fix(server): coordinate session creation lifecycle

[NWYLZW]

Summary

• make HTTP session creation the only database writer while early WebSocket connections wait for the completed creation lifecycle
• reject adapter startup for missing sessions and avoid attaching sockets that close during startup
• share cancellation state across overlapping creation attempts and add regression coverage for races, failures, timeouts, and termination

Changelog

• Changelog path or "Not applicable": changelog/1.0.0-rc.4/server.md

Screenshots

Not applicable

Validation

• pnpm exec vitest run apps/server/__tests__/services/session-creation-lifecycle.spec.ts apps/server/__tests__/websocket/server.spec.ts apps/server/__tests__/websocket/connection-loading.spec.ts apps/server/__tests__/websocket/lazy-connection.spec.ts apps/server/__tests__/services/session-start.spec.ts apps/server/__tests__/services/session-create.spec.ts apps/server/__tests__/routes/sessions.spec.ts apps/server/__tests__/services/channel-resume.spec.ts (141 tests passed)
• pnpm typecheck
• pnpm exec eslint for the changed server source and tests
• git diff --check

Review Scope

• Risk: medium
• Applicable profiles: server session creation and WebSocket lifecycle
• Evidence: lifecycle, WebSocket lazy-loading, session start/create, route, and channel-resume regression tests; full typecheck; scoped lint
• Rule exceptions: none

Experience Review

• 已判断是否需要沉淀经验
• 如需要，已运行 $post-task-experience-review
• reviewer PASS / NOT APPLICABLE 后才进入 merge

Policy Conflict Review

• Independent read-only reviewer checked workflow, permission, and release-rule conflicts and reported PASS

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
oneworks-dev	Ready	Preview	Aug 18, 2026 4:09pm

[github-actions]

Experience Review

Before merge, make sure the PR body contains this completed checklist:

## Experience Review
- [x] 已判断是否需要沉淀经验
- [x] 如需要，已运行 `$post-task-experience-review`
- [x] reviewer `PASS` / `NOT APPLICABLE` 后才进入 merge

Checklist to confirm:

• Decide whether this PR produced reusable project experience.
• If experience should be captured, run $post-task-experience-review.
• Merge only after the independent reviewer reports PASS or NOT APPLICABLE for the Experience Review Result.
• For workflow, permission, or release-rule documentation changes, also add this checked section to the PR body after an independent read-only conflict review:

## Policy Conflict Review
- [x] Independent read-only reviewer checked workflow, permission, and release-rule conflicts and reported PASS