[WH-2099]

Provider thinking can end with revised text, and Pi continuation needs the native files referenced by its conversation.
This change preserves those results across delivery and recovery.

• Require execution.modelConnection in Boot 7 and derive native configuration for Pi, Claude, OpenAI, and OpenCode.
• Publish disposable thought previews followed by bounded, authoritative thought.updated chunks, acknowledged before the Run terminal.
• Preserve canonical event identities across lost acknowledgments and retain received OpenAI thinking before delivery.
• Transfer Pi event ownership only after publisher admission, retaining thought content, tool arguments and message closures when the queue rejects an event.
• Recover unadmitted thought starts, final content and endings in bounded batches before a failed Run terminal, preserving post-admission delivery failures.
• Pin Pi 1.1, preserve native model metadata, validate thinking levels, and include verified native Bash and MCP output files in checkpoints.
• Bound Pi checkpoint payloads before copying and during recovery, including source files that grow after preflight.
• Derive OpenCode Anthropic proxy paths from the frozen connection protocol.
• Remove redundant instance generation fields while retaining connection ownership checks.

Verification

• bun run check: 2,283 regular tests and the packed MCP test passed, with 46 conditional skips; formatting, lint, generated sources, types and build passed.
• Native Claude, Codex and Pi CLI tests passed against local services, including tools, cancellation and cold recovery.
• A real Publisher → Socket → oRPC → Host ingestion → SQLite fault test passed after dropping post-persistence receipts for both thinking and completion.
• Regression tests cover queue overflow, admission versus acknowledgment, revised or empty thinking, stable retry content, partial batches and cache cleanup.
• Pi regression tests cover rejected thinking and message endings, 1,000 retained thought blocks, consecutive messages before rejection handlers run, and waiting for snapshot receipts before failure.
• Checkpoint regressions cover aggregate limits, source growth, recovery admission and preservation of the previous bundle.
• Independent review covered event delivery, lifecycle and Host integration changes.

Compatibility

Requires paired Host #671; release or revert both together.
Existing Gemini Sessions frozen to the previous Chat Completions protocol require a new Session for native Google routing.
No database migration is required.
Pi checkpoint output names follow the pinned Pi 1.1 format.
Pi checkpoint payloads have a 512 MiB aggregate limit; exceeding it fails explicitly and preserves the previous committed checkpoint.
Models absent from its native catalog retain generic text-only defaults without reasoning support or known pricing.

Paid model calls and deployment were not run.

[Copilot]

🟡 Changes recommended

Pi checkpoints lack an aggregate size bound and can exhaust storage by copying thousands of large output files.

1 open finding

• Checkpoint copies all session outputs without a cumulative size limit · New

What changed in this PR

Refactors Pi runtime reliability, model configuration, event delivery, cancellation, and checkpoint restoration alongside Boot protocol 8.

Changes:

• Adds bounded RPC delivery and reliable thinking reconciliation.
• Preserves native model metadata and validates thinking levels.
• Archives managed Pi outputs for cold restoration and upgrades Pi to 1.1.0.

File	Description
README.md	Documents Boot protocol 8.
Containerfile	Pins Pi 1.1.0.
package.json	Updates Pi dependency.
bun.lock	Locks updated Pi dependency graph.
src/​protocol/​boot/​index.ts	Advances Boot protocol version.
src/​runtimes/​atomic-file.ts	Supports atomic binary writes.
src/​runtimes/​pi/​pi-checkpoint.ts	Archives and restores managed outputs.
src/​runtimes/​pi/​pi-configuration.ts	Validates model configuration and restores outputs.
src/​runtimes/​pi/​pi-driver-backend.ts	Refactors settlement and cancellation ownership.
src/​runtimes/​pi/​pi-event-translator.ts	Reconciles reliable thinking events.
src/​runtimes/​pi/​pi-model-configuration.ts	Applies native model metadata.
src/​runtimes/​pi/​pi-rpc-client.ts	Bounds RPC frames and event queues.
src/​runtimes/​pi/​pi-session-validation.ts	Updates Pi version documentation.
tests/​driver-boot-schema.test.ts	Verifies protocol 8 payloads.
tests/​driver-rpc-wire-v3.test.ts	Updates wire protocol labeling.
tests/​pi-checkpoint.test.ts	Tests output checkpoint integrity.
tests/​pi-configuration.test.ts	Tests configuration validation.
tests/​pi-driver-backend.test.ts	Expands Pi integration coverage.
tests/​pi-driver-lifecycle.test.ts	Tests cancellation and settlement races.
tests/​pi-event-translator.test.ts	Tests thinking reconciliation and limits.
tests/​pi-model-configuration.test.ts	Tests native model enrichment.
tests/​pi-native-output-restore.test.ts	Tests cold output restoration.
tests/​pi-rpc-client.test.ts	Tests queue and frame bounds.
tests/​pi-thinking-level.test.ts	Tests thinking-level validation.
tests/​public-api.test.ts	Verifies exported protocol version.
tests/​read-driver-boot-payload.test.ts	Verifies handshake version rejection.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The coordinated Host changes, concurrency semantics, and security-sensitive checkpoint restoration warrant final human validation.

1 open finding

• Checkpoint copies all session outputs without a cumulative size limit

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Protocol-routing mismatches and redundant OpenAI snapshot delivery can cause failed requests and unnecessary large transfers.

5 open findings

• Checkpoint copies all session outputs without a cumulative size limit
• Derive Anthropic proxy path adjustment from connection protocol · New
• Reject non-Anthropic protocols for the Anthropic backend · New
• Reject non-Responses protocols for Codex configuration · New
• Mark committed reasoning snapshots as published · New

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Runtime protocol mismatches and aliased Pi model identifiers can silently route requests incorrectly.

4 open findings

• Checkpoint copies all session outputs without a cumulative size limit
• Reject non-Responses protocols for Codex configuration
• Reject non-Anthropic protocols for the Anthropic backend
• Derive Anthropic proxy path adjustment from connection protocol

1 resolved since last review

• Mark committed reasoning snapshots as published

Previously missed (1)

In code that hasn't changed since last review

Strip model prefix after mapping vendor aliases

src/​runtimes/​pi/​pi-configuration.ts:91

After mapping a vendor alias to Pi's native provider, the model prefix is stripped only for the original provider. Thus { provider: "zhipu", model: "zai/glm-4.7" }—a form already supported by the shared OpenCode configuration—launches Pi with provider zai and model ID zai/glm-4.7 instead of native ID glm-4.7, so catalog metadata and model selection are lost. Strip either the original or mapped provider prefix; the same issue affects google/... and moonshotai/... aliases.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Pi can discard an authoritative thought when event queue admission fails before publisher ownership transfers.

1 open finding

• Thoughts complete before publisher admission, causing unrecoverable failures · New

4 resolved since last review

• Checkpoint copies all session outputs without a cumulative size limit
• Reject non-Responses protocols for Codex configuration
• Reject non-Anthropic protocols for the Anthropic backend
• Derive Anthropic proxy path adjustment from connection protocol

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

It changes cross-runtime protocol, delivery, checkpoint, and paired-Host behavior across several critical boundaries.

0 open findings

1 resolved since last review

• Thoughts complete before publisher admission, causing unrecoverable failures

🧠 Review effort: Balanced