dsh-pause-resume 0.4.4 → 0.4.5

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.4.5
+
+A restore now leaves a durable record before every side effect, so a restart can finish it.
+
+* Before `goals.resume`, the plan records `pendingRestore` and writes it to disk. If the process dies
+  after the goal was armed but before the checkpoint was saved, the next boot sees the active,
+  disarmed goal and the intent that proves it is ours to re-arm. A goal is no longer reported as
+  `skipped` with an empty attention list after such a restart.
+* A goal whose state cannot be read is a retryable failure (`goal unreadable: …`) instead of being
+  treated as absent and consumed. Only a readable paused goal is resumed, and an unreadable goal is
+  never counted as work the pause can stop.
+* A crash plan on boot sets `phase` to `idle` and offers `resume`; it no longer claims the page is
+  paused. The dot still names the crash work through attention.
+* A pause plan that ended up in the crash slot can complete its restore, clear the slot and release
+  the heartbeat. It no longer leaves the button in `resuming`/`busy`.
+* Restore attention survives the consumed plan and is shown with a focused item id even when no work
+  is live. Killed jobs stay excluded from the dot.
+* A new pause bumps the continuation epoch only for the sessions it captured; rows owned by another
+  plan keep their request id.
+* A reload during a cold mount stops the old probe before it reports or prompts, so stale side
+  effects from a replaced instance cannot reach a session.
+* A full restore journals each item only after its outcome, and the plan is consumed only when every
+  item settled.
+
 ## 0.4.4
 
 Restores are now safe to hand over between instances and across an upgrade.

package/index.js

@@ -2,12 +2,12 @@ import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { createStore } from './lib/snapshot.js'
 import { createEngine } from './lib/engine.js'
-import { nextEpoch, dropEpoch } from './lib/epoch.js'
+import { nextEpoch, currentEpoch, dropEpoch } from './lib/epoch.js'
 import { createHeartbeat } from './lib/heartbeat.js'
 import { createProbe, listRunning } from './lib/probe.js'
 
 export const name = 'dsh-pause-resume'
-export const VERSION = '0.4.4'
+export const VERSION = '0.4.5'
 
 const BASE_PATH = '/dsh-pause-resume'
 const BUTTON_HEADER = 'x-dsh-pause-resume'
@@ -216,6 +216,7 @@ export function apply(ctx, config = {}) {
     log,
   })
   const probe = createProbe(ctx, {
+    isCurrent: () => currentEpoch() === epoch,
     graceMs: Number.isFinite(config?.graceMs) ? config.graceMs : 2000,
     continueText: typeof config?.continueText === 'string' ? config.continueText : undefined,
   })

package/lib/engine.js

@@ -28,6 +28,18 @@ function emptyLive() {
   return { sessions: [], goals: [], jobs: [], readable: false, source: 'none' }
 }
 
+/** One id for the hint: a restore attention row is either a label or a plan row. */
+function labelFocus(text) {
+  const match = /^(?:session|goal|job) ([^:]+):/.exec(String(text))
+  return match !== null ? match[1] : null
+}
+
+function attentionFocus(row) {
+  if (row === null || row === undefined) return null
+  if (typeof row === 'string') return labelFocus(row) ?? row.slice(0, 60) // ui-copy-ignore
+  return row.id || row.detail || null
+}
+
 /** One row per item: a retried stop must not multiply the same unfinished job in the dot. */
 function dedupeRows(rows) {
   const seen = new Set()
@@ -51,8 +63,12 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
   let result = null
   /** Set while a press runs, so a second caller joins the answer instead of starting work again. */
   let inflight = null
-  /** Crash plan kept in memory only when its durable write failed; a reload loses it, the file does not. */
-  let crashFallback = null
+  /**
+   * The complete plan kept in memory when its durable write failed. It can be a crash plan or a
+   * normal pause plan whose crash residue could not be merged; in both cases the file on disk is
+   * only an older subset and must not decide what this press restores.
+   */
+  let planFallback = null
   let counter = 0
 
   function newPlanId(kind) {
@@ -65,15 +81,21 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
   }
 
   function crashPlan() {
-    const stored = typeof store.readPending === 'function' ? store.readPending() : null
-    // When the merge could not be written, the in-memory plan holds the old crash sessions *and*
-    // the ones this process found; the older file would hide the half that was never saved.
-    return crashFallback ?? stored
+    return typeof store.readPending === 'function' ? store.readPending() : null
   }
 
