# Task: Plan Pi runtime resilience hardening ## Identity - Task ID: 20260825-pi-runtime-resilience-plan-4b8e2c71 - Mode: Feature - Branch: codex/20260825-pi-runtime-resilience-plan-4b8e2c71-pi-runtime-resilience-plan - Worktree: D:\Datas\OthersProjects\makelore-pi-runtime-resilience-plan-4b8e2c71 - Base commit: 274187e3cfe2ae6cb97f2b4bcb422b3fdf06fbf2 - Owner: codex-root - Status: Ready for Integration ## Scope - Produce a task-owned, executable Pi runtime resilience hardening proposal based on the installed Windows worker-loss incident and the existing Pi cutover Spec. - Define lifecycle invariants, crash/abort/settled ordering, explicit restart policy, resource cleanup, session safety, thinking-level correctness, privacy-safe diagnostics, packaged fault injection, release gates, and the executor handoff. - Do not modify product code, the active executor worktree, canonical project memory, or the original 18-node / 31-edge cutover DAG. ## Intent And Constraints - Treat process exit as unavoidable but make application survival, target-only failure convergence, no uncertain prompt replay, and explainable worker replacement mandatory product guarantees. - Keep the Pi hard cutover; do not introduce OpenCode fallback, a second runtime path, a global Pi daemon, generic Provider watchdog, feature flag, or speculative compatibility framework. - Preserve the original Conversation/session binding and generation isolation. Keep real external Provider validation as `Explicitly Waived / Accepted Risk`, `realTurnVerified=false`; do not present loopback evidence as Pass. - Follow repository-pinned pnpm, focused/full tests, `build:vite`, Windows Electron E2E, formal packaging, artifact verification, and final packaged fault injection. - Use no subagents, in accordance with the user's explicit direction and the repository policy. ## Project Context Loaded - Concurrent Task Gate passed in the isolated worktree owned by `codex-root`; task ID, mode, branch, worktree, base commit, and task record match the local registry. - Planning Gate passed after reading the entry and memory indexes, active task, positioning/current-state/decision/architecture/domain/success/evidence/ reflection/commitment/stale records, the Pi hard-cutover Spec and tickets, the installed stuck-processing diagnosis, the Windows proxy/session-reopen records, and active peer task scopes. - Base `274187e3cfe2ae6cb97f2b4bcb422b3fdf06fbf2` contains the cumulative Windows Pi proxy and persisted-session reopen fixes used by the installed package diagnosis. - Shared canonical architecture still contains superseded OpenCode-era text. This feature task records a future promotion candidate instead of modifying canonical files outside Integration Gate. - Executor task `20260825-pi-worker-exit-thinking-5e7c2a91` is already isolated on the same base and implements the exact current-fix portion of this plan. This task owns only its proposal/task record, so there is no code-path write conflict or competing architecture direction. - The initiating worker-exit class remains unknown. Eleven installed-runtime copied-session loopback cases settled, so ordinary tested Provider/SSE, session corruption, and `task_state` are not established causes. - Gate result: Passed. ## Plan 1. Consolidate confirmed incident evidence and the existing Pi Spec invariants without claiming an initiating cause that current artifacts cannot prove. 2. Define the Main-owned lifecycle seam, terminal-state and generation invariants, explicit stop/replacement reasons, no-replay recovery policy, and bounded privacy-safe diagnostics. 3. Define resource/session/thinking contracts, exact implementation phases, focused and final packaged fault-injection acceptance, and release blockers. 4. Record `PI-R001` as the current corrective implementation task and defer soak/field classification to a dependent `PI-R002`, without changing the original cutover DAG. 5. Run document drift/project-doc gates, commit only the owned proposal and task record, then send the fixed document and acceptance contract to the existing implementation thread. ## Outcome - Added task-owned proposal `10-decisions/proposals/20260825-pi-runtime-resilience-plan-4b8e2c71__pi-runtime-resilience-hardening.md`. - The proposal defines the difference between an impossible “never exits” promise and enforceable product guarantees: Electron survival, bounded run terminalization, target isolation, explicit replacement reasons, no mutation replay, same-session recovery, resource convergence, effective thinking state, privacy-safe forensics, and final Windows packaged fault injection. - Assigned current implementation scope to corrective ticket `PI-R001` and the already-active executor task `20260825-pi-worker-exit-thinking-5e7c2a91`. Defined `PI-R002` as a later non-concurrent soak/field-classification task. - Kept the original 18-node / 31-edge cutover DAG unchanged and retained all existing Provider/platform risk labels. ## Verification - Concurrent Task Gate and Planning Gate: passed. - Proposal cross-checked against Pi Spec sections 8, 12.2/12.3, 17, 18, 19, and 20, plus the current implementation/diagnosis records. - Product code and the executor worktree were not modified. - `check_doc_drift.py`: passed; only the task-owned proposal and task record are present. - `check_project_docs.py`: passed. - `git diff --check`: passed. ## Follow-ups - Executor task `20260825-pi-worker-exit-thinking-5e7c2a91` implements and verifies `PI-R001`, produces the Windows NSIS, and returns commit/path/hash. - After `PI-R001` package acceptance, schedule `PI-R002` for repeated loopback/fault-injection soak and use the new lifecycle evidence if a real installed-user recurrence occurs. - Real external Provider validation remains explicitly waived accepted risk; macOS and native non-WSL Linux status is unchanged. ## Promotion Candidates - Target canonical documents: Pi runtime release runbook, accepted Pi architecture/current-state, and future integration status. - Proposal: promote the invariants that worker failure must terminalize the matching run, every generation replacement has a bounded reason, accepted or uncertain mutation is never auto-replayed, and recover reopens the same session binding. - Evidence: installed-package diagnosis `20260825-pi-stuck-processing-diagnosis-7c4e91a2`, this proposal, and the future accepted `PI-R001` implementation/package evidence. - Future impact: all later Pi upgrades and Windows release candidates must keep the packaged failure-injection gate and explainable lifecycle diagnostics. - Semantic conflicts: canonical files still describe the superseded OpenCode runtime; Integration Gate must reconcile them with the completed Pi chain. - Human confirmation: not required for these already-authorized invariants; required if integration changes the existing real-Provider waiver or deferred platform release scope.