@dsiloed/silo-link 1.19.12 → 1.19.14

package/dist/core/base-tmux-launcher.js

@@ -54,6 +54,30 @@ export class BaseTmuxLauncher {
     // Panes already reported as orphaned-but-working, so the warning is logged
     // once rather than every idle cycle.
     orphanPaneNoted = new Set();
+    // Conversations whose CURRENT session came from an auto-launch (a message
+    // arriving for a conversation with no live session — the "resurrect to
+    // deliver" path) rather than a deliberate control-channel dispatch. Such
+    // sessions get an automatic idle wind-down: when the delivered message
+    // needed no work, nothing else ever cleans the stub up (idle-kill is
+    // usually off, the backend sees live heartbeats, and daemons no longer
+    // restart routinely). A later deliberate launch for the same conversation
+    // clears the mark.
+    autoLaunchedConversations = new Set();
+    static RESURRECT_IDLE_KILL_DEFAULT_MS = 12 * 60 * 1000;
+    getResurrectIdleKillMs() {
+        const configured = this.config.resurrect_idle_kill_ms;
+        return typeof configured === 'number' ? configured : BaseTmuxLauncher.RESURRECT_IDLE_KILL_DEFAULT_MS;
+    }
+    /**
+     * The idle-kill threshold that applies to this conversation's RESURRECT
+     * status: >0 only when its current session was auto-launched and the
+     * resurrect wind-down is enabled.
+     */
+    resurrectIdleKillThresholdMs(conversationId) {
+        if (!conversationId || !this.autoLaunchedConversations.has(conversationId))
+            return 0;
+        return this.getResurrectIdleKillMs();
+    }
     // A REGISTERED session with a live pane that has made no MCP call at all for
     // this long is wedged, not busy: a healthy SiloLink agent polls every few
     // seconds, so lastActivity advances constantly and a working session can
@@ -79,12 +103,26 @@ export class BaseTmuxLauncher {
     static PROMPT_STALL_THRESHOLD_MS = 3 * 60 * 1000;
     // Re-notify cadence while the SAME stall persists unanswered.
     static PROMPT_STALL_RENOTIFY_MS = 30 * 60 * 1000;
-    lastSessionId = null;
-    // Which conversation lastSessionId belongs to. A pinned resume id replays ONE
-    // conversation's CLI context; multi-conversation daemons (personal) must never
-    // resume it for a different conversation or the worker re-registers under the
-    // old conversation (the nightly-audit-review attribution leak).
-    lastSessionConversationId = null;
+    // Resume ids restored PER CONVERSATION for its next launch (from a dying
+    // session, Rails metadata at boot, or the process-dead sweep). Key 0 holds a
+    // pin of unknown provenance, usable only by a launch with no target
+    // conversation. This replaces the launcher-global `lastSessionId` slot: one
+    // slot shared by every conversation let a capture for conv A become conv B's
+    // `--resume` target (three transcripts pinned to conv 3331 in turn, then
+    // handed to 3337 and 3369 — 2026-08-24). A pinned resume id replays ONE
+    // conversation's CLI context and must never cross conversations.
+    restoredResumeIds = new Map();
+    // resumeId → owning conversation. Survives unregister: a transcript that once
+    // belonged to conv A is never attributed to conv B later in this process
+    // lifetime, even after A's session is gone (the old guard only looked at
+    // LIVE sessions, so 3331's transcript was captured for 3337 the moment 3331
+    // stopped).
+    resumeIdOwner = new Map();
+    // Resume ids minted at launch (Claude `--session-id`), per conversation.
+    mintedResumeIds = new Map();
+    // `${agentSessionId}:${resumeId}` pairs already persisted to Rails — the
+    // metadata PUT happens ONCE per pair, not on every liveness tick.
+    persistedResumeIds = new Set();
     pendingTriggerMessage = null;
     pendingWorkspaceConfig = null;
     pendingWorkspaceCwd = null;
@@ -441,6 +479,10 @@ export class BaseTmuxLauncher {
         // isAutoRespawnEnabled() at their own call sites.
         if (!this.enabled)
             return;
+        // Idempotent: a second call must not overwrite idleCheckTimer and orphan
+        // the first interval (the Codex launcher used to be started twice).
