pi-goal-list-loop-audit 0.34.15 → 0.34.16

package/README.md

@@ -235,7 +235,27 @@ No external watchdog plugin needed. It also recovers **stranded audits**
 (v0.29.1): a goal stuck in `auditing` with no auditor session alive re-runs
 the stored claim after 90s instead of black-holing. Storm protection: the
 send→pause→notify path rearms once per cycle and loud-stops after a 6-error
-brake streak, so a broken provider can't spin forever.
+brake streak, so a broken provider can't spin forever. A confirmed queued
+continuation with no turn is reported by the queue-stuck probe; it does not
+inject terminal input.
+
+## Session replacement and stale handles
+
+Recovery crosses pi's lifecycle boundary. On `session_shutdown`, glla records
+`.pi-glla/session-handoff.json` for a supervising, non-quit replacement,
+ledgering the reason and stopping every session-owned timer. On the fresh
+`session_start`, the new context consumes only fresh, same-process debt and
+continues the saved goal or loop. Timers resolve a fresh context when they fire;
+they do not retain an old `ctx` or `pi` handle.
+
+A user quit is not continuation consent: `reason: "quit"` is ledgered as
+`session_handoff_suppressed`, leaves no handoff debt, and does not receive
+same-pid rebind consent. An orphan with no fresh lifecycle event is reported
+honestly because an invalidated extension cannot repair its own pi host; if the
+warning says no replacement arrived, restart pi normally and let the saved
+`.pi-glla/` state restore. There are no automatic `/reload` keystrokes and no
+mux dependency. The legacy `autoReloadOnStale` and `autoRecovery` fields remain
+only as deprecated settings-file compatibility fields; they are ignored.
 
 **User aborts mean STOP** (v0.29.4): Esc-aborting a turn stands the chain
 down with a named notify (`/goal resume` to continue) — it does NOT count

package/docs/DESIGN.md

@@ -90,6 +90,26 @@ architectural decisions that changed the SHAPE of the system:
   Confirm path; it never audits work — the isolated auditor is the only
   verifier.
 
+## Addendum v0.34.16 (lifecycle handoff)
+
+- **Recovery crosses pi's lifecycle, never the terminal**: `session_shutdown`
+  persists fresh same-process continuation debt in
+  `.pi-glla/session-handoff.json`, records the shutdown reason, and clears all
+  session-owned timers. A fresh `session_start` consumes matching debt and
+  continues from its new context. No stale callback is allowed to use the old
+  `ctx` or `pi` reference.
+- **Quit is not implicit resume consent**: a shutdown with `reason: "quit"`
+  removes any handoff debt, records `session_handoff_suppressed`, and marks
+  the owner sidecar so the next same-pid startup is not mistaken for a
+  replacement rebind. The global `autoResume` policy remains independent and
+  explicit.
+- **True orphans stay honest**: once pi invalidates an extension without a
+  fresh lifecycle event, the extension cannot repair its host. glla stops
+  stale work, preserves the artifact, and tells the user to restart pi only
+  when no replacement arrives. `autoReloadOnStale` and `autoRecovery` remain
+  deprecated deserialization compatibility fields; they do not select a
+  transport.
+
 ## Addendum v0.4.0 (completion)
 
 - **Auditor compaction enabled** (flaw #3 — the last open one). Safety:

package/extensions/goal-loop-display.ts

@@ -215,10 +215,11 @@ export function buildStatusText(state: State, audit?: AuditDisplayProgress | nul
   }
   if (g.status === "active") {
     // v0.28.1 (S1/S2): a stale-handle interrupt keeps the goal ACTIVE.
-    // v0.29.11: the fresh session HOLDS it (hold-everything restore gate;
-    // autoresume=on resumes for you) — name the verb, don't promise auto.
+    // v0.34.16: a fresh session_start owns the handoff. A cold boot still
+    // follows the global autoResume setting, so the widget names the actual
+    // lifecycle rather than promising terminal keystroke recovery.
     if (g.interruptedAt) {
-      return `glla: ${paint(theme, "error", "⚠ interrupted — stale handle · /reload → /glla resume")}${heldSuffix}`;
+      return `glla: ${paint(theme, "error", "⚠ interrupted — stale handle · fresh session_start resumes")}${heldSuffix}`;
     }
     // v0.24.7: list policy gets its own wording — a queue item is not a goal.
     // v0.28.11 (U10): goal policy joins it — "list 29" read as a command

package/extensions/goal-settings.ts

@@ -68,18 +68,12 @@ export interface Settings {
   /** Consecutive stuck interventions before a loop stops (default 5,
    * 10 under aggressiveMode). */
   stuckMaxInterventions?: number;
-  /** v0.29.13: on a stale-handle terminal, inject /reload into our own
-   * tmux pane (keystroke self-heal; pi walls ctx.reload() behind
-   * assertActive). Default true; only acts when TMUX and TMUX_PANE are
-   * set — pi outside tmux just gets the manual warning. */
+  /** @deprecated v0.34.16: retained so older settings files deserialize, but
+   * ignored. Recovery now uses session_shutdown/session_start handoff and
+   * never injects terminal keystrokes. */
   autoReloadOnStale?: boolean;
-  /** v0.34.13: auto-recovery ladder — when a wedge is detected that only a
-   * /reload cures (unanswered continuation, send-retry storm), inject the
-   * /reload ITSELF via the v0.29.13 tmux/WezTerm transport and resume the
-   * goal/loop after the rebuild (sidecar marker — autoresume=off is a
-   * restore-time setting, not a recovery veto). Default true. The one
-   * class it does NOT cross: pi restart (transcript-writer dead) — that
-   * stays a loud stop for the human. */
+  /** @deprecated v0.34.16: retained for settings-file compatibility, but
+   * ignored. Lifecycle handoff is always enabled. */
   autoRecovery?: boolean;
   /** v0.26.1: consecutive heartbeat refires without a real turn before
    * the goal pauses / loop stops (default 5; 0 = never escalate). */
@@ -214,8 +208,6 @@ export const SETTINGS_KEYS: Array<keyof Settings> = [
   "quotaRetryMinutes",
   "stuckMaxInterventions",
   "stallEscalationRefires",
-  "autoReloadOnStale",
-  "autoRecovery",
   "stallShortWords",
   "stallSimilarityThreshold",
   "postaudit",

package/extensions/loops/goal.ts

@@ -15,7 +15,6 @@
  */
 
 import * as fs from "node:fs";
-import { exec } from "node:child_process";
 import * as os from "node:os";
 import * as path from "node:path";
 
@@ -221,18 +220,16 @@ const GOAL_EVENT_ENTRY = "goal-event";
 // not on ExtensionContext, so continuation sends need it at module scope.
 let extensionApi: ExtensionAPI | null = null;
 // v0.26.7: pi invalidates the extension runtime on session replacement
-// (newSession/fork/switchSession/reload — and the compaction path reaches
-// it via teardownCurrent in pi 0.82.x). Once stale, every sendMessage
+// (newSession/fork/switchSession/reload). Once stale, every sendMessage
 // throws FOREVER in this process — retrying for hours is the hegemon
 // failure shape. Detect the stale signature once and go terminally loud.
 let extensionApiStale = false;
 // v0.32.0: CRITICAL — goStaleTerminal must gate on its OWN flag, not
 // extensionApiStale: probeExtensionApiStale() sets extensionApiStale on
 // detection, so the heartbeat's `probe → goStaleTerminal` sequence always
-// found the flag already true and returned silently — orphan-stale recovery
-// (ledger, loop stop, interruptedAt, warn, AUTO-RELOAD SELF-HEAL) was dead
-// code since v0.29.11. Field proof: hegemon sat stale for days and the
-// wezterm self-heal never fired.
+// found the flag already true and returned silently. The terminal orphan
+// path must still ledger the stale handle, stop stale work, and preserve the
+// interrupt marker so a later fresh lifecycle can restore it.
 let staleTerminalDone = false;
 
