Recover terminal model failures and preserve verification evidence

[davidrhodus]

A bounded recovery from terminal 503 tool_protocol_error can resend an unchanged body with the failed generation’s request identity, causing the API to replay the failed admission. Give this specific recovery a fresh identity and preserve that replacement identity if its response is lost. Transport, unknown 503, partial-stream, and payment retries retain their existing identity and bounds. A real HTTP regression exercises the public flat error envelope, identity rotation, a lost replacement response, and successful replay.

Keep final outcomes tied to execution and verification evidence. Passing local checks alone cannot turn a failed provider request into completed work. Preserve visible model text while appending required failure or unverified-work diagnostics. Keep /plan status usable, stop exhausted implementation continuations after inspection-only recaps, and preserve disabled-continuation behavior.

Read-cache reuse compares freshly read bounded bytes, and source-ledger reconciliation hashes current content before sealing verification. Existing pruning, size limits, and cancellation remain. Box two large tool-batch futures so cold secret-scrubber initialization fits the default stack; fresh-process regressions cover both original stack failures.

Preserve SQLite DB and WAL-index locks during permission adjustment: validate already-private files without opening data descriptors, use inode-bound Linux metadata descriptors, and perform portable Unix mutations in a syscall-only child. Peer-process regressions cover reopen, permission tightening, connection close, and inode/link/FIFO protections. Native macOS CI exercises the portable path.

Retain search-launch diagnostics instead of reporting every exit 1 as no matches. Recognize the Linux sandbox’s specific missing-ripgrep result so the existing bounded fallback runs. An enforced subprocess regression removes ripgrep from PATH while retaining the helper probe; ordinary Core CI installs and probes native ripgrep. Process cleanup fixtures observe actual host PIDs while retaining sandbox enforcement and the original cleanup assertions. Mechanical module extractions keep the existing file-size ratchet unchanged.

Validation: all exact-revision CI jobs passed for c31c542e, including Linux tests and integration gates, native macOS SQLite checks, and terminal smoke. The full local suite passed 4,683 tests (13 existing skips), strict lint across 13 packages, 25 terminal scenarios and 12 chaos cases with actual sandbox enforcement. Targeted HTTP recovery, cold-stack, live SQLite locks, process cleanup, and native/missing-ripgrep regressions pass. The ordinary release build and isolated startup checks also pass.

The companion gateway fix is deployed. All three live Flash aliases and eight coding tasks passed through the new gateway.