fix: harden plugin shutdown and cold-pass isolation

[kernel-oops]

Summary

• implement OpenCode's supported asynchronous dispose hook and declare engines.opencode >=1.15.11
• quiesce cold-pass, incremental, timer, and persistence work before bounded shutdown and SQLite close
• make summarizer worker cleanup safe across writer-lease handoff using unique ownership and authoritative lease rechecks
• quarantine malformed sessions by sessionID + timeUpdated so one bad historical row cannot abort and retry the entire cold pass
• preserve valid recall data across transient metadata transport failures and retry it on later activity

Why

A plugin instance currently owns timers, SQLite state, background distillation, and summarizer workers without exposing lifecycle disposal. When OpenCode disposes a per-directory plugin instance, those resources can remain alive. Separately, one legacy session with an obsolete response shape can abort the complete cold pass; the global retry then scans thousands of healthy sessions again roughly once per minute.

Verification

• formatting and ESLint pass
• source and test TypeScript checks pass
• ESM build and declaration generation pass
• Vitest: 384 passed, 7 skipped (21 files passed, 2 skipped)
• focused disposal, lease-handoff, malformed-session, and metadata retry race tests pass repeatedly

Residual constraints

• the OpenCode SDK does not expose cancellation for already-started requests; shutdown prevents late SQLite work but may wait for an in-flight non-summarizer request
• a create request that outlives the bounded shutdown window may leave a uniquely owner-tagged remote worker for a later lease holder to remove
• quarantined revisions are kept in bounded in-memory state and are retried after plugin restart
• orphan discovery remains bounded to the existing session-list page size

[rmk40]

Thanks for this PR — the problem selection is exactly right (the cold-pass poisoning by one malformed session and the missing disposal lifecycle were both real gaps), and the test craftsmanship is above what most of this repo had: the Proxy-based post-close SQLite counter and the rival-store lease probe are patterns we're keeping.

I've reviewed it in depth (three independent review passes), merged main (v2.1.0) into the branch, and pushed maintainer fix commits directly (you had "allow edits by maintainers" on — thanks for that). Summary of what changed and why:

edf4738 — findings from the first review pass:

• Dropped engines.opencode. opencode hard-enforces engines and would refuse to load the plugin on any older host. dispose is an optional hook — old hosts simply never call it, so no gate is needed. (Also: the type appears in plugin 1.15.11, but there's upstream indication the host may not invoke it until 1.15.13, so the floor was unverifiable anyway.)
• Bounded dispose(). The unbounded distiller.stop() / operations waits could hang the host's shutdown forever on a never-settling in-flight request — your own residual-constraints note, but the host awaits dispose with no timeout of its own, so "may wait" meant "may wedge opencode on exit." Your settleWithin was the right primitive; it now wraps both phases.
• fetchMessagePage strictness is now opt-in (strict: true, distiller-only). The non-array throw also changed the query path (recall_messages/recall_context/drill), reverting a documented deliberate decision ("a session with no data returns an empty page rather than an error"). The distiller keeps the strict behavior it needs for quarantine.
• Owned-worker cleanup is no longer lease-gated. deleteOwnedWorker routed through the lease check, so losing the lease mid-batch skipped deleting a worker this process created — inverting the PR's own goal. Ownership of one's own remote worker is a separate authority from the SQLite writer lease; deletion now gates on ownership only.
• Authoritative ownsLease() before every distiller store write — closes the stale-writer window where a >TTL-suspended process resumes a fetch and writes after a rival took over.
• ownsLease predicate fixed to holder-identity only (own stale heartbeat ≠ loss — self-demotion cost a 60s stall), quarantine catch narrowed with quarantinedCount observability, status() made side-effect-free, plugin devDep bumped to 1.18.23 so tsc verifies the real dispose signature (augmentation deleted), guardTool returns the {ok:false} JSON shape, CHANGELOG entry.

45b2805, 953f046, 8d8f733 — findings from re-review of our own fixes (the panel reviewed the fixes as hard as the original): close is deferred (not skipped) when a foreground op outlives the bound — avoids both the use-after-close and a handle leak on instance eviction; recordProgress and the cold-pass "done" transition joined the lease fence; pagination sleeps are cancellable in quiesce(); 404-vs-transport classification fixed to the actual SDK discriminant (name: "NotFoundError") with tests; the owned-worker retry is now real (per-batch drain, capped at 3, 2-attempt give-up, batch-skip while the backlog is saturated).

Where we deliberately held your design: the quarantine mechanism (keying, cap, invalidation-on-update) is untouched — it's sound. The quiesce-retains-heartbeat sequencing is untouched — that was the right call. The TypeError-as-malformed classification stays, now documented as an explicit accepted tradeoff with its bounds.

Final state: 435 tests green, perf budgets verified under RECALL_PERF=1 (distill p50 0.85ms vs 150ms budget; rank p95 10.45ms vs 50ms), eval baseline intact. Merging once CI confirms on the updated head.