docs: plan Pi runtime resilience hardening

.project-docs/30-worklog/tasks/20260825-pi-runtime-resilience-plan-4b8e2c71.md

@@ -0,0 +1,136 @@
+# Task: Plan Pi runtime resilience hardening
+
+## Identity
+
+- Task ID: 20260825-pi-runtime-resilience-plan-4b8e2c71
+- Mode: Feature
+- Branch: codex/20260825-pi-runtime-resilience-plan-4b8e2c71-pi-runtime-resilience-plan
+- Worktree: D:\Datas\OthersProjects\makelore-pi-runtime-resilience-plan-4b8e2c71
+- Base commit: 274187e3cfe2ae6cb97f2b4bcb422b3fdf06fbf2
+- Owner: codex-root
+- Status: Ready for Integration
+
+## Scope
+
+- Produce a task-owned, executable Pi runtime resilience hardening proposal
+  based on the installed Windows worker-loss incident and the existing Pi
+  cutover Spec.
+- Define lifecycle invariants, crash/abort/settled ordering, explicit restart
+  policy, resource cleanup, session safety, thinking-level correctness,
+  privacy-safe diagnostics, packaged fault injection, release gates, and the
+  executor handoff.
+- Do not modify product code, the active executor worktree, canonical project
+  memory, or the original 18-node / 31-edge cutover DAG.
+
+## Intent And Constraints
+
+- Treat process exit as unavoidable but make application survival, target-only
+  failure convergence, no uncertain prompt replay, and explainable worker
+  replacement mandatory product guarantees.
+- Keep the Pi hard cutover; do not introduce OpenCode fallback, a second
+  runtime path, a global Pi daemon, generic Provider watchdog, feature flag, or
+  speculative compatibility framework.
+- Preserve the original Conversation/session binding and generation isolation.
+  Keep real external Provider validation as `Explicitly Waived / Accepted
+  Risk`, `realTurnVerified=false`; do not present loopback evidence as Pass.
+- Follow repository-pinned pnpm, focused/full tests, `build:vite`, Windows
+  Electron E2E, formal packaging, artifact verification, and final packaged
+  fault injection.
+- Use no subagents, in accordance with the user's explicit direction and the
+  repository policy.
+
+## Project Context Loaded
+
+- Concurrent Task Gate passed in the isolated worktree owned by `codex-root`;
+  task ID, mode, branch, worktree, base commit, and task record match the local
+  registry.
+- Planning Gate passed after reading the entry and memory indexes, active task,
+  positioning/current-state/decision/architecture/domain/success/evidence/
+  reflection/commitment/stale records, the Pi hard-cutover Spec and tickets,
+  the installed stuck-processing diagnosis, the Windows proxy/session-reopen
+  records, and active peer task scopes.
+- Base `274187e3cfe2ae6cb97f2b4bcb422b3fdf06fbf2` contains the cumulative Windows
+  Pi proxy and persisted-session reopen fixes used by the installed package
+  diagnosis.
+- Shared canonical architecture still contains superseded OpenCode-era text.
+  This feature task records a future promotion candidate instead of modifying
+  canonical files outside Integration Gate.
+- Executor task `20260825-pi-worker-exit-thinking-5e7c2a91` is already isolated
+  on the same base and implements the exact current-fix portion of this plan.
+  This task owns only its proposal/task record, so there is no code-path write
+  conflict or competing architecture direction.
+- The initiating worker-exit class remains unknown. Eleven installed-runtime
+  copied-session loopback cases settled, so ordinary tested Provider/SSE,
+  session corruption, and `task_state` are not established causes.
+- Gate result: Passed.
+
+## Plan
+
+1. Consolidate confirmed incident evidence and the existing Pi Spec invariants
+   without claiming an initiating cause that current artifacts cannot prove.
+2. Define the Main-owned lifecycle seam, terminal-state and generation
+   invariants, explicit stop/replacement reasons, no-replay recovery policy,
+   and bounded privacy-safe diagnostics.
+3. Define resource/session/thinking contracts, exact implementation phases,
+   focused and final packaged fault-injection acceptance, and release blockers.
+4. Record `PI-R001` as the current corrective implementation task and defer
+   soak/field classification to a dependent `PI-R002`, without changing the
+   original cutover DAG.
+5. Run document drift/project-doc gates, commit only the owned proposal and
+   task record, then send the fixed document and acceptance contract to the
+   existing implementation thread.
+
+## Outcome
+
+- Added task-owned proposal
+  `10-decisions/proposals/20260825-pi-runtime-resilience-plan-4b8e2c71__pi-runtime-resilience-hardening.md`.
+- The proposal defines the difference between an impossible “never exits”
+  promise and enforceable product guarantees: Electron survival, bounded run
+  terminalization, target isolation, explicit replacement reasons, no mutation
+  replay, same-session recovery, resource convergence, effective thinking
+  state, privacy-safe forensics, and final Windows packaged fault injection.
+- Assigned current implementation scope to corrective ticket `PI-R001` and the
+  already-active executor task `20260825-pi-worker-exit-thinking-5e7c2a91`.
+  Defined `PI-R002` as a later non-concurrent soak/field-classification task.
+- Kept the original 18-node / 31-edge cutover DAG unchanged and retained all
+  existing Provider/platform risk labels.
+
+## Verification
+
+- Concurrent Task Gate and Planning Gate: passed.
+- Proposal cross-checked against Pi Spec sections 8, 12.2/12.3, 17, 18, 19,
+  and 20, plus the current implementation/diagnosis records.
+- Product code and the executor worktree were not modified.
+- `check_doc_drift.py`: passed; only the task-owned proposal and task record
+  are present.
+- `check_project_docs.py`: passed.
+- `git diff --check`: passed.
+
+## Follow-ups
+
+- Executor task `20260825-pi-worker-exit-thinking-5e7c2a91` implements and
+  verifies `PI-R001`, produces the Windows NSIS, and returns commit/path/hash.
+- After `PI-R001` package acceptance, schedule `PI-R002` for repeated
+  loopback/fault-injection soak and use the new lifecycle evidence if a real
+  installed-user recurrence occurs.
+- Real external Provider validation remains explicitly waived accepted risk;
+  macOS and native non-WSL Linux status is unchanged.
+
+## Promotion Candidates
+
+- Target canonical documents: Pi runtime release runbook, accepted Pi
+  architecture/current-state, and future integration status.
+- Proposal: promote the invariants that worker failure must terminalize the
+  matching run, every generation replacement has a bounded reason, accepted or
+  uncertain mutation is never auto-replayed, and recover reopens the same
+  session binding.
+- Evidence: installed-package diagnosis
+  `20260825-pi-stuck-processing-diagnosis-7c4e91a2`, this proposal, and the
+  future accepted `PI-R001` implementation/package evidence.
+- Future impact: all later Pi upgrades and Windows release candidates must keep
+  the packaged failure-injection gate and explainable lifecycle diagnostics.
+- Semantic conflicts: canonical files still describe the superseded OpenCode
+  runtime; Integration Gate must reconcile them with the completed Pi chain.
+- Human confirmation: not required for these already-authorized invariants;
+  required if integration changes the existing real-Provider waiver or
+  deferred platform release scope.