fix-pi-continuation-exit-epoch-fence — WorksGood live mirror

Metadata

Status	done
Assigned	`agent-924`
Model	`pi:openai-codex:gpt-5.6-sol`
Created	2026-07-28T08:03:26.708702744+00:00
Started	2026-07-28T08:52:18.685939446+00:00
Completed	2026-07-28T09:58:22.873045933+00:00
Tokens	35683161 in / 44656 out

Description

Objective

Fix the process-epoch split exposed by implement-lazy-evaluation attempt attempt-0-22: a same-session continuation must not make the live current process exit/terminal receipts appear stale and strand retained WIP.

Incident evidence

Lifecycle remained pi_process_epoch=1 for exact PID 3536136 while watchdog state advanced to process_epoch=2, continuation_epoch=1 after an in-process same-session continuation prompt.
The exact current wrapper then received stale_process_epoch for terminal/exit reconciliation three times; no terminal receipt was accepted, no rescue transaction was created, and coordinator marked the attempt Lost via process_identity_dead.
27 modified/untracked source files and the substantive session journal survived; this is a fencing defect, not source failure.

Requirements

Define and enforce process epoch separately from continuation/prompt epoch: an in-process prompt/continuation on the same exact PID/start/boot/nonce must not impersonate a replacement process epoch.
A real replacement process must atomically update lifecycle and watchdog process epoch/identity before any progress, terminal, or exit receipt is accepted.
Wrapper exit reconciliation must obtain/attest the current exact epoch rather than use stale launch-time assumptions; truly old process receipts remain rejected.
Terminal, process-exit, continuation-budget, native stream follower, finalizer, and dead-agent reconciliation must share one epoch authority and remain idempotent across restart.
Preserve first-terminal-wins, exact route/session/worktree/fence/lease guards, and no cross-runtime fallback.

Validation

RED Fake-Pi case performs a same-PID continuation then exits with/without wg_done; current receipt is accepted or classified for exact-session completion, never stale_process_epoch.
Replacement-PID case updates lifecycle+watchdog atomically; old PID exit is evidence-only and new PID terminal/exit succeeds exactly once.
Restart at each epoch boundary converges without Lost, duplicate charge, or missing rescue.
Regression replays attempt-0-22 shape and preserves dirty WIP/session bytes.
Existing watchdog, native activity/session proof, crash-safe finalization, observer, and TUI smokes pass.
cargo fmt --check, cargo clippy, focused/full tests and owned smoke pass; commit/push and wg done complete normally.

## Objective
Fix the process-epoch split exposed by `implement-lazy-evaluation` attempt `attempt-0-22`: a same-session continuation must not make the live current process exit/terminal receipts appear stale and strand retained WIP.

## Incident evidence
- Lifecycle remained `pi_process_epoch=1` for exact PID 3536136 while watchdog state advanced to `process_epoch=2`, `continuation_epoch=1` after an in-process same-session continuation prompt.
- The exact current wrapper then received `stale_process_epoch` for terminal/exit reconciliation three times; no terminal receipt was accepted, no rescue transaction was created, and coordinator marked the attempt Lost via `process_identity_dead`.
- 27 modified/untracked source files and the substantive session journal survived; this is a fencing defect, not source failure.

## Requirements
- Define and enforce process epoch separately from continuation/prompt epoch: an in-process prompt/continuation on the same exact PID/start/boot/nonce must not impersonate a replacement process epoch.
- A real replacement process must atomically update lifecycle and watchdog process epoch/identity before any progress, terminal, or exit receipt is accepted.
- Wrapper exit reconciliation must obtain/attest the current exact epoch rather than use stale launch-time assumptions; truly old process receipts remain rejected.
- Terminal, process-exit, continuation-budget, native stream follower, finalizer, and dead-agent reconciliation must share one epoch authority and remain idempotent across restart.
- Preserve first-terminal-wins, exact route/session/worktree/fence/lease guards, and no cross-runtime fallback.

## Validation
- [ ] RED Fake-Pi case performs a same-PID continuation then exits with/without `wg_done`; current receipt is accepted or classified for exact-session completion, never `stale_process_epoch`.
- [ ] Replacement-PID case updates lifecycle+watchdog atomically; old PID exit is evidence-only and new PID terminal/exit succeeds exactly once.
- [ ] Restart at each epoch boundary converges without Lost, duplicate charge, or missing rescue.
- [ ] Regression replays attempt-0-22 shape and preserves dirty WIP/session bytes.
- [ ] Existing watchdog, native activity/session proof, crash-safe finalization, observer, and TUI smokes pass.
- [ ] `cargo fmt --check`, `cargo clippy`, focused/full tests and owned smoke pass; commit/push and `wg done` complete normally.

Depends on

done implement-lazy-evaluation

Required by

✉ Messages 1 message (1 unread)

#1implement-lazy-evaluation2026-07-28T08:43:02.386233581+00:00delivered

Lazy evaluation now relies on lifecycle attempt-running proof emitted at serialized launch-gate release and candidate-checkpointed emitted in the final completion commit. Continuation/exit fencing must preserve the current attempt generation/fence and must not synthesize candidate completion during reconciliation.

Log

2026-07-28T08:03:26.680586086+00:00 Task paused
2026-07-28T08:03:27.277192859+00:00 Task published
2026-07-28T08:50:56.523740366+00:00 Spawn preparation deferred before launch permit; rollback is complete and no circuit-breaker charge was recorded. Repair the reported checkout/configuration condition and retry: spawn transaction for agent-924 rolled back (task remains dispatchable; rollback diagnostics: complete): failed to establish isolated-worktree observer baseline: observer source tuple mismatch
2026-07-28T08:52:18.922673877+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-07-28T08:52:34.080104012+00:00 Starting investigation and direct implementation of Pi continuation/exit process-epoch fencing.
2026-07-28T08:57:09.851962831+00:00 RED established: focused integration test proves current code lacks replacement epoch authority APIs; same-PID test also encodes process_epoch must remain 1 through continuation/restart/terminal receipt.
2026-07-28T09:17:39.880657143+00:00 Implemented split authorities: same-PID prompts advance continuation only; lifecycle/watchdog persist exact process identity digests and replacement CAS/outbox; current wrapper exits attest PID, worker terminal ancestry and native follower PID are fenced; schema-v1 attempt-0-22 splits self-repair; dead-agent/sweep no longer overwrite Pi finalization with Lost. Focused watchdog, observer, and finalization tests pass; new installed-binary Fake-Pi smoke passes.
2026-07-28T09:56:10.406445123+00:00 Validated: RED-first same-PID/replacement/legacy/restart tests now pass (18/18 integration_pi_watchdog); lifecycle replacement rejects old exit and accepts current exactly once; focused observer (16/16), candidate finalization (5/5), sweep/dead-agent, cargo check/build, fmt, and plain clippy pass. Bin full suite remains exactly dependency-documented 3831 pass/25 unrelated stale failures; broader --all progressed through all relevant suites with only pre-existing config/fail/cycle/profile failures before timeout near final upgrade test.
2026-07-28T09:56:10.489618672+00:00 Validated installed-binary flows: owned pi_continuation_exit_epoch_fence PASS; pi_session_watchdog, pi_native_activity_session_proof, candidate_finalization_transaction (TMPDIR=/tmp for Unix socket length), isolated_worktree_observer, and tui_live_progress_selected_task PASS. cargo install --path . --locked completed.
2026-07-28T09:56:34.155616978+00:00 Committed: b41d5b1f — pushed to remote
2026-07-28T09:58:22.873046204+00:00 Task marked as done