docs(changelog): v2.6.7-interrupt-guard + reconcile roadmap/review/openspec

CHANGELOG entry for v2.6.7. Plus the session's doc reconciliation: roadmap shipped record synced through v2.6.7 (v2.3 lifecycle marked shipped, relicense AGPL->MIT batch, fork-sweep lift items, claude-agent-sdk SessionStore, ACP package fix); boocode_code_review_v2 (two fork sweeps, relicense decision = 3 AGPL files, jinja gate green); openspec v2-3 reconciled to shipped (v2.5.4-v2.5.13); openspec v2-6 Phase 0/1 + P1.5 shipped, F.1 done, remaining-phase plan + lift sources.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

openspec/changes/v2-3-provider-lifecycle/design.md

@@ -2,6 +2,8 @@
 
 Detailed implementation plan for Paseo-style provider registration, readiness probing, and enable/disable toggles in BooCoder.
 
+> **✅ Shipped 2026-05-29 across `v2.5.4`–`v2.5.13` (reconciled 2026-05-31).** All 6 phases live. As-built deltas: the diagnostic ships as JSON `{ diagnostic: string }` (§6) rather than a plaintext HTTP body (§8's framing); the provider-management UI landed as a **Settings → Providers tab** (the §7.1 "or section under existing settings" path), not a standalone `ProviderSettingsDrawer`; `AddProviderModal` is at `apps/web/src/components/coder/`. **Deferred** (the §7.1 "optional phase 2" + tasks O.1–O.3): WS `provider_snapshot_updated` frame, `available_agents.enabled` column, diagnostic row-click modal — tracked in `docs/DEFERRED-WORK.md`.
+
 **Audience:** Sam + future agents implementing the batch.  
 **Paseo reference:** `/opt/forks/paseo/packages/server/src/server/agent/` (registry, snapshot manager, generic ACP), `/opt/forks/paseo/packages/app/src/screens/settings/providers-section.tsx` (UI behavior).
 

openspec/changes/v2-3-provider-lifecycle/proposal.md

@@ -1,10 +1,12 @@
 # v2.3 Provider lifecycle (Paseo-style registry)
 
-**Status:** Planned  
+**Status:** ✅ **Shipped** across `v2.5.4`–`v2.5.13` (2026-05-29; reconciled 2026-05-31) — all 6 phases live; only the 3 optional Tier-2 items deferred  
 **Depends on:** v2.2 Paseo providers (snapshot, modes, commands, ACP dispatch)  
 **Reference fork:** `/opt/forks/paseo`  
 **Related deferred work:** [`docs/DEFERRED-WORK.md`](../../../docs/DEFERRED-WORK.md) §2 (cold-probe skip)
 
+> **Shipped mapping (reconciled 2026-05-31):** Phase 1 → `v2.5.4`, Phase 2 → `v2.5.5`, Phase 3 → `v2.5.6`, Phase 4 → `v2.5.12`, Phase 5 → `v2.5.13`, Phase 6 docs → `v2.5.13`/`v2.5.14`. **Deferred (tasks O.1–O.3):** WS `provider_snapshot_updated` frame, `available_agents.enabled` column, diagnostic row-click modal — tracked in `docs/DEFERRED-WORK.md`. (Cursor was retired in `v2.5.3`, so the success-criterion mention below is historical.)
+
 ## Why
 
 BooCode v2.2 copied Paseo’s **snapshot wire shape** (modes, thinking, commands) but not Paseo’s **provider lifecycle**:
@@ -46,12 +48,12 @@ Paseo’s model (see `/opt/forks/paseo/public-docs/providers.md`) treats provide
 
 ## Success criteria
 
-- Add `amp-acp` via catalog → appears in picker after refresh without coder redeploy
-- Disable goose in settings → gone from picker, still visible as “Disabled” in settings
-- opencode not on PATH → shows “Not installed” in settings, hidden from picker
-- Second snapshot open within warm window completes in <500ms (no ACP spawns)
-- `POST /api/providers/refresh` still runs full cold probe
-- Existing v2.2 dispatch (cursor, opencode, claude, qwen) unchanged for built-ins
+- ✅ Add `amp-acp` via catalog → appears in picker after refresh without coder redeploy *(catalog smoke-test entry; per `boocode_code_review_v2.md` §5m, Amp itself is paid-cloud, not a usable local provider)*
+- ✅ Disable goose in settings → gone from picker, still visible as “Disabled” in settings
+- ✅ opencode not on PATH → shows “Not installed” in settings, hidden from picker
+- ✅ Second snapshot open within warm window completes in <500ms (no ACP spawns)
+- ✅ `POST /api/providers/refresh` still runs full cold probe
+- ✅ Existing v2.2 dispatch unchanged for built-ins *(opencode, claude, qwen, goose — cursor + copilot retired `v2.5.3`)*
 
 ## Deliverables
 

openspec/changes/v2-3-provider-lifecycle/tasks.md

@@ -2,70 +2,68 @@
 
 Implement in phase order from [`design.md`](./design.md). Do not commit unless Sam asks.
 
