# Owned-session model continuation

Newly admitted runtime fallback plans carry `sessionContinuationVersion: 1`. Older plans and old Graphs without this protocol keep their existing conservative recovery behavior. No old business task is replayed or migrated. Empty fallback lists and zero degradation budgets still disable fallback; new admission takes fallback candidates only from explicit role/profile configuration and never appends or reorders the current main-session model. Existing frozen plans are not migrated.

The default provider-failure path keeps one owned worker and one `AgentSession`. It waits for `session.prompt` and `waitForIdle`, requires an idle SDK session with no queued inputs and a complete tool-call/start/end/result ledger, and accepts only an explicit provider diagnostic. Completed tool results, including writes, remain in the transcript. The worker reserves the next frozen candidate, calls public `setModel` without persisting defaults, applies and verifies thinking, and sends a fixed short continuation message. It never sends the original task again. Tool/turn/token/cost counters persist across candidates. A blocked operation with unsafe or unknown effects, extension error, abort, stop, timeout, unknown usage, incomplete tool, orphan result, late event or unknown provider diagnostic prevents fallback.

The owned controller also supports internal lifecycle operations, scoped to the owning parent session and the exact owned run:

- `checkpoint` with `{id}` requests a clean process handoff at the next safely settled provider failure. It is not permission to interrupt an in-flight tool. The worker saves its exact session and ledger, shuts down, and the independent guardian observes physical normal exit before continuing in a new process generation.
- `checkpoint` with `{id, park: true}` requests the same handoff but leaves it explicitly parked. It does not change Graph's user pause semantics.
- `resume` with `{id}` can adopt only an explicitly parked, normally exited checkpoint. It cannot resume a crash or infer safety from an absent PID. An exclusive directory claim prevents concurrent guardians or double adoption; a stale claim is never stolen automatically.

These are internal controller/RPC lifecycle operations, not new user-facing slash commands. Their authorization comes from the Graph dispatch implementation's in-process authority registration, frozen candidate plan and owned session identity. Task text and caller-supplied candidate lists cannot authorize continuation. Unknown `setModel` errors still stop rather than triggering speculative cold replay. Normal checkpoint handoff is an explicit controlled production path; arbitrary process exit is not recoverable.

Checkpoint validation binds the run, owner, Graph/workspace/guard/mailbox contract, generation, candidate ledger, actual model definitions, effective settings/tools/system prompt and deployment code. It strictly parses every JSONL record, checks an unbroken parent chain, unique IDs, complete tool results and cumulative usage, and verifies the session's hash and file/parent identities. Symlinks, hardlinks, truncation, compaction/branch summaries, changed deployment, changed permissions and unknown effects are refused. `SessionManager.open` must restore the same session ID and context, with content checks before and after opening.

Each generation has its own intent and observed exit artifact. Intermediate checkpoints publish no final result or process-terminal marker. The guardian validates and seals the final continuation ledger under its exclusive claim, then publishes the final generation's physical exit. Receipts bind that seal and reject contradictory model/usage evidence. Usage summaries attribute each segment to its actual model while counting the logical child run once.

A worker signal/crash, host/guardian crash without the full normal-exit handoff, missing proof, or stale exclusive claim requires attention. Completed external effects are never rolled back or replayed. No model credentials, global settings, active Pi reload, or old Graph files are changed by this protocol.

The execution guard remembers tool-call IDs for the entire owned session, including IDs restored from checkpoints. A repeated ID is blocked by the SDK `tool_call` hook before the tool implementation runs. A new ID with the same arguments remains legal. Settlement proof records full ID sets, counts, idle/queue state and agent lifecycle pairs; a `safe: true` field alone is never accepted. Sequential SDK agent cycles are valid; overlapping cycles and events after settlement invalidate the proof. A completed business tool error can be handled within a prompt and followed by successful output; it is separate from structural safety and does not itself make a successful primary response invalid.

Cross-family reviewer constraints are captured from accepted dependency evidence at Graph dispatch, including each producer's actual final model. They apply to every live/cold candidate, not only the initial model. An illegal next candidate stops the chain without consuming it; the legal primary is still allowed. Extra extensions whose effects cannot be proven do not disable the primary task: they disable session continuation and the result records that reason. A rejected checkpoint after confirmed normal worker exit is reported as `needs_attention`; monitoring returns failure using the true observed worker exit rather than waiting indefinitely or pretending that the ledger was sealed.

An explicitly frozen thinking level is checked exactly. When the candidate did not specify a level or suffix, the SDK's supported effective default is captured and validated; continuation does not silently replace it with `off`. Cold resume also binds the effective settings fingerprint. Neither path writes global thinking preferences.

A completed tool result marked `isError` remains recorded and is not itself a provider failure. If all tool events are fully paired and settled, a later authoritative provider error may advance the same session to an explicitly frozen candidate, including through a verified normal checkpoint. The historical `toolFailure` observation is preserved for audit but does not veto that later provider failure. Business tool errors alone never trigger model fallback, and this does not repair a provider subscription or create a missing candidate.