feat(#382): a crash mid-cycle no longer loses the work silently

[randomm]

Closes #382.

The problem

/work is meant to be something you fire and walk away from. Until now a Pi process death mid-cycle lost the cycle and left the state file asserting otherwise.

The resume machinery was declared but inert:

Thing	Reality
resumable: false	A literal in the type (workflow-state-schema.ts:305) — could never be anything else
inFlightJobIds	Declared, validated (:399), rendered (work-status.ts:263) — never written anywhere in src/
dispatch-started	Never emitted at all. The validator cross-checking it could only pass vacuously
Persistence	Step boundaries only, while one dispatch can run 30 minutes

So a crash inside a dispatch left the file at the previous boundary still saying status: "running". A dead cycle and a live one were indistinguishable, forever. This repo still carries the evidence — .pi/work-state/547.json and 551.json sit at running with empty event logs.

What this does

Write-ahead. Every step persists a dispatch-started event, the in-flight job id and the owning pid before awaiting. All nine steps, not just the five sharing runSingleDispatch — explore, plan, develop and handoff have their own dispatch shapes, and develop is the longest-running step in the cycle, so covering only the shared helper would have left the biggest window uncovered.

Ownership. A running state file is either a live driver's or a corpse's, and those need opposite responses:

Situation	Action
Recorded owner alive and not us	Refuse — two drivers on one branch interleave commits and produce a PR nobody can review
Owner gone, dispatch was in flight	Resume at the step that was in flight; completed steps are not re-dispatched
Nothing in flight	Continue from the boundary, as before

Resume granularity is the step. The child process died and its work with it, so the step starts over rather than continuing mid-flight. That is sound because every step is dispatch-then-verify and the verify gates catch partial work; commit-pr and merged additionally carry their own idempotency (#362's PR pre-flight, already-merged tolerance).

An in-flight id with no matching dispatch-started cannot have come from the write-ahead — that is corrupt state, and the existing inconsistency halt still fires on it rather than being silently cleared. The pre-existing test-work-driver-skeleton.ts caught me collapsing that distinction. Orphaned dispatch-started events are deliberately kept: they are the only record that a dispatch was paid for and lost.

Queue state. A multi-issue run now persists its outcome to .pi/work-state/queue-summary.json — parked reasons, human actions, and the groups that never started. Those leave no state file at all, so the run that parked them was the only place they were ever named, and it died with the session.

Dead code found and made live

discoverAllCycles and renderCycleIndex (work-status.ts) were written for the multi-cycle view and had no caller anywhere in src/. /work-status only ever reported on one issue, so after a multi-issue queue run the operator could inspect one cycle at a time and had no way at all to see groups that never started. /work-status with no issue argument now renders the index; an explicit issue number still gives the detail view.

Proving it works

test-resume.ts proves the write-ahead reaches disk by reading the state file back from inside the dispatch. A throw would not do — runSingleDispatch catches those and the cycle continues, so the throw proves nothing about what is already persisted when a process dies. Also covers the three-way classification, the corrupt-vs-crashed distinction, and queue-summary round-tripping.

PI_ENSEMBLE_RESUME=0 makes six of those assertions fail, so the mechanism is load-bearing rather than decorative.

Notes

• work-status.ts crossed the §12 500-line cap; the multi-cycle view moved to work-status-index.ts.
• Escape hatch: PI_ENSEMBLE_RESUME=0.
• Docs: README env table, "Resume" + "Queue state after you walk away" sections in docs/troubleshooting.md, AGENTS.md driver notes.

Quality gate

bun run build ✅ · bunx tsc --noEmit ✅ · bun run check ✅ · 77/77 offline smoke tests ✅