@cohortapp/agent-sdk 2.18.7 → 2.18.10

package/scripts/daemon/responder.mjs

@@ -34,7 +34,12 @@ import {
   routerItemFromDaemonItem,
   claimSession,
   releaseSession,
+  isSessionIdCollision,
 } from "./lib/session-router.mjs";
+// The seat's count of replies it owed and did not send (lib/daemon/reply-debt).
+// Every silent end of this path bumps one of these names so the number rides
+// the presence beat instead of dying in a log line nobody tails.
+import { REPLY_DEBT_COUNTERS } from "../../lib/daemon/reply-debt.mjs";
 // Permission scoping (security CRITICAL / audit H1). sessionPermissionArgs()
 // preserves the historical "--dangerously-skip-permissions" by default and only
 // scopes tools when the operator opts in (MAESTRO_SCOPED_PERMISSIONS=1), so the
@@ -284,12 +289,24 @@ function recordResponderCost({ json, model, durationMs, exitCode, unmeasuredReas
 //     so the caller can surface the failure.
 //
 // Session-router wire-up (b2-b4, cycle 474): when the caller supplies a
-// `sessionId` (pre-minted UUID) and a `router` + `routingKey`, the spawn
-// adds `--session-id <uuid> --output-format json`, parses the one-line JSON
-// stdout into {session_id, result, is_error}, calls router.touch on success
-// and router.recordExit on close. Per b1 flag-verification report, NEVER
-// combine `--resume` with `--session-id` (not needed: pre-minting + reusing
-// the same UUID across spawns is the resume mechanism).
+// `sessionId` (pre-minted UUID) and a `router` + `routingKey`, the spawn adds
+// the session flag for what it HOLDS — `--session-id <uuid>` for an id the
+// router just minted, `--resume <uuid>` for one it decided to continue — plus
+// `--output-format json`, parses the one-line JSON stdout into
+// {session_id, result, is_error}, calls router.touch on success and
+// router.recordExit on close. The two flags are never combined, and
+// `sessionArgs()` in lib/runtime/adapter.mjs is the one place that chooses.
+//
+// ~~"Per b1 flag-verification report, NEVER combine `--resume` with
+// `--session-id` (not needed: pre-minting + reusing the same UUID across
+// spawns is the resume mechanism)"~~ — STRUCK 2026-09-25. The parenthetical
+// is the false half and it is the half that costs replies: reusing a UUID is
+// NOT the resume mechanism, because `--session-id` is refused once that id has
+// a transcript (`Error: Session ID <uuid> is already in use.`, exit 1, before
+// any model call). The router's RESUME decision returns exactly such an id, so
+// this lane dropped every continued reply — four measured on this seat,
+// 09-22..24. Only the first half survives: the flags remain mutually
+// exclusive, which is what `resumeSession` below expresses.
 //
 // @returns {Promise<{ text: string, jsonResult: object|null, exitCode: number }>}
 /**
@@ -305,9 +322,13 @@ function recordResponderCost({ json, model, durationMs, exitCode, unmeasuredReas
  * W4-E1 (CF-44): `seat` is the seat's engine resolved once for this spawn
  * (lib/runtime/seat-engine.mjs). A claude seat adds no fields, so its spawn is
  * unchanged; an engine-cohort seat runs `cli.mjs run`, continuing --session-id.
- * @param {{systemPrompt:string, userPrompt:string, model:string, sessionId?:string|null, env?:object, bin?:string, seat?:{fields:object}}} o
+ * `resumeSession` distinguishes CONTINUING a transcript (`--resume <id>`) from
+ * starting one under a chosen id (`--session-id <id>`). Passing a used id to
+ * `--session-id` is what the CLI refuses with "Session ID … is already in use",
+ * and it was the session router's RESUME decision doing exactly that.
+ * @param {{systemPrompt:string, userPrompt:string, model:string, sessionId?:string|null, resumeSession?:boolean, env?:object, bin?:string, seat?:{fields:object}}} o
  */
-export function responderSpawn({ systemPrompt, userPrompt, model, sessionId = null, env = process.env, bin = CLAUDE_BIN, seat = { fields: {} } }) {
+export function responderSpawn({ systemPrompt, userPrompt, model, sessionId = null, resumeSession = false, env = process.env, bin = CLAUDE_BIN, seat = { fields: {} } }) {
   return buildSpawn({
     lane: "responder",
     bin,
@@ -315,6 +336,7 @@ export function responderSpawn({ systemPrompt, userPrompt, model, sessionId = nu
     systemPrompt,
     prompt: userPrompt,
     sessionId,
+    resumeSession,
     permissions: sessionPermissionArgs({ source: "responder" }),
     mcp: { source: "responder" },
     env,
@@ -328,11 +350,11 @@ function runClaudeCLI(systemPrompt, userPrompt, model, opts = {}) {
 }
 