 /** v0.26.7: a stale api is terminal for this process — go loudly with
@@ -241,25 +238,14 @@ let staleTerminalDone = false;
  * pausing — the restore gate only auto-resumes ACTIVE goals, so pausing
  * here stranded goals until manual /goal resume (hegemon/sraaal shape).
  * sendContinuation's extensionApiStale guard already stops further sends
- * in this doomed process; the next fresh session auto-resumes. */
-/** v0.30.0: rebind-first session-replacement survival. pi's sanctioned
- * pattern (docs/extensions.md lifecycle + the stale error text itself):
- * session_shutdown → cleanup, session_start → re-establish with the NEW
- * ctx. glla used to treat every stale handle as terminal ("run /reload"),
- * but three replacement shapes need three responses:
- *  (a) switch (resume/new/fork): pi rebinds THIS module to the new
- *      session — session_start delivers a fresh ctx. No user action, no
- *      warning; reset the stale flag via a re-probe and continue.
- *  (b) /reload: pi re-imports the extension modules — a SUCCESSOR
- *      instance owns this cwd in the same process. The old module stands
- *      down silently (owner-file check) instead of screaming + injecting
- *      /reload (v0.29.22's injection is right for orphans, wrong here).
- *  (c) orphan: the session died with NO replacement (hegemon 2026-07-31:
- *      handle dead ~06:03, zero ledger events for 5h). Only a rebuild
- *      revives extension function — goStaleTerminal's warning + self-heal
- *      stays for this case ONLY.
- * session_shutdown is now ledgered with pi's reason, so the next
- * unexplained disposal is attributable from the ledger alone. */
+ * in this doomed process; the next fresh session can restore the work. */
+/** v0.34.16: lifecycle-first session-replacement survival. pi's
+ * sanctioned pattern (docs/extensions.md lifecycle + the stale error text):
+ * session_shutdown → persist handoff debt + stop old timers,
+ * session_start → re-establish with the NEW ctx and consume the debt.
+ * A successor module may still stand down via the owner file. An orphan with
+ * no replacement is reported honestly: an invalid extension cannot repair its
+ * own pi host, so glla never injects terminal keystrokes. */
 const SESSION_REBIND_GRACE_MS = 60_000;
 let sessionReplacementUntil = 0;
 const instanceStartedAt = Date.now();
@@ -301,12 +287,7 @@ function absorbStaleIfSuperseded(ctx: ExtensionContext): boolean {
     appendLedger(ctx.cwd, "zombie_stood_down", { owner: owner.instanceId });
     zombieStoodDown = true;
     extensionApiStale = true; // silence the send paths WITHOUT the terminal theatre
-    clearLoopTimer();
-    if (continuationTimer) { clearTimeout(continuationTimer); continuationTimer = null; }
-    // v0.32.0: the superseded module's heartbeat + UI ticker were IMMORTAL
-    // (clearInterval appeared nowhere) — N /reloads = N×2 zombie tickers.
-    if (heartbeatTimer) { clearInterval(heartbeatTimer); heartbeatTimer = null; }
-    if (uiTicker) { clearInterval(uiTicker); uiTicker = null; }
+    clearSessionOwnedTimers();
     return true;
   }
   return false;
@@ -317,10 +298,10 @@ function goStaleTerminal(ctx: ExtensionContext, where: string): void {
   staleTerminalDone = true;
   extensionApiStale = true;
   appendLedger(ctx.cwd, "extension_api_stale", { where, kind: isLoopActive() ? "loop" : "goal" });
-  const guidance = "pi invalidated this session's extension handle (session replacement — the session was disposed and this process's sends can never land). Run /reload — extensions rebuild IN PLACE, no pi restart needed — then /glla resume (autoresume=on resumes for you). Restart pi only if /reload itself fails.";
+  const guidance = "pi invalidated this session's extension handle without delivering a replacement session. glla stopped stale sends and kept the work safe in .pi-glla/. A fresh session_start will resume it; if pi does not create one, restart pi normally and glla will restore the saved work.";
   // v0.32.0: kill the continuation re-arm too — otherwise an orphaned goal
   // keeps spinning a flat 50ms retry below every watchdog.
-  if (continuationTimer) { clearTimeout(continuationTimer); continuationTimer = null; continuationScheduledFor = null; }
+  clearSessionOwnedTimers();
   if (isLoopActive()) {
     clearLoopTimer();
     state.loop = { ...state.loop!, active: false, stopReason: `extension api stale: ${guidance}` };
@@ -329,107 +310,83 @@ function goStaleTerminal(ctx: ExtensionContext, where: string): void {
     updateGoal({ interruptedAt: nowIso(), interruptedReason: `extension api stale (${where})` }, ctx);
   }
   ctx.ui.notify(`glla: ${guidance}`, "warning");
-  notifyExternal(ctx, `glla: extension api stale — run /reload, then /glla resume. (${where})`);
-  attemptAutoReload(ctx, where);
+  notifyExternal(ctx, `glla: extension api stale — waiting for a fresh session_start; restart pi normally only if no replacement arrives. (${where})`);
 }
 
