[Brian Krabach (bkrabach)]

Summary

Restore the previously accepted native-recovery summary and identity if exporting or saving the next piece raises an exception or is cancelled. Previously, the explicit helper installed the new summary before save_progress succeeded, allowing an unaccepted piece to remain installed and appear in a later export.

• Preserve canonical original messages and the last accepted piece, including when a later piece fails.
• Re-raise the original exception or cancellation; completed provider call counts and billing remain real, not rolled back.
• Keep the existing callback contract: save_progress may be sync or async; all return values, including False, remain ignored. A callback must raise to reject a save. This is now explicit in the module README.

This is the explicit offline native recovery helper, not ordinary request preparation or a new mandatory durability service. The caller still owns session exclusivity and atomic external writes. In-memory rollback does not undo storage writes made by the callback. No Legacy engine/default/migration work is included.

Verification

Independent isolated DTU, actual installed production bytes matched candidate 52108cb:

• Complete Managed suite: 498 passed, Python 3.13.11/public Rust Core 2.0.2.
• Added tests cover synchronous/asynchronous save errors, cancellation, second-piece save failure, checkpoint export failure, identical exception propagation, original-message preservation, accepted-state restore/export/retry, actual provider call counts and compatibility of sync/async None/True/False callback returns.
• Cross-repo installed-package receipt/save/converter falsifiers: 12 passed, versus corrected original baseline 8 failures and 4 passing controls.
• Foundation tests/: 2,483 passed, 4 existing skips; Chat Completions full 196 passed, 5 existing local-server smoke skips; CLI targeted installed-boundary checks 64 passed. The CLI results are isolated-DTU evidence, not readiness of its separate prepared test PR's existing lockfile.

No live vendor/model/desktop calls or all-provider runtime qualification. IP/DNS were denied; caught non-model discovery attempts were retained honestly. Local Python 3.11/3.12 were not executed for Managed. Earlier setup/plugin/fixture failures remain in the original receipts; no behavioral assertions were weakened. Repository policy-only CI, if that is the current workflow, is not represented as a hosted test suite.

Integration and review

Foundation PR microsoft/amplifier-foundation#446 merged first as a5f91fc4765dd3c6a1496b400c4fe428e5aa06f2. Its distinct receipt-preservation fix owns upstream transcript repair. This PR fixes the accepted-state transaction boundary of the explicit recovery helper without adding a provider or storage dependency.

Fresh second-opinion reviews used actual openai/gpt-6-astra and fable/claude-fable-5-1 on an identical supplied-code/evidence H0-H8 brief. Both supported Managed publication after Foundation merge. Those were bounded reviews, not full-diff audits or GitHub approvals. Independent source review and actual DTU validation also completed.

Legacy retirement/migration #3 remains deferred and unfulfilled. No merge, host install, release or teardown of the historical Boundary environment is included in this PR.