 function runSeatCLI(seat, systemPrompt, userPrompt, model, opts = {}) {
-  const { sessionId = null, router = null, routingKey = null } = opts;
+  const { sessionId = null, resumeSession = false, router = null, routingKey = null } = opts;
   const startedAt = Date.now();
 
   return new Promise((resolvePromise, rejectPromise) => {
-    const spawnSpec = responderSpawn({ systemPrompt, userPrompt, model, sessionId, seat });
+    const spawnSpec = responderSpawn({ systemPrompt, userPrompt, model, sessionId, resumeSession, seat });
     if (!spawnSpec.ok) {
       rejectPromise(new Error(`claude CLI unavailable: ${spawnSpec.error.message}`));
       return;
@@ -884,6 +906,7 @@ ${MESSAGE_CRAFT}`;
   const routerItem = deriveRouterItem(item);
   let key = null;
   let sessionId = null;
+  let resumeSession = false;
   if (routerItem) {
     try {
       const candidateKey = deriveRoutingKey(routerItem);
@@ -896,6 +919,11 @@ ${MESSAGE_CRAFT}`;
         key = candidateKey;
         if (decision.decision === "RESUME" && decision.resumeId) {
           sessionId = decision.resumeId;
+          // CONTINUING a transcript is `--resume`. Handing this id to
+          // `--session-id` is what the CLI refuses outright, and it refused
+          // EVERY resume this router ever decided — see sessionArgs() in
+          // lib/runtime/adapter.mjs.
+          resumeSession = true;
         } else {
           // EPHEMERAL or EPHEMERAL_REPLACE — pre-mint a fresh UUID. Reusing
           // the same key on next call (with a different sessionId) is fine;
@@ -920,17 +948,64 @@ ${MESSAGE_CRAFT}`;
   // and released in a `finally`: a throw anywhere in between must not leave the
   // room's key claimed forever, which would silently disable continuity for it.
   try {
-    const cliResult = await (deps.runCLI || runClaudeCLI)(systemPrompt, userContent, model, {
-      sessionId,
-      router: key ? router : null,
-      routingKey: key,
-    });
+    const runCLI = deps.runCLI || runClaudeCLI;
+    let cliResult;
+    try {
+      cliResult = await runCLI(systemPrompt, userContent, model, {
+        sessionId,
+        resumeSession,
+        router: key ? router : null,
+        routingKey: key,
+      });
+    } catch (err) {
+      // "Session ID <uuid> is already in use" is an ADDRESSING fault, not a
+      // model failure: the CLI exits 1 in ~0.1s having called nothing, and the
+      // same prompt with a fresh id succeeds. Before `sessionArgs` this was
+      // every RESUME; it can still happen for an id another process on this box
+      // claimed between route() and spawn. Either way, dropping a person's
+      // reply over a name collision is indefensible — mint a new id and go
+      // once more. ONE retry, and it never resumes: the second attempt is
+      // deliberately cold, because whatever owns that transcript is not us.
+      if (!isSessionIdCollision(err)) throw err;
+      counters.bump(REPLY_DEBT_COUNTERS.sessionCollision, { key: key || "none", model: String(model || "unknown") });
+      const freshId = randomUUID();
+      console.warn(`[responder] session id ${sessionId} already in use — retrying once cold as ${freshId}`);
+      cliResult = await runCLI(systemPrompt, userContent, model, {
+        sessionId: freshId,
+        resumeSession: false,
+        router: key ? router : null,
+        routingKey: key,
+      });
+      // Recovered: a person got their answer. Counted separately from the
+      // collision so `machine.replyDebt.withheld` does not accuse this seat of
+      // a silence it did not commit.
+      counters.bump(REPLY_DEBT_COUNTERS.sessionCollisionRecovered, { key: key || "none" });
+      sessionId = freshId;
+    }
 
