)

* fix: hotfix v0.9.3 prefill safety + provider redirects

Three regressions introduced inside v0.9.3 itself, each a self-contained
hunk:

* assemble: restore PR #504 reference-inequality contract.  The
  no-user-turn fallback added by PR #502 returned `params.messages` by
  reference, defeating the `installContextEngineLoopHook` identity check
  installed by PR #504 (`assembled.messages !== sourceMessages`).  The
  hook then fell through to raw sourceMessages (still ending with
  assistant), re-introducing the prefill-rejection bug fixed by
  safeFallback in the other early-return paths.  Use safeFallback() here
  too.  Closes #559 (sub-fix A1).

* assembler: strip assistant messages whose only blocks are blank text
  (`[{type:"text", text:""}]`).  PR #506 added isThinkingOnlyContent for
  the Bedrock empty-content case, but blank-text blocks pass that filter
  and Bedrock still rejects with `The text field in the ContentBlock
  object at messages.N.content.0 is blank`.  New isBlankContent helper
  mirrors the thinking-only shape and is added to the cleanedEntries
  filter.  Closes #559 (sub-fix B5).

* plugin: respect explicit `https://api.openai.com/v1` for openai-codex.
  PR #549's OPENAI_CODEX_NATIVE_BASE_URLS would rewrite an
  explicitly-configured api.openai.com/v1 to chatgpt.com/backend-api/codex
  whenever api was openai-codex-responses.  That broke paid OpenAI
  API-key users who chose the endpoint deliberately — their key cannot
  authenticate against the ChatGPT backend.
  shouldUseNativeCodexBaseUrl now accepts an isExplicitlyConfigured
  flag (set when configuredBaseUrl is non-undefined) and skips the
  rewrite for that case; the native rewrite still applies when baseUrl
  is empty or already a ChatGPT Codex variant.  Closes #560 (sub-fix
  A2).

* plugin: remove silent ollama localhost fallback.  PR #546's
  `inferBaseUrlFromProvider['ollama']` mapping silently routed cloud
  ollama configs (`https://ollama.com`, per #480) to localhost.  Drop
  the entry so any ollama user must configure an explicit baseUrl;
  failing with an empty baseUrl is loudly diagnosable, while a wrong
  localhost connect is not.  Closes #560 (sub-fix A3).

Sub-fix A4 (#561's bootstrap raw-hash anchor) was deferred from this
PR after a deeper audit: the original recommendation conflicts with
the heartbeat-prune append-only fast path because the same
\`lastProcessedEntryHash\` field serves both DB-tail integrity (post-
prune, post-externalization) and raw-transcript checkpoint roles.  Will
be addressed alongside the bootstrap dedup migration in a follow-up.

Tests updated for each sub-fix:
- engine.test.ts: assembler regression test for blank-text blocks;
  existing no-user-turn fallback test rewritten to assert
  reference-inequality.
- index-complete-provider-config.test.ts: new test for explicit
  api.openai.com/v1 preservation; existing ollama test updated and
  paired with a new cloud-ollama explicit-baseUrl test.

Refs #554, #496, #499, #505, #509, #519, #480, #436, #508, #541, #251.

* fix: address pr 572 review findings

* docs(plugin): correct ollama baseUrl-fallback comment

The previous comment claimed "forces an explicit baseUrl" but
`resolveProviderModelBaseUrl` still passes `""` through to the
dispatcher when no other source yields a value.  Reword to reflect
actual behavior: returning undefined drops the inferred default and
the empty-baseUrl error is the deliberate clearer-failure path,
not a configuration enforcement.

Addresses #572 (review).

---------

Co-authored-by: Eva <eva@100yen.org>
Co-authored-by: Josh Lehman <josh@martian.engineering>