Pi persisted-session takeover proof
Original: https://github.com/pingdotgg/t3code/pull/12506
Bottom head: e02ed9b1c3b507cf1ea13cce66c3d546ee193cba
Runtime proof capture head: dc3bb11e999f034c17e272cc16a4ef0543ad018d
Current reviewed top: 751b435382d51f3e9d9605f602fa91479e472e4a (fixture migration only; runtime production unchanged)
Platform: headless Linux, Node24, native @earendil-works/pi-coding-agent0.85.1.

Focused checks:102/102 tests across adapter.test.ts(97) and mcpInjection.test.ts(5), versus98/98 on main. The initial cold-resume regression failed against main at missing --session. Two additional Deferred/process regressions fail on the earlier implementation at accepted overlapping turn and missing one-time startup recovery. Pi package typecheck, apps/server typecheck and four-file lint pass; existing warnings only.

Native lifecycle probe: old default-spawn plus switch_session invokes two extension factories and shutdown. Initial --session invokes one factory and no shutdown before its next command. A real distinct-file switch still reloads. The exact historical extension-context symptom and real permission/OpenRouter hooks were not reproduced.

Integrated app captured at dc3bb11e99, isolated worktree state and isolated Pi configuration; no live database/global config changes. A local deterministic OpenAI-compatible response fixture supplies fixed replies; this is not a paid-account or model-quality check.

Healthy cold resume: completed an ordinary turn through the web composer after restarting T3. Real Pi wrapper process224427 received --session with the original persisted native file. Commands: get_state, get_available_models, get_entries, set_model, set_session_name, prompt, get_state, get_entries, get_session_stats. No switch_session was sent. Native process224462 had one factory and used the original file for before_provider_request. Fixture request history retained four messages versus two before the restart. Web showed completed reply and enabled send button.

Unusable-session recovery: stopped T3, changed only the disposable native session header cwd to a nonexistent directory, then restarted at the same head. Real Pi process228152 received --session and exited before get_state could answer, matching native startup behavior. The adapter spawned process228169 once without --session. Commands then included get_state, switch_session(error), new_session, get_state, get_available_models, get_entries, set_model, set_session_name, prompt and terminal stats. The existing service logged Provider resume failed; attempting a fresh native session. The model fixture received a new-session request and the web showed a completed reply. Its native file was distinct from the unusable one. Native original fixture restored after stopping the app. No synthetic business commands/events or app database writes used.

Registration concurrency, native wakes during same-file registration and real-switch rejection are verified with Deferred-controlled adapter tests. A focused cold-fallback test proves null-reference ensureThread on a spawn-attached process sends new_session and returns a distinct native file. Pending-handoff crash recovery was not reproduced in the UI. These adapter paths are not claimed as browser-timing proof.

Limits: macOS, Windows, iOS, Android and Electron desktop unverified. No real Pi subscription/account, OpenRouter request, permission dialog or exact historical stale extension context reproduced. Browser proof uses the normal composer; the response is deterministic fixture output.

CI follow-up at751b:3 existing orchestrator replay cases failed with old process argv / redundant switch expectations. Intentional protocol migration changes two recorded process starts to include --session and removes4 obsolete self-switch exchanges. Original recorded model/tree payloads and retained frame ordering verified unchanged; provenance metadata explicitly says migration, not new native recording. Existing resume/rollback outputs retained; all3 targeted cases nowpass (141othersskipped), package102pass, scopedPi/servertypecheck and changedTypeScriptlint/fmtpass. Runtimecode byte-identical dc3..751b, so native/app screenshots reuse the actual earlier capture; no new native/app run is claimed. Full fourth-round independent Sol and Opus reviews found no code bugs. Current-head CI and human approval remain publication gates.