# Current operations

## Attach and reload

Attach is scoped to `(transport root, participantId)`. One owner watcher may inject and mutate queue state; secondary sessions are read-only. Reload rotates runtime session identity but must preserve owner/active/completed state and renew heartbeat.

Verify after attach/reload:

```text
amq presence list --root ROOT --json
amq_bridge_status
```

Presence is fresh only within 30 seconds. Owner state without fresh presence means watcher health is unknown/stale, not connected.

## Stale active-work policy

AMQ Bridge never silently clears unfinished `activeStack` frames. `activeId` is stack-top compatibility evidence.

Status classifies top active work:

- `queued in new/`: envelope has not crossed body boundary;
- `read but unfinished in cur/`: body was read, but no reply/resolve completed it;
- `not found`: state/mailbox reconciliation required.

Operator choices:

1. **Resume:** inspect and read exact active ID, then either reply to complete with a response or resolve to complete without one.
2. **Abandon intentionally:** use explicit lifecycle resolution for exact active ID and record reason externally until terminal-reason support lands.
3. **Quarantine:** stop new natural work, preserve mailbox, and investigate state/artifacts.

Nested work rules:

- same-thread answer/review response from a live known peer may suspend parent work;
- trusted urgent actionable work may suspend current top frame;
- reply/resolve must target stack top; completion resumes prior frame;
- stack depth is bounded at 8; overflow queues rather than stopping watcher.

Never:

- reply to latest/history without exact ID;
- resolve a different message to unblock queue;
- clear state file manually while work may be in flight;
- treat processed as completed;
- use `send` as substitute after reply/resolve rejection.

Existing-root E2E must run in diagnostic mode. Stable communication acceptance uses isolated per-run roots so old unresolved work cannot alter causal result.

## Provider versus bridge diagnosis

Provider/model failure indicators:

- no model turn generated;
- quota/rate-limit/provider error;
- model refuses or ignores tool.

Bridge failure indicators:

- exact envelope absent from recipient mailbox;
- wrong sender/recipient/thread/ID;
- owner/heartbeat/lease contradiction;
- explicit read/reply/resolve operation fails for valid target;
- state transition loses unfinished work.

Record both separately.

## Pi stable baseline

Release scope:

- Pi-to-Pi over AMQ filesystem;
- notify-pull envelope delivery;
- explicit read/reply/resolve IDs;
- reload heartbeat/presence;
- active-work preservation across read/takeover;
- isolated natural sequential E2E;
- 172/172 automated tests at active-stack preparation.

Known non-goals:

- hard cancellation of an already-running provider turn (urgent work schedules at next available turn);
- durable cross-transport operation journal;
- OpenCode/Codex adapters, intentionally deferred until core architecture and lifecycle semantics mature;
- authentication against malicious shared mailbox;
- power-loss durability beyond filesystem guarantees.

After scheduler/core upgrades, fully restart Pi. `/reload` may keep cached dependency modules and is not a supported active-stack upgrade boundary.