+        if (this.idleCheckTimer)
+            return;
         // Reap tmux sessions left over from a prior daemon run before the
         // monitor starts. The new daemon's tmuxSessions map is empty by
         // definition, and the spawned CCs in those panes were bound to the
@@ -456,6 +498,28 @@ export class BaseTmuxLauncher {
         const respawnState = this.isAutoRespawnConfigured() ? 'auto-respawn on' : 'auto-respawn off';
         console.log(`  ${this.getLogTag()} idle monitor running (idle timeout: ${this.getIdleTimeoutMs()}ms, ${respawnState})`);
     }
+    /** The env name this daemon was started as (\`--env <name>\`). */
+    ownerEnv() {
+        return this.config.config_env || 'default';
+    }
+    /**
+     * SILOLINK_OWNER_ENV stamped on a tmux session at launch, or null when the
+     * pane predates the marker (or tmux can't answer).
+     */
+    readPaneOwnerEnv(name) {
+        return new Promise((resolve) => {
+            const show = spawn('tmux', ['show-environment', '-t', name, 'SILOLINK_OWNER_ENV'], {
+                stdio: ['ignore', 'pipe', 'ignore'],
+            });
+            let out = '';
+            show.stdout.on('data', (d) => { out += d.toString(); });
+            show.on('exit', () => {
+                const m = out.trim().match(/^SILOLINK_OWNER_ENV=(.*)$/);
+                resolve(m ? m[1] : null);
+            });
+            show.on('error', () => resolve(null));
+        });
+    }
     /**
      * Scan tmux for sessions matching this launcher's prefix and kill any
      * we don't currently track. Intended to run once at daemon startup to
@@ -481,12 +545,28 @@ export class BaseTmuxLauncher {
         if (names.length === 0)
             return;
         const reaped = [];
+        const skipped = [];
         for (const name of names) {
             if (this.tmuxSessions.has(name))
                 continue;
+            // Only reap panes THIS env owns. On a multi-env host the tmux namespace
+            // is shared, so an untracked pane is usually another daemon's LIVE
+            // session, not our leftover (2026-08-23: rolling fleet auto-update —
+            // every env boot reaped the video env's in-flight recording). A pane
+            // with no marker (pre-1.19.13 launch) is also skipped: a leaked pane is
+            // reconciled server-side within minutes, a killed live session is not
+            // recoverable at all.
+            const owner = await this.readPaneOwnerEnv(name);
+            if (!shouldReapOrphanPane(owner, this.ownerEnv())) {
+                skipped.push(`${name}(owner=${owner ?? 'unmarked'})`);
+                continue;
+            }
             reaped.push(name);
             spawn('tmux', ['kill-session', '-t', name], { stdio: 'ignore' });
         }
+        if (skipped.length > 0) {
+            console.log(`${this.getLogTag()} Startup reap: left ${skipped.length} pane(s) owned elsewhere/unmarked: ${skipped.join(', ')}`);
+        }
         if (reaped.length > 0) {
             console.log(`${this.getLogTag()} Reaped ${reaped.length} orphan tmux session(s) from prior daemon run: ${reaped.join(', ')}`);
         }
@@ -631,10 +711,23 @@ export class BaseTmuxLauncher {
         return prompt;
     }
     setLastResumeId(resumeId, conversationId) {
-        this.lastSessionId = resumeId;
-        this.lastSessionConversationId = conversationId ?? null;
+        this.restoredResumeIds.set(conversationId ?? 0, resumeId);
+        if (conversationId)
+            this.resumeIdOwner.set(resumeId, conversationId);
         console.log(`${this.getLogTag()} Restored resume ID: ${resumeId} (conv=${conversationId ?? 'unknown'})`);
     }
+    /** The resume id minted at launch for a conversation (Claude), if any. */
+    getMintedResumeId(conversationId) {
+        return this.mintedResumeIds.get(conversationId);
+    }
+    /**
+     * Public entry to the capture path — the Bridge calls it right after it
+     * pre-registers a launched session so a minted id lands on the Session (and
+     * is persisted once) immediately rather than on the next liveness tick.