-## Phase 1 — Config + registry
+> **✅ SHIPPED across `v2.5.4`–`v2.5.13` (reconciled 2026-05-31).** All 6 phases done; the 3 Optional items (O.1–O.3) deferred (tracked in `docs/DEFERRED-WORK.md`). Verified in tree: `provider-config.ts`, `provider-config-registry.ts`, `command-availability.ts`, `provider-diagnostic.ts`, `acp-provider-catalog.ts`, `components/coder/AddProviderModal.tsx`, Settings→Providers tab.
 
-- [ ] 1.1 Add `CODER_PROVIDERS_PATH` to `apps/coder/src/config.ts` (default `/data/coder-providers.json`)
-- [ ] 1.2 Add `data/coder-providers.json` example + wire in `apps/coder/.env.host`
-- [ ] 1.3 Implement `provider-config.ts` (Zod schema + load/merge/save)
-- [ ] 1.4 Implement `provider-config-registry.ts` (`buildResolvedRegistry`, module singleton + reload)
-- [ ] 1.5 Unit tests: built-in override, custom ACP add, enabled false, invalid entry skipped
-- [ ] 1.6 Update `agent-probe.ts` to iterate resolved registry (include custom ids, respect enabled)
+## Phase 1 — Config + registry — ✅ `v2.5.4-provider-lifecycle-phase1`
 
-## Phase 2 — Snapshot lifecycle
+- [x] 1.1 Add `CODER_PROVIDERS_PATH` to `apps/coder/src/config.ts` (default `/data/coder-providers.json`)
+- [x] 1.2 Add `data/coder-providers.json` example + wire in `apps/coder/.env.host`
+- [x] 1.3 Implement `provider-config.ts` (Zod schema + load/merge/save)
+- [x] 1.4 Implement `provider-config-registry.ts` (`buildResolvedRegistry`, module singleton + reload)
+- [x] 1.5 Unit tests: built-in override, custom ACP add, enabled false, invalid entry skipped
+- [x] 1.6 Update `agent-probe.ts` to iterate resolved registry (include custom ids, respect enabled)
 
-- [ ] 2.1 Extend `ProviderSnapshotEntry` / status union in coder + web types (`loading`, `unavailable`, `enabled`)
-- [ ] 2.2 Add `command-availability.ts` (`isCommandAvailable`)
-- [ ] 2.3 Rewrite `buildProviderEntry`: never return null; handle disabled/uninstalled/loading
-- [ ] 2.4 Implement tier-2 skip using `available_agents.last_probed_at` + `PROVIDER_PROBE_TTL_MS`
-- [ ] 2.5 Return `loading` entries synchronously on cache miss; complete via inflight promise
-- [ ] 2.6 Extend `provider-snapshot.test.ts` for disabled, uninstalled, fresh DB skip, force refresh
-- [ ] 2.7 Verify warm cache: second snapshot call does not invoke `probeAcpProvider` (mock assert)
+## Phase 2 — Snapshot lifecycle — ✅ `v2.5.5-provider-lifecycle-phase2`
 
-## Phase 3 — Generic dispatch
+- [x] 2.1 Extend `ProviderSnapshotEntry` / status union in coder + web types (`loading`, `unavailable`, `enabled`)
+- [x] 2.2 Add `command-availability.ts` (`isCommandAvailable`)
+- [x] 2.3 Rewrite `buildProviderEntry`: never return null; handle disabled/uninstalled/loading
+- [x] 2.4 Implement tier-2 skip using `available_agents.last_probed_at` + `PROVIDER_PROBE_TTL_MS`
+- [x] 2.5 Return `loading` entries synchronously on cache miss; complete via inflight promise *(client-side poll deferred to Phase 5; cache miss returns `loading` then settles)*
+- [x] 2.6 Extend `provider-snapshot.test.ts` for disabled, uninstalled, fresh DB skip, force refresh
+- [x] 2.7 Verify warm cache: second snapshot call does not invoke `probeAcpProvider` (mock assert)
 
-- [ ] 3.1 Add `resolveLaunchSpec()` to `acp-spawn.ts`
-- [ ] 3.2 Wire `acp-dispatch.ts` to use launch spec + env merge
-- [ ] 3.3 Wire `dispatcher.ts` to load resolved def by agent name
-- [ ] 3.4 Unit test: custom command argv reaches spawn
-- [ ] 3.5 Smoke: task dispatch for one custom catalog provider (if installed on host)
+## Phase 3 — Generic dispatch — ✅ `v2.5.6-provider-lifecycle-phase3`
 
-## Phase 4 — HTTP API
+- [x] 3.1 Add `resolveLaunchSpec()` to `acp-spawn.ts`
+- [x] 3.2 Wire `acp-dispatch.ts` to use launch spec + env merge
+- [x] 3.3 Wire `dispatcher.ts` to load resolved def by agent name
+- [x] 3.4 Unit test: custom command argv reaches spawn (built-in dispatch byte-identical)
+- [x] 3.5 Smoke: task dispatch for one custom catalog provider (if installed on host)
 
