Reset stall timer on repeated plan updates

The stall guard never extends its deadline after the first onPlanUpdate("update") event because armControlPlaneStallTimer returns early whenever a timer already exists. In runs that continue emitting plan updates for longer than 45 seconds before the first tool/block output, this will incorrectly abort an active turn and send the "Turn stalled" error even though control-plane progress is still being produced. Re-arming (or refreshing) the timer on each update would avoid these false positives.

Useful? React with 👍 / 👎.

Ensure forwarded abort listeners are always cleaned up

createAbortControllerWithForwardedSignal is called before the plugin-bound early-return paths, but controlPlaneAbort.cleanup() only runs in the later finally block. When replyOptions.abortSignal is provided and execution returns early (for example, plugin-bound handled/declined/error paths), the listener added to the upstream signal is never removed, so long-lived channel abort signals can accumulate listeners and leak memory over many messages.

Useful? React with 👍 / 👎.

Preserve completed cleanup state for orphaned runs

markOrphanedRunForCleanup always clears cleanupCompletedAt, which reopens runs that were already fully cleaned up/announced on previous boots. On the next restore those runs are treated as pending again (because pending-descendant logic keys off cleanupCompletedAt), so they can be retried and re-announced as new orphan errors, overwriting prior terminal state and producing duplicate parent-facing failure messages. This should skip or preserve completed cleanup records instead of resetting them.

Useful? React with 👍 / 👎.

Limit stale-session reconciliation to tracked run sources

This loop unconditionally flips any processing session to idle when sessionHasLiveRun cannot find it in the embedded/reply registries, but not every dispatch path registers there (for example plugin inbound dispatch calls dispatchReplyFromConfig directly in src/plugin-sdk/inbound-reply-dispatch.ts and still marks the session as processing). In those channels, any turn that runs past one heartbeat interval is reclassified as idle mid-flight, which suppresses stuck-session diagnostics and skews queue/state telemetry for active work.

Useful? React with 👍 / 👎.

Avoid hardcoding main-lane fail-close to agent:main:main

resolveSessionRefForLane("main") always maps to agent:main:main, but the global main lane is shared by runs from other sessions (for example embedded runs enqueue their global step on main in src/agents/pi-embedded-runner/run.ts). A FailoverError from one of those runs will incorrectly mark the main session idle and decrement its queue depth, while leaving the real session state unchanged, so fail-closed diagnostics point at the wrong session.

Useful? React with 👍 / 👎.

Preserve keyword fallback when embedding lookup throws

When embedQueryWithTimeout fails, this branch swallows the exception and leaves queryVec empty, but the downstream if (!hybrid.enabled || !this.fts.enabled || !this.fts.available) path still returns vector-only results. In configurations with query.hybrid.enabled = false (vector-first mode), a transient embedding outage now produces silent empty searches instead of either falling back to keyword results or surfacing an error, which can hide relevant memory hits during provider incidents.

Useful? React with 👍 / 👎.

Enforce retry backoff even with pending debounce timer

The fetch-failure retry path exits early whenever sessionWatchTimer already exists, but that same timer is also used for normal 5s session-delta debounce. Under active transcript traffic during a fetch outage, new updates keep this timer populated, so the 60s retry delay is skipped and retries continue at debounce cadence, causing repeated failed sync attempts and log churn instead of true backoff.

Useful? React with 👍 / 👎.