A delivered document skipped the entire structural finalize stage
(proof: replaying finalize on the shipped file immediately applied
fixes the file never received). Two real breaks: (1) loop-side, four
early Err returns per provider loop bypass the loop's own finalize —
including a mid-stream SSE error that pump_sse itself reports as Ok;
(2) desktop-side, New Chat / Stop / close-tab / session-replacing
launches all drop the session BEFORE the frame's pump runs, so the
poll backstop never observes the death.
Close both: an outer wrapper finalizes on any Err exit, and a shared
teardown helper guards every place a session is dropped or replaced —
ordered before the unsaved-changes prompt on close so the repair
reaches disk. Each run emits a source-tagged diagnostic (transcript
when alive, stderr at teardown) so a future unfinalized file is
attributable. Locks the incident's exact rail-collapse numbers as a
cleanup regression.