+     */
+    syncResumeId(conversationId) {
+        this.captureResumeId(conversationId);
+    }
     /**
      * The resume id to use when launching for `conversationId`, or null to launch
      * fresh. Only a pin captured for the SAME conversation may be resumed — a pin
@@ -645,32 +738,35 @@ export class BaseTmuxLauncher {
     resumeTargetFor(conversationId) {
         // Per-conversation pin is authoritative: each Session stores the resume id
         // captured for ITS OWN transcript, so two conversations sharing a cwd never
-        // resume each other's CLI session. The global lastSessionId is only a
-        // fallback, and only when it was captured for THIS same conversation.
+        // resume each other's CLI session. The per-conversation restored id is the
+        // fallback (dying session / Rails metadata at boot). Nothing else — a pin
+        // from another conversation or of unknown provenance launches fresh.
         if (conversationId) {
             const pinned = this.sessionManager.getByConversationId(conversationId)?.resumeId;
             if (pinned)
                 return pinned;
-            if (this.lastSessionConversationId !== conversationId) {
-                if (this.lastSessionId) {
-                    console.warn(`${this.getLogTag()} Resume id ${this.lastSessionId} belongs to conv=${this.lastSessionConversationId ?? 'unknown'} — launching conv=${conversationId} fresh instead of resuming it.`);
-                }
-                return null;
+            const restored = this.restoredResumeIds.get(conversationId);
+            if (restored)
+                return restored;
+            const orphanPin = this.restoredResumeIds.get(0);
+            if (orphanPin) {
+                console.warn(`${this.getLogTag()} Resume id ${orphanPin} has no recorded conversation — launching conv=${conversationId} fresh instead of resuming it.`);
             }
+            return null;
         }
-        return this.lastSessionId;
+        return this.restoredResumeIds.get(0) ?? null;
     }
     /**
      * Forget a resume target that turned out to be unresumable so the next
      * relaunch starts FRESH instead of re-crashing on the same `--resume <id>`.
-     * Clears all three stores captureResumeId writes to: the global `lastSessionId`,
-     * the in-memory SessionInfo (which finishPaneTeardown would otherwise restore),
+     * Clears every store a resume target lives in: the per-conversation restored
+     * and minted ids, the in-memory SessionInfo (which finishPaneTeardown would otherwise restore),
      * and the persisted rails AgentSession metadata (so a daemon restart can't
      * resurrect it). Best-effort; never throws into the teardown path.
      */
     clearResumeId(conversationId) {
-        this.lastSessionId = null;
-        this.lastSessionConversationId = null;
+        this.restoredResumeIds.delete(conversationId || 0);
+        this.mintedResumeIds.delete(conversationId);
         const session = conversationId
             ? this.sessionManager.getByConversationId(conversationId)
             : this.sessionManager.getAll()[0];
@@ -982,6 +1078,16 @@ export class BaseTmuxLauncher {
         return { command, resolvedPath: this.resolveCommandPath(command) };
     }
     async launchInternal(reason = 'manual', conversationId) {
+        // Record the launch origin for the resurrect idle wind-down. Respawns
+        // ('process-exit') keep the conversation's existing origin — a respawned
+        // deliberate session stays deliberate, a respawned resurrect stays a
+        // resurrect.
+        if (conversationId) {
+            if (reason === 'inbound-message')
+                this.autoLaunchedConversations.add(conversationId);
+            else if (reason !== 'process-exit')
+                this.autoLaunchedConversations.delete(conversationId);
+        }
         if (!this.enabled) {
             console.log(`${this.getLogTag()} Not configured`);
             return false;
@@ -1167,6 +1273,12 @@ export class BaseTmuxLauncher {
             });
             tmuxCreate.unref();
             spawn('tmux', ['set-option', '-t', tmuxSession, 'remain-on-exit', 'on'], { stdio: 'ignore' });
+            // Ownership marker for the startup orphan reaper: on a multi-env host
+            // every daemon shares the same tmux namespace, and an unmarked pane is
+            // indistinguishable from a leftover of THIS env's prior run. 2026-08-23:
+            // a fleet-wide auto-update rolled every env daemon in sequence and each
+            // boot's reaper killed the video env's LIVE recording session — twice.
