fix: recover committed conversation leaf

[ikma-ricon]

Summary

• replace array-only visible history with a versioned snapshot containing messages and the committed Pi leaf
• capture the post-response leaf at the visible-history commit boundary
• restore or reset SessionManager to the snapshot leaf before Pi builds model context after restart
• fail closed for legacy, corrupt, missing, unknown, and internally inconsistent recovery metadata

Why

Pi persists a completed turn before the separate visible-history replacement. If the process exits between those writes, restart can otherwise retain model context that the client never committed. The visible-history snapshot now acts as the commit record and selects its Pi leaf on reopen.

Recovery deliberately treats the recorded leaf as the cross-store pointer rather than interpreting Pi's persisted message sequence. Pi retains internal entries such as failed auto-retry attempts that do not map one-for-one to visible history, so role-count matching would reject valid sessions without proving content equality.

This is process-crash recovery only. It does not claim power-loss durability or multi-process safety, and it leaves the standalone session runner unchanged.

Validation

• full mise run check: strict TypeScript, 58/58 tests, all six Codebase lints, and whitespace checks
• real SessionManager restart coverage for crashes before and after snapshot replacement, abandoned first-turn/root recovery, and standalone-path preservation
• fail-closed coverage for missing sessions, unknown leaves, corrupt JSON, legacy arrays, invalid messages, and impossible message/leaf metadata combinations

[c0da-ricon]

Validation review: approved.

The visible-history snapshot correctly stores the committed Pi leaf and recovery restores it before agent creation. Using the exact leaf rather than raw Pi message cardinality handles persisted internal retry entries without weakening version, root, missing-session, unknown-leaf, or malformed-snapshot checks.

The real SessionManager regression now proves one visible user/assistant pair can correspond to persisted user, retryable assistant error, and successful assistant entries while recovery selects the successful leaf.

I independently ran 34 focused tests and strict typecheck before the fix, then the complete fixed tree: strict TypeScript, 59/59 tests, all six Codebase lints, and whitespace checks. Hosted CI is green on exact head 167994053f26124e336eeb38727dfb7b0f07d520.