-  /** Exactly one plan is pending, and a finished pause outranks a leftover crash record. */
+  /**
+   * Exactly one plan is pending, and a finished pause outranks a leftover crash record. The
+   * in-memory fallback outranks both files: when a write failed it holds the complete work, while
+   * the older file would hide the half that was never saved.
+   */
   function currentPlan() {
-    return pausedPlan() ?? crashPlan()
+    return planFallback ?? pausedPlan() ?? crashPlan()
+  }
+
+  /** Identity and content of one plan, used to find which store actually holds it. */
+  function samePlan(left, right) {
+    return left !== null && right !== null && left.planId === right.planId && planKey(left) === planKey(right)
   }
 
   /** The work a plan asks for, without timestamps or reporting fields. */
@@ -94,12 +116,10 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
     if (isCurrent() === false) return false
     // When the merge could not be written, this in-memory plan is the complete set and the file
     // is only its older subset. The epoch check above already proved no newer instance wrote.
-    if (isCrashPlan(plan) === true && crashFallback === plan) return true
-    const current = isCrashPlan(plan)
-      ? (typeof store.readPending === 'function' ? store.readPending() : null)
-      : store.read()
-    if (current === null) return crashFallback === plan && isCrashPlan(plan) === true
-    return current.planId === plan.planId && planKey(current) === planKey(plan)
+    if (planFallback === plan) return true
+    // A plan can live in either file: a crash plan converted to a pause plan may have fallen back
+    // to pending.json when snapshot.json could not be written. Find it by content, not by source.
+    return samePlan(pausedPlan(), plan) || samePlan(crashPlan(), plan)
   }
 
   function isCrashPlan(plan) {
@@ -169,6 +189,16 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
     return work.sessions.length + work.goals.length + work.jobs.length
   }
 
+  /** The item a partial restore could not finish, so the tooltip can name it. */
+  function failureFocus(summary) {
+    for (const line of Array.isArray(summary?.failed) ? summary.failed : []) {
+      const match = /^(?:session|goal) ([^:]+):/.exec(String(line))
+      if (match !== null) return match[1]
+      if (typeof line === 'string' && line !== '') return line.slice(0, 60) // ui-copy-ignore
+    }
+    return null
+  }
+
   /**
    * What the button shows. `action` is the one decision the client may not make itself:
    * `none` (nothing to do), `pause`, `resume`, or `busy` (an operation is running).
@@ -187,14 +217,17 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
     if (busy) action = 'busy'
     else if (plan !== null) action = 'resume'
     else if (current.readable === true && workCount > 0) action = 'pause'
-    // The dot means "something still needs you". A clean idle page has nothing to point at: the
-    // jobs a pause killed stay in the last-restore record, but they are not an open obligation.
-    const attentionRows = plan !== null
-      ? dedupeRows(Array.isArray(plan.attention) ? plan.attention : [])
-      : phase === 'idle' && lastError === null ? null : result?.attention
-    const attention = Array.isArray(attentionRows) ? attentionRows.length : 0
+    // The dot means "something still needs you". Stopped jobs are reported separately and must not
+    // turn a clean idle page into a permanent dot, but restore attention also covers "the message
+    // was admitted and no turn started" and "the turn cannot be proven finished": those are open
+    // obligations even when no plan is left, so they are always shown.
+    const attentionRows = dedupeRows([
+      ...(Array.isArray(plan?.attention) ? plan.attention : []),
+      ...(Array.isArray(result?.attention) ? result.attention : []),
+    ])
+    const attention = attentionRows.length
     const first = attention > 0 ? attentionRows[0] : null
-    const focus = first === null ? null : (typeof first === 'string' ? first : (first.id || first.detail || null))
+    const focus = first !== null ? attentionFocus(first) : failureFocus(result)
     return {
       phase,
       action,
@@ -273,17 +306,20 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
     return out
   }
 
+  /** Which durable file currently holds this plan; a converted pause plan may still live in pending. */
+  function usesPending(plan) {
+    if (isCrashPlan(plan) === true) return true
+    return samePlan(crashPlan(), plan) && !samePlan(pausedPlan(), plan)
+  }
+
   function persist(plan) {
     if (isCurrent() === false) {
       log('stale instance: refusing to write over a newer plan')
       return null
     }
-    if (isCrashPlan(plan) === true) {
-      const stored = store.writePending(plan)
-      if (stored !== null) crashFallback = null
-      return stored
-    }
-    return store.write(plan)
+    const stored = usesPending(plan) ? store.writePending(plan) : store.write(plan)
+    if (stored !== null) planFallback = null
+    return stored
   }
 
