncated GitHub contents response as the complete `docs/product-technical-gap-baseline.md`: the diff was `+7/-1,505`, the literal truncation diagnostic entered the file, and protected level-two authority fell from 59 sections to 36. That was not an intentional supersession and was unrelated to the checkpoint runtime repair.
+
+RED `117c1bf07ab07b8a7262da3d2da9d1f437c36cf0` integrates the canonical-owner preservation contract already established on #2281 and fails on five missing representative security, runtime, compliance, APA, and credential-lifetime sections. GREEN `e55c34159b43bd32fa7e039d69faa2b5f0ab5814` reconstructs the exact `7c5844ad…` parent baseline from bounded line ranges, then applies only the three intended OpenCode control-row updates. The repaired file has 59/59 protected level-two sections, no truncation marker, one instance of every OpenCode control row, and a `+3/-3` baseline diff relative to `7c5844ad…`.
+
+This test is a cross-file authority guard, not checkpoint behavior evidence. It prevents a future documentation-only successor from erasing unrelated PRD/TRD, Context Map, security, runtime, compliance, or APA decisions while preserving the checkpoint lane's valid delta.
+
+
+## Scope
+
+Improve OpenCode stopping mid-work or misunderstanding required outputs on
+**same-model retries** under the pinned pool
+`contextual-orchestrator/orchestrator/free` (`opencode.jsonc`), without model
+changes. Out of scope: inflight same-head dispatch dedupe / pg-erd handshake
+waste (`ContextualWisdomLab/.github#2283`).
+
+## Reproduction cases (live Actions)
+
+| Run ID | Repo | Termination | Context loss | Retry/resume | Completion judgment |
+| --- | --- | --- | --- | --- | --- |
+| `35452307646` | `.github` PR `#2040` | `cancelled` (`cancel-superseded-opencode-review-runs`) | In-flight review discarded on superseded head; no exported session checkpoint | Replacement dispatch queued; prior partial work not reused | Job `cancelled`, not success; no formal verdict on cancelled head |
+| `35401977816` | `.github` PR `#2278` | `failure` (`opencode-review` job) | Model pool cycled without host checkpoint; partial assistant export dropped between attempts | Same-model retries restarted from full prompt only | `review_status=exhausted`; fail-closed, no synthetic APPROVE |
+
+Pinned model for measurement: `contextual-orchestrator/orchestrator/free`
+(resolved upstream ids recorded from sidecar route evidence when present).
+
+## Reused surfaces
+
+- Provider-specific route evidence remains inside ContextualWisdomLab/contextual-orchestrator.
+  The leaf does not consume mutable `attempts[]`, provider, model, phase, or status
+  fields from open CO PR #1205; a released provider-neutral projection is required
+  before any owner telemetry can enter continuation control context.
+- `scripts/ci/opencode_review_session_checkpoint.py` — host-managed checkpoint
+  ledger (digest-only partial work, missing required outputs, route telemetry).
+- `scripts/ci/run_opencode_review_model_pool.sh` — injects bounded same-model
+  continuation appendix on retry only when explicit calibrated authority supplies
+  `OPENCODE_SESSION_CONTINUATION_BUDGET`; missing authority injects no appendix.
+
+## Before / after (pinned model, fixture-backed)
+
+| Metric | Before | After (this change) |
+| --- | --- | --- |
+| Same-model retry carries prior termination reason | No | Yes (checkpoint) |
+| Same-model retry carries missing required outputs | No | Yes |
+| Provider-specific route telemetry on retry | Discarded | Still discarded at the leaf; CO remains the observability owner |
+| Continuation budget | Unbounded prompt replay cycles only | Missing authority fails closed; explicit budget path is tested but remains Proposed pending calibration |
+| False success on incomplete control | Fail-closed already | Unchanged fail-closed |
+| Partial provider body replayed into prompt | N/A | Forbidden (digest only) |
+
+Live completion-rate deltas require a controlled replay harness on org runners;
+fixture tests prove the host contract; production measurement remains open.
+
+## Remaining
+
+- Executable fresh-session loop with durable SQLite ledger (`#2068`) still needs
+  read-only agent boundary preserved.
+- Inflight dedupe cancellation waste (`#2283`) remains lead-owned.
+- Production before/after completion rate on long tool-heavy reviews is not yet
+  measured on live `orchestrator/free` traffic.
