merge: sync upstream Cotal main into rigel-release (RIG-5440)

[rigel-mintaka]

Summary

This is the first sync of upstream Cotal main (8ca93e96) into rigel-release (0f396e1a), per Matt's ruling on RIG-5440. It must land as a merge commit, as earlier fork syncs did, so that main stays an ancestor and the next sync merges only new commits.

• Conflicts: 54 resolved. Upstream's version is the default. These Rigel changes are kept on top of it:
  • seat custody and the custodial pty runtime
  • the rigel-release CI triggers, concurrency and apparmor sysctl
  • the Pi connector and the omp/zellij extensions
  • the quarantine registry
• Kept deleted: changesets.yml, windows.yml, and the three design records in docs/design/. Design records do not go in code repos.
• Dropped Rigel changes, now covered upstream:
  • The statusRevision fix in connector-core/agent.ts is replaced by upstream's ordered presence updates. Its revision-only cell is removed from turn-intake (39 cells, measured).
  • The && !aborted check in pi/driver.ts can no longer be reached.
• Manager launch: passes both Rigel's continueSession (--continue) and upstream's reopenSession (manifest continuity: exact). Each has a separate trigger.
• Edits outside the conflicts:
  • dm-targets.smoke.ts now uses peer?.card.
  • The seed-case files expect the fork's 7 connectors and 9 extensions.
  • omp and zellij are bumped to 0.82.0, in lockstep with the fixed release group. Without this, the seed reconcile refuses omp.
  • Three mutation anchors that the merge broke are re-aimed.

Quarantined (Matt: hard-disable flaky or broken upstream tests, do not fix them)

• smoke:mutation-fixtures: 91 dead anchors on pristine upstream main.

• smoke:required-arg-seam: upstream call-site pins are stale (247/193 found against 229/179 pinned), and the tls site in control-target.ts cannot be checked.

• smoke:orphan-seat-reap, smoke:orphan-seat-spawn-window: upstream's in-process pty runtime gives no custody reference, so both crash on ready.reference.id.

• smoke:web-echo-escaping, smoke:instrument-instance-pin: fail on pristine upstream main locally (1/29 and 2/61 cells).

• smoke:manager-reconcile-startup, smoke:manager-restart-live: red on upstream main CI (runs 38756147210, 38753177566).

• smoke:up-tls-routes: delivery-refresh-keeps-tls failed once on this PR; passes locally on the merge and on main.

• smoke:seat-exit-cause, smoke:sys-rotation-e2e: fail on pristine upstream main locally.

• The schema direct-engine diagnostic unit step: fails on pristine upstream main; it now runs with continue-on-error and a LIVE_QUARANTINED entry.

• smoke:user-auth-launch:live: two foreground-spawn-beyond-grant cells fail on pristine upstream main locally.

• smoke:claude-hosted-presence, smoke:claude-hosted-types: new upstream suites that exit 0 without a COTAL_SMOKE_SENTINEL, so the shard grades them failed.

• smoke:transport-liveness:broker: passes its cells, then never exits on pristine upstream main (it hit the 60-minute shard limit on CI).

• Shards stop at their first red, so CI showed only a few at a time. A local run of every live CI suite on the sync head then found 17 more, each red on pristine upstream 8ca93e96: presence-render-census, manager-caller-transport, claude-workspace-trust, orphan-seat-rollback, runtime-mesh-turn, manager-stop-spare-guard, delivery-explicit-space, claude-hosted-session, cli-on-instance, legacy-packaged-manager, mint-provision:auth, mutation-metadata, mutation-reproof, orphan-seat-succession, remote-manager-goal-reader, suite-ambient-env-self, up-refresh-identity:live.

• Mutation reproof does not run on this branch (RIG-5497): a sync selects about 300 fixtures and runs out of the 130-minute budget. The daily --all sweep grades rigel-release after the merge.

• check:docs-voice gets back upstream's docs/design exemption, because the sync reintroduces eight upstream design records that upstream code cites.

• AGENTS.md records the rule so it is not asked again: broken upstream tests are disabled, and our own are fixed.

Review fixes

Review83 (review-lead) found four resolution gaps. Each fix has a test that fails without it:

• continueSession now refuses a blank value, like resume (manager cluster revision 28).
• omp declares supportsPrompt and arms events through launchArmsEvents.
• zellij answers startup prompts through confirmWatch, refuses before launch with SpawnRefused, and gives each confirm action one shared deadline.

CI fixes: dm-targets' fake endpoint gains upstream's presenceView and unicastAttributed. smoke:managed-retire-door:auth moves from the frozen ci-suites.txt into a fragment, as the shard-stability gate requires. Upstream deleted smoke:web-probe-target from the middle of the frozen list (3808751), which re-shards every suite below it. Its line comes back with a skip-only script, so the frozen list matches rigel-release exactly (437 entries, 0 indices moved).

