fix(server): recover Pi resumes without reusing native history

[juliusmarminge]

Long Pi resumes could time out after 15 seconds, enter the portable-handoff fallback, and accidentally adopt the original native session. Legacy history then exhausted the 128k fallback budget even when Pi reported a 1M model window, producing the misleading error in #12931.

Give Pi session lifecycle operations 60 seconds. Explicitly create and verify a fresh native session for replacement, clear the old binding/defaults, and retire the process on lifecycle timeout or interruption so a late switch cannot race fallback. Expose selected-model capacity from Pi's state/catalog to handoff budgeting, preserving small-model limits and the existing bounded history allowance. Add bounded diagnostics for failed resumes.

Validation:

• Three regressions failed before the fix: a 16.82-second resume, replacement adopting the original native ID, and legacy history receiving zero budget despite a 1M model window. All pass after the fix.
• 145 tests pass across PiAdapterV2, PiProvider, ProviderSwitch, ProviderTurnStartService, and ContextHandoffBudget. Includes replacement vetoes/identity checks, timeout/interruption, failed state refresh, and smaller/unknown model capacity.
• After the typed timeout review fix, all 58 affected Pi tests pass again.
• Server typecheck and scoped lint pass; lint retains the pre-existing unused layer warning.
• Real Pi 0.85.1 RPC smoke check with isolated session state: deliberately slow resume completed in 33.65 seconds, retained its native identity, new_session created a different identity, and state reported a 1,000,000-token window. No model requests or UI changes.

CI limitation: SteeringCompletion.integration.test.ts has five failing steering/mailbox completion assertions. The same five failures reproduce in a separate checkout of the unchanged V2 base 0e682145efc and on this PR head; both CI revisions failed Test Server 3 on those assertions. All other executed CI jobs pass on 60469f781ce; correctness and Effect reviews are clear. Automated approvability is neutral because the lifecycle changes require human review. They are outside this Pi fix.

Fixes #12931. Based directly on V2 #2829, without native stack grouping.

Model: GPT-6. Harness: Codex in T3 Code.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.4 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	2	—	8	✅
Claude	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	20.8 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	2	—	8	✅

Baseline: unavailable · PR result: cf9ec37 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 106.1 KiB
• Claude decoded thread snapshot: 106.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This production change alters Pi resume and fallback semantics by retiring processes, creating replacement native sessions, clearing history state, and changing context-handoff budgeting. Although the behavior has substantial regression coverage, its runtime scope and lifecycle side effects warrant human review.

No code changes detected at cf9ec37. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}