fix(antigravity): stop commands left running after a turn

[rynfar]

Antigravity can leave native commands running after its prompt and turn complete. Stop previously sent session/cancel to an idle session, which had no prompt to cancel, so those commands kept running. This closes the session when Stop finds promoted commands and emits their stopped task receipts. A later turn can resume the saved native session.

Pylon's ProviderService can recover a new session as soon as the adapter reports the old one stopped, while the old stopped-task and exit events are still queued. This PR fences an explicit Antigravity Stop to its exact live incarnation until ProviderService ingests the old exit event, after the stopped-task receipt. Concurrent Stops share the fence, and recovery rechecks it at the incarnation swap. The fence survives caller interruption and releases on active-prompt Stop. If the exit is missing after 15 seconds, Stop fails explicitly while the fence remains in place; recovery resumes after a late exit or adapter replacement/server restart. Ordinary absent-session recovery remains available. This adapts T3 cdb26fe63549df633751ab0eed145b9357b30a21 (#13388) from frozen cycle #865.

Validation: 219 focused tests across ProviderService, Antigravity adapter, recovery, and steering; vp run --filter t3 typecheck; scoped vp lint and vp fmt. Tests cover idle promoted commands, active prompt Stop, new-turn rejection during close, ProviderService receipt ordering under a blocked subscriber, missing exit timeout and fail-closed retry, late exit after timeout, interrupted Stop caller, concurrent Stops, recovery/Stop race, and already absent session recovery. Native Antigravity process behavior was not exercised by these harness tests.

Model: GPT-6 Sol (low reasoning), overseen by Codex.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pylon-marketing	Ignored	Preview	Sep 27, 2026 5:17am UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	14.0 KiB	−32 B (−0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.3 KiB	+11 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.7 KiB	−43 B (−0.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	9	−1 (−10.0%)	21	✅
Claude	Total thread wire	14.0 KiB	14.0 KiB	+5 B (+0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.3 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−1 B (−0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.9 KiB	58.9 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 415c668 · PR result: 42a431d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.7 KiB
• Claude decoded thread snapshot: 116.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.