-/** v0.29.13: automatic recovery — the zombie handle can't call ctx.reload()
- * (pi walls EVERY runtime method behind assertActive), but fs/child_process
- * are extension-side and still work. Inject /reload as keystrokes into our
- * own terminal pane: pi rebuilds the extension runtime in place, the fresh
- * instance loads .pi-glla state and holds (autoresume=on resumes for you).
- * v0.29.22: transport-generalized — tmux OR WezTerm. Field: this rig runs
- * WezTerm (TERM_PROGRAM=WezTerm, WEZTERM_PANE set, no TMUX), so the
- * tmux-only gate failed silently 100% of the time — auto_reload_injected
- * never fired fleet-wide, and every stale handle fell back to the manual
- * warning (user: "stopping and told to reload is common"). v0.29.22 also
- * fires from the entry-probe path (the most common stale discovery).
- * Opt out: autoReloadOnStale=false. Best-effort: the manual warning
- * already fired, so failures cost nothing. */
-function attemptAutoReload(ctx: ExtensionContext, where: string): boolean {
+/** v0.34.16: lifecycle handoff replaces terminal keystroke injection. A
+ * stale extension cannot call pi, so recovery must cross the lifecycle
+ * boundary: session_shutdown records durable resume debt, clears every timer
+ * that could retain the old context, and session_start consumes the debt from
+ * a fresh context. */
+const SESSION_HANDOFF_FILE = "session-handoff.json";
+const SESSION_HANDOFF_FRESH_MS = 300_000;
+function sessionHandoffPath(cwd: string): string {
+  return path.join(piGlaDir(cwd), SESSION_HANDOFF_FILE);
+}
+function writeSessionHandoff(ctx: ExtensionContext, reason: string): boolean {
+  if (!isSupervising()) return false;
+  // A user quit is an explicit stop, not a replacement boundary. Do not
+  // leave debt that could silently resume the work on a later startup;
+  // global autoResume may still apply by its own explicit policy.
+  if (reason.trim().toLowerCase() === "quit") {
+    try { fs.rmSync(sessionHandoffPath(ctx.cwd), { force: true }); } catch { /* advisory cleanup */ }
+    appendLedger(ctx.cwd, "session_handoff_suppressed", { reason });
+    return false;
+  }
   try {
-    if (loadSettings(ctx.cwd).autoReloadOnStale === false) return false;
-    const tmuxPane = process.env.TMUX_PANE;
-    const wezPane = process.env.WEZTERM_PANE;
-    let transport: "tmux" | "wezterm";
-    let cmd: string;
-    let pane: string;
-    if (process.env.TMUX && tmuxPane && /^%\d+$/.test(tmuxPane)) {
-      transport = "tmux";
-      pane = tmuxPane;
-      // v0.29.22: NO leading Escape — a late zombie probe can fire AFTER a
-      // fresh instance already resumed and started a turn, and Escape
-      // would abort that turn without consent (the consent line). /reload
-      // alone lands at a dead prompt and queues harmlessly mid-turn (pi
-      // refuses the reload itself if a response is streaming).
-      cmd = `tmux send-keys -t ${pane} -l '/reload' && tmux send-keys -t ${pane} Enter`;
-    } else if (wezPane && /^\d+$/.test(wezPane)) {
-      transport = "wezterm";
-      pane = wezPane;
-      // wezterm cli send-text --no-paste delivers bytes as keystrokes.
-      // /reload + CR only — no Escape (see above). Literal CR byte inside
-      // single quotes — no bash-isms (exec uses /bin/sh).
-      cmd = `wezterm cli send-text --pane-id ${pane} --no-paste '/reload\r'`;
-    } else {
-      appendLedger(ctx.cwd, "auto_reload_skipped", { where, reason: "no supported multiplexer (tmux/WezTerm) in env" });
-      return false;
-    }
-    appendLedger(ctx.cwd, "auto_reload_injected", { where, transport, pane });
-    ctx.ui.notify("glla: injecting /reload into this pane — extensions rebuild in place and the fresh instance holds state. /glla resume after (automatic with autoresume=on).", "info");
-    exec(cmd, () => { /* best-effort */ });
+    fs.mkdirSync(piGlaDir(ctx.cwd), { recursive: true });
+    fs.writeFileSync(sessionHandoffPath(ctx.cwd), JSON.stringify({ pid: process.pid, at: new Date().toISOString(), reason }));
+    appendLedger(ctx.cwd, "session_handoff_pending", { reason, pid: process.pid });
     return true;
   } catch {
-    /* never let recovery take the warning path down */
+    appendLedger(ctx.cwd, "session_handoff_write_failed", { reason });
     return false;
   }
 }
-
-/** v0.34.13: one rung of the auto-recovery ladder. Returns true when a
- * /reload was injected (caller should NOT also pause/alert the manual
- * cure). Writes the sidecar resume marker FIRST so the fresh instance
- * resumes the goal/loop even with autoresume=off. Throttled — a second
- * wedge inside the window is the pi-restart class and must reach the
- * user as a loud stop, not another reload. */
-let lastAutoRecoveryAt = 0;
-function attemptAutoRecovery(ctx: ExtensionContext, where: string): boolean {
-  if (loadSettings(ctx.cwd).autoRecovery === false) return false;
-  const now = Date.now();
-  if (now - lastAutoRecoveryAt < AUTO_RECOVERY_THROTTLE_MS) return false;
-  // Inject FIRST — the throttle stamp + marker must reflect a real
-  // recovery, not a no-transport skip (else the watchdog would mislabel
-  // the next wedge as the pi-restart class).
-  if (!attemptAutoReload(ctx, where)) return false;
-  lastAutoRecoveryAt = now;
+function consumeSessionHandoff(cwd: string): boolean {
   try {
-    fs.writeFileSync(
-      path.join(piGlaDir(ctx.cwd), RECOVERY_RESUME_MARKER),
-      JSON.stringify({ at: new Date(now).toISOString(), where }),
-    );
-  } catch { /* best-effort — the reload still helps; restore just holds */ }
-  appendLedger(ctx.cwd, "auto_recovery_reload", { where });
-  ctx.ui.notify(`glla auto-recovery: ${where} — the ${isLoopActive() ? "loop" : "goal/list item"} resumes ITSELF after the rebuild (no /glla resume needed; the sidecar marker carries the consent). If this recurs within ${Math.round(AUTO_RECOVERY_THROTTLE_MS / 60_000)}m it's the pi-restart class and you'll get a loud stop.`, "warning");
-  return true;
+    const p = sessionHandoffPath(cwd);
+    if (!fs.existsSync(p)) return false;
+    const raw = fs.readFileSync(p, "utf-8");
+    fs.unlinkSync(p);
+    const data = JSON.parse(raw) as { pid?: number; at?: string; reason?: string };
+    const at = Date.parse(data.at ?? "");
+    return data.pid === process.pid && data.reason?.trim().toLowerCase() !== "quit" && !Number.isNaN(at) && Date.now() - at < SESSION_HANDOFF_FRESH_MS;
+  } catch {
+    return false;
+  }
 }
 
