feat(resume): Resume Pipeline — "continue exactly where you left off"

CLAUDE.md

@@ -276,7 +276,7 @@ window.limboo.system.{notify,openExternal,clipboardWrite,clipboardRead}
 window.limboo.app.getInfo()                             // version/electron/…
 window.limboo.events.onCommand(cb)                      // native menu/tray → command
 // …plus one namespace per platform service: workspace, session, agent, fs,
-// terminal, git, worktree, services, memory, search, updates, voice
+// terminal, git, worktree, services, memory, search, resume, updates, voice
 // (full surface: docs/reference/window-limboo-api.md)
 ```
 
@@ -606,11 +606,59 @@ ones at query time (memory, git, sessions, commands).
   filters, recent + saved searches. Backed by `useSearchStore`. Settings live in the
   **Memory & Search** category (`settings.search`).
 
+### Resume Pipeline
+
+A provider-independent **platform service owned by the app** — "continue exactly
+where you left off." SDK sessions persist the *conversation* (`options.resume`),
+not repository state; this service reconciles the two. Owned entirely by the main
+process (`managers/resume/ResumeManager.ts` + `resume/delta.ts`), wired in the
+composition root like Memory/Search (setter injection + a *separate additive*
+`sessions.onActiveChanged` listener, so the existing retarget path is untouched;
+boot revalidation chains after `worktrees.recover().finally(retarget)`).
+
+- **Snapshots** (`session_snapshots`, schema v10) — one repository anchor per
+  session (HEAD + branch + a `dirty_hash` = sha256 over sorted
+  `status\0path\0size\0mtimeMs`, computed via `fs.lstat`, never reading file
+  contents), upserted at run-end (`AgentManager.send` finally →
+  `onRunFinished`), checkpoint creation (`GitManager.createCheckpoint` →
+  `onCheckpointCreated`), and session deactivation.
+- **Revalidation** — on every activation + boot, async/best-effort, `Promise.race`
+  against `RESUME_LIMITS.revalidateTimeoutMs`; failures degrade to "no delta" and
+  **never block session switching**. Cheap short-circuit when HEAD + branch +
+  dirty-hash all match the snapshot (the common case).
+- **Repository delta** (`resume/delta.ts`, argv-only via `runGit`; snap HEAD
+  regex-validated) — `cat-file -e`/`merge-base --is-ancestor` (rebase/gc →
+  `historyRewritten`), `rev-list --count` both ways, capped `git log`, `git diff
+  --name-status -z` (reuses `parseNameStatus`) merged with the dirty set,
+  categorized (manifest/lockfiles/**limboo.json**/migrations flagged). Persisted
+  in `resume_deltas` so the one-shot injection survives a restart.
+- **Code-intelligence enrichment** — reuses the Search index: `search_files.content_hash`
+  (schema v11) skips unchanged files in incremental indexing; per-file symbol
+  adds/removes are diffed across a reindex; the new `search_refs` regex import-edge
+  table (`search/refs.ts`, parser-agnostic for a future tree-sitter upgrade) powers
+  "N files import X". No tree-sitter, no embeddings.
+- **Memory revalidation** — `create`/`acceptProposal` now write `memory_links`
+  (`kind='file'`/`'symbol'`); on revalidation, memories whose linked files vanished
+  have confidence downgraded (×0.6, floor 0.1; `preDowngradeConfidence` stashed in
+  `meta`) and restored when the file returns. Retrieval already weights confidence.
+- **Injection** — `AgentManager.resumeContextFor` is the third context producer
+  beside memory/search: renders a `<repository-delta>` block (budgeted like the
+  others), one-shot per delta (marks the row `injected`), cached on the run record
+  so recovery retries re-inject the same block.
+- **UI** — `ResumeBanner` (MissingWorktreeBanner idiom) + a "Revalidating…" header
+  chip + `ResumeDeltaDialog` (HooksConfirmDialog idiom), backed by `useResumeStore`;
+  results also land in the timeline via `AgentManager.recordStatus`. IPC:
+  `resume:getState/getDelta/dismiss/revalidate` (string session ids only; revalidate
+  gated to the active session) + `resume:state-changed`. Settings under the **Memory
+  & Search** category (`settings.resume`, bounds in `RESUME_LIMITS`).
+
 **Still open / future** — Repository clone/track UI, a dedicated Permission System
 beyond the agent's `canUseTool`, merge-conflict resolution UI, remote management, and
 stash. Local vector embeddings on top of BM25 (both Memory and Search rankings are
 already fusion-ready) and recording File Writer mutations into the session activity
 timeline (today they land in the in-memory File History ring) are natural follow-ups.
+A **tree-sitter upgrade** of the `search_symbols` / `search_refs` extractors (both
+tables are parser-agnostic) would sharpen the resume symbol delta.
 
 ---
 

README.md

@@ -65,11 +65,53 @@ project, its history, and its memory belong to the developer.
   git status into the session list.
