[diegosouzapw]

Summary

• Turn Zed Hosted status.failed frames received before model output into a canonical, sanitized
  502 readiness failure, and terminate immediately even when the upstream socket stays open.
• Hold role/bootstrap-only frames until the first substantive delta, then preserve that partial
  output before raising a fixed public 502 stream error through the existing Chat finalization path.
• Remove fake assistant error text and normal-success finish_reason: "stop"; partial failures now
  end with the strict Chat finish_reason: "error" frame and invoke failure/persistence callbacks
  exactly once.
• Make client cancellation idempotent and independent of an upstream cancel() hook that stalls
  forever.

This fix is standalone and does not depend on a separate shared public-error projector change.

Security, wire, and isolation contract

Concern	Guarantee
Pre-content diagnostics	Only recognized message / error / code fields are selected, bounded to 512 characters, and routed through buildErrorBody()
Post-content failure	Only the fixed public message Zed upstream stream failed reaches the client and completion callback
Chat framing	Role + partial content are retained; one format-safe terminal error and [DONE] are emitted; neither response.failed nor a normal stop is emitted
Parent test process	Performs no repository imports and does not mutate environment, globals, DB, logger, or call-log state
Child environment	Explicit allowlist only: runtime path/module/locale/temp values, NODE_ENV=test, synthetic API_KEY_SECRET, and test flags; no provider credential/token, HOME, or CODEX_HOME is inherited
Child lifecycle	Creates fresh DATA_DIR and plugin directory before imports, blocks ambient fetch, resets DB, closes the shared logger, restores state, and removes temp directories
Persistence proof	The pipeline uses a fixture-unique model and connection ID; the local persistence callback starts empty and must receive exactly one matching 502 record

Validation

Exact candidate head: bc565e8633bcb252809fa5421f92d0ada968eb89

Class	Gate	Result
PASS	Original TDD RED -> GREEN	Initial readiness/partial fixtures exposed false HTTP 200 success; full-handler coverage also rejected leaked response.failed framing and lost content before the final implementation
PASS	Shared-process contamination RED	RED 4/5 under --test-isolation=none: the unrelated call-log drain assertion deterministically failed because the old Zed test changed top-level DATA_DIR/DB state
PASS	Process-isolated boundary child	PASS 3/3: pre-content 502/fallback eligibility, role + content + failure with an open socket, and never-resolving upstream cancellation
PASS	Pure parent wrapper	PASS 1/1 and asserts that the child reported 3 tests, 3 passes, 0 failures
PASS	Paired isolation regression	PASS 3/3 for wrapper + call-log drain under --test-isolation=none, with no concurrency override
PASS	Zed/readiness/stream regressions	PASS 74/74 behaviors: 71 direct regressions plus 3 child boundary tests; outer runner PASS 72/72 (71 + wrapper)
PASS	Open-SSE TypeScript	openSseTypecheckErrors=0
PASS	ESLint / formatting	Official ESLint suppressions and Prettier check passed on all owned files
PASS	Repository ratchets	Changelog integrity, file-size, complexity, tracked-artifacts, and git diff --check passed
PASS	Secret scan	secretFindings=0; the child receives no inherited provider credentials
PASS	Independent adversarial production review	Zero P1/high/material P2 findings after cancellation and read-ahead hardening
PASS	Latest release reconciliation	Merged e243b04de22da2d78900c27fde5f83f4fbc3d7f9 without conflicts; focused 52/52 tests and gates rerun on candidate bc565e8633bcb252809fa5421f92d0ada968eb89
HOLD	GitHub CI	Re-running on this updated draft head
HOLD	Live Zed credential smoke	Not run; deterministic fixtures block network access and contain no live credentials
BASE-RED	Scoped executed gates	None observed or attributed

Reconciliation

• Development started from required release SHA 7802f6ea163f18f349348dbfd8710a159ac32e15
  in an isolated worktree.
• The final branch was reconciled by merging live release tip
  e243b04de22da2d78900c27fde5f83f4fbc3d7f9; there was no overlap in the owned
  Zed production/test/changelog fragment paths.
• Production remained byte-identical during the isolation repair:
  open-sse/executors/zed-hosted.ts SHA-256
  017686e4f41106be1cecf373dc1e939d9686c24fce93f0937758eaabde9cd4b0.
• No merge, automerge, deployment, or live credential use is requested by this PR.