feat: auto-resume polish + spawn-gate follow-ups — persistent crash trace, circuit breaker, cancel, Retry-After (katas znhn, bccd) - #582

…ollowups)

Validation wave results (7 verified, 6 falsified, 2 accepted-deferred):
- D-7 REVERSED: do not gate the opencode cold-start (A10: worst-case
  permit hold ~50-70s vs 10s door waits; singleton already bounds forks)
- D-3/Task 9: reconnect backstop clears stale recovering notices (A3:
  missed broadcast frames were a forever-lying notice)
- D-4/Task 8: registry-validate cancel ids; take_cancel emits the settle
  frame (A5: poisoned-flag path defused)
- D-1/Task 9: corrected clean-exit rationale; allowlist pinned as the
  out-of-order barrier (A1/A6)
- Task 7: thread cfg.healthy_lifetime_ms into the eviction condition;
  between-thresholds test (A8)
- Tasks 9/10: clear settle state on exit/replacement (A15 stale
  resumeCycles leak)
- Notes: Task 3 byte-identical payload (A9), Task 12 knob margins (A7),
  D-2 createRequestId verification record (A2)

Fresh-eyes review iteration 1 flagged two executable plan defects:

- Task 10: setPaneCrashTrace/clearPaneCrashTrace were specified against a
  paneId-only helper call, but the panes-tree traversal helpers take
  positional (state, tabId, paneId). Payloads now carry { tabId, paneId },
  the reducer bodies call findReconcileTerminalContent(state,
  action.payload.tabId, action.payload.paneId), and both TerminalView
  dispatch sites (terminal.replaced handler, banner onDismissCrashTrace)
  pass tabId. Also corrected the 'same traversal helper' claim: the
  reconcile-notice reducers use findReconcilePaneContent (:631); crashTrace
  uses its TerminalPaneContent-narrowed sibling findReconcileTerminalContent
  (:618).

- Task 9: the D-3 reconnect-backstop test referenced reconnectHandler!(),
  which the existing harness never captures (wsMocks.onReconnect is a bare
  mockReturnValue). Added an explicit harness-extension step: declare
  reconnectHandler next to messageHandler and capture it in beforeEach via
  wsMocks.onReconnect.mockImplementation, mirroring the messageHandler
  capture.

…art (znhn#4, bccd#3)

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

…e (bccd#1, bccd#5)

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

… (bccd#2)

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

…doors (bccd#4, D-7 reversed)

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

…ld (znhn#3)

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

…-flight resume (znhn#2)

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

…add cancel (znhn#2,#3,#6)

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

…n#1)

Note: the plan's no-code-change persistence premise held for the
persistMiddleware strip (denylist) and persistedState load (passthrough),
but normalizePaneContent is a whitelist reachable from hydratePanes — the
trace needed an explicit passthrough there to actually survive reload.

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

…znhn#2)

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

… immediately (znhn#1,#2,#3)

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

…sh-eyes)

A fresh create is a genuinely NEW identity-less conversation — the
persisted 'crashed & auto-resumed' trace belongs to the retired session
and must not leak onto it. The respawn branch deliberately keeps it
(same conversation).

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

…replaced tail (znhn#2 fresh-eyes)

A cancel landing after the hub's post-sleep take_cancel check (or for a
terminal that settles without ever reaching the Resume arm) leaked in
WsState.auto_resume_cancels forever. Every settle tail and the respawn
match tail now consume the entry, so 'removed on consumption' holds on
every path. Too late to abort at those points — cleanup, not abort.

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>