Re-base the app-bundle overlay onto canonical opencode v1.18.29

[aarontrowbridge]

Important

Problem — The app-bundle overlay's upstream base is v1.18.12 while canonical
opencode has released through v1.18.29 (19 releases). The engine re-base program
pins the vendored runtime to stock canonical v1.18.29; if the overlay stays on
.12, every app surface drifts from the runtime it renders against. Phase-0 recon
(campaign ledger, loop 28a) proved stock v1.18.29 passes every feasibility gate
live: digest verification, per-boot auth, boot liveness, single-export legacy
plugin load, origin-root app, SSE, and the session-route shapes the frozen
session-list semantics expect.

Approach — Re-materialize the app source tree from the canonical v1.18.29
tag, re-derive the overlay drift report against the new base, repair overlay
files that upstream's 19 releases broke (mechanical class first), rebuild the
app bundle, and boot-proof it against the stock v1.18.29 binary. Bump the
manifest's upstream base to v1.18.29 with its archive sha.

Scope — in: overlay re-derivation + drift report + mechanical repairs +
manifest bump + boot proof · out: the engine lock pin change (separate slice),
the fork-server route disposition (separate slice), repairing breakage beyond
one slice's absorption (report the residual as an honest worklist).

Assumptions — Phase-0 gates green (proven); network access to fetch the
upstream tag archive; bun available for the app build.

Acceptance Criteria

• A fresh materialization at the v1.18.29 base builds the app bundle successfully.
• The drift report classifies every overlay file against the new upstream base (added / modified / unchanged / deleted) and is committed as a durable artifact.
• The boot proof passes against the stock v1.18.29 binary: origin document served (not the placeholder), asset content-types correct, per-boot auth gate (401 unauthed / 200 authed), /event SSE reachable.
• The manifest's upstream base reads v1.18.29 with the tag's archive sha recorded.
• Any overlay file that cannot be repaired in this slice is reported in a residual worklist with its breakage class — never silently dropped.

Testing Decisions

Reuse-first: the existing app-probe recipe (the boot-proof script) and the
drift-gate tooling from the .18 re-derivation are the gates. No new suites; the
drift report is the new artifact this slice adds.

Key Decisions

• The copy-overwrite conflict policy stays: overlay files replace upstream paths wholesale.
• The overlay remains the single Amicode UI source; where upstream superseded an overlay file, the drift report decides — updated or retired, never both live.
• The manifest sha is verified against the fetched archive before any repair work begins.

Constraints & Invariants

• Work happens in a worktree off fresh origin/main; the shared checkout's branch is never moved.
• Harness-neutral surfaces stay harness-neutral: no harness-specific vocabulary in shared surfaces.
• The drift report's classification must be derivable (re-runnable), not hand-written.

Prior Art

• The app-bundle materializer and its manifest (upstream base + sha fields).
• The drift-gate sweep from the .18 overlay re-derivation (the extractor's re-derivation pass).
• The app-probe recipe in the extension scripts directory (shell, assets, auth, SSE assertions).
• The Phase-0 recon artifacts under /tmp/opencode/recon-129 (a live stock v1.18.29 server to boot-proof against).

Source

Part of the re-base leg — campaign ledger sessions/session-20260827-harness-agnostic.md, loop 28.