   /**
@@ -320,8 +356,12 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
     const before = new Map((basePlan?.sessions ?? []).filter((row) => typeof row?.sessionId === 'string').map((row) => [row.sessionId, row]))
     const restoredBefore = Number.isSafeInteger(basePlan?.restore?.attempts) && basePlan.restore.attempts > 0
     plan.sessions = unionSessions(plan.sessions ?? [], work.sessions.map(freshSession))
+    // Only rows this press actually captured may get a new cycle. A row left from an earlier
+    // restore attempt belongs to a different pause: incrementing it would change its request id
+    // and admit a second continuation while the first is still sitting in the queue.
+    const captured = new Set(work.sessions.map((session) => session.sessionId))
     plan.sessions = plan.sessions.map((row) => {
-      if (row.intent !== 'continue') return row
+      if (row.intent !== 'continue' || captured.has(row.sessionId) === false) return row
       const prior = before.get(row.sessionId)
       const priorEpoch = Number.isSafeInteger(prior?.epoch) ? prior.epoch : 0
       if (Number.isSafeInteger(row.epoch) && row.epoch > priorEpoch) return row
@@ -401,16 +441,21 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
       // The crash record described work that was not paused. This press did pause it, so the plan
       // becomes a normal pause plan and the crash evidence is no longer a separate obligation.
       plan.source = 'pause' // ui-copy-ignore
-      if (store.write(plan) === null) {
-        const kept = store.writePending(plan)
+      // The two files are a migration, not a plain write: if snapshot.json cannot be written, the
+      // pending fallback is the only durable copy. Removing it after a failed snapshot write would
+      // discard the plan, and reading only snapshot.json would then call this plan a stranger.
+      if (store.write(plan) !== null) {
+        planFallback = null
+        if (typeof store.clearPending === 'function' && store.clearPending() === false) lastError = 'store'
+      } else {
+        const kept = typeof store.writePending === 'function' ? store.writePending(plan) : null
         if (kept === null) {
-          crashFallback = plan
+          planFallback = plan
           lastError = 'store'
+        } else {
+          planFallback = null
         }
-      } else if (typeof store.clearPending === 'function') {
-        if (store.clearPending() === false) lastError = 'store'
       }
-      crashFallback = null
     } else if (store.write(plan) === null) {
       // The durable copy still says `pausing` or `paused`: the next boot reports it instead of
       // claiming a stop that was never written.
@@ -494,18 +539,47 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
     // flight turns a long serial restore into one batch without flooding the Harness.
     await Promise.all(Array.from({ length: Math.min(4, sessionRows.length) }, sessionWorker))
     for (const goal of plan.goals ?? []) {
+      if (stale()) break
       const key = `g:${goal.sessionId}:${goal.goalId ?? ''}`
-      const outcome = await step(key, `goal ${goal.goalId ?? goal.sessionId}`, () => probe.restoreGoal(goal, { plan }))
+      const label = `goal ${goal.goalId ?? goal.sessionId}`
+      const setGoal = (change) => {
+        plan.goals = (plan.goals ?? []).map((row) => (row.sessionId === goal.sessionId && row.goalId === goal.goalId
+          ? { ...row, ...change }
+          : row))
+      }
+      // Persist the intent before the side effect. A crash or a checkpoint failure after
+      // `goals.resume()` leaves an active, disarmed goal on the next boot; without this record the
+      // plan cannot prove that goal was its own work and would silently skip it.
+      if (goal.pendingRestore === undefined || goal.pendingRestore === null) {
+        setGoal({ pendingRestore: { revision: Number.isSafeInteger(goal.revision) ? goal.revision : null, at: now() } }) // ui-copy-ignore
+        if (persist(plan) === null) {
+          summary.failed.push(`${label}: restore intent not saved`)
+          lastError = 'store'
+          phase = 'paused'
+          return { status: 'partial', summary, outstanding: outstandingOf(plan) }
+        }
+      }
+      const outcome = await step(key, label, () => probe.restoreGoal(goal, { plan }))
+      if (outcome?.status === 'reloaded') break
       if (outcome?.status === 'restored' && Number.isSafeInteger(outcome.revision)) {
         // Remember what this plan armed. A restarted process sees `active + disarmed`, and that
         // exact revision is the only proof the goal is ours to arm again rather than someone else's.
-        plan.goals = (plan.goals ?? []).map((row) => (row.sessionId === goal.sessionId && row.goalId === goal.goalId
-          ? { ...row, armedRevision: outcome.revision }
-          : row))
+        const row = (plan.goals ?? []).find((item) => item.sessionId === goal.sessionId && item.goalId === goal.goalId)
+        setGoal({ armedRevision: outcome.revision, pendingRestore: null })
+        if (persist(plan) === null) {
+          // Keep the intent on disk so the next boot can still re-arm the goal; returning partial
+          // without it was exactly how a successful resume became a silent skip after a restart.
+          setGoal({ armedRevision: row?.armedRevision ?? null, pendingRestore: goal.pendingRestore ?? { revision: Number.isSafeInteger(goal.revision) ? goal.revision : null, at: now() } })
+          summary.failed.push(`${label}: checkpoint not saved`)
+          lastError = 'store'
+          phase = 'paused'
+          return { status: 'partial', summary, outstanding: outstandingOf(plan) }
+        }
+      } else if (outcome?.status === 'restored' || TERMINAL.has(outcome?.status)) {
+        // Restored without a revision, or terminal for another reason: the intent is spent.
+        setGoal({ pendingRestore: null })
         if (persist(plan) === null) {
-          // Without the checkpoint a later boot cannot prove this goal is ours to arm again.
-          // Keep the plan (sessions mount idempotently) instead of silently skipping the goal.
-          summary.failed.push(`goal ${goal.goalId ?? goal.sessionId}: checkpoint not saved`)
+          summary.failed.push(`${label}: checkpoint not saved`)
           lastError = 'store'
           phase = 'paused'
           return { status: 'partial', summary, outstanding: outstandingOf(plan) }
@@ -532,9 +606,22 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
       return { status: 'partial', summary, outstanding: outstandingOf(plan) }
     }
 