 - **Local Memory System** — durable, provider-independent project knowledge with
   fully offline FTS5 / BM25 retrieval, injected into the agent prompt.
+- **Resume Pipeline** — reopening a session revalidates the repository against the
+  state it last saw and hands the agent a structured **repository delta** (commits,
+  files, symbols, dependency manifests) so it continues against current reality, not
+  a stale transcript. Fully local, bounded git, never blocks switching.
 - **Unified streaming timeline** — one continuous, turn-grouped event stream of the
   conversation, tool calls, and status.
 - **Pure-black, dark-only UI** — a minimal three-pane shell tuned for a true
   `#000000` background.
 
+## What makes Limboo different
+
+Most agent tools stop at "resume the conversation." That restores what the agent
+*said*, but not the world it said it in. Limboo treats the environment as a
+first-class, continuously-maintained system that cooperates with the agent instead
+of leaving it to rediscover reality on every turn.
+
+- **The agent resumes against verified repository reality, not a transcript.** The
+  **Resume Pipeline** is the flagship of this idea. When you reopen a session — after
+  an hour or after three weeks of other people's commits, rebases, and dependency
+  bumps — Limboo revalidates the git worktree against the exact state the session
+  last saw and computes a structured *repository delta*: commits landed, files
+  changed (with dependency manifests and migrations flagged), symbols added or
+  removed, and which files import what changed. That delta is injected once, before
+  your next prompt, so the agent reconciles its assumptions up front instead of
+  burning turns re-reading the tree. It is fully local, uses only bounded argv-only
+  git, and never blocks you from switching sessions. See
+  [the Resume Pipeline](docs/architecture/subsystems/resume-pipeline.md).
+
+- **Isolation by default.** Every session can own its own git worktree — a real
+  isolated checkout and branch — so parallel work never collides, and "continue where
+  I left off" means a specific filesystem, not a shared one.
+
+- **The app owns the knowledge, not the model.** Durable project memory, the search
+  index, and now a symbol/dependency graph are platform services the app maintains
+  and injects — provider-independent and offline. Memory even references repository
+  symbols, so guidance whose code was deleted is automatically demoted until it
+  reappears.
+
+- **A hard security boundary you can trust.** The renderer performs nothing: all
+  filesystem, git, shell, and database access lives in the main process behind a
+  single typed IPC bridge with sender validation, deny-by-default permissions, and
+  parameterized SQL throughout. Git never runs through a shell; paths are guarded
+  against traversal; secrets are never stored.
+
+The result: continuation feels genuinely intelligent, because the agent begins each
+resumed task with an accurate, up-to-date understanding of a living codebase.
+
 ## Screenshots
 
 A tour of the shell: sessions on the left, the conversation in the center, and
@@ -169,6 +211,9 @@ The documentation is organized as a subsystem, not a single file. Start at the
   [memory system](docs/guides/memory-system.md),
   [terminal](docs/guides/terminal.md),
   [keyboard shortcuts](docs/guides/keyboard-shortcuts.md).
+- **Deep dives** — [the Resume Pipeline](docs/architecture/subsystems/resume-pipeline.md)
+  ("continue exactly where you left off") and the other
+  [subsystem docs](docs/architecture/subsystems/agent-manager.md).
 - **Reference** — [`window.limboo` API](docs/reference/window-limboo-api.md),
   [IPC channels](docs/reference/ipc-channels.md),
   [settings](docs/reference/settings.md),
@@ -186,11 +231,13 @@ for contributors: [`CLAUDE.md`](CLAUDE.md) (the code-level working contract) and
 ## Project status
 
 Limboo is at `1.0.0`. The desktop foundation and platform services are built:
-workspaces, sessions, the git engine, the integrated terminal, the File System
-Layer, agent orchestration, the Local Memory System, and a hardened IPC layer over
-a 14-table SQLite database. Planned work (repository clone/track UI, a standalone
-permission system, a dedicated search engine, merge-conflict resolution, remote
-management, and stash) is tracked in [ROADMAP.md](ROADMAP.md).
+workspaces, sessions with per-session git worktrees, the git engine, the integrated
+terminal, the File System Layer, agent orchestration, the Local Memory System, the
+Search Engine, the Resume Pipeline ("continue exactly where you left off"), and a
+hardened IPC layer over a local SQLite database. Planned work (repository clone/track
+UI, a standalone permission system, merge-conflict resolution, remote management,
+stash, and a tree-sitter / vector-embeddings upgrade of the code-intelligence layer)
+is tracked in [ROADMAP.md](ROADMAP.md).
 
 ## Contributing
 

docs/README.md

@@ -73,6 +73,7 @@ architecture vision).
   [File System Layer](architecture/subsystems/file-system-layer.md),
   [Agent Manager](architecture/subsystems/agent-manager.md),
   [Memory System](architecture/subsystems/memory-system.md),
+  [Resume Pipeline](architecture/subsystems/resume-pipeline.md),
   [Database](architecture/subsystems/database.md),
   [Settings](architecture/subsystems/settings.md).