+            spawn('tmux', ['set-environment', '-t', tmuxSession, 'SILOLINK_OWNER_ENV', this.ownerEnv()], { stdio: 'ignore' });
             // Wait for tmux session to start
             await new Promise(resolve => setTimeout(resolve, 3000));
             const sessionExists = await new Promise((resolve) => {
@@ -1181,10 +1293,16 @@ export class BaseTmuxLauncher {
                 return false;
             }
             console.log(`${this.getLogTag()} tmux session "${tmuxSession}" created`);
-            this.tmuxSessions.set(tmuxSession, { conversationId: conversationId || 0, startedAt: new Date(), cwd });
+            const mintedSessionId = conversationId ? this.mintedResumeIds.get(conversationId) : undefined;
+            this.tmuxSessions.set(tmuxSession, { conversationId: conversationId || 0, startedAt: new Date(), cwd, mintedSessionId });
             if (workspaceSessionId) {
                 this.tmuxSessionWorkspaces.set(tmuxSession, workspaceSessionId);
             }
+            // A minted id needs no discovery — pin it on an already-registered session
+            // (relaunch) right away. A fresh launch's session is pre-registered by the
+            // Bridge afterwards, which calls syncResumeId.
+            if (mintedSessionId && conversationId)
+                this.captureResumeId(conversationId);
             // Wait for agent to be ready, then send the prompt
             const sessionToPrompt = tmuxSession;
             const promptToSend = this.formatPrompt(prompt);
@@ -1361,7 +1479,7 @@ export class BaseTmuxLauncher {
                     // forget that id so finishPaneTeardown relaunches FRESH instead of
                     // re-issuing the same doomed `--resume`/`resume` and looping forever.
                     // Applies to every CLI via the per-launcher isResumeFailure() override.
-                    const hadResumeTarget = this.lastSessionId != null
+                    const hadResumeTarget = this.restoredResumeIds.has(info.conversationId)
                         || this.sessionManager.getByConversationId(info.conversationId)?.resumeId != null;
                     if (hadResumeTarget && this.isResumeFailure(paneContent)) {
                         console.warn(`${this.getLogTag()} Pane died on an unresumable session for conv=${info.conversationId} — clearing resume id and relaunching fresh.`);
@@ -1391,12 +1509,12 @@ export class BaseTmuxLauncher {
         const stillRegistered = this.sessionManager.getByConversationId(conversationId);
         if (!stillRegistered)
             return;
-        // RESTORE resume id from the dying SESSION's stored value (not a stale
-        // global) BEFORE we unregister it — this is what lets the auto-respawn relaunch
-        // the SAME CLI session (`--resume <id>`) and continue an in-progress task
-        // instead of starting fresh. Best-effort: if the worker never captured an id
-        // (capture failed / CLI has no resume), lastSessionId stays null and the
-        // relaunch falls back to a fresh session — current behavior, never blocked.
+        // RESTORE resume id from the dying SESSION's stored value BEFORE we
+        // unregister it — this is what lets the auto-respawn relaunch the SAME CLI
+        // session (`--resume <id>`) and continue an in-progress task instead of
+        // starting fresh. Best-effort: if the worker never captured an id (capture
+        // failed / CLI has no resume), nothing is restored and the relaunch falls
+        // back to a fresh session — never blocked.
         const resumeId = stillRegistered.resumeId || stillRegistered.claudeResumeId;
         if (resumeId) {
             this.setLastResumeId(resumeId, conversationId);
@@ -1477,23 +1595,27 @@ export class BaseTmuxLauncher {
      *
      * Best-effort: returns null on any failure. NEVER throws into the launch path.
