[FradSer]

Summary

Cancelled OpenAI sessions can restart from state beyond the last acknowledged native checkpoint, and an ACP connection can be killed by its expired startup deadline after a successful handshake. Restore the acknowledged OpenAI checkpoint before resuming, release startup abort ownership after ACP setup, keep late session metadata session-scoped, and finish provider cleanup before cancellation terminals. Skip empty authoritative OpenAI text snapshots while preserving lifecycle closure and final-message identity rules.

Current upstream integration

Merged current main (49df36e9735f261829ea90b6570382bd33a67775, #133) without rewriting the existing PR history. The integration commit is 5738cf178dc0ec5ac42202d62e3b2b87c8550cda.

• Preserve upstream typed modelConnection and native thought delivery, including its lossless snapshot/terminal regression cases.
• Retain all six empty-assistant completion regressions alongside the upstream thought cases.
• Supply the required session publisher in two upstream ACP thought test fixtures.
• Retire the PR-only OpenCode environment-config helper after the harness moved to typed model connections. It has no remaining caller.

Protocol/schema sources, the native thought helper, Pi production code, package.json, and bun.lock are unchanged relative to current main. The upstream dependency changes are retained by the merge.

Verification

Fresh local Linux verification with frozen dependencies, Bun 1.4.0, Node 24.22.0:

• bun run check: 2,332 passed / 47 optional skips / 0 failed, followed by build and 1/1 packed MCP replay/recovery/cancellation acceptance. Formatting, lint, generated-schema freshness and type checks passed.
• Installed native Claude/OpenAI/Pi lifecycle cases: 3/3 passed against local provider fixtures, including OpenAI warm turns and checkpoint recovery in a fresh native home.
• Focused cancellation, ACP startup/session routing and empty-message/native-thought regressions: 206/206 passed.
• Backpressure and overflow: 40/40 passed across 20 repetitions. The original upstream fixture reproduced 19 failures in 20 below-limit runs (21 pass / 19 fail across both modes): it asserted writer completion when only 61–552 of 900 notifications had been admitted. The repaired fixture observes the final notification and peer write callback with a bounded event-driven wait and fresh filesystem state. The original Bun provider, blocked-handler assertion, 900-message delivery, 1,025-message overflow and exactly one protocol error remain; no polling sleeps or increased queue limits.
• git diff --check, object-database verification and public-diff credential/path review passed.

Current hosted checks additionally cover every runtime image and native CLI/package-manager smoke case. These are separate from the local gate.

Scope and remaining limits

• Related to fix(acp): hung session/prompt is un-cancellable — turn hangs forever and user cancel tears down the runtime #107 for cancellation/recycle recovery; this does not implement its complete unresponsiveness-timeout proposal.
• Mosoo #693 is pricing-only and does not consume this branch. Its Driver gitlink is not changed here or in the extracted follow-up PRs.
• No real-provider inference matrix was rerun at this integration commit. Earlier live-model results on older revisions are not represented as fresh results for this head.
• No production deployment, migration or PR merge. Reverting this PR restores the upstream runtime behavior.

[FradSer]

Merge restriction diagnosis (2026-10-25): the active default branch ruleset 17401181 requires verified commit signatures. GitHub reports three PR commits as unsigned: 84ea5cee, f7c5cad0, and 5738cf17. The other three commits are verified. The branch is up to date, conflict-free, has no unresolved review threads, and its latest Check and title checks passed. GitHub documents that unsigned head-branch commits can block even squash merges: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#require-signed-commits

A local signed replacement candidate 55b4b53b4f81deb0ecc89017eb03e09271f93bcd is prepared. All six signatures verify locally. Every corresponding commit retains the identical source tree; the final tree diff is empty. Original commits, messages, author/committer metadata and parent topology are preserved in a backup reference / mapping receipt. The user explicitly authorized the guarded rewrite, and it was published with an exact lease against 5738cf178dc0ec5ac42202d62e3b2b87c8550cda. GitHub now verifies all six signatures. New exact-head CI passed: title, full code checks, and runtime image build/tool-fixture tests. No protection was weakened, no merge was attempted, and no paid Session was created. Final verification: exact head 55b4b53b has six GitHub-verified signatures, all required checks passed, and GitHub now reports MERGEABLE / CLEAN. The signing restriction is resolved. No paid Session was added.