[yaacovcorcos]

What Changed

Server tests no longer use the Scient source checkout as a workspace.

• Replay workspaces resolve like production. A new Scient test layer,
  orchestration-v2/scient-fork/ReplayWorkspacePolicy.testkit.ts, is the replay harness's default runtime
  policy. A local thread resolves to its worktree, else its project's root. A test thread with no project
  (which production refuses) gets its disposable replay profile. Explicit runtimePolicyOverride.cwd and
  runtimePolicyLayer still win.
• A guard in Git itself. src/testUtils/checkoutIsolation.setup.ts sets GIT_CEILING_DIRECTORIES to the
  checkout root for every server test. Git started anywhere below the root can't find the repository. That
  covers capture, ref publication, restore, clean, worktrees and any future path, whichever process runner
  starts Git. Fixtures in the OS temp directory are unaffected.
• Real checkpoints stay tested. The native-import projects are a small committed repository
  (checkpointWorkspace()) instead of a plain temp folder. One continuation test now checks that its run's own
  checkpoint is ready, in the project root, with its ref in that repository. A new case continues an import
  whose project folder is not a repository: the run completes there with no ready checkpoint.
• A latent test bug surfaced. The interrupted-replacement reopen test released its project workspace with
  its first runtime. Nobody noticed while every run used the checkout. It now keeps its projects for the
  whole test, as the file's other reopen test already did.
• PiObservedEffort drops a cwd override and comment that worked around the old behaviour.
• Shard weights are refreshed (9a4d18e3f7) from this PR's green CI run on 33303b63b5. The old
  weights (570 entries) predated this fix and many new files; now 823. Re-splitting that run's measured times
  gives 9.2 / 19.6 / 15.7 shard-minutes with the old weights and 14.8 / 14.8 / 14.8 with the new ones
  (Codex's exact reproduction, counting shard 2's 16 untimed skipped files at the 0.6 s default). GitHub
  truncated the Test Server 2 log, so that shard comes from the run's Vitest JSON report, which matches the
  full logs of shards 1 and 3 to a mean 0.05–0.09 s per file. On the next run (9a4d18e3f7) the shard jobs
  took 20 / 20 / 21 minutes; the slowest was no faster than the first run's 21, because that run did about a
  quarter more total work. main's two recent full runs had a slowest shard of 23.5–24 test-minutes.

Why

The replay harness's default policy leaves a local thread's cwd null, and Orchestrator.ts then
checkpoints process.cwd(). In tests that is apps/server, inside the checkout. So each turn captured the
whole repository and published refs/t3/orchestration-v2/checkpoints/* into its .git.

• Slow CI. On the last green main run, ConversationImporterContinuation.native.test.ts took 464 s (its
  tests move in ~8 s steps, one per whole-repository capture), PiNativeCloseConjunctions 127 s and
  stress/RestartRollback 41 s. test(server): isolate replay checkpoint workspaces #560's isolated run measured 29 s, 19 s and 3 s. The server shards are the
  longest jobs of every CI run.
• Flaky CI. Merge-queue run 38846481944 and main run 39159412448 failed in a server shard because that
  capture inside the checkout exited with Git error 128.
• Local side effects. One local run of the continuation file added 7 checkpoint refs to this checkout's
  .git, and 22 of its 27 tests timed out on Windows.

Two tests already worked around this locally, with comments saying so. This fixes it once, in the harness.

Divergence

File	Change
orchestration-v2/testkit/ProviderReplayHarness.ts (upstream)	Marked import and one marked block: the default policy is the Scient layer
apps/server/vite.config.ts (upstream)	One marked setupFiles entry
apps/server/src/testUtils/shardWeights.json (upstream data)	Regenerated

Everything else is Scient-owned. UPSTREAM.md records the seams. Upstream's harness has the same fallback,
so it's noted as worth upstreaming.

#593: it changes conversationImport.native-test-harness.ts to production's policy with a mocked
instance registry. With this PR that local override is redundant; whichever lands second drops it and keeps
#593's unrelated Layer.mergeAll additions.

Replaces #560.

Documentation Impact

Documentation impact: Updated — docs/operations/development.md (how replay tests get their workspace;
the Git guard), UPSTREAM.md.

Verification

Local, Windows 11 (Node 24.21.0, pnpm 11.10.0):

• ReplayWorkspacePolicy.test.ts (precedence, modes kept, project-less fallback, explicit override, store
  errors) and checkoutIsolation.test.ts (Git can't find the checkout from apps/server or below; a temp
  repository and the shared Git config still work).
• ConversationImporterContinuation.native.test.ts: all 28 pass, in 6.7 min. On main, 22 of its 27 time out
  here. With the harness seam reverted, the checkpoint check fails (scope cwd is …\apps\server), and the
  checkout's ref count stays unchanged even then: the Git guard blocked the writes.
• ProviderSwitch.integration, ThreadLaunchService pass.
• Server typecheck: no errors. vp fmt --check, vp lint on changed files (one existing warning),
  git diff --check.

Per-file CI times, two runs each side (main 18 and 19 October; this PR on 33303b63b5 and 9a4d18e3f7):
import continuation 464 s on main → 29 s and 34 s. Nothing else changes beyond the run-to-run spread:
replay fixtures 185 s on main, 124 s and 186 s here; ProviderSwitch 76–79 s vs 81–87 s;
NativeQueueHoldPolicy 65 s vs 68–76 s; OrchestratorMcpToolkit 22–23 s vs 24–36 s; AcpAdapterV2
87–89 s vs 73–89 s. Two runs can't settle differences that small. Second push (33303b63b5): all 12 required
checks green; rebased onto main ac705a0384 (no conflicts) with the weights commit; all 13 required checks
green on 9a4d18e3f7.

CI on the first push (afface466a): every check passed except Test Server 1, which caught the reopen-test bug
above; fixed in 33303b63b5.

Independent review, Codex gpt-6.1-sol (extra-high):

• Design, round 1: rework. The capture-only guard missed restore, clean, ref deletion and the fork baseline
  (answered with the Git ceiling); other answers are in the proposal's table.
• Implementation, round 2: approve with changes, no P0/P1. It confirmed the suspended policy shares the
  harness's stores, database and config. Fixed: the run's own checkpoint is checked, a non-repository case
  was added, the docs say the guard covers discovery from below the root, an unused import went, and the
  weight extractor now covers every test path and reconciles counts with each shard's summary.
• Weights commit, round 3: approve with changes, no P0/P1. It reproduced the weights file byte for byte
  and confirmed every key matches the sequencer's path format. Its corrections, both applied above: one run
  can't show that no file slowed, and the exact re-split figures.

Implemented through the Claude Code harness (Scient) using claude-opus-5-5.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.6 KiB	5.6 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	4.3 KiB	4.3 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.3 KiB	1.3 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	26.2 KiB	26.2 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.6 KiB	5.6 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	4.3 KiB	4.3 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.3 KiB	1.3 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	26.6 KiB	26.6 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 129f4af · PR result: 8683e79 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.
Full compact HTTP snapshot with live cursor.

• Codex decoded thread snapshot: 133.1 KiB
• Claude decoded thread snapshot: 133.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.