 /** v0.34.14: /reload rebind detector. The extension runs INSIDE pi, so
  * process.pid IS pi's pid: an instance that boots and finds its OWN pid
- * already in the owner file is a /reload rebuild of a live session, not a
- * cold boot. Rebinds always resume active goals/loops — holding mid-work
+ * already in the owner file is normally a same-process rebuild, not a cold
+ * boot. A non-quit rebind resumes active goals/loops — holding mid-work
  * after an in-place rebuild is pure friction (user directive: keep going
  * unless we must stop; "the list is not continuing" after /reload,
- * hellhunter 2026-08-01). Cold boots (new pid) still honor autoresume=off.
- * Sidecar, not the ledger: read-before-write must be atomic-ish and the
- * ledger is append-only. */
+ * hellhunter 2026-08-01). An explicit quit is stamped in the sidecar and
+ * does not receive this implicit consent; cold boots (new pid) still honor
+ * autoresume=off. Sidecar, not the ledger: read-before-write must be
+ * atomic-ish and the ledger is append-only. */
 const SESSION_OWNER_FILE = "session-owner.json";
+function markSessionOwnerShutdown(cwd: string, reason: string): void {
+  try {
+    const p = path.join(piGlaDir(cwd), SESSION_OWNER_FILE);
+    const owner = JSON.parse(fs.readFileSync(p, "utf-8")) as { pid?: number; at?: string };
+    if (owner.pid === process.pid) {
+      fs.writeFileSync(p, JSON.stringify({ ...owner, shutdownReason: reason, shutdownAt: new Date().toISOString() }));
+    }
+  } catch { /* advisory sidecar — lifecycle cleanup must not throw */ }
+}
 function claimSessionOwnerAndDetectRebind(cwd: string): boolean {
   try {
     const p = path.join(piGlaDir(cwd), SESSION_OWNER_FILE);
-    let prevPid: number | null = null;
+    let previous: { pid?: number; shutdownReason?: string } = {};
     try {
-      prevPid = (JSON.parse(fs.readFileSync(p, "utf-8")) as { pid?: number }).pid ?? null;
+      previous = JSON.parse(fs.readFileSync(p, "utf-8")) as { pid?: number; shutdownReason?: string };
     } catch { /* absent or corrupt — first boot */ }
     fs.writeFileSync(p, JSON.stringify({ pid: process.pid, at: new Date().toISOString() }));
-    return prevPid !== null && prevPid === process.pid;
+    const quit = previous.shutdownReason?.trim().toLowerCase() === "quit";
+    return previous.pid === process.pid && !quit;
   } catch {
     return false;
   }
@@ -486,6 +443,10 @@ function probeExtensionApiStale(): boolean {
  * promise from sync archiveCurrentGoal turned it into an uncaughtException
  * and pi EXITED mid-audit. Probe first, catch anyway, ledger the skip. */
 function safeSteerUser(ctx: ExtensionContext, text: string): boolean {
+  if (sessionHandoffPending) {
+    appendLedger(ctx.cwd, "steer_skipped_handoff", { chars: text.length });
+    return false;
+  }
   if (probeExtensionApiStale()) {
     appendLedger(ctx.cwd, "steer_skipped_stale", { chars: text.length });
     return false;
@@ -505,11 +466,15 @@ function safeSteerUser(ctx: ExtensionContext, text: string): boolean {
  * and must NOT claim work started (S3's "created — starting now" lie). */
 function warnIfStaleAtEntry(ctx: ExtensionContext, what: string): boolean {
   if (!probeExtensionApiStale()) return false;
-  // v0.30.0: a successor may already own this session (e.g. /reload
-  // re-imported the modules) — the user's command belongs to the fresh
-  // instance; say so softly instead of demanding a reload.
+  if (sessionHandoffPending) {
+    ctx.ui.notify(`glla: this session is handing off to a fresh pi context — ${what} will be handled after session_start.`, "info");
+    return true;
+  }
+  // v0.30.0: a successor may already own this session (e.g. a module
+  // re-import) — the user's command belongs to the fresh instance; say so
+  // softly instead of claiming the old handle can recover it.
   // v0.32.0: the rebind window means a fresh instance is COMING, not here —
-  // the old message claimed "handled there" while nothing owned the session.
+  // the message names that handoff rather than pretending a send landed.
   if (Date.now() < sessionReplacementUntil) {
     ctx.ui.notify(`glla: this session is rebinding after /reload — ${what} will be handled by the refreshed instance; retry in a moment if it doesn't.`, "info");
     return true;
@@ -520,14 +485,12 @@ function warnIfStaleAtEntry(ctx: ExtensionContext, what: string): boolean {
   }
   appendLedger(ctx.cwd, "extension_api_stale", { where: `entry probe (${what})` });
   ctx.ui.notify(
-    `glla: this session's extension handle is stale (pi session replacement) — ${what} can't send continuations in this process. State is safe in .pi-glla/ — run /reload (extensions rebuild in place), then /glla resume. Restart pi only if /reload fails.`,
+    `glla: this session's extension handle is stale (pi session replacement) — ${what} can't send continuations in this process. State is safe in .pi-glla/. A fresh session_start will resume it; if pi does not create one, restart pi normally and restore the saved work.`,
     "warning",
   );
-  // v0.29.22: deliberately NO self-heal from the entry probe — it fires
-  // when the user is ACTIVELY typing a /glla command, and injected
-  // keystrokes would race their input. User-present cases keep the manual
-  // warning; the self-heal stays on the autonomous paths (heartbeat
-  // probe, send paths) where no one is at the keyboard.
+  // Entry probes never mutate the terminal. The only recovery boundary is
+  // pi's own session lifecycle; user-present commands keep an honest warning
+  // and the durable state remains available to the fresh session.
   return true;
 }
 