+
+
+## Exact-head review repair (2026-09-20)
+
+Independent review of `9fdfddfaa3d792ad0a2de4d1884df14ad999ffd5`
+found four checkpoint-integrity defects:
+
+- bounded log helpers loaded the complete file before slicing;
+- user-prompt markers could satisfy assistant-output requirements;
+- later retries accumulated every earlier checkpoint appendix;
+- checkpoint state and continuations applied to candidates outside
+  `contextual-orchestrator/orchestrator/free`.
+
+Test-only commits `cfeda192f68af43077cae3b3cd61ef8f11eaea20` and
+`afe1420d3175d81f51c091b3499d792037cc304e` reproduce all four defects.
+Fresh execution at the test-only head reported exactly **4 failed**. Minimal
+source commits `36fb3907eaa229f8d2292feae3f25e010643693a` and
+`b400ad5d993dcc8d5efcdbcb13aafa2f6d295d2c` bound file reads, filter only
+assistant text parts, rebuild the base prompt on every retry, and scope
+checkpoint read/write to the pinned orchestrator route. Fresh
+warnings-as-errors execution passed **43 tests** across the checkpoint, route
+evidence, and model-pool suites; Bash syntax, Python compilation, and diff
+whitespace checks also passed. Hosted exact-head gates remain separately
+required and no predecessor receipt transfers.
+
+
+### Continuation budget authority repair (2026-09-20)
+
+Review of exact `bed37694c191f13bf18a595af672bb4d63e811af` found that
+`DEFAULT_CONTINUATION_BUDGET = 2` and
+`${OPENCODE_SESSION_CONTINUATION_BUDGET:-2}` silently selected two
+decision-affecting continuations while the controlled A/B and allocator
+evidence remained open. This violated the no-heuristics contract.
+
+Test-only commits `f0775fd48d31bf033279701f747698310aa6d7c6` and
+`c4165352bab48123f9333bcfa11a78d060cb9cb0` require the runner and direct
+CLI to reject missing budget authority. Minimal source commits
+`3e290447b80c3964599bbb811f5cada2435ce28f` and
+`4070c161685298a37554a551e7e3f33b2b6e49ad` remove both numeric defaults:
+the runner injects no checkpoint appendix without an explicit non-negative
+budget, and both CLI commands require `--budget`.
+
+Fresh materialization of exact `4070c161…` passed Python compilation, full
+runner Bash syntax, and four direct authority probes (missing CLI authority
+fails, the required argument is diagnosed, an explicit budget remains
+accepted, and the shell numeric fallback is absent). The execution image does
+not contain pytest, so no fresh pytest count is claimed. An explicit budget is
+still Proposed rather than calibrated production authority until controlled
+completion/time/token evidence and the selected fast-mlsirm/Fugu/Conductor/
+TRINITY-compatible allocator receipt are integrated. Hosted exact-head gates
+and independent review remain required.
+
+
+### Provider-neutral owner-boundary repair (2026-09-20)
+
+The existing P0 review showed that the leaf parser read the mutable CO #1205
+`model`, `provider_name`, phase, attempt number, and HTTP status fields and
+formatted them into the next model prompt. That made two envelopes with the
+same provider-neutral outcome produce different control context and duplicated
+an unreleased owner schema inside ContextualWisdomLab/.github.
+
+RED `7c5c6a7548f5836d956cb196427581060951021b` and
+`3a8c056bc2b4e0f5b012f900b24bfc54636e24ba` require provider/model/phase/
+status values to have zero effect on the appendix. GREEN
+`866cc6a4a1285936da5110ea0a28071548da09e2` and
+`8c04d1284f96eb0a702a24287290e30ba3f1bb9d` remove route parsing, storage,
+formatting, CLI plumbing, and runner input. Commits
+`51a531886962f35eb091b97cf8ec2d6e05dcec81` and
+`b7e8256f4c8a9cf7cf1022312ee86ba6f985f9a4` retire the consumer-owned parser
+and fixtures entirely.
+
+Fresh exact materialization at `7c5844ad…` (tree `53908068…`) passed Python
+compilation, Bash syntax, checkpoint/runner **65 tests**, and the full
+warnings-as-errors suite (**3,428 passed / 5 skipped / 40 subtests passed**).
+The provider-neutral probe injects hostile legacy `openrouter`, phase, HTTP 429,
+and served-model fields into a checkpoint and proves none reaches the
+continuation appendix. RED `68459817…` additionally proves both direct CLI paths
+previously accepted negative budget authority and exited zero; GREEN
+`7c5844ad…` rejects it at the parser boundary. CO issue #1106 records the
+required immutable, provider-neutral, allocator/fast-mlsirm receipt before any
+owner telemetry or valid budget can be consumed.