-- [ ] 4.1 `GET /api/providers/config`
-- [ ] 4.2 `PATCH /api/providers/config` (merge + write file + reload registry + clear snapshot cache)
-- [ ] 4.3 `POST /api/providers/refresh` optional body `{ providers?: string[] }`
-- [ ] 4.4 `GET /api/providers/:id/diagnostic` (plaintext report)
-- [ ] 4.5 Extend `apps/web/src/api/client.ts` coder namespace
-- [ ] 4.6 Confirm BooChat proxy forwards new routes (or document direct :9502)
+## Phase 4 — HTTP API — ✅ `v2.5.12-provider-lifecycle-phase4`
 
-## Phase 5 — Web UI
+- [x] 4.1 `GET /api/providers/config`
+- [x] 4.2 `PATCH /api/providers/config` (merge + write file + reload registry + clear snapshot cache)
+- [x] 4.3 `POST /api/providers/refresh` optional body `{ providers?: string[] }`
+- [x] 4.4 `GET /api/providers/:id/diagnostic` *(ships as JSON `{ diagnostic: string }`, not plaintext — see design §8 delta)*
+- [x] 4.5 Extend `apps/web/src/api/client.ts` coder namespace
+- [x] 4.6 Confirm BooChat proxy forwards new routes (blanket `/api/coder/*` forward)
 
-- [ ] 5.1 Create `apps/web/src/data/acp-provider-catalog.ts` (5–10 curated entries)
-- [ ] 5.2 `AddProviderModal.tsx` — search, install → patch + refresh subset
-- [ ] 5.3 `ProviderSettingsDrawer.tsx` — list, status, toggle, refresh, link to add
-- [ ] 5.4 Entry point from CoderPane / AgentComposerBar (gear or settings link)
-- [ ] 5.5 Filter `AgentComposerBar` selectable providers (`enabled && ready`)
-- [ ] 5.6 Loading state while snapshot entries `loading` (poll or one-shot refetch)
-- [ ] 5.7 `npx tsc -p apps/web/tsconfig.app.json --noEmit`
+## Phase 5 — Web UI — ✅ `v2.5.13-provider-lifecycle-phase5`
 
-## Phase 6 — Docs, deploy, closeout
+- [x] 5.1 Create `apps/web/src/data/acp-provider-catalog.ts` (5–10 curated entries)
+- [x] 5.2 `AddProviderModal.tsx` — search, install → patch + refresh subset *(at `components/coder/`)*
+- [x] 5.3 Provider management UI *(shipped as a **Settings → Providers tab** in `SettingsPane.tsx`, not a standalone `ProviderSettingsDrawer` — design §7.1 "or section under existing settings")*
+- [x] 5.4 Entry point from CoderPane / AgentComposerBar (gear or settings link)
+- [x] 5.5 Filter `AgentComposerBar` selectable providers (`enabled && ready|loading`)
+- [x] 5.6 Loading state while snapshot entries `loading`
+- [x] 5.7 `npx tsc -p apps/web/tsconfig.app.json --noEmit`
 
-- [ ] 6.1 `BOOCODER.md` — config file, refresh contract, enable/disable
-- [ ] 6.2 Update `docs/DEFERRED-WORK.md` — mark tier-2 cold-probe item addressed
-- [ ] 6.3 `CHANGELOG.md` entry when tagged
-- [ ] 6.4 `pnpm -C apps/coder test && pnpm -C apps/coder build`
-- [ ] 6.5 `sudo systemctl restart boocoder`
-- [ ] 6.6 Smoke via Tailscale:
-  - `curl http://100.114.205.53:9502/api/providers/snapshot`
-  - PATCH disable goose → absent from composer, visible in settings
-  - POST refresh → models repopulate
-  - Add catalog entry → appears after refresh
+## Phase 6 — Docs, deploy, closeout — ✅ `v2.5.13` / docs `v2.5.14`
 
-## Optional (same batch if time)
+- [x] 6.1 `BOOCODER.md` — config file, refresh contract, enable/disable
+- [x] 6.2 Update `docs/DEFERRED-WORK.md` — tier-2 cold-probe item marked addressed
+- [x] 6.3 `CHANGELOG.md` entries (per-phase tags, not a single tag)
+- [x] 6.4 `pnpm -C apps/coder test && pnpm -C apps/coder build`
+- [x] 6.5 `sudo systemctl restart boocoder`
+- [x] 6.6 Smoke via Tailscale (snapshot / disable goose / refresh / add-catalog)
 