-    if (isCrashPlan(plan) === true) {
+    // A pending copy of the same plan means the migration's cleanup failed after snapshot.json was
+    // written. Finish that cleanup before consuming, or the next boot would offer the same restore
+    // again from a plan that is already complete.
+    if (usesPending(plan) === false && samePlan(crashPlan(), plan) && typeof store.clearPending === 'function') {
+      if (store.clearPending() === false) {
+        lastError = 'store'
+        phase = 'paused'
+        return { status: 'partial', summary, outstanding: outstandingOf(plan) }
+      }
+    }
+    // A plan may live in pending.json even after it became a normal pause plan (the snapshot
+    // write failed during the crash-to-pause migration). Completion follows the file that holds it.
+    if (usesPending(plan)) {
       if (stillMine(plan) === false) {
         log('stale instance: crash record left alone')
+        phase = 'paused'
         return { status: 'partial', summary, outstanding: 0 }
       }
       if (typeof store.writeResult === 'function' && store.writeResult({ ...plan, status: 'restored', restoredAt: summary.at, summary }) === false) {
@@ -544,6 +631,7 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
       }
       if (stillMine(plan) === false) {
         log('stale instance: crash record left alone')
+        phase = 'paused'
         return { status: 'partial', summary, outstanding: 0 }
       }
       if (typeof store.clearPending !== 'function' || store.clearPending() === false) {
@@ -551,16 +639,12 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
         phase = 'paused'
         return { status: 'partial', summary, outstanding: 0 }
       }
-      crashFallback = null
+      planFallback = null
       if (typeof store.clearJournal === 'function') store.clearJournal(plan.planId)
-      try {
-        heartbeat?.release?.()
-      } catch (error) {
-        log(`cannot release crash record: ${error?.message ?? error}`)
-      }
     } else {
       if (stillMine(plan) === false) {
         log('stale instance: pause plan left alone')
+        phase = 'paused'
         return { status: 'partial', summary, outstanding: 0 }
       }
       const consumed = store.consume(plan, summary)
@@ -569,6 +653,15 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
         phase = 'paused'
         return { status: 'partial', summary, outstanding: 0 }
       }
+      planFallback = null
+    }
+    // The plan is complete, including every crash row that was merged into it. Only now may the
+    // heartbeat stop protecting the previous process's record: releasing earlier would overwrite
+    // the only evidence of a session the merge had not yet brought into this plan.
+    try {
+      heartbeat?.release?.()
+    } catch (error) {
+      log(`cannot release heartbeat: ${error?.message ?? error}`)
     }
     phase = 'idle'
     return { status: 'resumed', summary }
@@ -625,7 +718,7 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
    * overwrites the previous process's file; it is persisted here so a second restart still sees it.
    */
   async function hydrate(options = {}) {
-    crashFallback = null
+    planFallback = null
     lastError = null
     const residue = options?.residue ?? heartbeat?.residue ?? null
     const restored = typeof store.lastRestore === 'function' ? store.lastRestore() : null
@@ -648,7 +741,7 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
           // A failed write stays in memory for this process, but the caller must not let the
           // heartbeat overwrite the file the next process would have read the same residue from.
           if (stored === null) {
-            crashFallback = crash
+            planFallback = crash
             durable = false
             lastError = 'store'
             heartbeat?.hold?.()
@@ -681,10 +774,13 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
             if (stored === null) {
               durable = false
               lastError = 'store'
-              if (isCrash) crashFallback = plan
+              // Whatever the source, the in-memory plan now holds the complete set. Resume must
+              // use it, or the sessions that only exist here would be skipped forever.
+              planFallback = plan
               heartbeat?.hold?.()
               log('cannot merge the crash plan; keeping the previous heartbeat')
             } else {
+              planFallback = null
               log(`crash sessions merged (${added.length})`)
             }
           }
@@ -692,7 +788,9 @@ export function createEngine({ store, probe, heartbeat = null, bootId = 'boot',
       }
     }
 
