chore: sync main onto upstream tag v1.6.0

[escooterclinic]

Resyncs main onto upstream tag v1.6.0 (4d08b0b). main was 258 commits behind the real upstream and had never been measured against it — until 5a924c5 the upstream remote named a dead mirror.

Target is the tag, not HEAD (operator decision, 2026-08-12): upstream's main has been red since 2026-08-11, npm ci failing with EUSAGE / Missing: oxc-parser@0.144.0. Re-checked before starting — both Docker jobs still failing at 63a2968. Our fix for it, reqcore-inc/reqcore#271, is open and unreviewed.

measure	before	after
behind v1.6.0	148	0
files differing (3-dot, vs upstream/main)	27	26

26 is close to the floor: 21 of them are permanent overlay — the 8 workflow deletions, verify.sh/verify-e2e.sh/check-no-workflows.sh/install-hooks.sh/.githooks/, deploy.sh, release.sh, sync-upstream.sh/.sync-upstream.conf, the divergence doc, .nvmrc, .gitignore. Only 5 are content deltas.

Conflicts, resolved by reading both sides

No --ours/--theirs anywhere.

• package.json — kept this fork's engines/private and the range-form security overrides; took upstream's licence/repository/homepage metadata, scripts and dependency bumps. Every override floor is now max(ours, upstream's pin), so the range form never lowers a version upstream had already reached.
• README.md — upstream deliberately dropped the openalternative/Railway badges and rewrote the nav line; taken. Their CI badges stay out — they point at workflows this fork deletes.
• tests/unit/ai-config-schema.test.ts — duplicate intent: both sides independently repaired the same stale file. Upstream's assertions are a strict superset, so theirs stands, with our record of how they went stale folded into the docblock.
• package-lock.json — regenerated, not hand-merged.

Three carried "fixes" that were not reimposed

As predicted: the test script and the node:22.22-alpine base image were already upstream and collapsed silently. The third, server/utils/logger.ts, did not — it merged cleanly and broke typecheck. Our options-object BatchLogRecordProcessor belongs to sdk-logs 0.221; this tree is on upstream's 0.219. Reverted to positional. Only the gate caught it.

Two new deviations, both documented

• ai / @ai-sdk/* ceilings. The tail of every current AI-SDK major is under advisory, and @ai-sdk/provider-utils 4.0.41+ pulls undici ^5.29.0 — all of undici 5.x sits inside GHSA-vrm6-8vpv-qv8q, the one HIGH that fails the gate. There is no fixed release inside these majors; the fix is ai 7 / @ai-sdk 4, a breaking upgrade through the scoring and shortlisting path. That needs its own review, not a sync — filed separately.
• unhead override raised to >=3.3.1. Upstream pins 2.1.13 while their own nuxt 4.4.8 asks for ^2.1.15; nuxt 4.5.2 — the first release outside the nuxt advisory — needs ^3.3.1. The exact pin was already dragging their tree backwards, and here it broke npm ci outright.

⚠️ Worth knowing: main's "0 vulnerabilities" was an artefact of a frozen lockfile. origin/main's own package.json, resolved fresh today, yields 10 advisories including 2 high. This branch yields 0.

Also fixed

sync-upstream.sh merged upstream/main on the first attempt despite an explicit UPSTREAM_BRANCH=v1.6.0 — the conf was sourced after the environment, so it silently won. That is the exact ref the operator chose the tag to avoid. Canonical copy fixed in claude-code-policy with a mutation-checked regression test; twenty/ still carries the old one and is named in the follow-up.

Verified, not assumed

./verify.sh                                exit 0   (556 tests, 44 files)
npm audit --audit-level=high               exit 0   0 vulnerabilities
npm ci in node:22.22-alpine (npm 10.9.8)   exit 0
npm ci locally (npm 11.11.1)               exit 0
docker build, full 27 steps, real image    exit 0
./check-no-workflows.sh                    exit 0

Both npm versions matter and neither is optional: the image ships npm 10.9.8, but npm 10.9.8's resolver hoists cac@7 and cannot nest the cac@6 @bomb.sh/tab needs — producing a lockfile its own npm ci rejects. An npm 11-resolved lockfile satisfies both.

Nothing deploys from main; esc-live is a separate branch and a separate resync.