-- [ ] O.1 WS frame `provider_snapshot_updated` (skip polling)
-- [ ] O.2 `available_agents.enabled` column mirror
-- [ ] O.3 Diagnostic sheet UI (row click → modal)
+## Optional — ⬜ DEFERRED (tracked in `docs/DEFERRED-WORK.md`)
+
+- [ ] O.1 WS frame `provider_snapshot_updated` (skip polling) — **deferred**; `AgentComposerBar:219` polls instead (comment notes the absence)
+- [ ] O.2 `available_agents.enabled` column mirror — **deferred**; `enabled` read from config memory only (no DB column)
+- [ ] O.3 Diagnostic sheet UI (row click → modal) — **deferred**; the plaintext/JSON diagnostic API + Settings surface shipped, the modal polish did not
 
 ## Explicitly out of scope
 

openspec/changes/v2-6-persistent-agent-sessions/design.md

@@ -3,6 +3,8 @@
 Reference implementations: `/opt/forks/opencode` (server + SDK),
 `/opt/forks/paseo` (warm ACP + opencode server-manager + reasoning dedup).
 
+> **⚠️ Reconciled 2026-05-31 — read the proposal's Reconciliation note first.** §2a and §3 describe the *original* design; four details were revised during implementation (per-session SSE; `(chat_id, agent)` key + `worktrees` table; `session.next.*` events; password deferred) — flagged inline. **Phases 2–3 and the Phase-1 UX (§2b, §6, §9) are not yet built**; updated lift sources for them are in new **§10**.
+
 ## 1. Architecture overview
 
 ```
@@ -47,6 +49,8 @@ interface AgentBackend {
 
 ### 2a. OpenCodeServerBackend (shared HTTP server)
 
+> **⚠️ Shipped deltas vs the bullets below:** (a) **per-session SSE** — one `event.subscribe({directory})` per live opencode session (P1.5-a, `v2.6.2`), NOT one global `/event` loop; (b) events are **`session.next.*`** (`text.delta`/`reasoning.delta`/`tool.{called,success,failed}`), NOT `message.part.*`; (c) **`OPENCODE_SERVER_PASSWORD` deferred** — server binds loopback unsecured.
+
 - **Spawn once per BooCoder process:** `opencode serve --hostname 127.0.0.1 --port <p>`
   with `OPENCODE_SERVER_PASSWORD=<random-at-boot>` (verified: `serve.ts`, `network.ts`;
   default port 4096, prints `opencode server listening on http://…`). Use the official
@@ -82,6 +86,8 @@ interface AgentBackend {
 
 ## 3. Data model
 
+> **⚠️ Shipped (P1.5-b, `v2.6.3`–`v2.6.4`):** `agent_sessions` is keyed **`(chat_id, agent)`** (the tab/chat is the agent-context unit; `chat_id` CASCADEs from `chats`), and a first-class **`worktrees`** table (one-per-session, survives session delete via `session_id` `SET NULL`) replaced `session_worktrees`. `tasks.chat_id` threads the tab id to the dispatcher. The SQL below is the original `(session_id, agent)` / `session_worktrees` shape — see `apps/coder/src/schema.sql` for the live DDL.
+
 Agent switching is **free** within a chat (the picker is per-turn, not locked), so
 the worktree is shared across agents but each agent keeps its own backend session.
 That splits into two tables: one **shared worktree per chat**, and one **backend
@@ -281,3 +287,12 @@ over the new `agent` column and `agent_sessions` — no dispatch-logic change.
   "opencode's edits live in its worktree — boocode won't see them until applied."
   Derived purely from per-change `agent` + current `value.provider`; no new state.
   Keeps the §3a staging caveat from biting silently.
+
+## 10. Lift sources for the remaining phases (added 2026-05-31)
+
+From the second external review (`boocode_code_review_v2.md`). These supersede/augment §2b, §6, §9 for the unbuilt work:
+
+- **Phase 2 (warm ACP, goose/qwen) — `qwen --acp` is a validated reference.** qwen-code ships a real stdio multi-session ACP agent (`Map<sessionID,Session>`, `loadSession`/`unstable_resumeSession`, mid-session model/mode switch), so `warm-acp.ts` (§2b) wires qwen into the existing `acp-dispatch.ts` stack as planned. **Caveat:** goose ACP exposes **no `loadSession`/resume** → its cross-restart resume needs a different design than opencode's (re-`session/new` + accept memory loss, or replay). Cross-check qwen's `@agentclientprotocol/sdk@^0.14` vs BooCode's `^0.22` handshake before relying on `unstable_resumeSession`. (`boocode_code_review_v2.md` §5f, §5n.)