-    phase = pausedPlan() !== null ? 'paused' : 'idle'
+    const hydrated = currentPlan()
+    // A crash record is not a pause: the button offers restore, but the page is not paused.
+    phase = hydrated !== null && isCrashPlan(hydrated) === false ? 'paused' : 'idle'
     return { phase, durable }
   }
 

package/lib/probe.js

@@ -76,9 +76,12 @@ function goalView(services, agent) {
   if (goals === undefined || goals === null || typeof goals.get !== 'function') return undefined
   try {
     const view = goals.get(agent)
-    return view === undefined || view === null ? undefined : view
-  } catch {
-    return undefined
+    // `null` is the service's answer for "no goal"; a throw is "cannot tell right now". Collapsing
+    // both into `undefined` made a transient read error look like the goal had been deleted, which
+    // the restore then recorded as a terminal skip and never retried.
+    return view === undefined || view === null ? null : view
+  } catch (error) {
+    return { unreadable: true, detail: String(error?.message ?? error).slice(0, 120) }
   }
 }
 
@@ -132,6 +135,10 @@ export function createProbe(services, options = {}) {
   const continueText = typeof options.continueText === 'string' && options.continueText.trim() !== ''
     ? options.continueText
     : '继续'
+  // A reload replaces the probe while an old restore is still awaiting a mount. The old probe must
+  // stop before its side effects, not after: a sent message cannot be taken back.
+  const isCurrent = typeof options.isCurrent === 'function' ? options.isCurrent : () => true
+  const reloaded = () => isCurrent() === false
 
   /** Everything this press can stop, read from the live registry only. */
   function live() {
@@ -151,7 +158,7 @@ export function createProbe(services, options = {}) {
       sessions.push({ sessionId: agent.id, running: agent.status === 'running', lastTurn: lastTurnOf(agent) })
       // A disarmed goal is not work: it will not start a round, and pausing it would throw. Only an
       // active, armed goal is something this press can stop and this restore can re-arm.
-      if (goal !== undefined && goal.phase === 'active' && goal.activation === 'armed') {
+      if (goal !== undefined && goal !== null && goal.unreadable !== true && goal.phase === 'active' && goal.activation === 'armed') {
         goals.push({ sessionId: agent.id, goalId: goal.id, revision: goal.revision })
       }
       for (const job of owned) if (RUNNING_JOB.has(job.status)) jobs.push({ id: job.id, owner: agent.id, status: job.status })
@@ -293,6 +300,7 @@ export function createProbe(services, options = {}) {
         return { status: 'failed', detail }
       }
     }
+    if (reloaded()) return { status: 'reloaded' }
 
