fix(runtime): close compute-host continuation gaps

[RecursiveIntell]

Summary

Complete the compute-host continuation boundary for deferred dashboard sessions and make the isolation certification harness observe asynchronous stream events correctly.

Changes

• Keep deferred sessions compute-host routed after serving-side agent prewarming.
• Use the canonical session-source resolver in the compute-host fallback path.
• Treat the void session-row persistence helper according to its actual contract: normal return admits the turn; fatal storage errors remain exception-signaled.
• Buffer WebSocket frames that arrive before the matching RPC response in the isolation certification harness.
• Add regression coverage for prewarm routing, fallback construction, void persistence admission, child turn protocol, and event-before-RPC ordering.

Verification

• Integrated continuity set: 130 passed, 0 failed.
• Complete tests/test_tui_gateway_server.py: 616 passed, 0 failed.
• Current changed Python paths: Ruff lint, compilation, and git diff --check passed.
• Synthetic isolation-off baseline: 37 heavy turns, serving p99 6331.7 ms, 8 serving stalls.
• Synthetic isolation-on run: 6/6 heavy turns, serving p99 408.2 ms, zero serving stalls, zero event-loop stall log lines.

The isolation measurements use a scratch, loopback-bound dashboard and a deterministic pure-Python heavy-turn seam. They do not claim provider quality, production availability, security certification, or independent benchmark validation.

Scope and non-effects

This commit contains only the six declared source/test paths. It does not include runtime receipts, scratch homes, raw host logs, credentials, service changes, database migrations, or historical-goal mutations.

Live activation and historical-goal handling remain separate managed gates.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-09-11T06:32:01.673157Z	0aeb55d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 0aeb55d — fix(runtime): complete compute-host continuation certificati}

⚠️ Warnings

OSV vulnerability scan · View job

50 known vulnerabilities found in pinned dependencies.

• CVE-2026-84375 in package-lock.json
• CVE-2026-84375 in website/package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-85062 in website/package-lock.json
• CVE-2026-13149 in package-lock.json
• CVE-2026-82417 in scripts/whatsapp-bridge/package-lock.json
• CVE-2026-82417 in website/package-lock.json
• CVE-2026-84369 in website/package-lock.json
• CVE-2026-75931 in website/package-lock.json
• CVE-2026-71554 in uv.lock
• CVE-2026-84368 in website/package-lock.json
• CVE-2026-73088 in website/package-lock.json
• CVE-2026-84381 in uv.lock
• CVE-2026-84381 in uv.lock
• CVE-2026-19693 in package-lock.json
• CVE-2026-84373 in package-lock.json
• CVE-2026-84373 in package-lock.json
• GHSA-8423-8fgw-73vq in uv.lock
• CVE-2026-84382 in uv.lock
• CVE-2026-70608 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 7m49s vs 6m19s (+23.7%). 27 job(s) slower, 10 faster, 1 unchanged.

• Python tests / Run tests slice 7/12: +102.0s
• Python tests / Run tests slice 3/12: +101.0s
• Python tests / Run tests slice 8/12: +76.0s
• JS & TS checks / apps/desktop / check:test:ui:shard-1of3: +70.0s
• Python tests / Run tests slice 2/12: +69.0s