Release BJ — stage-379 — 4-PR review-bypass batch

Four already-approved contributor fixes spanning four runtime surfaces.

Fixed

• #2461 by @starship-s — Add a WebUI-side memory-provider session lifecycle for batch-extraction providers (OpenViking, etc.). The new api/session_lifecycle.py module tracks per-session generation, segment ownership, and an in_flight flag with a threading.Condition, so a late-finishing commit can only advance committed_generation against its captured generation without erasing newer turns marked during the commit. mark_turn_completed runs post-turn after save/cancel/completed-journal guards; commit_session_memory runs at session boundaries (new session, eviction, shutdown) outside cache locks. drain_all_on_shutdown flushes every registered session with uncommitted work at process exit.
• #2473 by @ts2111 — /model <alias> now correctly routes cross-provider custom-model aliases to their custom_providers[].name rather than falling through to the active provider's config_base_url branch. Adds a custom-providers prefix check in resolve_model_provider() between the explicit early-return carve-outs and the config_base_url catch-all, and exposes a top-level aliases key in /api/models so the frontend can resolve /model <alias> shortcuts. cmdModel() fetches the aliases list, fuzzy-matches the dropdown, and falls back to a direct POST /api/session/update when no dropdown match exists.
• #2480 by @Michaelyklam (closes #2472) — Make "Fork from here" use the same merged messaging-session transcript coordinate space that /api/session exposes, so forking an older message no longer silently copies the full sidecar when CLI/Gateway history inflated the visible message offset. Extracts the merge logic into _merged_session_messages_for_display() and routes both GET /api/session and POST /api/session/branch through it. The frontend snapshots the source session id across the async full-history load and reloads the forked transcript fully after creation.

Changed

• #2479 by @Michaelyklam (refs #1925) — Route Stop Generation through the default-off RuntimeAdapter.cancel_run(...) seam when HERMES_WEBUI_RUNTIME_ADAPTER=legacy-journal is enabled. Implements the first code slice of the Slice 3a cancel-control gate accepted in #2469 / v0.51.85. The default legacy-direct path still calls cancel_stream(...) directly; the adapter branch preserves the existing {ok, cancelled, stream_id} JSON response contract. No new cancellation registry, runner, sidecar, approval/clarify, queue/goal, or cached-agent state is introduced — the adapter remains a pure protocol translator.

Verification

• pytest: 5889 passed, 6 skipped, 3 xpassed, 0 failed
• Opus advisor: STAGE-FIX-FIRST (one CHANGELOG hygiene issue found and applied as stage commit) → SHIP; verified late-commit safety on the new lifecycle module, disjoint cross-PR handler interactions in api/routes.py, cmdModel() XSS surface safe (showToast uses textContent), 20+ existing resolve_model_provider tests still passing
• Agent self-verify on api/session_lifecycle.py: late-commit safety invariant, segment-merge correctness, drain_all_on_shutdown, unregister_agent cleanup — all PASS via direct unmocked execution
• Browser API sanity: all 11 endpoint checks PASS on isolated port-8789 stage server
• CI: 3.11 / 3.12 / 3.13 all green
• Tag SHA verified against merge commit