[37/37] Reconcile OpenCollection PR review fixes

[cjohnsto-nz]

Purpose

This PR lands after #71 and owns review corrections that do not safely belong on historical implementation branches. That keeps the implementation PRs aligned with their assigned task scopes and avoids forcing review-only conflicts through the descendants.

Included corrections

• 4631068 validates WebSocket binary payloads.
• a2f2b2e, cff9785, 87f10e3, and f4d5eb0 correct stale audit, ledger, and acceptance evidence.
• 2b50626 adds gRPC streaming message-sequence authoring.
• d67c2dc pins the local VSCE packaging tool.
• d725810 secures runtime script-variable handling and fixtures.
• d6b3799 preserves the base-plan dependency and ownership clarifications relocated from PR [01/36] Add OpenCollection agent plan #35.
• 3861f90 preserves WebSocket transport-failure coverage relocated from PR [10/36] Add OC-020 WebSocket support #44.
• c303d27 preserves request-action dispatch guards relocated from PR [36/36] Fix request action first-click reliability #71.
• 06ed31a preserves OC-150 assertion and response-state corrections relocated from PR [32/36] Add OC-150 runtime assertion variables UX #67.
• 2616402 and c7ba06a preserve WebSocket session-lifecycle and panel-disposal corrections relocated from PR [29/36] Add OC-140 WebSocket lifecycle UX #61.
• 6053a8f normalizes the reconciled documentation and fixture file endings.

Exact final-stack validation

The live remote heads were composed in merge order:

35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 63, 51, 52, 53, 56, 54, 64, 57, 62, 58, 59, 60, 61, 65, 66, 67, 68, 69, 70, 71, 72.

Results:

• 37/37 sequential merges completed without conflicts.
• The live composite tree is cbd75fa780b93f233bd7fd55096a7af10d210e9d.
• git diff --check passed.
• TypeScript compile passed.
• production schema and extension build passed.
• 31 test files and 539 tests passed.
• demo collection validation passed 47/47 files.
• every changed immediate stack edge passed the mandatory three-way merge simulation.
• GitHub build and security checks pass; this PR is MERGEABLE / CLEAN.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vscode/​vsce@​3.9.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm cheerio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@vscode/vsce@3.9.2 → npm/cheerio@1.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cheerio@1.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm underscore is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@vscode/vsce@3.9.2 → npm/underscore@1.13.8 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/underscore@1.13.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cjohnsto-nz]

Final reconciliation is complete.

This PR now owns every review correction that produced a latent conflict when placed on a historical implementation branch: the PR #35 clarifications, PR #44 transport coverage, PR #61 lifecycle corrections, PR #67 OC-150 corrections, and PR #71 dispatch guard. The originating branches have been restored to their task-scoped heads; none of the fixes were discarded.

I validated the live remote state, not a local approximation:

• all 37 PR heads composed in actual stack order
• 37/37 sequential merges completed without conflicts
• final composite tree: cbd75fa780b93f233bd7fd55096a7af10d210e9d
• git diff --check passed
• TypeScript compile passed
• production schema and extension build passed
• 31 test files / 539 tests passed
• demo collection validation passed 47/47 files
• GitHub reports every PR in the stack MERGEABLE / CLEAN with all checks passing

This PR is the single stack-tip rework owner for these cross-cutting review corrections.

[cjohnsto-nz]

Second-review reconciliation is complete.

I re-reviewed all 37 PRs in stack order and found 12 comments that were not present during the first pass, on PRs #36, #46, #49, #50, #52, #53, #54, #56, #58, #59, #61, and #65. Each now has a direct, evidence-backed response. Valid findings were either confirmed as already fixed on the owning branch or implemented here when changing the historical branch would disturb its descendants; incorrect or out-of-scope findings were answered concretely.

This branch adds the remaining stack-safe reconciliation work, including:

• an explicit compile step in PR CI;
• corrected task and ledger ownership/status;
• local-only mTLS fixture and TLS-toggle documentation;
• the later-stack persistence, WebSocket-history, and script-variable fixes already recorded by their implementation commits.

Final verification:

• all 37 live PRs report MERGEABLE/CLEAN;
• every adjacent base/head edge was reproduced locally without conflicts;
• all 37 heads compose sequentially without conflicts;
• npm run build passed;
• npm run compile passed;
• 31 test files / 539 tests passed;
• 47 / 47 demo validations passed;
• this PR's build/test and both Socket checks passed.

No historical branch was rewritten for a fix that belongs on this final rework layer.