+- **Phase 3 (lifecycle hardening) — lift from `openchamber` (MIT, same warm-opencode-server architecture), not Paseo.** Health-monitor + crash auto-restart + busy-aware restart (skip-while-busy + stale-grace) + port reclaim (`killProcessOnPort`/`waitForPortRelease`) + stall-detecting SSE reader — a concrete state machine for §6's "supervise children / rebuild on next turn" sketch. Worktree reaper: Paseo's worktree-archive cascade (soft-delete + `Promise.allSettled` fan-out) + superset's destroy-saga (preflight dirty/unpushed inspect + ordered failure semantics). Bound the warm server's per-session Maps (LRU) — long-lived-daemon leak class. (`boocode_code_review_v2.md` §5c, §5b, §5j.)
+- **Fix-next (Phase 1/2) — the post-interrupt stale-terminal bug (confirmed live).** `opencode-server.ts:~307` settles any `session.idle` onto whatever `activeTurn` holds the session slot, with **no turn-identity guard** → after abort + new prompt, a stale `session.idle` from the cancelled turn settles the *new* turn early as success. Paseo fix `1d38aac` (suppress-terminal-until-next-user-message). **Now one-click reachable** since `v2.6.5` shipped the Send→Stop composer. (`boocode_code_review_v2.md` §1 #6, §3.)
+- **Phase 1 UX (§9) — opencode already streams token/ctx usage.** `session.next.step.ended` carries `{tokens, cost}` on the wire (SDK already installed) → consume it to fill ctx/token usage for opencode sessions, closing the "no usage for external agents" gap; surfaces beside the §9b chip. (`boocode_code_review_v2.md` §1 #8, §3.)

openspec/changes/v2-6-persistent-agent-sessions/proposal.md

@@ -1,10 +1,16 @@
 # v2.6 Persistent agent sessions (warm processes + OpenCode server)
 
-**Status:** Planned
+**Status:** Phase 0 + Phase 1 + P1.5-a/b **shipped** (`v2.6.0`–`v2.6.4`); Phase 1-UX, Phase 2, Phase 3, and unit tests **remaining.** (Reconciled 2026-05-31.)
 **Depends on:** v2.2 Paseo providers (ACP dispatch), v2.3 provider lifecycle (registry/snapshot)
-**Reference fork:** `/opt/forks/paseo`, `/opt/forks/opencode`
+**Reference fork:** `/opt/forks/paseo`, `/opt/forks/opencode`; **remaining-phase lift sources in `boocode_code_review_v2.md`** (openchamber → Phase 3, qwen-code → Phase 2).
 **Pairs with:** the v2.5.x MessageBubble "Thinking" render fix — reasoning already flows; this batch is about persistence, not capability.
 
+> **Reconciliation note (2026-05-31).** Four design details below were revised *during* implementation; the original prose/SQL is now superseded:
+> 1. **Per-session SSE** — one `event.subscribe({directory})` per live opencode session (P1.5-a, `v2.6.2`) replaced the single global `/event` read loop (design §2a).
+> 2. **`agent_sessions` is keyed `(chat_id, agent)`**, and a first-class **`worktrees`** table replaced `session_worktrees` (P1.5-b, `v2.6.3`); `session_id`/`worktree_id` are informational `SET NULL` (`v2.6.4`). The design §3 SQL is the *original* shape.
+> 3. **opencode streams `session.next.*` events**, not `message.part.*` (design §2a's event names were wrong).
+> 4. **`OPENCODE_SERVER_PASSWORD` was deferred** — the warm server binds loopback unsecured (design §2a specified a random password). Basic-auth scheme since confirmed (openchamber, `boocode_code_review_v2.md` §5c) if ever wanted.
+
 ## Why
 
 BooCode dispatches external agents (opencode, goose, qwen) **one-shot per task**:
@@ -93,18 +99,20 @@ this batch does not touch it beyond porting OpenCode's reasoning-dedup.
 
 ## Success criteria
 
-- Send two messages in one external-agent chat → second turn reuses the same agent
+(Status reconciled 2026-05-31: ✅ met · 🟡 partial · ⬜ remaining)
+
+- ✅ Send two messages in one external-agent chat → second turn reuses the same agent
   session **and** the same worktree (verified: no second `createWorktree`, agent
-  references files it edited in turn 1).
-- Warm-start latency for turn 2 materially below turn 1 (no spawn/handshake).
-- opencode reasoning shows once per thought (no dupes) in the Thinking block.
-- Killing the opencode server mid-session → pool restarts it and the next turn
-  recovers (opencode persists sessions on disk).
-- Switch opencode → boocode → opencode in one chat → opencode resumes its *same*
+  references files it edited in turn 1). *(opencode; Smoke 1, `v2.6.1`)*
+- ✅ Warm-start latency for turn 2 materially below turn 1 (no spawn/handshake). *(turn 2 ~9× faster, `v2.6.1`)*
+- ✅ opencode reasoning shows once per thought (no dupes) in the Thinking block.
+- ⬜ Killing the opencode server mid-session → pool restarts it and the next turn