     const text = (cliResult.text || "").trim();
     if (!text) {
+      // COUNT THE SILENCE BEFORE THROWING IT.
+      //
       // Empty text is "nothing to send" — including the fail-closed non-JSON
-      // path, where the raw model turn was withheld. Throwing here is what
-      // keeps it off the wire; the reason rides along for the log.
+      // path, where the raw model turn (tool chatter, thinking, an un-enveloped
+      // draft) was withheld because it has reached the wire before. Failing
+      // closed is right. But from anywhere except this log file, a withheld
+      // reply and a quiet hour are the same picture, and that is how a seat
+      // stops answering people without anything saying so.
+      //
+      // MEASURED FIRST, THEN SIZED. This path fired ZERO times in this seat's
+      // daemon logs between 2026-09-21 (when the fail-closed change landed) and
+      // 2026-09-24 — every observed quick-reply failure in that window was a
+      // session-id collision instead. So the fix is a counter and a number on
+      // the beat, not a retry machine for a failure nobody has seen yet.
+      if (cliResult.withheldChars !== undefined || cliResult.error) {
+        counters.bump(REPLY_DEBT_COUNTERS.unparseable, {
+          model: String(model || "unknown"),
+          chars: Number(cliResult.withheldChars) || 0,
+          service: String((item && item.service) || "unknown"),
+        });
+      }
       throw new Error(`claude CLI returned empty result text in generateResponse${cliResult.error ? ` (${cliResult.error}; ${cliResult.withheldChars ?? 0} chars withheld)` : ""}`);
     }
 

package/scripts/local-triggers/autoupdate.sh

@@ -417,6 +417,46 @@ restart_daemon(){
   if [ -z "$DAEMON_LABEL" ]; then log "no -daemon plist under ~/Library/LaunchAgents — nothing to kickstart (maestro upgrade installs it; doctor will say)"; return 0; fi
   launchctl kickstart -k "gui/$UID_/$DAEMON_LABEL" >> "$LOG" 2>&1 || log "WARN: kickstart $DAEMON_LABEL nonzero"
 }
+session_beating(){ # is the front door actually ANSWERING, not merely loaded?
+  # `session_reconciled` asks whether the job is loaded and a supervisor process
+  # is alive. Both were true on the seats that went silent: on 2026-09-24 three
+  # front doors had been wedged on an unanswered modal for days with their
+  # supervisors up and their jobs loaded. A process that exists is not a
+  # colleague who answers — the same substitution this gate's daemon half was
+  # rewritten to stop making.
+  local hb="$AGENT_DIR/state/session/heartbeat.json" age
+  [ -f "$hb" ] || return 1
+  age="$(node -e '
+    try {
+      const j = JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"));
+      const t = Date.parse(j && j.ts);
+      process.stdout.write(Number.isFinite(t) ? String(Math.round((Date.now() - t) / 1000)) : "");
+    } catch {}
+  ' "$hb" 2>/dev/null)"
+  [ -n "$age" ] || return 1
+  [ "$age" -le "$SESSION_STALE_S" ]
+}
+
+revive_session(){ # a wedged front door cannot restart itself; restart it FOR it
+  # The upgrade notice asks the session to restart "at an idle moment". A
+  # session sitting on a modal never reaches an idle moment, so the polite ask
+  # is exactly the wrong instrument for the one case that needs it. A hard
+  # kickstart drops a wedged session and the new supervisor launches a fresh
+  # one — which clears the modal by construction and, from this release,
+  # watches the pane so it does not happen again.
+  [ -n "$SESSION_LABEL" ] || return 0
+  # An UNLOADED job is a different fault with a different remedy (`maestro
+  # session start`), and kickstarting a label launchd does not know just fails.
+  # Leave that one to session_reconciled, which already names it.
+  label_loaded "$SESSION_LABEL" || return 0
+  session_beating && return 0
+  log "front door $SESSION_LABEL is loaded but not beating (> ${SESSION_STALE_S}s) — kickstarting it rather than waiting for a session that cannot answer"
+  launchctl kickstart -k "gui/$(id -u)/$SESSION_LABEL" >> "$LOG" 2>&1 \
+    && { log "front door $SESSION_LABEL restarted"; return 0; }
+  log "WARN: could not kickstart $SESSION_LABEL (maestro session restart --force)"
+  return 1
+}
+
 session_reconciled(){ # only asked when a -session plist was generated; never a rollback reason
   label_loaded "$SESSION_LABEL" || { log "reconcile-failed: session job $SESSION_LABEL is not loaded (maestro session start)"; return 1; }
   pgrep -f "$AGENT_DIR/scripts/session/supervisor" >/dev/null 2>&1 || { log "reconcile-failed: $SESSION_LABEL is loaded but no supervisor process is alive for $AGENT_DIR (maestro session status)"; return 1; }
@@ -544,6 +584,12 @@ if [ "$CUR" = "$LATEST" ] || [ "$(printf '%s\n%s\n' "$CUR" "$LATEST" | sort -V |
   if is_healthy; then
     log "healthy on $CUR"
     sibling_job_audit
+    # The up-to-date path is NOT exempt from the front door, for the same
+    # reason it stopped being exempt from the daemon: the seats that went
+    # silent for days were all "up to date". A daemon that beats while the
+    # front door is wedged is a seat that looks perfect from here and answers
+    # nobody.
+    revive_session || true
     if [ -n "$STALE_HOP" ]; then
       # A real version hop: complete it the way an automatic one completes —
       # the notice tells the session to restart itself onto the new code.
@@ -597,6 +643,11 @@ fi
 # installed version, never a LATEST). Fail-open: an unreadable last.json holds
 # nothing.
 FAILED_HOLD_S="${MAESTRO_AUTOUPDATE_FAILED_HOLD_S:-86400}"
+# How long a front door may go without beating before this run restarts it FOR
+# it. Ten minutes: long enough that a busy session is never interrupted (the
+# heartbeat rides every tool use), short enough that a wedged one is measured in
+# minutes rather than the days it took to notice the last three.
+SESSION_STALE_S="${MAESTRO_SESSION_STALE_S:-600}"
 failed_hold_reason(){ # prints "<reason> at <at>" when LATEST failed health within FAILED_HOLD_S
   node -e '
     const [file, latest, holdS] = process.argv.slice(1);
@@ -668,7 +719,11 @@ restart_daemon
 