@@ -616,6 +579,11 @@ function resolveCarryover(ctx: ExtensionContext, trigger: "goal" | "loop" | "lis
 // pi replaces sessions (newSession/fork/reload) and stale ctx throws on use,
 // so timers must never capture a ctx — they read lastCtx at fire time.
 let lastCtx: ExtensionContext | null = null;
+// v0.34.16: shutdown sets this before pi invalidates the old context. Any
+// timer or late event that reaches the old module must stand down until the
+// fresh session_start rebinds it.
+let sessionHandoffPending = false;
+const sessionTimeouts = new Set<NodeJS.Timeout>();
 // v0.23.8: the session that OWNS the loop (its sessionManager). Subagent
 // sessions (pi-subagents binds extensions there too) fire our handlers
 // with their own ctx — they must never take over lastCtx (a headless
@@ -718,15 +686,9 @@ const CONTINUATION_UNANSWERED_THROTTLE_MS = 300_000;
 // cycle. Sending 2.5s AFTER agent_end lets teardown settle; the send lands
 // and the next turn starts immediately. 2.5s per turn beats 60s per turn.
 const EAGER_CONTINUATION_SETTLE_MS = Number(process.env.GLLA_EAGER_SETTLE_MS ?? 2_500);
-// v0.34.13: auto-recovery ladder ("keep going unless we MUST stop — a
-// question, or done" — user directive 2026-08-01). A wedge that only a
-// /reload cures should /reload ITSELF: inject the keystrokes (v0.29.13
-// transport) with a sidecar marker so the fresh instance RESUMES even when
-// autoresume=off (the consent came from autoRecovery at recovery time, not
-// the restore-time setting). Throttled to one attempt per window: a
-// recurrence inside the window is the transcript-writer-dead class, which
-// only a pi restart cures — that one stays a loud stop for the human.
-const AUTO_RECOVERY_THROTTLE_MS = 600_000;
+// v0.34.16: retain the old recovery marker for one compatibility window so
+// an in-flight v0.34.15 reload can still resume once. New recovery debt uses
+// the session lifecycle handoff below and never injects terminal keystrokes.
 const RECOVERY_RESUME_MARKER = "recovery-resume.json";
 const RECOVERY_RESUME_FRESH_MS = 300_000;
 // v0.29.19: dead-turn caps (agent_end exemption path). 6 consecutive
@@ -904,14 +866,10 @@ function escalateSendRearmStorm(ctx: ExtensionContext, kind: "continuation" | "l
   const silent = Math.round(SEND_REARM_ESCALATE_SILENT_MS / 60000);
   appendLedger(ctx.cwd, "send_rearm_escalated", { kind, afterMinutes: mins, silentMinutes: silent });
   if (kind === "loop" && isLoopActive()) {
-    if (attemptAutoRecovery(ctx, "send-retry storm")) {
-      appendLedger(ctx.cwd, "send_rearm_escalated_suppressed", { reason: "auto-recovery reload" });
-      return;
-    }
     clearLoopTimer();
-    state.loop = { ...state.loop!, active: false, stopReason: `send-retry storm: ${mins}m of re-arms with no session activity for ${silent}m — the session is wedged. Press Escape to cancel the stuck run (pi's own rate-limit retry holds it; pi prints "escape to cancel"), then /loop resume — the loop holds on restore. If still wedged: /reload rebuilds extensions in place, then /loop resume again. Restart pi only if /reload itself fails.` };
+    state.loop = { ...state.loop!, active: false, stopReason: `send-retry storm: ${mins}m of re-arms with no session activity for ${silent}m — the session is wedged. Press Escape to cancel the stuck run (pi's own rate-limit retry holds it; pi prints "escape to cancel"), then /loop resume — the loop holds on restore. A fresh session_start rebinds the loop; restart pi normally only if no replacement arrives.` };
     persistState(ctx);
-    ctx.ui.notify(`Loop stopped: send-retry storm (${mins}m, session silent ${silent}m). Escape cancels the stuck run, then /loop resume (the loop holds on restore). /reload if it persists; restart pi only if /reload fails.`, "warning");
+    ctx.ui.notify(`Loop stopped: send-retry storm (${mins}m, session silent ${silent}m). Escape cancels the stuck run, then /loop resume (the loop holds on restore). A fresh session_start rebinds it; restart pi normally only if no replacement arrives.`, "warning");
     notifyExternal(ctx, "Loop stopped: send-retry storm.");
     return;
   }
@@ -931,21 +889,13 @@ function escalateSendRearmStorm(ctx: ExtensionContext, kind: "continuation" | "l
     return;
   }
   if (state.goal && state.goal.status === "active") {
-    // v0.34.13: keep going unless we MUST stop — try the auto-recovery
-    // /reload before spending the user's attention on a pause. A reload
-    // that fails to cure throttles the next attempt, and the pause below
-    // fires then as today.
-    if (attemptAutoRecovery(ctx, "send-retry storm")) {
-      appendLedger(ctx.cwd, "send_rearm_escalated_suppressed", { reason: "auto-recovery reload" });
-      return;
-    }
     updateGoal({
       status: "paused",
       pauseKind: "error",
       pauseReason: `send-retry storm: ${mins}m of re-arms with no session activity for ${silent}m — the session never went idle for the continuation`,
-      pauseSuggestedAction: "The session produced no events while the send retried (wedged queue — often pi's own rate-limit retry holding the run; pi prints 'escape to cancel'). Press Escape, then /goal resume. If still wedged: /reload rebuilds extensions in place, then /goal resume again. Restart pi only if /reload fails.",
+      pauseSuggestedAction: "The session produced no events while the send retried (wedged queue — often pi's own rate-limit retry holding the run; pi prints 'escape to cancel'). Press Escape, then /goal resume. A fresh session_start rebinds the goal; restart pi normally only if no replacement arrives.",
     }, ctx);
-    ctx.ui.notify(`${goalNoun()} paused: send-retry storm (${mins}m, session silent ${silent}m). Escape cancels the stuck run, then /goal resume. /reload if it persists; restart pi only if /reload fails.`, "warning");
+    ctx.ui.notify(`${goalNoun()} paused: send-retry storm (${mins}m, session silent ${silent}m). Escape cancels the stuck run, then /goal resume. A fresh session_start rebinds it; restart pi normally only if no replacement arrives.`, "warning");
     notifyExternal(ctx, `${goalNoun()} paused: send-retry storm.`);
   }
 }
@@ -954,17 +904,11 @@ function escalateStallNow(ctx: ExtensionContext, threshold: number): boolean {
   if (!shouldEscalateStall(consecutiveStalls, threshold)) return false;
   consecutiveStalls = 0;
   appendLedger(ctx.cwd, "stall_escalated", { threshold, kind: isLoopActive() ? "loop" : "goal" });
-  // v0.34.13: recovery before stop — usually throttled (the 2.5min
-  // watchdog already tried), in which case the stop proceeds as today.
-  if (attemptAutoRecovery(ctx, "stall escalation")) {
-    appendLedger(ctx.cwd, "stall_escalated_suppressed", { reason: "auto-recovery reload", threshold });
-    return true;
-  }
   if (isLoopActive()) {
     clearLoopTimer();
-    state.loop = { ...state.loop!, active: false, stopReason: `stalled: ${threshold} continuation refires landed no turn — the session is not continuing (wedged message queue or stale API). Press Escape to cancel any stuck run, then /loop resume — the loop holds on restore. If the handle is stale, /reload rebuilds extensions in place; restart pi only if /reload fails.` };
+    state.loop = { ...state.loop!, active: false, stopReason: `stalled: ${threshold} continuation refires landed no turn — the session is not continuing (wedged message queue or stale API). Press Escape to cancel any stuck run, then /loop resume — the loop holds on restore. A fresh session_start rebinds the loop or goal; restart pi normally only if no replacement arrives.` };
     persistState(ctx);
-    ctx.ui.notify(`Loop stopped: ${threshold} refires produced no turn — the continuation is not landing. Escape cancels a stuck run, then /loop resume (the loop holds on restore). /reload if stale; restart pi only if /reload fails.`, "warning");
+    ctx.ui.notify(`Loop stopped: ${threshold} refires produced no turn — the continuation is not landing. Escape cancels a stuck run, then /loop resume (the loop holds on restore). A fresh session_start rebinds it; restart pi normally only if no replacement arrives.`, "warning");
     notifyExternal(ctx, "Loop stopped: stalled (continuation not landing).");
     return true;
   }
@@ -973,9 +917,9 @@ function escalateStallNow(ctx: ExtensionContext, threshold: number): boolean {
       status: "paused",
       pauseKind: "error",
       pauseReason: `stalled: ${threshold} continuation refires landed no turn`,
-      pauseSuggestedAction: "The continuation chain is broken in this process (wedged message queue or stale API). Press Escape to cancel any stuck run, then /goal resume. If the handle is stale, /reload rebuilds extensions in place — restart pi only if /reload fails.",
+      pauseSuggestedAction: "The continuation chain is broken in this process (wedged message queue or stale API). Press Escape to cancel any stuck run, then /goal resume. A fresh session_start rebinds the goal; restart pi normally only if no replacement arrives.",
     }, ctx);
-    ctx.ui.notify(`${goalNoun()} paused: ${threshold} refires produced no turn. Escape cancels a stuck run, then /goal resume. /reload if stale; restart pi only if /reload fails.`, "warning");
+    ctx.ui.notify(`${goalNoun()} paused: ${threshold} refires produced no turn. Escape cancels a stuck run, then /goal resume. A fresh session_start rebinds it; restart pi normally only if no replacement arrives.`, "warning");
     notifyExternal(ctx, `${goalNoun()} paused: stalled (continuation not landing).`);
     return true;
   }
@@ -1069,17 +1013,10 @@ function heartbeatTick(): void {
   ) {
     lastUnansweredAlertAt = Date.now();
     appendLedger(ctx.cwd, "continuation_unanswered", { silentMs: Date.now() - lastContinuationSentAt });
-    // v0.34.13: recover, don't just report. Only the failure modes reach
-    // the user: throttled (a reload already failed to cure → the
-    // pi-restart class) or recovery unavailable (setting off / no pane).
-    if (!attemptAutoRecovery(ctx, "continuation unanswered")) {
-      const mins = Math.round((Date.now() - lastContinuationSentAt) / 60_000);
-      const msg = lastAutoRecoveryAt > 0
-        ? `glla: auto-recovery /reload did NOT unstick this session — still no turn ${mins}m after the continuation. This class kills pi's transcript writer; only a pi RESTART cures it: restart pi in this tab, then /glla resume (the goal holds in .pi-glla state).`
-        : `glla: pi accepted the continuation ${mins}m ago but NO turn has started — no tool calls, no tokens, transcript frozen (the turn trigger is wedged). Cure: /reload — autoresume re-fires the ${isLoopActive() ? "loop" : "goal/list item"}. (auto-recovery is off or no tmux/WezTerm pane — /glla settings autoRecovery=on enables the automatic form.)`;
-      ctx.ui.notify(msg, "warning");
-      notifyExternal(ctx, msg);
-    }
+    const mins = Math.round((Date.now() - lastContinuationSentAt) / 60_000);
+    const msg = `glla: pi accepted the continuation ${mins}m ago but NO turn has started — no tool calls, no tokens, transcript frozen (the turn trigger is wedged). Re-sends do not unstick it. A fresh session_start will rebind the ${isLoopActive() ? "loop" : "goal/list item"}; if no replacement arrives, restart pi normally and restore the saved work.`;
+    ctx.ui.notify(msg, "warning");
+    notifyExternal(ctx, msg);
   }
   // v0.29.1: stranded-audit recovery. A goal left in "auditing" with NO
   // in-flight audit means the auditor's result never landed (wedged queue
@@ -1241,11 +1178,37 @@ function clearContinuationTimer(): void {
   continuationScheduledFor = null;
 }
 