+  recovers (opencode persists sessions on disk). *(Phase 3 — `opencode-server.ts` still comments "recovery is Phase 3")*
+- 🟡 Switch opencode → boocode → opencode in one chat → opencode resumes its *same*
   session (its memory intact), boocode saw opencode's turns as history, and all three
-  shared the one worktree. No agent is locked to the chat.
-- Closing/archiving a session removes its worktree; BooCoder restart drains cleanly.
-- Existing one-shot paths (arena, `new_task` tool, MCP create-task) still work.
+  shared the one worktree. No agent is locked to the chat. *(opencode↔boocode works; goose/qwen warm side is Phase 2 → full round-trip = Smoke 2b, unshipped)*
+- ⬜ Closing/archiving a session removes its worktree; BooCoder restart drains cleanly. *(delete-guard shipped `v2.6.2`, but the close→cleanup hook + orphan reaper are Phase 3)*
+- ✅ Existing one-shot paths (arena, `new_task` tool, MCP create-task) still work. *(dispatcher resolve-or-create fallback)*
 
 ## Deliverables
 

openspec/changes/v2-6-persistent-agent-sessions/tasks.md

@@ -4,37 +4,32 @@ Phased so each phase is independently shippable and smoke-testable. Phase 1
 (OpenCode server) delivers the most value on the cleanest API; goose/qwen warm
 ACP follows; hardening last.
 
-## Phase 0 — Foundations (no behavior change)
+## Phase 0 — Foundations (no behavior change) — ✅ SHIPPED `v2.6.0-phase0-foundations`
 
-- [ ] 0.1 Add `session_worktrees` + `agent_sessions` tables (per `(session_id, agent)`)
-      to `apps/coder/src/schema.sql` (idempotent; see design §3).
-- [ ] 0.2 Define `AgentBackend` / `AgentSessionHandle` interface + normalized `onEvent`
-      event union (reuse shapes from `acp-dispatch.ts`).
-- [ ] 0.3 Scaffold `agent-pool.ts` with lazy get-or-create keyed by `(chat, agent)`,
-      health, `dispose()`; wire `app.addHook('onClose')` to dispose alongside dispatcher `stop()`.
+- [x] 0.1 Tables added to `apps/coder/src/schema.sql` (idempotent) + `pending_changes.agent` column. *Later re-keyed to `(chat_id, agent)` + `worktrees` table in P1.5-b.*
+- [x] 0.2 `AgentBackend` / `AgentSessionHandle` interface + normalized `AgentEvent` union — `apps/coder/src/services/agent-backend.ts`.
+- [x] 0.3 `agent-pool.ts` scaffolded (lazy get-or-create, health, `dispose()`, `onClose` hook).
 
-## Phase 1 — OpenCode server backend (multi-turn, warm)
+## Phase 1 — OpenCode server backend (multi-turn, warm) — ✅ SHIPPED `v2.6.1-phase1-opencode` (Smoke 1 verified)
 
-- [ ] 1.1 Add `@opencode-ai/sdk` to `apps/coder/package.json`; pin to installed opencode major.
-- [ ] 1.2 `backends/opencode-server.ts`: spawn `opencode serve` once (random
-      `OPENCODE_SERVER_PASSWORD`, allocated port), `createOpencodeClient`, wait for ready line.
-- [ ] 1.3 Single `/event` SSE read loop; demux by `properties.sessionID`; map
-      `message.part.delta`/`updated` (text + reasoning) + tool parts to `onEvent`.
-- [ ] 1.4 Port Paseo `streamedPartKeys` reasoning dedup (delta vs final part).
-- [ ] 1.5 `ensureSession`: reuse the `(chat, opencode)` `agent_sessions` row if present
-      (resume on switch-back), else `client.session.create()` → store `agent_session_id`.
-- [ ] 1.6 `prompt`: send via SDK with `x-opencode-directory` = session worktree + `model`.
-- [ ] 1.7 Dispatcher: when `agent==='opencode'`, route to pool backend instead of
-      `dispatchViaAcp`; keep broker frames + `persistExternalAgentTurn` identical.
-- [ ] 1.8 Persistent worktree: chat-keyed `createWorktree` (shared across agents);
-      capture base commit in `session_worktrees`; reuse across turns and agents.
-- [ ] 1.9 Per-session concurrency: replace global `running` with `Map<sessionId,Promise>`;
-      `poll()` skips sessions with an in-flight turn.
-- [ ] 1.10 Per-turn diff → supersede prior `pending_changes` row for the session (latest-wins).
-- [ ] **Smoke 1:** two messages in one opencode chat → same `agent_session_id`, same worktree,
-      no second `createWorktree`; agent references turn-1 edits; reasoning shows once; turn-2 faster.
+- [x] 1.1 `@opencode-ai/sdk` added to `apps/coder/package.json`.
+- [x] 1.2 `backends/opencode-server.ts`: spawn `opencode serve`, allocated port, wait for ready line. *`OPENCODE_SERVER_PASSWORD` deferred — loopback-unsecured.*
+- [x] 1.3 SSE read loop + demux + text/reasoning/tool mapping. *Superseded by per-session SSE (P1.5-a); events are `session.next.*`, not `message.part.*`.*