 if is_healthy; then
   REASON=""
-  if [ -n "$SESSION_LABEL" ] && ! session_reconciled; then REASON="session-reconcile-failed"; fi
+  # Revive BEFORE reconciling: the new code is installed, and a front door that
+  # is not beating must be restarted onto it rather than left holding an inbox
+  # it cannot answer.
+  revive_session || REASON="session-revive-failed"
+  if [ -n "$SESSION_LABEL" ] && ! session_reconciled; then REASON="${REASON:-session-reconcile-failed}"; fi
   log "OK: healthy on $LATEST${REASON:+ ($REASON)}"
   sibling_job_audit
   write_upgrade_notice "$CUR" "$LATEST"

package/scripts/session/supervisor.mjs

@@ -52,7 +52,7 @@ import { pathToFileURL } from "node:url";
 import { resolveAgentRoot } from "../../lib/agent-root.mjs";
 import { writeJsonAtomic as fsWriteJsonAtomic, writeFileAtomic as fsWriteFileAtomic } from "../../lib/fs-atomic.mjs";
 import { parseHeartbeat } from "../../lib/session/liveness.mjs";
-import { ensureClaudeConfig, heartbeatSilence, attentionRecord, HEARTBEAT_GRACE_MS } from "../../lib/session/first-run.mjs";
+import { ensureClaudeConfig, heartbeatSilence, attentionRecord, carriedRestarts, HEARTBEAT_GRACE_MS } from "../../lib/session/first-run.mjs";
 import { paneTail, classifyPane, watchdogAction, captureCommand, sendKeyCommand } from "../../lib/session/pane.mjs";
 import { acquireLock as singletonAcquireLock } from "../../lib/singleton.js";
 import { buildSpawn } from "../../lib/runtime/adapter.mjs";
@@ -96,6 +96,25 @@ function defaultAfter(ms, fn) {
   return () => clearTimeout(t);
 }
 
