fix: keep orchestrator respawn stable across prefix changes

[polymath-orchestrator]

Summary

• Root cause: orchestrator canonical branch verification used the mutable display sessionPrefix, so changing that config could make respawn expect a different infra branch than the live orchestrator worktree used.
• Fix: derive orchestrator branch identity from the stable project ID prefix while keeping sessionPrefix as the display/workspace prefix for user-facing names.
• Fix: make post-spawn orchestrator replacement verification non-fatal; mismatches emit a structured warning with ORCHESTRATOR_REPLACEMENT_VERIFICATION_FAILED and remediation instead of blocking respawn.
• Cleanup: remove the prior SESSION_PREFIX_LOCKED config guard and its active-orchestrator store probe.

Closes #113

Test plan

• go test ./internal/service/session ./internal/session_manager ./internal/service/project ./internal/storage/sqlite/store -count=1
• go build ./... && go vet ./... && go test ./... from backend/

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[Copilot]

Pull request overview

This PR fixes orchestrator respawn instability caused by deriving the orchestrator’s canonical branch name from the mutable sessionPrefix. It decouples orchestrator branch identity from display/workspace prefixes, so a sessionPrefix change won’t strand a live orchestrator or break replacement/respawn flows.

Changes:

• Derive orchestrator default branch naming from a stable project-ID-derived prefix, while keeping sessionPrefix for user-facing/session/workspace naming.
• Make orchestrator replacement verification non-fatal by emitting a structured telemetry warning instead of failing the respawn.
• Remove the prior SESSION_PREFIX_LOCKED guard path and the related store/service probe (HasActiveOrchestrator), plus associated tests.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
backend/internal/storage/sqlite/store/store_test.go	Removes tests for HasActiveOrchestrator after the feature is deleted.
backend/internal/storage/sqlite/store/session_store.go	Removes HasActiveOrchestrator EXISTS probe from the sqlite store.
backend/internal/session_manager/manager.go	Uses a stable prefix for orchestrator branch naming while keeping display prefix behavior for workspaces.
backend/internal/session_manager/manager_test.go	Adds coverage to ensure orchestrator branch ignores display sessionPrefix.
backend/internal/service/session/service.go	Makes replacement verification non-fatal and emits telemetry warnings; updates expected branch derivation.
backend/internal/service/session/service_test.go	Updates/adds tests for stable orchestrator branch behavior and non-fatal verification warnings.
backend/internal/service/project/service.go	Removes SESSION_PREFIX_LOCKED enforcement; switches default prefix derivation to shared helper.
backend/internal/service/project/service_test.go	Removes lock-related tests; keeps coverage for sessionPrefix updates and other config edits.
backend/internal/domain/project.go	Introduces DefaultProjectPrefix / DefaultProjectPrefixLength as the shared prefix derivation helper.
backend/internal/adapters/workspace/gitworktree/workspace.go	Uses domain.DefaultProjectPrefix when no explicit sessionPrefix is provided.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nhod-codex]

INDEPENDENT RE-REVIEW — PR #135, cycle 2
Reviewer family: claude
Head SHA: d8dbbef
Buckets reviewed: bugs, architecture, security, performance, repo-specific-invariants, tests, spec-drift, bypass-flags, docs
Verdict: clean / approve. Previous medium finding fixed.

Fixed finding verified: the unrelated sqlite regression test TestCreateSessionRejectsSecondLiveOrchestratorForProject is restored, while the obsolete HasActiveOrchestrator prefix-lock coverage remains removed. Claude left only low notes about an abnormal stale-worktree edge and documenting one-time branch migration; neither is a medium+ merge blocker. Local backend gate passed after the fix: go build ./..., go vet ./..., go test ./.... GitHub CI is green on this head. Active review threads: none.