Summary

• close adapter sessions before reuse and recycle adapters when close is unsupported or unverified
• preserve cancellation, model-switch ownership, request identities, retry accounting, and platform-specific cleanup across retirement
• publish exact terminal control receipts only after relay OK, with bounded reconnect, rate-limit, lag, replay, and retention handling
• keep preliminary sent/recycling progress outside terminal retention, keep ordinary telemetry loss separate from terminal shutdown proof, and reset relay-scoped desktop proof claims on community changes
• convert lifecycle invariant drift into typed fail-closed outcomes instead of supervisor panics
• add the incident solution, operator runbook, and scoped live-switch contributor contract

Verification

• cargo test -p buzz-acp — 791 unit, 9 lifecycle, 1 startup-cleanup test, and doc tests passed
• cargo fmt --all -- --check
• cargo check -p buzz-acp --all-targets
• cargo clippy -p buzz-acp --all-targets --all-features -- -D warnings
• desktop tests — 3,793 passed
• desktop TypeScript typecheck passed
• desktop scoped Biome check passed
• git diff --check origin/main...HEAD
• Gitleaks scanned the commit series with no leaks
• the signed merge-preserving handoff tree at d7ac0d27f is byte-identical to the fully validated signed rebase tree at ce8b16e54 (b0000634450d156063ad37584f624e4239a7130e)
• independent final correctness review found no PR-introduced blockers or warnings
• aggregate just ci reached the Tauri system-library step after workspace clippy and desktop static checks; this host lacks GTK/GDK/Cairo/Pango development packages

Review feedback

• 77075bf keeps non-terminal progress out of the retained terminal ledger, resets claim state on community switches, and persists the application-proof contract in the scoped guide.
• c68236e gives Windows an explicit verified-direct-child shutdown boundary while Unix continues to require original process-group absence and other non-Unix targets remain fail-closed.
• 6606a01 removes production panic assumptions from eager startup, replacement ownership, sparse idle removal/model switch, and native-steer queue removal; each now returns an existing or crate-internal typed failure.
• e2f4eaa keeps telemetry-only broadcast lag observable without poisoning the separately acknowledged terminal-delivery proof used by graceful shutdown.
• 9d797be integrates current upstream main without rewriting the published PR history; d7ac0d2 makes the new upstream env-probe test honor the typed shutdown result.
• c80c16d admits ordinary channel messages within the existing five-second replay-skew window, clamps replay watermarks to local time, and keeps all future owner controls non-authoritative.
• All eleven automated review threads to date were answered and resolved after focused and full validation.

Coordination

• Closest overlap: feat(acp): let the owner switch an agent's model mid-session with !model #3380. That PR adds a chat !model front door to the existing owner switch path; this PR hardens the underlying session lifecycle and terminal-result delivery. It overlaps acp.rs, lib.rs, and pool.rs, so merge order may require conflict resolution, but it is not a duplicate.
• No exact duplicate PR was found.
• Screenshots are not applicable: the desktop change adds terminal toast outcomes without changing persistent layout or styling.

Boundaries and residual risk

• Source-only contribution; no service, hook, credential, runtime, deployment, or node state was changed.
• Windows currently verifies direct-child reaping; descendants can outlive the child until adapters are placed in Job Objects. The typed boundary and runbook make this interim limitation explicit.
• The 1,024-entry terminal ledger fails shutdown closed on terminal-result overflow, but capacity is not reserved before control mutation; exact pre-mutation durability would require a larger cross-async reservation or spool design.
• Membership events are signature-checked but not pinned to the relay NIP-11 self key. The official relay rejects client-authored membership events; a malicious or nonconforming relay remains a trust-boundary risk.
• Graceful shutdown waits five seconds while a terminal acknowledgement attempt may last ninety seconds. Exit is nonzero and visible, but process-local receipts are not durable across restart.