write down what to test, and what is most likely broken

The serve is the only path now, so this is not a comparison against a fallback.

Split by what I have actually driven end to end versus what probes cannot answer. The second
list is the real testing: resume from history (never exercised against the serve, and my
pick for most likely broken), an idle session, a sidecar restart mid-turn, an officer restart
mid-turn, and two conversations at once — that last one because the live event stream is
global and a wrong sessionID filter would splice one conversation into another.

Known gaps are listed so they do not get reported as bugs, and the one silent failure mode
with a single cause — a turn producing nothing at all — points at the credential line from
boot, which I have chased twice already.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/opencode-serve-migration-plan.md

@@ -67,9 +67,13 @@ Each of these cost time to find. None is in the API docs.
 - **Phase C — server half done.** A message sent while a turn runs is injected with `delivery: "steer"`
   into the RUNNING turn, verified end to end. No client change was needed: officer's composer already
   sends mid-turn, and the subprocess path was superseding where the serve steers.
-- **Phase D — not started, deliberately.**
+- **Phase D — done.** The subprocess is deleted: no `runner.ts`, no `OPENCODE_TURNS` switch, no fallback
+  engine. Andre called it — nothing depends on OpenCode, so the cost of removing the escape hatch is
+  near zero and the recovery is git. 818 lines went with it, all of them workarounds for `stdin` being
+  `/dev/null`.
 
-Not yet lived with. Nothing here has run a real conversation with a person at the other end.
+Not yet lived with. **Nothing here has run a real conversation with a person at the other end** — see
+`docs/opencode-testing-checklist.md` for what to try and what is most likely to be broken.
 
 ## Shape of the work