+function scheduleSessionTimeout(callback: () => void, delayMs: number): NodeJS.Timeout {
+  let timer: NodeJS.Timeout;
+  timer = setTimeout(() => {
+    sessionTimeouts.delete(timer);
+    callback();
+  }, delayMs);
+  sessionTimeouts.add(timer);
+  timer.unref?.();
+  return timer;
+}
+
+function clearSessionOwnedTimers(): void {
+  sessionHandoffPending = true;
+  clearContinuationTimer();
+  clearLoopTimer();
+  if (queueStuckProbe) { clearTimeout(queueStuckProbe); queueStuckProbe = null; }
+  if (heartbeatTimer) { clearInterval(heartbeatTimer); heartbeatTimer = null; }
+  if (uiTicker) { clearInterval(uiTicker); uiTicker = null; }
+  for (const timer of sessionTimeouts) clearTimeout(timer);
+  sessionTimeouts.clear();
+  cancelQuotaRetry();
+  lastCtx = null;
+  ownerSession = null;
+}
+
 function isActionableGoal(): boolean {
   return !!state.goal && state.goal.status === "active" && state.goal.autoContinue;
 }
 
 function freshCtx(): ExtensionContext | null {
+  if (sessionHandoffPending) return null;
   // A captured ctx throws "stale" after session replacement. Probe cheaply;
   // on stale, drop it and wait for the next event to hand us a fresh one.
   if (!lastCtx) return null;
@@ -1263,35 +1226,34 @@ function freshCtx(): ExtensionContext | null {
 // pi idled. The 0.34.11 watchdog gates on "pi reported NO pending" and the
 // stall ladder takes ~10 minutes; a send that lands queued-without-a-turn is
 // a CONFIRMED dead trigger (hegemon law), so probe once, ~45s after every
-// landed send, and go straight to auto-recovery. A consumed message (even an
-// instant-429 turn consumes it) or any real activity disarms the probe.
+// landed send, and report it without terminal input. A consumed message (even
+// an instant-429 turn consumes it) or any real activity disarms the probe.
 function queueStuckProbeMs(): number {
   return Number(process.env.GLLA_QUEUE_STUCK_MS ?? 45_000);
 }
 let queueStuckProbe: ReturnType<typeof setTimeout> | null = null;
-function armQueueStuckProbe(ctx: ExtensionContext, sentAt: number): void {
+function armQueueStuckProbe(sentAt: number): void {
   if (queueStuckProbe) clearTimeout(queueStuckProbe);
-  queueStuckProbe = setTimeout(() => {
+  queueStuckProbe = scheduleSessionTimeout(() => {
     queueStuckProbe = null;
     try {
-      if (isForeignCtx(ctx)) return; // stale instance — the live one probes
+      const ctx = freshCtx();
+      if (!ctx) return; // no fresh lifecycle context — do not touch a stale one
       if (!isSupervising()) return; // paused/completed meanwhile
       if (lastContinuationSentAt !== sentAt) return; // a newer send armed its own probe
       if (lastRealActivityAt > sentAt) return; // the turn started and worked
       if (!ctx.isIdle()) return; // a turn is running — healthy
       if (!ctx.hasPendingMessages()) return; // consumed — even an instant 429 consumes
       appendLedger(ctx.cwd, "queue_stuck_detected", { waitedMs: Date.now() - sentAt });
-      if (!attemptAutoRecovery(ctx, "queue-stuck continuation")) {
-        const msg = `${goalNoun()}: the continuation is QUEUED but pi won't start a turn — the turn trigger is dead (re-sends only queue). Cure: /reload — the goal resumes itself after the rebuild (autoresume off? /glla resume).`;
-        ctx.ui.notify(msg, "warning");
-        notifyExternal(ctx, msg);
-      }
+      const msg = `${goalNoun()}: the continuation is QUEUED but pi won't start a turn — the turn trigger is dead (re-sends only queue). glla will resume from a fresh session_start; if no replacement arrives, restart pi normally and restore the saved work.`;
+      ctx.ui.notify(msg, "warning");
+      notifyExternal(ctx, msg);
     } catch { /* stale ctx — the live instance owns the probe now */ }
   }, queueStuckProbeMs());
-  queueStuckProbe.unref?.();
 }
 
 function scheduleContinuation(ctx: ExtensionContext, force = false, delayMs?: number): void {
+  if (sessionHandoffPending) return;
   abortedStandDown = false; // v0.29.5: any explicit schedule ends the stand-down
   if (!isActionableGoal()) return;
   rememberCtx(ctx);
@@ -1305,11 +1267,11 @@ function scheduleContinuation(ctx: ExtensionContext, force = false, delayMs?: nu
     return;
   }
   continuationScheduledFor = goalId;
-  continuationTimer = setTimeout(() => sendContinuation(goalId), delay);
-  continuationTimer.unref?.();
+  continuationTimer = scheduleSessionTimeout(() => sendContinuation(goalId), delay);
 }
 
