fix(acp): retire sessions safely and preserve terminal receipts

[OrionArchitekton]

Summary

• close adapter sessions before reuse and recycle adapters when close is unsupported or unverified
• preserve cancellation, model-switch ownership, request identities, retry accounting, and platform-specific cleanup across retirement
• publish exact terminal control receipts only after relay OK, with bounded reconnect, rate-limit, lag, replay, and retention handling
• keep preliminary sent/recycling progress outside terminal retention, keep ordinary telemetry loss separate from terminal shutdown proof, and reset relay-scoped desktop proof claims on community changes
• convert lifecycle invariant drift into typed fail-closed outcomes instead of supervisor panics
• add the incident solution, operator runbook, and scoped live-switch contributor contract

Verification

• cargo test -p buzz-acp — 791 unit, 9 lifecycle, 1 startup-cleanup test, and doc tests passed
• cargo fmt --all -- --check
• cargo check -p buzz-acp --all-targets
• cargo clippy -p buzz-acp --all-targets --all-features -- -D warnings
• desktop tests — 3,793 passed
• desktop TypeScript typecheck passed
• desktop scoped Biome check passed
• git diff --check origin/main...HEAD
• Gitleaks scanned the commit series with no leaks
• the signed merge-preserving handoff tree at d7ac0d27f is byte-identical to the fully validated signed rebase tree at ce8b16e54 (b0000634450d156063ad37584f624e4239a7130e)
• independent final correctness review found no PR-introduced blockers or warnings
• aggregate just ci reached the Tauri system-library step after workspace clippy and desktop static checks; this host lacks GTK/GDK/Cairo/Pango development packages

Review feedback

• 77075bf keeps non-terminal progress out of the retained terminal ledger, resets claim state on community switches, and persists the application-proof contract in the scoped guide.
• c68236e gives Windows an explicit verified-direct-child shutdown boundary while Unix continues to require original process-group absence and other non-Unix targets remain fail-closed.
• 6606a01 removes production panic assumptions from eager startup, replacement ownership, sparse idle removal/model switch, and native-steer queue removal; each now returns an existing or crate-internal typed failure.
• e2f4eaa keeps telemetry-only broadcast lag observable without poisoning the separately acknowledged terminal-delivery proof used by graceful shutdown.
• 9d797be integrates current upstream main without rewriting the published PR history; d7ac0d2 makes the new upstream env-probe test honor the typed shutdown result.
• c80c16d admits ordinary channel messages within the existing five-second replay-skew window, clamps replay watermarks to local time, and keeps all future owner controls non-authoritative.
• All eleven automated review threads to date were answered and resolved after focused and full validation.

Coordination

• Closest overlap: feat(acp): let the owner switch an agent's model mid-session with !model #3380. That PR adds a chat !model front door to the existing owner switch path; this PR hardens the underlying session lifecycle and terminal-result delivery. It overlaps acp.rs, lib.rs, and pool.rs, so merge order may require conflict resolution, but it is not a duplicate.
• No exact duplicate PR was found.
• Screenshots are not applicable: the desktop change adds terminal toast outcomes without changing persistent layout or styling.

Boundaries and residual risk

• Source-only contribution; no service, hook, credential, runtime, deployment, or node state was changed.
• Windows currently verifies direct-child reaping; descendants can outlive the child until adapters are placed in Job Objects. The typed boundary and runbook make this interim limitation explicit.
• The 1,024-entry terminal ledger fails shutdown closed on terminal-result overflow, but capacity is not reserved before control mutation; exact pre-mutation durability would require a larger cross-async reservation or spool design.
• Membership events are signature-checked but not pinned to the relay NIP-11 self key. The official relay rejects client-authored membership events; a malicious or nonconforming relay remains a trust-boundary risk.
• Graceful shutdown waits five seconds while a terminal acknowledgement attempt may last ninety seconds. Exit is nonzero and visible, but process-local receipts are not durable across restart.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 100e5b63f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[OrionArchitekton]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 77075bf9c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[OrionArchitekton]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c68236ea2a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[OrionArchitekton]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6606a018a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[OrionArchitekton]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e2f4eaac24

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[OrionArchitekton]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: d7ac0d27f3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[OrionArchitekton]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: c80c16d168

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[nathansmithopenclaw-alt]

I have a small shutdown-notice patch prepared against current main and noticed a direct overlap here: cancel_checked_out_for_shutdown() already adds cancellation before the prompt drain, and this PR replaces the abort fallback with verified process cleanup.

The additional behavior in my patch is a channel reply anchored to the exact triggering request and classified from the worker's terminal result. Normal completion suppresses the notice, including when its result is buffered after the task join set empties. Stopped turns get conservative wording about checking the thread before retrying; missing results or failed cancellation are described as unknown outcomes. Neither message claims that no work completed or promises automatic replay.

The local regressions capture signed notice events and cover threaded reply targets, both result-drain paths, cancellation failure, forced abort and Drop-mode retry behavior. Each relevant guard has a passing test that fails when the guard is removed.

Would you prefer a notice-only follow-up on top of this lifecycle work, or a small PR against current main with merge order coordinated here? I want to preserve the process-ownership and cleanup guarantees in this PR when adding the notices.