A second merge brings in rigel-release 87f09fc (#81, #82). It keeps the rigel-release push trigger in ci.yml.

Custody stack merge (b0f572fa, 6a08beea, 7304d0e3)

A third merge (b0f572fa) brings in rigel-release 68a148c5, the RIG-4320 custody stack (#69–#76). Custody wins every conflicting hunk, per Matt's ruling.

• 6a08beea: upstream fix(manager): stop starting a seat custodian for default pty spawns on Linux Cotal-AI/Cotal#2351 made the default pty runtime spawn in-process on Linux, which dropped the custodian. CI caught it as spawn-action M3. createRuntime("pty") returns CustodialPtyRuntime on Linux again. The attach smoke and the pty docs match.
• Smoke adaptations: three upstream smokes build CustodialPtyRuntime with { root }. The custody-fail-closed fake endpoint answers the lifecycleMemberships inventory verb.
• Quarantined, unchanged, because they assert behaviour the custody contract forbids:
  • smoke:custody-exit-proof and smoke:seat-reap-group-identity: numeric pid/pgid reap. reap-group-identity moves out of smoke:seat-lifecycle and the seat test script into its own suite, so lifecycle stays gated.
  • smoke:freeslot-barrier:live (7304d0e3): expects a static orphan with no custody reference to retire; custody refuses an unproven reap. 7 cells fail locally.
  • smoke:up-stack:live (7304d0e3): expects an in-process pty seat to die with the manager on Ctrl-C. It gets its own continue-on-error step and a LIVE_QUARANTINED entry. 2 cells fail locally.
• Local on 6a08beea/7304d0e3: typecheck, pnpm test, check:docsbundle, gate-inventory pass; smokes manager-spawn-action, manager-spawn-action-auth, attach, custodial-pty, custody-fail-closed, manager-reconcile-redrive, cli-kernel, flag-inventory, mesh-attach, console-attach, seat-lifecycle, seat-orphan, manager-service-invoke pass.

Verification (local)

• Build and typecheck pass; pnpm test passes.
• Gates: gate-inventory OK, ci-suites 25/0, flag-inventory 443/443, package-test-contract 89/0, launch-parity 54/54, workflow-concurrency 29/0.
• Smokes: seat-lifecycle 51/0, seat-orphan 33, lifecycle-e2e 30/0, turn-intake 39/0, pi 166, send 39/0, seed 80/0, seed-checkout-store 32/0, npm-publish-preflight 178/0.

Notes

• jj-vine refuses a bookmark whose parent is another author's bookmark, so I forgot the local main mirror bookmark before submitting. Nothing was deleted on the remote.
• The custody stack (fix(manager): release seat handles when agents exit on their own (RIG-4320) #70–feat(manager,seat): seats under a distinct agent uid in a delegated cgroup (RIG-4320) #76) merges either before or after this PR. Whichever lands second rebases onto it.

Refs RIG-5440

Approved-at: 8adfa45

[linear-code]

RIG-5440

[rigel-mintaka]

agents lane review at f1db329

Scope: the 11 commits after the review-fix commit c3701c5f, up to f1db3295 (9 files, +91/-15). I did not re-review the merge resolution or the four Review83 fixes. Review83 (review-lead) covered those, per the Review fixes section above.

Verdict: clean. No findings.

• Quarantines (bin/smoke/ci-quarantine.mjs): each new entry names upstream 8ca93e96 plus a local or CI run, and has recheckBy: 2026-12-31. I checked 6 suite files against upstream and all are byte-identical: orphan-seat-reap, orphan-seat-spawn-window, orphan-seat-rollback, orphan-seat-succession, seat-exit-cause, legacy-packaged-manager. This matches Matt's RIG-5440 ruling to hard-disable broken upstream tests.
• ci.yml: only the schema direct-engine diagnostic step gets continue-on-error. The step still runs, so its output stays visible.
• mutation-reproof.yml: the skip applies only to same-repo pull_request events on the exact branch harness/rig-5440-upstream-sync. Other PRs still run reproof.
• ci-suites.txt: smoke:web-probe-target comes back as a skip-only script, so the frozen shard indices stay the same. managed-retire-door:auth moves to a fragment.
• scripts/check-docs-voice.mjs: byte-identical to upstream 8ca93e96.
• dm-targets.smoke.ts: the fake endpoint gains presenceView and unicastAttributed, and both share one message builder. No change in behavior.
• AGENTS.md: records the rule: upstream-broken tests are disabled, and tests for our own code are fixed by waiting for the event.

Checks at this head: 18 pass, 5 skipped. The only red is attribution, which needs Matt's Approved-at: f1db3295058eca397fe3070b0b65a2d8494c7bcb paragraph in the body. The branch is 0 behind rigel-release and mergeable.