+/**
+ * The installed Claude Code version, for the version-gated first-run screens.
+ *
+ * Fail-open to `null`: a version we could not read is never GUESSED, and
+ * `seedClaudeConfig` leaves the version-gated keys alone when it gets none.
+ * Writing an invented version would re-open the very screen the seeding exists
+ * to close, which is strictly worse than leaving it to the watchdog.
+ *
+ * @returns {Promise<string|null>}
+ */
+async function readCliVersion(bin, d) {
+  try {
+    const r = await d.execFile(bin, ["--version"]);
+    if (!r || r.code !== 0) return null;
+    const m = String(r.stdout || "").trim().match(/(\d+\.\d+\.\d+)/);
+    return m ? m[1] : null;
+  } catch { return null; }
+}
+
 /**
  * Real `execFile`: spawn without a shell, capture stdout, resolve with the
  * exit code (never reject on a non-zero code — that is a result, not a defect).
@@ -162,6 +181,7 @@ export async function runSupervisor(deps = {}) {
     homeDir: deps.homeDir === undefined ? homedir() : deps.homeDir,
     after: deps.after || defaultAfter,
     heartbeatGraceMs: deps.heartbeatGraceMs ?? HEARTBEAT_GRACE_MS,
+    cliVersion: deps.cliVersion === undefined ? undefined : deps.cliVersion,
     mkdirSync: deps.mkdirSync || fsMkdirSync,
     unlinkSync: deps.unlinkSync || fsUnlinkSync,
     now: deps.now || Date.now,
@@ -286,20 +306,48 @@ export async function runSupervisor(deps = {}) {
   const envFile = engineCohort ? join(paths.stateDir, `engine-env-${d.envFileId()}.env`) : null;
   const cmds = buildMuxCommands({ mux, muxName, cwd: agentRoot, claudeBin: spec.bin, claudeArgs, exitFile: paths.lastExitFile, envFile });
 
-  // 4b. First-run dialogs. Nobody is attached to press a key, so the two
-  //     one-time acknowledgements are recorded up front. Fail-open: a seat
-  //     still launches when this cannot be done — the watchdog below then
-  //     reports the blocked session instead of nothing at all. The engine has
-  //     no first-run dialogs, so an engine-cohort seat's ~/.claude.json is left alone.
+  // 4b. First-run dialogs. Nobody is attached to press a key, so every one-time
+  //     acknowledgement is recorded up front. Fail-open: a seat still launches
+  //     when this cannot be done — the watchdog below then reads the screen and
+  //     acts on it instead of nothing at all. The engine has no first-run
+  //     dialogs, so an engine-cohort seat's ~/.claude.json is left alone.
+  //
+  //     Two of those screens are VERSION-GATED (`lastOnboardingVersion`,
+  //     `lastReleaseNotesSeen`): the CLI compares them against the version it is
+  //     RUNNING, so an upgrade re-opens a screen a seeded seat had already
+  //     passed. That is the difference between "the seat was set up wrong" and
+  //     "the seat was fine until Tuesday" — and it was the second on the seats
+  //     that went silent inside an upgrade window. So the seeder has to be told
+  //     which version is installed; an unreadable one is `null` and those keys
+  //     are left alone rather than guessed.
+  const cliVersion = d.cliVersion !== undefined
+    ? d.cliVersion
+    : (engineCohort ? null : await readCliVersion(spec.bin, d));
   if (!engineCohort) {
     const seeded = ensureClaudeConfig({
       homeDir: d.homeDir, agentRoot, bypass: permissionArgs.includes("--dangerously-skip-permissions"),
+      cliVersion,
       readFileSync: d.readFileSync, writeFileAtomic: d.writeFileAtomic,
     });
-    if (seeded.changed) d.log(`${seeded.path} seeded for an unattended launch: ${seeded.applied.join(", ")}`);
-    else if (!seeded.ok) d.log(`${seeded.path || "~/.claude.json"} not seeded (${seeded.error}) — a first-run dialog may block the session; the watchdog will report it`);
+    if (seeded.changed) d.log(`${seeded.path} seeded for an unattended launch${cliVersion ? ` (cli ${cliVersion})` : " (cli version unreadable — the version-gated screens were left alone)"}: ${seeded.applied.join(", ")}`);
+    else if (!seeded.ok) d.log(`${seeded.path || "~/.claude.json"} not seeded (${seeded.error}) — a first-run dialog may block the session; the watchdog reads the screen and acts on it`);
   }
 
