Add thread lifecycle ownership and fix dependent worker cleanup

[ymichael]

Human comments

What was wrong

Side chats and workflow workers could outlive their origins, continue executing, or retain environments. Replacing a workflow worker lost references to earlier attempts, and notifications to unavailable origins could retry indefinitely. Review also found timestamp resets, inconsistent archive traversal, and shutdown/retry races.

What changed

• Added immutable, creation-only lifecycleOwnerThreadId, independent of sidebar parent, fork source, visibility, and plugin attribution. Owners may be in another project, environment, or host.
• Owner archive recursively stops and archives dependents; owner deletion recursively deletes them. Unarchive does not restore dependents automatically, dependent actions do not affect the owner, and ordinary Stop does not cascade.
• Preserved existing archive/delete timestamps. Individual, environment-wide, and project deletion now share lifecycle-tree traversal and resolve each dependent's environment.
• Validated owner admission in the same immediate transaction as thread insertion. The restrictive FK retains owners until dependent cleanup succeeds; migration 0121 adds only the column, index, and FK and leaves existing threads unowned.
• Side chats use their source as lifecycle owner. Workflows durably track every worker attempt, recover interrupted cleanup with capped backoff, abandon notifications to unavailable origins, and amortize worker discovery/origin reconciliation.
• Codex shutdown closes stdin for orderly cleanup, ignores late approval writes, rejects new requests during shutdown, and escalates through SIGTERM before SIGKILL.
• Exposed lifecycle ownership through SDK, API, and CLI (--lifecycle-owner-thread) and updated the guide/API audit. Plugin SDK is 0.4.98 with matching Workflows and Side Chat minimums. No daemon wire change or protocol bump.
• Follow-up review changes restore owner-first archive undo, centralize project lifecycle-tree selection, retain cleanup ownership after history expiration, stagger legacy worker cleanup, and cap origin reconciliation frequency.

How you verified

• At 408130292c, targeted Turbo suites passed: 2,743 server, 4,690 app, 525 DB, 624 CLI, 294 Codex provider, and 240 Workflows tests (9,116 passed total; 4 skipped). All 14 Turbo tasks succeeded.
• The prior full CI run was green at e02f848f7a, including all active test shards, build/typecheck/lint, and Linux/macOS package smoke. Current-commit CI is pending after this update.
• Rebuilt and restarted the isolated pnpm start:worktree server. Server and daemon health passed, the host connected, the app rendered in a real headless browser, and Workflows started with a fresh isolated plugin store.
• Drove the current source CLI against the server: created owner → child → grandchild lifecycle ownership, confirmed one archive cascaded with the same timestamp, confirmed dependent unarchive returned HTTP 409 while its owner was archived, confirmed owner restoration did not restore dependents, and confirmed owner deletion recursively returned 404 for all three disposable threads.
• Earlier live verification used actual Codex turns to confirm active command PID termination on owner archive, stable repeated-archive timestamps, dependent row/storage removal, workflow worker retirement, cross-project deletion in both directions, Side Chat deletion, notification abandonment, storage failure/reconnect recovery, and graceful provider termination fallback.
• Regression coverage includes lifecycle admission, rejected updates, timestamp preservation, deleted candidates, cross-environment traversal, cross-project deletion/reconnect, archived-runtime reconciliation, empty CLI values, late approval replies, cleanup retry deadlines/caps, origin scan amortization, and worker ownership retained beyond workflow-history expiration.

Limits: live checks used one host and unmanaged fixture directories. Remote-host outage, managed-machine retirement, forced native crash containment, and iOS were not exercised live; deterministic harnesses cover failure and reconnect paths. The verification inventory still reports unrelated pre-existing browser CLI catalog drift. No production records were changed.

The isolated inspection server remains available at https://ymichael--20713.getbb.app (Connect login).

AGENT GENERATED