 function sendContinuation(goalId: string): void {
+  if (sessionHandoffPending) return;
   continuationTimer = null;
   continuationScheduledFor = null;
   if (!isActionableGoal()) return;
@@ -1320,16 +1282,14 @@ function sendContinuation(goalId: string): void {
     if (probeExtensionApiStale()) return;
     // No live ctx — retry shortly; the next session event will refresh it.
     continuationScheduledFor = goalId;
-    continuationTimer = setTimeout(() => sendContinuation(goalId), BACKOFF_IDLE_RETRY_MS);
-    continuationTimer.unref?.();
+    continuationTimer = scheduleSessionTimeout(() => sendContinuation(goalId), BACKOFF_IDLE_RETRY_MS);
     return;
   }
   if (!ctx.isIdle() || ctx.hasPendingMessages()) {
     accountSendRearm(ctx, "continuation");
     continuationScheduledFor = goalId;
     // v0.28.29: backing-off cadence (was flat 50ms — 6,000 spins in 5m).
-    continuationTimer = setTimeout(() => sendContinuation(goalId), sendRearmDelayMs(continuationRearmStreak));
-    continuationTimer.unref?.();
+    continuationTimer = scheduleSessionTimeout(() => sendContinuation(goalId), sendRearmDelayMs(continuationRearmStreak));
     return;
   }
   if (!extensionApi || extensionApiStale) return;
@@ -1347,7 +1307,7 @@ function sendContinuation(goalId: string): void {
     continuationRearmStreak = 0; continuationRearmSince = 0; // v0.28.5 (E3): a landed send clears the storm
     appendLedger(ctx.cwd, "goal_continuation_sent", { goalId });
     lastContinuationSentAt = Date.now();
-    armQueueStuckProbe(ctx, lastContinuationSentAt);
+    armQueueStuckProbe(lastContinuationSentAt);
   } catch (err) {
     appendLedger(ctx.cwd, "goal_continuation_send_failed", { goalId, error: err instanceof Error ? err.message : String(err) });
     // v0.26.7: stale runtime = terminal (sends can never land); anything
@@ -1361,7 +1321,7 @@ function sendContinuation(goalId: string): void {
 // what closes the turn: complete_goal if done, pause_goal if blocked, a tool
 // call otherwise. display: true — the user should see the warning too.
 function sendStallEscalation(ctx: ExtensionContext, nudges: number): void {
-  if (!extensionApi || extensionApiStale) return;
+  if (sessionHandoffPending || !extensionApi || extensionApiStale) return;
   const remaining = HEARTBEAT_MAX_NUDGES - nudges;
   const text = [
     `[STALL WARNING ${nudges}/${HEARTBEAT_MAX_NUDGES}] The last turn produced no tool calls.`,
@@ -1383,7 +1343,7 @@ function sendStallEscalation(ctx: ExtensionContext, nudges: number): void {
 // sendContinuation (stale api = terminal), independent of goal state —
 // plain sessions truncate too.
 function sendLengthContinue(ctx: ExtensionContext, consecutive: number): void {
-  if (!extensionApi || extensionApiStale) return;
+  if (sessionHandoffPending || !extensionApi || extensionApiStale) return;
   try {
     extensionApi.sendMessage({
       customType: GOAL_EVENT_ENTRY,
@@ -1914,7 +1874,7 @@ function fireReviewer(
           // to still count as "proposed" in the report + notify. Now the
           // failure is LOUD and the proposal goes uncounted.
           ctx.ui.notify(
-            `Postaudit /goal proposal NOT delivered: ${err instanceof Error ? err.message : String(err)} — the follow-up never reached the session. Run /reload if the session was just replaced (extensions rebuild in place), then retry.`,
+            `Postaudit /goal proposal NOT delivered: ${err instanceof Error ? err.message : String(err)} — the follow-up never reached the session. Wait for a fresh session_start, then retry.`,
             "warning",
           );
           return false;
@@ -2050,7 +2010,7 @@ async function startDrafting(ctx: ExtensionContext, target: "goal" | "list" | "l
     if (isStaleApiError(err)) {
       extensionApiStale = true;
       appendLedger(ctx.cwd, "extension_api_stale", { where: "startDrafting seed" });
-      ctx.ui.notify("glla: can't start the drafting interview — this session's extension handle is stale (pi session replacement). Run /reload (extensions rebuild in place), then re-run the command. Restart pi only if /reload fails.", "warning");
+      ctx.ui.notify("glla: can't start the drafting interview — this session's extension handle is stale (pi session replacement). A fresh session_start will rebind it; if no replacement arrives, restart pi normally, then re-run the command.", "warning");
     } else {
       ctx.ui.notify(`glla: couldn't start the drafting interview (${err instanceof Error ? err.message : String(err)}) — try again.`, "warning");
     }
@@ -2179,7 +2139,7 @@ async function cmdSet(args: string, ctx: ExtensionContext, skipDraft = false): P
     // v0.28.1 (S3): the goal is persisted — mark the interrupt so the next
     // fresh session LOADS it (held by default since v0.28.21), and tell the truth instead of "starting now".
     updateGoal({ interruptedAt: nowIso(), interruptedReason: "created in a stale session" }, ctx);
-    ctx.ui.notify(`Goal saved: ${shortObj(goal.objective)} — safe in .pi-glla/, but this stale process can't send continuations. Run /reload (extensions rebuild in place, state survives), then /goal resume. Restart pi only if /reload itself fails.`, "warning");
+    ctx.ui.notify(`Goal saved: ${shortObj(goal.objective)} — safe in .pi-glla/, but this stale process can't send continuations. A fresh session_start will resume it; if no replacement arrives, restart pi normally, then /goal resume if autoresume is off.`, "warning");
     return;
   }
   ctx.ui.notify(`Goal started: ${shortObj(goal.objective)} — the auditor will verify on completion.`, "info");
@@ -2359,8 +2319,11 @@ async function showDecisionPrompt(ctx: ExtensionContext): Promise<boolean> {
  * disabled (/glla decisionpopup=off), or when one is already open. */
 function maybeDecisionPopup(ctx: ExtensionContext): void {
   if (!ctx.hasUI || loadSettings(ctx.cwd).decisionPopup === false) return;
-  setTimeout(() => {
-    void showDecisionPrompt(ctx).catch(() => {});
+  const cwd = ctx.cwd;
+  scheduleSessionTimeout(() => {
+    const fresh = freshCtx();
+    if (!fresh || fresh.cwd !== cwd) return;
+    void showDecisionPrompt(fresh).catch(() => {});
   }, 600);
 }
 
@@ -2907,7 +2870,7 @@ function loopPrompt(loop: LoopState, regressionNote: string, strategyNote: strin
 }
 
 function scheduleLoopTick(ctx: ExtensionContext): void {
-  if (!isLoopActive()) return;
+  if (sessionHandoffPending || !isLoopActive()) return;
   rememberCtx(ctx);
   clearLoopTimer();
   let delay = 0;
@@ -2916,11 +2879,11 @@ function scheduleLoopTick(ctx: ExtensionContext): void {
   } catch {
     return;
   }
-  loopTimer = setTimeout(() => sendLoopTurn(), delay);
-  loopTimer.unref?.();
+  loopTimer = scheduleSessionTimeout(() => sendLoopTurn(), delay);
 }
 
