harden runtime recovery and observability

[pmbstyle]

Summary

• prevent the Telegram dispatcher test from starting a real managed PinchTab container
• make MCP reconnect backoff bounded, overflow-safe, and respected by connection refreshes
• preserve the complete LiteLLM retry and fallback timeout budget without truncating prompt context
• add content-free hybrid memory retrieval telemetry
• persist cooldowns for blocked generic scheduled Octo tasks
• classify empty HTTP connection timeouts as A2A transport failures
• update audited Web/Desktop dependency locks and migrate the dashboard to React Router 8

Root causes

The affected paths mixed per-attempt and overall timeout budgets, allowed normal MCP refreshes to bypass a scheduled reconnect, and treated some failed scheduled or A2A outcomes as immediately retryable without accurate classification. A test also inherited the production managed-browser default and leaked a Docker sidecar on every full suite run.

The CI follow-up was caused by newly reported npm advisories in existing dependency locks. Safe transitive releases fixed the Desktop and most Web findings. The remaining React Router advisories covered all published 7.x releases, so the dashboard now uses the audited 8.3.0 package and direct imports.

Impact

Long provider calls can complete their configured retry/fallback policy, broken MCP servers no longer reconnect on every prompt, scheduled external failures stop hot-looping, memory retrieval decisions become observable without logging content or memory identifiers, and the test suite no longer creates persistent browser containers. Web and Desktop dependency audits now report zero vulnerabilities.

Validation

• uv run pytest -q
• uv run ruff check on all changed Python files
• uv run black --check on all changed Python files
• git diff --check
• npm ci && npm audit --audit-level=moderate && npm run build && npm test in webapp
• npm ci && npm audit --audit-level=moderate && npm run build && npm test in desktop
• verified the PinchTab container count remains unchanged across the dispatcher regression test

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​electron-builder@​26.8.1 ⏵ 26.15.3	+1		+1	+1
	npm/​react-router@​7.18.1 ⏵ 8.3.0	-21	+16		-1
	npm/​electron-updater@​6.8.3 ⏵ 6.8.9	-1		+1	+3
	npm/​postcss@​8.5.15 ⏵ 8.5.23		+16	-1
	npm/​react@​19.2.4 ⏵ 19.2.8
	npm/​react-dom@​19.2.4 ⏵ 19.2.8

View full report