+  // THE RESTART BUDGET IS CARRIED, NOT RESET — and it has to be read HERE,
+  // before the unlink below destroys the record that holds it. Every restart
+  // the watchdog performs ENDS this process and launchd starts a fresh one, so
+  // `restarts` held in memory is zero on every launch and `watchdogAction`'s
+  // bound never binds: a seat blocked on something a relaunch cannot fix would
+  // restart every two minutes forever. `carriedRestarts` resets it on evidence
+  // of work — a beat stamped after the record — so a seat that recovered once
+  // gets a full budget for its next fault.
+  let priorAttention = null;
+  try { priorAttention = JSON.parse(d.readFileSync(paths.attentionFile, "utf8")); } catch { priorAttention = null; }
+  let priorHeartbeat = null;
+  try { priorHeartbeat = parseHeartbeat(d.readFileSync(paths.heartbeatFile, "utf8")); } catch { priorHeartbeat = null; }
+  const restartsSoFar = carriedRestarts({ attention: priorAttention, heartbeat: priorHeartbeat });
+  if (restartsSoFar > 0) d.log(`this launch carries ${restartsSoFar} silent restart(s) from the previous run`);
+
   try { d.unlinkSync(paths.lastExitFile); } catch { /* none from a previous run */ }
   try { d.unlinkSync(paths.attentionFile); } catch { /* none outstanding */ }
   // 4c. An upgrade notice asking for a restart onto the version THIS launch
@@ -350,7 +398,7 @@ export async function runSupervisor(deps = {}) {
   // worse failure than the one it replaces. Every pass records what it saw, so
   // the note stops being a guess and becomes evidence.
   let clears = 0;
-  let restarts = 0;
+  let restarts = restartsSoFar;
   let watchdogStopped = false;
   let cancelPass = () => {};
   const paneFile = join(agentRoot, "state", "session", "pane-capture.txt");
@@ -388,20 +436,29 @@ export async function runSupervisor(deps = {}) {
     const seen = classifyPane(pane);
     const act = watchdogAction({ silent: true, kind: seen.kind, keys: seen.keys, clears, restarts });
 
-    const rec = attentionRecord({ reason: silence.reason, mux, muxName, since: startedAt, runMs: silence.runMs });
+    // THE RECORD COUNTS THE ACTION IT IS ABOUT TO TAKE, not the ones before it.
+    // A restart ENDS this process, so this write is the last chance to tell the
+    // next launch what was spent; recording the pre-action count would hand
+    // every relaunch a budget one short of the truth and the bound would never
+    // reach its limit.
+    const nextClears = act.act === "clear" ? clears + 1 : clears;
+    const nextRestarts = act.act === "restart" ? restarts + 1 : restarts;
+    const rec = attentionRecord({ reason: silence.reason, mux, muxName, since: startedAt, runMs: silence.runMs, restarts: nextRestarts, action: act.act });
     // The record now carries WHAT THE SCREEN SAYS and what was done about it.
     // `hint` keeps the attach line for a human who is at the machine, but it is
     // no longer the only remedy on offer.
-    const record = { ...rec, modal: seen.kind, modalWhy: seen.why, pane, action: act.act, actionReason: act.reason, clears, restarts };
+    const record = { ...rec, modal: seen.kind, modalWhy: seen.why, pane, action: act.act, actionReason: act.reason, clears: nextClears, restarts: nextRestarts };
+    // Written BEFORE the stop, because the stop ends this process's ability to
+    // write anything at all.
     try { d.writeJsonAtomic(paths.attentionFile, record); } catch { /* the log line still says it */ }
     d.log(`session ${muxName} silent ${Math.round(silence.runMs / 1000)} s — screen shows: ${seen.kind} (${seen.why}); ${act.reason}`);
 
     if (act.act === "clear") {
-      clears += 1;
+      clears = nextClears;
       d.log(`session ${muxName}: answering ${seen.kind} with ${JSON.stringify(seen.choice || seen.keys)}`);
       await sendKeys(seen.keys);
     } else if (act.act === "restart") {
-      restarts += 1;
+      restarts = nextRestarts;
       d.log(`session ${muxName}: restarting (${restarts}) — the session is not answering and the screen cannot be cleared safely`);
       try { await d.execFile(cmds.stop.file, cmds.stop.args, { cwd: agentRoot, env: d.env }); } catch { /* the relaunch loop handles a dead mux */ }
       watchdogStopped = true; // the supervisor's own loop relaunches; do not fight it