 function sendLoopTurn(): void {
+  if (sessionHandoffPending) return;
   loopTimer = null;
   if (!isLoopActive() || !extensionApi) return;
   const ctx = freshCtx();
@@ -2932,8 +2895,7 @@ function sendLoopTurn(): void {
       if (probeExtensionApiStale()) return;
       loopRearmStreak++;
     } else accountSendRearm(ctx, "loop");
-    loopTimer = setTimeout(() => sendLoopTurn(), sendRearmDelayMs(loopRearmStreak)); // v0.28.29: backing-off cadence
-    loopTimer.unref?.();
+    loopTimer = scheduleSessionTimeout(() => sendLoopTurn(), sendRearmDelayMs(loopRearmStreak)); // v0.28.29: backing-off cadence
     return;
   }
   const loop = state.loop!;
@@ -3030,7 +2992,7 @@ function sendLoopTurn(): void {
     loopRearmStreak = 0; loopRearmSince = 0; // v0.28.5 (E3): a landed turn clears the storm
     appendLedger(ctx.cwd, "loop_turn_sent", { iteration: loop.iteration });
     lastContinuationSentAt = Date.now();
-    armQueueStuckProbe(ctx, lastContinuationSentAt);
+    armQueueStuckProbe(lastContinuationSentAt);
   } catch (err) {
     // stale API — next agent_end reschedules (but if none comes, the
     // heartbeat's stall escalation stops the spin — v0.26.1).
@@ -4246,7 +4208,7 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
             // refused; the dialog simply can't render in a doomed process.
             extensionApiStale = true;
             appendLedger(liveCtx.cwd, "extension_api_stale", { where: "batch confirm" });
-            return { content: [{ type: "text", text: "The Confirm dialog could not render: pi invalidated this session's extension handle (session replacement). This is NOT a rejection — do NOT refine or re-propose. Tell the user to restart pi, then re-run the drafting flow." }], details: {} };
+            return { content: [{ type: "text", text: "The Confirm dialog could not render: pi invalidated this session's extension handle (session replacement). This is NOT a rejection — do NOT refine or re-propose. Wait for a fresh session_start, then re-run the drafting flow." }], details: {} };
           }
           batchConfirmed = c === "yes";
         }
@@ -4290,7 +4252,7 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
           // v0.28.1 (T1): a stale dialog is NOT "Draft rejected by the user".
           extensionApiStale = true;
           appendLedger(liveCtx.cwd, "extension_api_stale", { where: "draft confirm" });
-          return { content: [{ type: "text", text: "The Confirm dialog could not render: pi invalidated this session's extension handle (session replacement). This is NOT a rejection — do NOT refine or re-propose. Tell the user to restart pi, then re-run the drafting flow." }], details: {} };
+          return { content: [{ type: "text", text: "The Confirm dialog could not render: pi invalidated this session's extension handle (session replacement). This is NOT a rejection — do NOT refine or re-propose. Wait for a fresh session_start, then re-run the drafting flow." }], details: {} };
         }
         confirmed = c === "yes";
       }
@@ -6240,7 +6202,7 @@ export default function (pi: ExtensionAPI): void {
     // EVERY post-grace tick until agent_start discharges it).
     postCompactResumeOwed = true;
     postCompactResyncPending = true;
-    const settle = setTimeout(() => {
+    scheduleSessionTimeout(() => {
       const c = freshCtx();
       if (!c) return;
       try {
@@ -6253,7 +6215,6 @@ export default function (pi: ExtensionAPI): void {
         /* settle race — the 60s heartbeat covers it */
       }
     }, 2000);
-    settle.unref?.();
     // v0.29.21: a SECOND settle at grace expiry. The 2s settle almost
     // always loses (pi is mid-compact / mid-resumed-turn then), and the
     // heartbeat's first post-grace tick lands up to one interval late —
@@ -6262,7 +6223,7 @@ export default function (pi: ExtensionAPI): void {
     // 195.8k after two output-limit turns, zero rearms after the compact
     // event, recovery only at 04:34:48 via the post-grace heartbeat;
     // ~4 min that read as a stoppage). Refire the moment the grace ends.
-    const graceSettle = setTimeout(() => {
+    scheduleSessionTimeout(() => {
       const c = freshCtx();
       if (!c) return;
       try {
@@ -6275,7 +6236,6 @@ export default function (pi: ExtensionAPI): void {
         /* settle race — the 60s heartbeat covers it */
       }
     }, COMPACTION_GRACE_MS + 2_000);
-    graceSettle.unref?.();
   });
 
   pi.on("message_start", async (event: any, _ctx: ExtensionContext) => {
@@ -6350,15 +6310,24 @@ export default function (pi: ExtensionAPI): void {
     // tells the stale probe that a rebind (session_start) is imminent.
     const shutdownReason = typeof event?.reason === "string" ? event.reason : "unknown";
     appendLedger(ctx.cwd, "session_shutdown", { reason: shutdownReason });
+    markSessionOwnerShutdown(ctx.cwd, shutdownReason);
+    writeSessionHandoff(ctx, shutdownReason);
     sessionReplacementUntil = Date.now() + SESSION_REBIND_GRACE_MS;
+    clearSessionOwnedTimers();
+    registeredCtx = null;
+    toolHealNotified = false;
   });
 
   pi.on("session_start", async (event: any, ctx: ExtensionContext) => {
-    rememberCtx(ctx);
     // v0.23.8: subagent sessions (pi-subagents binds extensions there too)
     // are workers — never run the restore gate or reschedule the loop from
     // a foreign session.
     if (isForeignCtx(ctx)) return;
+    extensionApi = pi;
+    sessionHandoffPending = false;
+    rememberCtx(ctx);
+    startHeartbeat();
+    startUITicker();
     // v0.30.0: rebind bookkeeping — claim ownership, close any replacement
     // window, and reset a stale flag left over from the PREVIOUS session's
     // invalidation. pi rebinds THIS module to the new session (switch) or
@@ -6378,10 +6347,12 @@ export default function (pi: ExtensionAPI): void {
       const stillStale = probeExtensionApiStale();
       appendLedger(ctx.cwd, "stale_flag_reset_on_rebind", { reason: startReason, stillStale });
       if (stillStale) {
-        ctx.ui.notify("glla: session rebound but the extension handle is still stale — run /reload (extensions rebuild in place), then /glla resume.", "warning");
+        ctx.ui.notify("glla: session rebound but the extension handle is still stale — waiting for another fresh session_start; restart pi normally only if no replacement arrives, then /glla resume.", "warning");
       }
     }
     state = readState(ctx.cwd);
+    const handoffResume = consumeSessionHandoff(ctx.cwd);
+    if (handoffResume) appendLedger(ctx.cwd, "session_handoff_resumed", { pid: process.pid, reason: startReason });
     // v0.28.14: snapshot carryover BEFORE any restore logic mutates state —
     // a paused goal, waiting list items, or a loop that was live/held when
     // the last session ended. Resolved once at the first NEW activation.
@@ -6479,16 +6450,17 @@ export default function (pi: ExtensionAPI): void {
       persistState(ctx);
       appendLedger(ctx.cwd, "audit_loop_target_migrated", { from: "audit-every-iteration", to: "fix-first" });
     }
-    // v0.34.13: an auto-recovery /reload carries its own resume consent —
-    // the sidecar marker overrides autoresume=off for THIS restore only.
+    // v0.34.15 compatibility: consume one legacy recovery marker if an older
+    // process wrote it before this lifecycle-first build landed.
     const recoveryResume = consumeRecoveryResume(ctx.cwd);
-    // v0.34.14: a /reload rebind (same pi pid) ALWAYS resumes — the session
-    // is live mid-work; holding is the "list is not continuing" bug.
+    // v0.34.16: a same-process lifecycle handoff is explicit continuation
+    // debt, so it resumes independently of the cold-boot autoResume setting.
+    // A same-pid owner rebind is the second same-process signal.
     const rebindResume = claimSessionOwnerAndDetectRebind(ctx.cwd);
     if (rebindResume) appendLedger(ctx.cwd, "rebind_resume", { pid: process.pid });
     if (isLoopActive()) {
       const l = state.loop!;
-      if (autoResume || recoveryResume || rebindResume) {
+      if (autoResume || recoveryResume || rebindResume || handoffResume) {
         ctx.ui.notify(
           `Resuming loop (iteration ${l.iteration}/${l.maxIterations > 0 ? l.maxIterations : "∞"}, best ${l.bestValue ?? "n/a"}, stall ${l.stallCount}/${l.plateauWindow}): ${l.target.slice(0, 60)}`,
           "info",
@@ -6509,7 +6481,7 @@ export default function (pi: ExtensionAPI): void {
       // "load it but not auto start it"). Interrupted goals hold like
       // everything else; autoresume=on (unattended rigs) still auto-resumes
       // them, and the marker is cleared only on that promised auto-resume.
-      if (autoResume || recoveryResume || rebindResume) {
+      if (autoResume || recoveryResume || rebindResume || handoffResume) {
         // v0.28.1 (S2): clear the stale-handle interrupt marker — this IS
         // the auto-resume the marker promised.
         if (wasInterrupted) updateGoal({ interruptedAt: undefined, interruptedReason: undefined }, ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.34.15",
+  "version": "0.34.16",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. An isolated extension-less auditor re-verifies every completion with raw evidence; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "MIT",
   "author": "dracon",