stage-batch37: v0.51.155 / Release EA — 3-PR very low-risk cleanup

[nesquena-hermes]

stage-batch37 — v0.51.155 — Release EA

3-PR very low-risk cleanup. All contributor PRs, all CI-green on origin, all surgical bug fixes.

Included

• fix: suppress timeout toasts for passive pollers #3039 (dso2ng) fix: suppress timeout toasts for passive pollers — adds timeoutToast:false opt-in to the api() helper; applied to sidebar/projects polling, agent/system health pollers, cron-status watches, dashboard status, active-session external-refresh poll. Explicit user actions still surface timeout errors.
• fix(session): preserve sidecar order in display merges #3085 (ai-ag2026) fix(session): preserve sidecar order in display merges — when the messaging sidecar already has at least as many rows as the mirrored state store, route through merge_session_messages_append_only instead of role/content fallback sorting. Fixes the case where subsecond timestamps collapse and assistant rows get grouped before user rows.
• fix(session): preserve subsecond message timestamp order #3086 (ai-ag2026) fix(session): preserve subsecond message timestamp order — gateway-backed turns now write assistant_ts = now + 0.000001 instead of int(now); compacted/reconciled batches use new helper _stamp_missing_message_timestamps that walks in order assigning base + (i * 0.000001).

The three fixes are tightly correlated: #3085 prevents the wrong fallback path; #3086 prevents the upstream collapse that triggers it. Both #3085 and #3086 are from the same author (ai-ag2026) and address the timestamp-collapse failure mode from different angles.

Verification

• ast.parse: api/streaming.py, api/routes.py, api/gateway_chat.py — OK
• node -c: static/sessions.js, static/ui.js, static/panels.js, static/workspace.js — OK
• Conflict markers: none
• Full pytest suite: running (target: zero failures sequential, no:xdist)

New PRs landed this session (Tier B / Tier hold)

Held back from this batch — will route to a separate Tier B batch with Opus advisor:

• fix(sessions): full transcript load on INFLIGHT restore #3082 / fix(reasoning): show effort options for custom providers #3083 (theseussss) — overlapping INFLIGHT merge + custom-provider reasoning. Two PRs from same author opened a minute apart; fix(reasoning): show effort options for custom providers #3083 is a superset of fix(sessions): full transcript load on INFLIGHT restore #3082. Need author decision on which to merge.
• fix: harden WebUI request and runtime edge cases #3084 (AJV20) — auth.py threading.Lock + rate limit hardening. New concurrency primitives in sensitive auth module — needs Opus + per memory rule the empirical thread-test self-verify.
• Fix browser chat provider fallback on fresh sessions #3087 (george-andraws) — model_provider helper refactor for fresh-session chat start. Hot path in send() — wants careful review with fix(sessions): full transcript load on INFLIGHT restore #3082/fix(reasoning): show effort options for custom providers #3083 since all three touch the same JS surface.

Drafts that need contributor "ready" signal:

• fix: reattach SSE on session-switch return and preserve live progress (closes #2924) #3005, Restore visible WebUI progress contract #3015, fix(scroll): preserve user position during live stream reattach on session return #3045 (franksong2702, starship-s)
• Add RFC for pending message Queue/Steer controls #3061 (franksong2702, RFC)