docs/product-technical-gap-baseline.md

@@ -7,6 +7,16 @@
 
 이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다.
 
+### 2026-09-20 current-head incident delta
+
+| Gap ID | 상태 | exact-head evidence | causal owner / next gate |
+|---|---|---|---|
+| CONTROL-OPENCODE-CHECKPOINT-INTEGRITY-01 | **Source repaired on PR #2284; hosted exact-head acceptance pending** | Review of `#2284@9fdfddfa` found complete-file reads before slicing, user-prompt marker laundering, accumulated retry appendices, and checkpoint application outside `contextual-orchestrator/orchestrator/free`. Test-only `afe1420d` produced exactly 4 failures; source `b400ad5d` produced 43 focused warnings-as-errors passes. Later test expansion at `9012eac2` hid an arithmetically unreachable `used < 0` decision from coverage while its named test exercised only `used == 0`. RED `802a4fa5` makes that vacuous oracle executable; GREEN `0aa9b902` removes only the impossible clamp. Exact `7c5844ad` (tree `53908068`) passes checkpoint/runner **65 tests** and the full warnings-as-errors suite **3,428 passed / 5 skipped / 40 subtests passed**. | ContextualWisdomLab/.github owns the trusted OpenCode host checkpoint boundary. Keep #2284 Draft until fresh terminal hosted security/quality evidence and qualifying independent review exist; no predecessor result transfers. |
+| CONTROL-OPENCODE-CONTINUATION-AUTHORITY-02 | **Missing or negative authority now fails closed on PR #2284; calibrated admission remains Proposed** | Exact `bed37694` silently selected budget `2` although controlled completion/time/token evidence was still pending. RED `f0775fd4` and `c4165352` require the runner and direct CLI to reject absent authority; GREEN `3e290447` and `4070c161` remove the Python and shell defaults. Exact-head RED `68459817` then proves both direct CLI paths accepted negative authority, exited zero, and emitted `0`; GREEN `7c5844ad` validates non-negative authority at the parser boundary. Focused **65 passed**, full suite **3,428 passed / 5 skipped / 40 subtests passed**, compileall, Bash syntax, and diff check bind the repair to tree `53908068`. | ContextualWisdomLab/.github owns host enforcement. A budget may be enabled only after a versioned fast-mlsirm/Fugu/Conductor/TRINITY-compatible allocator receipt and controlled A/B evidence are integrated; absent or invalid authority keeps checkpoint injection disabled. Hosted exact-head GREEN and independent review remain required. |
+| CONTROL-OPENCODE-PROVIDER-NEUTRAL-03 | **Consumer schema copy removed on PR #2284; released CO projection pending** | Exact `bed37694` parsed CO model/provider/phase/status fields and formatted them into continuation prompts. RED `7c5c6a75`/`3a8c056b` requires byte-neutral handling of hostile provider details. GREEN `866cc6a4`/`8c04d128` removes route parsing and runner plumbing; `51a53188`/`b7e8256f` deletes the mutable parser and fixtures. Exact `7c5844ad` retains that provider-neutral boundary and passes checkpoint/runner **65 tests** plus the full warnings-as-errors suite **3,428 passed / 5 skipped / 40 subtests passed**. | ContextualWisdomLab/contextual-orchestrator issue #1106 owns the released provider-neutral allocation receipt. ContextualWisdomLab/.github must know only `orchestrator/free` and the gateway token; provider identities remain CO observability data. Keep Draft until immutable owner release/pin, exact-head GREEN, and independent review. |
+| CONTROL-OPENCODE-CHECKPOINT-CAUSE-04 | **Source repaired on PR #2284; hosted exact-head acceptance pending** | Exact `3f05c1fc` proves two causal-context failures: provider-like words in assistant prose selected a trusted provider termination label, and an invalid control result reached the continuation as generic `nonzero-exit` although the host already held wrapper status `3`. GREEN `f57319d1` restricts classification to structured OpenCode `type=error` events, CLI stderr, and fixed host hints; GREEN `9dc05e7d` maps wrapper status `3` to `invalid-control-output`. Exact-source assertions confirm assistant export is no longer causal while export presence remains checked, and the runner continuation contract requires `Termination reason: invalid-control`. | ContextualWisdomLab/.github owns checkpoint cause identity. Keep #2284 Draft until exact-head Python/runner/security gates are terminal GREEN and an independent review qualifies; no assistant prose, prior head, or predecessor check may author the cause. |
+| CONTROL-OPENCODE-CHECKPOINT-BOUNDS-05 | **Source repaired on PR #2284; hosted exact-head acceptance pending** | RED `c8680c56` executes a valid provider session export above the existing 2 MiB OpenCode evidence bound and proves that both checkpoint summary and required-output extraction consumed it in full. GREEN `5c49d4f8` introduces `MAX_SESSION_EXPORT_BYTES`, reads at most bound + 1 byte, rejects oversized or non-UTF-8 exports before JSON parsing, and replaces both unbounded `read_text()` paths. Exact remote Python compilation, the oversized/small-export behavior probe, and 31 directly executable checkpoint cases pass; three fixture-dependent cases were not represented as hosted evidence. | ContextualWisdomLab/.github owns the review-host memory boundary. Keep #2284 Draft until exact-head hosted quality/security gates and qualifying independent review are terminal; oversized provider artifacts cannot become continuation evidence. |
+
 ### 2026-09-13 current-head incident delta
 
 | Gap ID | 상태 | exact-head evidence | causal owner / next gate |