Task: Plan Pi runtime resilience hardening

Identity

Task ID: 20260825-pi-runtime-resilience-plan-4b8e2c71
Mode: Feature
Branch: codex/20260825-pi-runtime-resilience-plan-4b8e2c71-pi-runtime-resilience-plan
Worktree: D:\Datas\OthersProjects\makelore-pi-runtime-resilience-plan-4b8e2c71
Base commit: 274187e3cf
Owner: codex-root
Status: Ready for Integration

Produce a task-owned, executable Pi runtime resilience hardening proposal based on the installed Windows worker-loss incident and the existing Pi cutover Spec.
Define lifecycle invariants, crash/abort/settled ordering, explicit restart policy, resource cleanup, session safety, thinking-level correctness, privacy-safe diagnostics, packaged fault injection, release gates, and the executor handoff.
Do not modify product code, the active executor worktree, canonical project memory, or the original 18-node / 31-edge cutover DAG.

Treat process exit as unavoidable but make application survival, target-only failure convergence, no uncertain prompt replay, and explainable worker replacement mandatory product guarantees.
Keep the Pi hard cutover; do not introduce OpenCode fallback, a second runtime path, a global Pi daemon, generic Provider watchdog, feature flag, or speculative compatibility framework.
Preserve the original Conversation/session binding and generation isolation. Keep real external Provider validation as Explicitly Waived / Accepted Risk, realTurnVerified=false; do not present loopback evidence as Pass.
Follow repository-pinned pnpm, focused/full tests, build:vite, Windows Electron E2E, formal packaging, artifact verification, and final packaged fault injection.
Use no subagents, in accordance with the user's explicit direction and the repository policy.

Concurrent Task Gate passed in the isolated worktree owned by codex-root; task ID, mode, branch, worktree, base commit, and task record match the local registry.
Planning Gate passed after reading the entry and memory indexes, active task, positioning/current-state/decision/architecture/domain/success/evidence/ reflection/commitment/stale records, the Pi hard-cutover Spec and tickets, the installed stuck-processing diagnosis, the Windows proxy/session-reopen records, and active peer task scopes.
Base 274187e3cfe2ae6cb97f2b4bcb422b3fdf06fbf2 contains the cumulative Windows Pi proxy and persisted-session reopen fixes used by the installed package diagnosis.
Shared canonical architecture still contains superseded OpenCode-era text. This feature task records a future promotion candidate instead of modifying canonical files outside Integration Gate.
Executor task 20260825-pi-worker-exit-thinking-5e7c2a91 is already isolated on the same base and implements the exact current-fix portion of this plan. This task owns only its proposal/task record, so there is no code-path write conflict or competing architecture direction.
The initiating worker-exit class remains unknown. Eleven installed-runtime copied-session loopback cases settled, so ordinary tested Provider/SSE, session corruption, and task_state are not established causes.
Gate result: Passed.

Consolidate confirmed incident evidence and the existing Pi Spec invariants without claiming an initiating cause that current artifacts cannot prove.
Define the Main-owned lifecycle seam, terminal-state and generation invariants, explicit stop/replacement reasons, no-replay recovery policy, and bounded privacy-safe diagnostics.
Define resource/session/thinking contracts, exact implementation phases, focused and final packaged fault-injection acceptance, and release blockers.
Record PI-R001 as the current corrective implementation task and defer soak/field classification to a dependent PI-R002, without changing the original cutover DAG.
Run document drift/project-doc gates, commit only the owned proposal and task record, then send the fixed document and acceptance contract to the existing implementation thread.

Added task-owned proposal 10-decisions/proposals/20260825-pi-runtime-resilience-plan-4b8e2c71__pi-runtime-resilience-hardening.md.
The proposal defines the difference between an impossible “never exits” promise and enforceable product guarantees: Electron survival, bounded run terminalization, target isolation, explicit replacement reasons, no mutation replay, same-session recovery, resource convergence, effective thinking state, privacy-safe forensics, and final Windows packaged fault injection.
Assigned current implementation scope to corrective ticket PI-R001 and the already-active executor task 20260825-pi-worker-exit-thinking-5e7c2a91. Defined PI-R002 as a later non-concurrent soak/field-classification task.
Kept the original 18-node / 31-edge cutover DAG unchanged and retained all existing Provider/platform risk labels.

Concurrent Task Gate and Planning Gate: passed.
Proposal cross-checked against Pi Spec sections 8, 12.2/12.3, 17, 18, 19, and 20, plus the current implementation/diagnosis records.
Product code and the executor worktree were not modified.
check_doc_drift.py: passed; only the task-owned proposal and task record are present.
check_project_docs.py: passed.
git diff --check: passed.

Executor task 20260825-pi-worker-exit-thinking-5e7c2a91 implements and verifies PI-R001, produces the Windows NSIS, and returns commit/path/hash.
After PI-R001 package acceptance, schedule PI-R002 for repeated loopback/fault-injection soak and use the new lifecycle evidence if a real installed-user recurrence occurs.
Real external Provider validation remains explicitly waived accepted risk; macOS and native non-WSL Linux status is unchanged.

Target canonical documents: Pi runtime release runbook, accepted Pi architecture/current-state, and future integration status.
Proposal: promote the invariants that worker failure must terminalize the matching run, every generation replacement has a bounded reason, accepted or uncertain mutation is never auto-replayed, and recover reopens the same session binding.
Evidence: installed-package diagnosis 20260825-pi-stuck-processing-diagnosis-7c4e91a2, this proposal, and the future accepted PI-R001 implementation/package evidence.
Future impact: all later Pi upgrades and Windows release candidates must keep the packaged failure-injection gate and explainable lifecycle diagnostics.
Semantic conflicts: canonical files still describe the superseded OpenCode runtime; Integration Gate must reconcile them with the completed Pi chain.
Human confirmation: not required for these already-authorized invariants; required if integration changes the existing real-Provider waiver or deferred platform release scope.