+- [x] 1.4 Paseo `streamedPartKeys` reasoning dedup (delta vs final part).
+- [x] 1.5 `ensureSession` reuse/resume. *Re-keyed `(chat_id, agent)` in P1.5-b.*
+- [x] 1.6 `prompt` via SDK with worktree `directory` + `model`.
+- [x] 1.7 Dispatcher routes `agent==='opencode'` to the pool backend; broker frames + `persistExternalAgentTurn` identical.
+- [x] 1.8 Persistent worktree, chat-keyed, base commit captured, reused across turns/agents. *Now the first-class `worktrees` table (P1.5-b).*
+- [x] 1.9 Per-session concurrency: `Map<sessionId,Promise>`; `poll()` skips in-flight sessions.
+- [x] 1.10 Per-turn diff supersedes prior `pending_changes` row (latest-wins).
+- [x] **Smoke 1** — verified end-to-end (two turns, same session + worktree, turn 2 ~9× faster, reasoning once).
 
-## Phase 1 (UX) — Attribution & switch affordances (design §9)
+## Phase 1.5 — concurrency + chat-keying follow-ups (added during impl, not in original plan) — ✅ SHIPPED
+
+- [x] P1.5-a **Per-session SSE** (`v2.6.2-delete-guard-and-sse`): one `event.subscribe({directory})` per live opencode session, each with an `AbortController`; `sessionID` demux guard + zombie-loop fix — replaces task 1.3's single global loop. Bundled: session-delete work-loss guard (`/worktree-risk`).
+- [x] P1.5-b **Re-key `agent_sessions` → `(chat_id, agent)`** + first-class `worktrees` table (`v2.6.3-chatkey-and-skills`); `tasks.chat_id` threaded; `runOpenCodeServerTask` resolve-or-creates a chat for session-less creators; cross-chunk dcp-strip. FK convergence to `SET NULL` (`v2.6.4-agent-sessions-fk`).
+
+## Phase 1 (UX) — Attribution & switch affordances (design §9) — ⬜ REMAINING (pure read+display over already-shipped `pending_changes.agent` + `agent_sessions`)
 
 - [ ] U.1 Stamp `pending_changes.agent` at queue time (worktree path → task agent;
       native write tools → `'boocode'`; manual RightRail create → NULL).
@@ -45,10 +40,13 @@ ACP follows; hardening last.
       `useAgentSessions(sessionId)` (refetch on `message_complete`) (§9b).
 - [ ] U.5 `AgentComposerBar` optional `sessionId` prop → resumed / history / new-session
       chip beside the Provider picker; hidden on fresh chats and other callers (§9b).
+- [ ] U.6 Consume opencode `session.next.step.ended` `{tokens, cost}` → fill ctx/token usage for opencode sessions (SDK already installed; closes the "no usage for external agents" gap; surface beside the §9b chip). Source: `boocode_code_review_v2.md` §1 #8, design §10.
 - [ ] **Smoke U:** stage edits with opencode then boocode → DiffPanel badges each row to the
       right agent; composer shows "resumed" when re-selecting opencode, "new session" for goose.
 
-## Phase 2 — Warm ACP backend (goose, qwen)
+## Phase 2 — Warm ACP backend (goose, qwen) — ⬜ REMAINING
+
+> **Lift (design §10):** `qwen --acp` is a validated reference (real stdio multi-session, `loadSession`/resume) — wire qwen into the existing `acp-dispatch.ts` stack. **goose ACP has no `loadSession`/resume** → cross-restart resume needs a different design (re-`session/new` + accept memory loss, or replay). Cross-check qwen `@agentclientprotocol/sdk@^0.14` vs BooCode `^0.22` before relying on `unstable_resumeSession`. Do **qwen first** to de-risk.
 
 - [ ] 2.1 `backends/warm-acp.ts`: persistent spawn + `ClientSideConnection`; `initialize` +
       `session/new` once; reuse `acp-dispatch.ts` `handleSessionUpdate`.
@@ -62,12 +60,14 @@ ACP follows; hardening last.
       resumes the SAME `agent_session_id` (memory intact), boocode saw opencode's turns as
       history, all three shared the one worktree, and no agent was locked to the chat.
 
-## Phase 3 — Lifecycle hardening
+## Phase 3 — Lifecycle hardening — ⬜ REMAINING
+
+> **Lift (design §10):** hardening from **openchamber** (MIT, same warm-opencode-server architecture) — health-monitor + crash auto-restart + busy-aware restart + port reclaim (`killProcessOnPort`/`waitForPortRelease`) + stall-SSE = a concrete state machine for 3.1/3.2/3.6. Reaper (3.3/3.4): Paseo worktree-archive cascade + superset destroy-saga (preflight dirty/unpushed inspect) + LRU cap on warm-server Maps. Do crash-recovery + reaper together (shared supervision loop).
 
 - [ ] 3.1 Idle TTL eviction keyed per `(chat, agent)`; reattach-on-next-turn from `agent_sessions`.
