feat: warm preload + unified adapter build for the Tokyo ECS runtime

[canyugs]

Summary

• Cherry-pick upstream 701db767 (preload_persisted_sessions readiness gate) — the fork was cut just before that merge, and the warm Tokyo ECS runtime depends on it. Two conflicts hand-resolved (config tests + main.rs pool wiring); config suite and the readiness-gate integration test pass.
• Build Dockerfile.claude with --features unified: the default feature set has no LINE adapter, and a non-unified binary exits at startup with "no adapter configured". This exact failure crash-looped ECS task-def rev 3 in production before the fix.

Deployed to Tokyo ECS as task-def rev 5 (oab/openab-multiturn@sha256:56746d68…) and E2E-verified: one LINE turn delivered as three structured openab.turn.v1 bubbles via the Push fallback.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Mo5khGdTnLRTUm8Q3LfZwc

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[opencodezebra]

Review Council started (round 1).

Baseline:

• Scope: 6 files changed (+466/−9)
• CI/checks: pending (0 contexts) at 3efc2d9

The council is reviewing this pull request; the verdict will follow as a separate comment when the round closes.

[opencodezebra]

CHANGES REQUESTED ⚠️ — documentation understates the blocking scope of preload_persisted_sessions; the feature itself is correctly implemented and well-tested.
Reviewed at 3efc2d9 (round 1)

What This PR Does

Cherry-picks the upstream preload_persisted_sessions readiness gate into the fork and fixes the Dockerfile.claude build to pass --features unified, preventing the "no adapter configured" crash-loop that hit Tokyo ECS task-def rev 3. Together these changes let the warm ECS runtime restore persisted ACP sessions before accepting traffic.

How It Works

• SessionPool::preload_persisted_sessions iterates persisted thread mappings and restores each via session/load under a ResumePolicy::Required policy that fails closed on any error (corrupt mapping, pool-size overflow, agent refusal).
• The gate runs in main.rs before any adapter, listener, or cron task starts — a failure aborts the process with a non-zero exit.
• Dockerfile.claude adds --features unified to both the dep-cache and final build stages so the LINE adapter is compiled in.

Findings

ID	Severity	Finding	Location
F1	🟡	Doc says preload blocks "before the unified webhook listener publishes /health" but it actually blocks the entire startup sequence (all adapters, cron, gateway) (raised by: rev-claude)	docs/config-reference.md:422
F2	🟢	Preload rejects invalid mappings, oversized pools, unsupported loading, and failed restoration — fails closed as designed (raised by: rev-codex)	crates/openab-core/src/acp/pool.rs:439
F3	🟢	Listener not started until preload gate succeeds (raised by: rev-codex)	src/main.rs:588
F4	🟢	unified feature compiles adapter code but activation remains gated by existing credential checks (raised by: rev-codex)	Dockerfile.claude:15

Finding Details

🟡 F1: Doc understates preload blocking scope

docs/config-reference.md:422 and crates/openab-core/src/config.rs:1727 describe preload_persisted_sessions as blocking "before the unified webhook listener publishes /health". In reality, main.rs:588 calls pool.preload_persisted_sessions().await? in the sequential startup flow — ALL adapters (Discord, Slack, gateway, unified webhook, cron scheduler) initialize after this point. An operator sizing ECS health-check grace periods around "/health delay only" would underestimate the stall window if an agent is slow to restore.

Fix: update both doc strings to say "before any adapter or listener starts" (two one-line edits).

What's Good (🟢)

• Fail-closed design: corrupt mapping, pool overflow, missing capability, and agent refusal all abort before readiness.
• ResumePolicy::Required vs BestEffort split cleanly separates preload semantics from lazy-resume without touching existing paths.
• Four targeted unit tests cover the failure modes; the integration test (preload_readiness.rs) confirms /health is withheld until the gate completes.
• Dockerfile fix is minimal and addresses a verified production crash-loop.

Baseline Check

• Main already has: lazy session resume, pool eviction, mapping persistence.
• Net-new value: operator-opt-in readiness gate that restores all sessions before traffic; build fix for unified feature.
• CI: pending (0 commit statuses); only [code]smith check present (skipped). No repo CI workflow ran against this head.

Review Metadata

• Reviewers: rev-codex (approve, security focus), rev-claude (approve, correctness focus)
• Consensus: approve with one doc fix
• Absent reviewers: none

---

🔴×0 🟡×1 🟢×3 · 💬 Comment @opencodezebra <question> for a follow-up · 🔁 Push new commits or comment @opencodezebra review <fix notes> to re-run the council · ✋ Disagree with a finding? @opencodezebra dismiss F1 <why it is not a defect>

[opencodezebra]

Council request_changes — 🔴0 🟡1 🟢3. Reviewed at 3efc2d9. Full report: #2 (comment)