     // Version 2 plans carry only `running`; a normalized version 3 plan carries `intent`. Reading
     // the old field here keeps a plan written by 0.3.0 working across the upgrade.
@@ -317,6 +325,7 @@ export function createProbe(services, options = {}) {
     if (controller === undefined || controller === null || typeof controller.prompt !== 'function') {
       return { status: 'failed', detail: 'prompt unavailable', continued: false }
     }
+    if (reloaded()) return { status: 'reloaded' }
     const request = continuation(plan, sessionId, session.epoch)
     try {
       // Two arguments: the shipped service takes the caller's AbortSignal. Passing source metadata
@@ -361,12 +370,16 @@ export function createProbe(services, options = {}) {
         return { status: 'failed', detail: String(error?.message ?? error).slice(0, 120) }
       }
     }
+    if (reloaded()) return { status: 'reloaded' }
     const services_goals = service(services, 'goals')
     if (services_goals === undefined || services_goals === null || typeof services_goals.resume !== 'function') {
       return { status: 'failed', detail: 'goals unavailable' }
     }
     const view = goalView(services, agent)
-    if (view === undefined || (typeof goal.goalId === 'string' && view.id !== goal.goalId)) {
+    if (view !== undefined && view !== null && view.unreadable === true) {
+      return { status: 'failed', detail: `goal unreadable: ${view.detail}` }
+    }
+    if (view === undefined || view === null || (typeof goal.goalId === 'string' && view.id !== goal.goalId)) {
       return { status: 'skipped', detail: 'goal is gone' }
     }
     // An active goal is normally not ours to touch. The one exception is a goal this same plan
@@ -374,13 +387,22 @@ export function createProbe(services, options = {}) {
     // exactly the revision the plan recorded. Another person's goal has no such record.
     if (view.phase === 'active') {
       if (view.activation === 'armed') return { status: 'skipped', detail: 'already active' }
-      if (Number.isSafeInteger(goal.armedRevision) && goal.armedRevision === view.revision) {
+      const pending = goal.pendingRestore !== null && typeof goal.pendingRestore === 'object' ? goal.pendingRestore : null
+      const pendingRevision = Number.isSafeInteger(pending?.revision) ? pending.revision : null
+      // `pendingRestore` was written before the side effect. If the process died after resume but
+      // before the checkpoint, the goal is active and disarmed at the revision our resume produced.
+      const ours = pending !== null && (pendingRevision === null || view.revision >= pendingRevision)
+      if (ours || (Number.isSafeInteger(goal.armedRevision) && goal.armedRevision === view.revision)) {
+        if (reloaded()) return { status: 'reloaded' }
         try {
           services_goals.resume(agent, { id: view.id, revision: view.revision })
         } catch (error) {
           return { status: 'failed', detail: String(error?.message ?? error).slice(0, 120) }
         }
         const after = goalView(services, agent)
+        if (after !== undefined && after !== null && after.unreadable === true) {
+          return { status: 'failed', detail: 'goal unreadable after resume' }
+        }
         return { status: 'restored', detail: 're-armed after restart', revision: after?.revision ?? null }
       }
       return { status: 'skipped', detail: 'goal disarmed' }
@@ -395,12 +417,16 @@ export function createProbe(services, options = {}) {
     const expected = Number.isSafeInteger(goal.revision) ? goal.revision : goal.pausedRevision
     if (Number.isSafeInteger(expected) === false) return { status: 'attention', detail: 'goal has no saved revision' }
     if (view.revision !== expected) return { status: 'skipped', detail: 'goal changed by hand' }
+    if (reloaded()) return { status: 'reloaded' }
     try {
       services_goals.resume(agent, { id: view.id, revision: view.revision })
     } catch (error) {
       return { status: 'failed', detail: String(error?.message ?? error).slice(0, 120) }
     }
     const after = goalView(services, agent)
+    if (after !== undefined && after !== null && after.unreadable === true) {
+      return { status: 'failed', detail: 'goal unreadable after resume' }
+    }
     return { status: 'restored', detail: 'armed', revision: after?.revision ?? null }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-pause-resume",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "type": "module",
   "description": "One header button stops running turns, goals and jobs, writes a plan to disk, and restores that work after a restart or crash; the button shape is the only status.",
   "license": "MIT",