[codex] Harden execution reliability and heartbeat tooling (#3679)

## Thinking Path

> - Paperclip orchestrates AI agents for zero-human companies
> - Reliable execution depends on heartbeat routing, issue lifecycle
semantics, telemetry, and a fast enough local verification loop to keep
regressions visible
> - The remaining commits on this branch were mostly server/runtime
correctness fixes plus test and documentation follow-ups in that area
> - Those changes are logically separate from the UI-focused
issue-detail and workspace/navigation branches even when they touch
overlapping issue APIs
> - This pull request groups the execution reliability, heartbeat,
telemetry, and tooling changes into one standalone branch
> - The benefit is a focused review of the control-plane correctness
work, including the follow-up fix that restored the implicit
comment-reopen helpers after branch splitting

## What Changed

- Hardened issue/heartbeat execution behavior, including self-review
stage skipping, deferred mention wakes during active execution, stranded
execution recovery, active-run scoping, assignee resolution, and
blocked-to-todo wake resumption
- Reduced noisy polling/logging overhead by trimming issue run payloads,
compacting persisted run logs, silencing high-volume request logs, and
capping heartbeat-run queries in dashboard/inbox surfaces
- Expanded telemetry and status semantics with adapter/model fields on
task completion plus clearer status guidance in docs/onboarding material
- Updated test infrastructure and verification defaults with faster
route-test module isolation, cheaper default `pnpm test`, e2e isolation
from local state, and repo verification follow-ups
- Included docs/release housekeeping from the branch and added a small
follow-up commit restoring the implicit comment-reopen helpers that were
dropped during branch reconstruction

## Verification

- `pnpm vitest run
server/src/__tests__/issue-comment-reopen-routes.test.ts
server/src/__tests__/issue-telemetry-routes.test.ts`
- `pnpm vitest run server/src/__tests__/http-log-policy.test.ts
server/src/__tests__/heartbeat-run-log.test.ts
server/src/__tests__/health.test.ts`
- `server/src/__tests__/activity-service.test.ts`,
`server/src/__tests__/heartbeat-comment-wake-batching.test.ts`, and
`server/src/__tests__/heartbeat-process-recovery.test.ts` were attempted
on this host but the embedded Postgres harness reported
init-script/data-dir problems and skipped or failed to start, so they
are noted as environment-limited

## Risks

- Medium: this branch changes core issue/heartbeat routing and
reopen/wakeup behavior, so regressions would affect agent execution flow
rather than isolated UI polish
- Because it also updates verification infrastructure, reviewers should
pay attention to whether the new tests are asserting the right failure
modes and not just reshaping harness behavior

## Model Used

- OpenAI Codex coding agent (GPT-5-class runtime in Codex CLI; exact
deployed model ID is not exposed in this environment), reasoning
enabled, tool use and local code execution enabled

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>

tests/e2e/onboarding.spec.ts

@@ -54,6 +54,45 @@ test.describe("Onboarding wizard", () => {
       page.locator("h3", { hasText: "Give it something to do" })
     ).toBeVisible({ timeout: 30_000 });
 
