fix(resume): recover cleanly after Pi exits

PROJECT_STATE.md

@@ -85,13 +85,15 @@ ThothII gira in Docker sul server co-locato, **embedded nel portale omics_portal
 
 - **Pi turns have an explicit lifecycle.** The bridge tracks `idle`, `running`, `waiting`,
   and `failed`; a reviewer gate is `waiting`, responses/steering return to `running`, and an
-  assistant provider error becomes `failed`. Provider error details are never forwarded to the
-  client; the UI receives a fixed sanitized recovery message.
+  assistant provider error or unexpected Pi child exit becomes `failed`. Provider error details
+  are never forwarded to the client; the UI receives a fixed sanitized recovery message.
 - **Resume preserves only active work.** `running`/`waiting` runtimes return as already active.
-  `idle`/`failed` runtimes are torn down, their SSE buffer/subscribers are cleared, and the normal
-  cold path restarts from the persisted provider/model/thinking with `/riprendi-sessione`. A
-  successful Resume of the currently selected session also closes and recreates its EventSource,
-  so the replacement runtime cannot be left behind an old same-ID stream.
+  Every validated cold path—including recovery after a child has already exited—clears stale SSE
+  state before reopening and restarts from persisted provider/model/thinking with
+  `/riprendi-sessione`; `idle`/`failed` runtimes are torn down at that point. Failed validation does
+  not detach the existing stream. A successful Resume of the currently selected session also
+  closes and recreates its EventSource, so the replacement runtime cannot be left behind an old
+  same-ID stream.
 - **Private Qwen routing is live.** Core is attached to both `omics_portal_omics_network` and
   external `localllm_default`; frontend remains only on the portal network. The mounted Pi profile
   resolves `local-qwen/qwen3.6-35b-a3b` at the sanitized base URL