fix: stabilize continuous sessions and automation recovery

Keep active tool schemas stable through emergency compaction, account for
retained reasoning, and extract prefix caching into headless Core. Recover
missing session stores without reusing lost authority or allowing stale
writers to replace the recovered binding; support the session picker too.

Coalesce missed automation occurrences without overlap or replay, isolate
corrupt siblings, and reconcile only the current runtime ownership scope.
Use compact default metrics and consistent composer/rail geometry.

Validation on exact source tree 77342d1:
- Rust nextest: 13,281 passed, 0 failed, 20 skipped (Core/TUI/config/localization lib).
- npm test: 521 passed, 0 failed (66 wrapper + 9 package + 446 web).
- npm run check:web: passed.
- cargo fmt --all -- --check: passed.

An earlier 2-second compaction settlement watchdog failed under full load;
10 unchanged focused repetitions passed. Reuse the existing 10-second
settlement watchdog while preserving all durable completion assertions.
Installed-binary acceptance, hosted CI and release publication are separate.

Author: CodeWhale Bot

.github/workflows/marketplace-sync.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           path: core
           persist-credentials: false
@@ -44,15 +44,16 @@ jobs:
           with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
               output.write(f'revision={revision}\n')
           PY
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: Hmbown/codewhale-plugin-marketplace
           ref: ${{ steps.source.outputs.revision }}
           path: marketplace
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
+          package-manager-cache: false
       - name: Check catalog and real bundle manifests
         run: node marketplace/scripts/check-marketplace.mjs
       - name: Check bundled catalog snapshot

Cargo.lock

@@ -1157,7 +1157,7 @@ osc8_links = true            # emit OSC 8 escapes around URLs (Cmd+click in iTer
 #                               # compact keeps the posture chips (and the cap
 #                               # warning) and drops the clocks, counts and hint;
 #                               # hidden gives the row to the transcript.
-# metrics_line = "full"         # full | compact | hidden (default full)
+# metrics_line = "compact"      # full | compact | hidden (default compact)
 #                               # compact keeps the route, context reading, cost
 #                               # and balance and drops the telemetry and the
 #                               # help hint; hidden gives the row to the transcript.

config.example.toml

@@ -23,6 +23,7 @@ codewhale-protocol = { path = "../protocol", version = "0.9.13" }
 codewhale-state = { path = "../state", version = "0.9.13" }
 codewhale-tools = { path = "../tools", version = "0.9.13" }
 regex = "1.11"
+sha2.workspace = true
 serde_json = { workspace = true, features = ["preserve_order"] }
 tokio = { workspace = true, features = ["time"] }
 tracing.workspace = true

crates/core/Cargo.toml

@@ -2,6 +2,7 @@ pub mod context_reference;
 pub mod fragments;
 pub mod ids;
 pub mod journal;
+pub mod prefix_cache;
 pub mod request;
 pub mod role;
 pub mod session;

crates/core/src/lib.rs

@@ -41,12 +41,13 @@ use std::hash::{Hash, Hasher};
 
 use serde::{Deserialize, Serialize};
 
-use codewhale_models::{SystemPrompt, Tool};
+use crate::request::{SystemPrompt, Tool};
 
 /// A snapshot of the immutable prefix's fingerprint.
 ///
-/// Two snapshots with the same `combined` hash are guaranteed to
-/// produce the same byte prefix when serialized for the API.
+/// Matching hashes show stable system text and the normalized OpenAI-style
+/// tool catalog. They do not measure provider cache hits or fingerprint every
+/// provider-specific wire transformation; request replay tests cover those.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PrefixFingerprint {
     /// SHA-256 of the system prompt text.
@@ -730,7 +731,13 @@ fn tool_to_api_json(tool: &Tool) -> Option<String> {
 
 /// Compute the SHA-256 hex digest of a byte slice.
 fn sha256_hex(bytes: &[u8]) -> String {
-    crate::hashing::sha256_hex(bytes)
+    use sha2::{Digest, Sha256};
+    use std::fmt::Write;
+    let mut hex = String::with_capacity(64);
+    for byte in Sha256::digest(bytes) {
+        let _ = write!(&mut hex, "{byte:02x}");
+    }
+    hex
 }
 
 /// Bounded line delta between the session context the model last saw and a