 - [ ] 3.2 Crash recovery: opencode server restart recreates sessions; ACP re-`session/new`.
 - [ ] 3.3 Chat close/archive hook → `closeSession` for every `(chat, agent)` + remove the
-      shared `session_worktrees` row + worktree; mark agent rows `status='closed'`.
+      chat's **`worktrees`** row + worktree (NOT `session_worktrees` — superseded P1.5-b); mark agent rows `status='closed'`.
 - [ ] 3.4 Orphan worktree reaper (extend periodic sweeper) + max-live-worktrees LRU cap.
 - [ ] 3.5 Re-baseline worktree diff after `apply_pending`.
 - [ ] 3.6 Reconnect test: restart BooCoder mid-session → next turn reattaches/recreates cleanly.
@@ -75,20 +75,36 @@ ACP follows; hardening last.
       provider can't see another agent's unapplied worktree edits (derived from per-change
       `agent` + current provider; no new state).
 
-## Tests
+## Tests — ⬜ REMAINING (none of T.1–T.3 exist yet)
 
 - [ ] T.1 `agent-pool` unit: get-or-create, idle evict, dispose drains in-flight (DB-opt-in pattern).
-- [ ] T.2 opencode SSE demux + reasoning dedup unit (fixture event stream).
+- [ ] T.2 opencode SSE demux + reasoning dedup unit (fixture event stream). *Fold in an F.1 interrupt-bug regression case.*
 - [ ] T.3 per-session concurrency: two sessions run concurrently, one session serializes.
 
 ## Docs
 
-- [ ] D.1 Update `CLAUDE.md` (BooCoder dispatch section) + `BOOCODER.md` health/contract.
-- [ ] D.2 Note opencode `@opencode-ai/sdk` dep + `OPENCODE_SERVER_PASSWORD` env in env docs.
-- [ ] D.3 `CHANGELOG.md` entry on tag (`v2.6.0-persistent-agent-sessions`).
+- [~] D.1 `CLAUDE.md` BooCoder-dispatch section **done** (v2.6.1 / v2.6.4 doc-syncs); **`BOOCODER.md` health/contract still pending** (no v2.6 warm-server mentions).
+- [~] D.2 `@opencode-ai/sdk` dep noted; `OPENCODE_SERVER_PASSWORD` env n/a (deferred — loopback-unsecured).
+- [x] D.3 `CHANGELOG.md` entries per tag (`v2.6.0`–`v2.6.4`) — shipped as 5 tags, not the single planned `-persistent-agent-sessions`.
 
-## Build / deploy gate
+## Build / deploy gate — ✅ (per shipped tags; re-run per remaining batch)
 
-- [ ] B.1 `pnpm -C apps/server build && pnpm -C apps/coder build` clean.
-- [ ] B.2 `pnpm -C apps/server test` (+ DB-opt-in) green.
-- [ ] B.3 Deploy: `sudo systemctl restart boocoder`; `curl :9502/api/health` reports tool count.
+- [x] B.1 `pnpm -C apps/server build && pnpm -C apps/coder build` clean.
+- [x] B.2 `pnpm -C apps/server test` green. *(v2.6-specific T.1–T.3 units still unwritten.)*
+- [x] B.3 Deployed (`sudo systemctl restart boocoder`; `curl :9502/api/health`).
+
+-----
+
+## Fix-next (before Phase 2) — ✅ SHIPPED `v2.6.7-interrupt-guard`
+
+- [x] F.1 **Post-interrupt stale-terminal guard.** opencode emits one trailing `session.idle`/`session.error` for a cancelled turn (sessionID only, no turn id) which settled the *next* turn early. Fixed with a pure per-session guard (`backends/turn-guard.ts`: `armAbortGuard`/`noteTurnActivity`/`consumeTerminal` over `swallowNextTerminal`) wired into `opencode-server.ts` (arm on abort, swallow the orphan terminal, self-heal on next-turn activity). 3 regression tests (`turn-guard.test.ts`), TDD. Paseo parallel: `1d38aac`.
+
+## Remaining — recommended order (implementation plan, 2026-05-31)
+
+1. ~~**F.1 interrupt-bug fix**~~ — ✅ shipped `v2.6.7-interrupt-guard` (3 regression tests, TDD).
+2. **Phase 1-UX** (U.1–U.6) — pure read+display over already-shipped `pending_changes.agent` + `agent_sessions`; no dispatch-logic or backend change, so it ships value on data that already exists. U.6 (token/ctx usage) rides the same opencode SSE.
+3. **Phase 2 — warm ACP, qwen first then goose** — qwen has a validated `--acp` reference; goose's missing resume is the open design question, so qwen de-risks the pattern. Smoke 2 + 2b (the switch round-trip success criterion).
+4. **Phase 3 — lifecycle hardening** — lift openchamber's state machine; do crash-recovery (3.1/3.2/3.6) + worktree reaper (3.3/3.4 + LRU) together (shared supervision loop). Closes the two ⬜ success criteria (server-crash recovery, close→cleanup).
+5. **Tests T.1–T.3 + `BOOCODER.md` (D.1 remainder)** — backfill alongside each phase, not at the end.
+
+Each phase stays independently shippable + smoke-testable (original phasing holds). Tag monotonically from `v2.6.7`, one batch per phase.