[WH-2099]

Summary

Provider thinking can differ from its preview, and restoring an entire Session's thinking can exceed the Host's memory budget.
The Host and paired Driver now share typed model connections, authoritative thought chunks and stable retry identities, with bounded thinking recovery.

• Derive native model configuration in each Driver adapter from execution.modelConnection.
• Pin the merged Driver from Driver #133 at 49df36e9735f261829ea90b6570382bd33a67775, including Pi delivery recovery and the checkpoint aggregate limit.
• Restore recent recorded thinking with bounded reads, and reload viewer snapshots when replay frames are discarded during their read.
• Apply backpressure to SSE and preserve durable event identities.
• Validate thought offsets, completion and serialized byte totals through a Session/thought index, without retaining thought bodies in the Driver connection's live state.
• Retire stopped instances before or during their first connection, revoke their grants, and preserve the requested cancellation outcome.
• Preserve Pi model capabilities and native output files; route Gemini through its native Google protocol.
• Use the typed model connection in the real Claude Host checkpoint recovery canary.

Why

Lost acknowledgments must preserve recorded content and the committed checkpoint.
Long Sessions must continue validating thought chunks after earlier thoughts leave the viewer's recovery window.

Verification

• just check: 3,820 tests passed, 47 conditional skips, zero failures; formatting, docs, lint, workspace types, GraphQL freshness and Public API checks passed.
• just test-native-host-checkpoint: the pinned Claude CLI completed two turns through oRPC, D1 and SquashFS against a local model endpoint; a new Driver restored the prior native history.
• just e2e e2e/cases/deterministic/session-log.spec.ts --grep Session.log.acceptance.replay: browser transcript and diagnostics replay passed.
• just db-reset-local: all 21 migrations applied locally, including the new thought lookup index.
• Edited product and architecture documents passed just fmt-check-path.
• Regressions recover a complete 8 MiB thought when replay frames are evicted or cleared during snapshot loading, and verify that new and existing thought lookups use both index keys.
• Existing regressions cover five maximum-size thoughts, omission of unavailable prefixes, continuation outside the viewer window, UTF-16 offsets, escaped JSON byte limits across restarts, duplicate receipts, gaps, changed chunks and updates after completion or cancellation.
• A local SQLite probe with 136 MiB of recorded thinking reduced new-thought validation from 118–131 ms to 0.17–0.57 ms.
• Existing fault coverage includes lost receipts, queue overflow, connection/stop races, cancellation write failures and slow SSE readers.
• Paid provider calls, Cloudflare load testing and deployment were not run.

Impact

• User/API/contract changes: Boot 7 requires the paired Driver.
  Viewer thinking recovery and public history use bounded windows; thoughts missing their first chunk are omitted from the view while their events remain stored.
  Public history reports truncation; SSE preserves recorded event IDs and omits disposable thinking previews.
• Generated files / GraphQL / DB / lockfile: OpenAPI output includes the truncation description; there are no wire schema or GraphQL changes.
  Additive migration 0020_session-thought-lookup.sql adds the Session/thought expression index, with its generated snapshot and journal entry.
  The Driver submodule and existing Pi 1.1 lockfile update are included.
• Env or config changes: native model configuration comes from execution.modelConnection.
• Risk and rollback: release or revert Host and Driver together.
  Apply the additive index migration during release and retain its files when reverting an applied release.
  Existing Gemini Sessions frozen to Chat Completions require a new Session for native Google routing.
  Legacy checkpoint cutover follows the verification procedure.

Review

• Review areas: Boot connections, event admission and receipt identity, thought validation and recovery, bounded history reads, instance revocation and checkpoint recovery.
• Known limits: the viewer has no pagination for omitted thinking.
  Pi models absent from its catalog use generic text-only defaults without reasoning support or known pricing.

Design (UI changes only, otherwise N/A)

N/A.