+    const baseUrl = page.url().split("/").slice(0, 3).join("/");
+    if (SKIP_LLM) {
+      const companiesAfterAgentRes = await page.request.get(`${baseUrl}/api/companies`);
+      expect(companiesAfterAgentRes.ok()).toBe(true);
+      const companiesAfterAgent = await companiesAfterAgentRes.json();
+      const companyAfterAgent = companiesAfterAgent.find(
+        (c: { name: string }) => c.name === COMPANY_NAME
+      );
+      expect(companyAfterAgent).toBeTruthy();
+
+      const agentsAfterCreateRes = await page.request.get(
+        `${baseUrl}/api/companies/${companyAfterAgent.id}/agents`
+      );
+      expect(agentsAfterCreateRes.ok()).toBe(true);
+      const agentsAfterCreate = await agentsAfterCreateRes.json();
+      const ceoAgentAfterCreate = agentsAfterCreate.find(
+        (a: { name: string }) => a.name === AGENT_NAME
+      );
+      expect(ceoAgentAfterCreate).toBeTruthy();
+
+      const disableWakeRes = await page.request.patch(
+        `${baseUrl}/api/agents/${ceoAgentAfterCreate.id}?companyId=${encodeURIComponent(companyAfterAgent.id)}`,
+        {
+          data: {
+            runtimeConfig: {
+              heartbeat: {
+                enabled: false,
+                intervalSec: 300,
+                wakeOnDemand: false,
+                cooldownSec: 10,
+                maxConcurrentRuns: 1,
+              },
+            },
+          },
+        }
+      );
+      expect(disableWakeRes.ok()).toBe(true);
+    }
+
     const taskTitleInput = page.locator(
       'input[placeholder="e.g. Research competitor pricing"]'
     );
@@ -74,8 +113,6 @@ test.describe("Onboarding wizard", () => {
 
     await expect(page).toHaveURL(/\/issues\//, { timeout: 30_000 });
 
-    const baseUrl = page.url().split("/").slice(0, 3).join("/");
-
     const companiesRes = await page.request.get(`${baseUrl}/api/companies`);
     expect(companiesRes.ok()).toBe(true);
     const companies = await companiesRes.json();
@@ -128,6 +165,17 @@ test.describe("Onboarding wizard", () => {
         const issue = await res.json();
         expect(["in_progress", "done"]).toContain(issue.status);
       }).toPass({ timeout: 120_000, intervals: [5_000] });
+    } else {
+      await expect
+        .poll(async () => {
+          const runsRes = await page.request.get(
+            `${baseUrl}/api/companies/${company.id}/heartbeat-runs?agentId=${ceoAgent.id}`
+          );
+          expect(runsRes.ok()).toBe(true);
+          const runs = await runsRes.json();
+          return Array.isArray(runs) ? runs.length : -1;
+        }, { timeout: 10_000, intervals: [500, 1_000, 2_000] })
+        .toBe(0);
     }
   });
 });

tests/e2e/playwright.config.ts

@@ -1,9 +1,13 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 import { defineConfig } from "@playwright/test";
 
 // Use a dedicated port so e2e tests always start their own server in local_trusted mode,
 // even when the dev server is running on :3100 in authenticated mode.
 const PORT = Number(process.env.PAPERCLIP_E2E_PORT ?? 3199);
 const BASE_URL = `http://127.0.0.1:${PORT}`;
+const PAPERCLIP_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-e2e-home-"));
 
 export default defineConfig({
   testDir: ".",
@@ -22,19 +26,25 @@ export default defineConfig({
       use: { browserName: "chromium" },
     },
   ],
-  // The webServer directive starts `paperclipai run` before tests.
-  // Expects `pnpm paperclipai` to be runnable from repo root.
+  // The webServer directive bootstraps a throwaway instance and then starts it.
+  // `onboard --yes --run` works in a non-interactive temp PAPERCLIP_HOME.
   webServer: {
-    command: `pnpm paperclipai run`,
+    command: `pnpm paperclipai onboard --yes --run`,
     url: `${BASE_URL}/api/health`,
-    reuseExistingServer: !process.env.CI,
+    // Always boot a dedicated throwaway instance for e2e so browser tests
+    // never attach to the developer's active Paperclip home/server.
+    reuseExistingServer: false,
     timeout: 120_000,
     stdout: "pipe",
     stderr: "pipe",
     env: {
       ...process.env,
       PORT: String(PORT),
+      PAPERCLIP_HOME,
+      PAPERCLIP_INSTANCE_ID: "playwright-e2e",
+      PAPERCLIP_BIND: "loopback",
       PAPERCLIP_DEPLOYMENT_MODE: "local_trusted",
+      PAPERCLIP_DEPLOYMENT_EXPOSURE: "private",
     },
   },
   outputDir: "./test-results",