      */
-    detectResumeId(_cwd) {
+    detectResumeId(_cwd, _notBefore) {
         return null;
     }
     /**
-     * Capture the running worker's CLI session id and remember it so the next
-     * respawn relaunches the SAME session (`--resume`). Stores on three places:
-     *   1. `this.lastSessionId` — what buildLaunchPrompt reads to add resume args.
-     *   2. the SessionInfo (`resumeId`) — survives in-memory so finishPaneTeardown
-     *      can restore it just before relaunch (keyed off the SESSION, not a stale
-     *      global).
-     *   3. the rails AgentSession metadata (`cli_resume_id` + legacy
-     *      `claude_resume_id`) — survives a daemon restart so bridge startup /
-     *      remote_load_context can restore it.
+     * Pin the running worker's CLI session id on its Session so the next respawn
+     * relaunches the SAME session (`--resume`). Two sources, in order:
+     *   1. the id MINTED at launch (Claude `--session-id`) — authoritative, no
+     *      discovery, never overwritten;
+     *   2. discovery from the CLI's on-disk transcript (Gemini/Codex, and Claude
+     *      launches that resumed) — accepted only if the transcript was touched
+     *      at/after the pane's startedAt.
+     * Either way the id is refused when another conversation owns it — a LIVE
+     * session or any conversation seen earlier this process lifetime
+     * (`resumeIdOwner`, which survives unregister). Stores on the Session
+     * (`resumeId`) and persists `cli_resume_id` + legacy `claude_resume_id` to the
+     * rails AgentSession metadata ONCE per (agent session, id) pair — that
+     * survives a daemon restart so bridge startup / remote_load_context can
+     * restore it.
      *
-     * Idempotent + throttled by the caller (runs on the live-usage tick and once
-     * shortly after launch). Best-effort — a capture failure leaves prior state
-     * intact and never blocks anything.
+     * Idempotent; runs on the liveness tick and once right after launch.
+     * Best-effort — a capture failure leaves prior state intact and never blocks.
      */
     captureResumeId(conversationId) {
         const session = conversationId
@@ -1502,44 +1624,63 @@ export class BaseTmuxLauncher {
         if (!session)
             return;
         // Locate by the ACTUAL launch cwd (same resolution extractTranscriptUsage uses).
-        let cwd;
-        for (const info of this.tmuxSessions.values()) {
-            if (info.conversationId === conversationId) {
-                cwd = info.cwd;
+        let info;
+        for (const candidate of this.tmuxSessions.values()) {
+            if (candidate.conversationId === conversationId) {
+                info = candidate;
                 break;
             }
         }
-        cwd ||= this.getWorkingDirectory();
+        const cwd = info?.cwd || this.getWorkingDirectory();
+        const minted = info?.mintedSessionId ?? this.mintedResumeIds.get(conversationId);
         let resumeId = null;
-        try {
-            resumeId = this.detectResumeId(cwd);
+        let source;
+        if (minted) {
+            resumeId = minted;
+            source = 'minted';
         }
-        catch (err) {
-            console.warn(`${this.getLogTag()} detectResumeId failed for conv=${conversationId}: ${err}`);
-            return;
+        else {
+            try {
+                resumeId = this.detectResumeId(cwd, info?.startedAt);
+            }
+            catch (err) {
+                console.warn(`${this.getLogTag()} detectResumeId failed for conv=${conversationId}: ${err}`);
+                return;
+            }
+            source = 'discovered';
         }
         if (!resumeId)
             return;
-        // Cross-conversation guard: detectResumeId is cwd-scoped ("most recent
-        // transcript in the launch cwd"), so when two conversations share a cwd it
-        // can return the OTHER conversation's transcript. Never pin a transcript id
-        // that a different live conversation's session already owns — that would
-        // make this conversation resume the other's CLI session (observed 2026-07-18:
-        // conv 2170 stole conv 2158's id, both in the demo-kit cwd, so the 2170
-        // pane ended up polling 2158). Leave this conversation fresh instead.
-        const otherOwner = this.sessionManager.getAll().find((s) => s.resumeId === resumeId && s.conversationId !== conversationId);
-        if (otherOwner) {
-            console.warn(`${this.getLogTag()} Resume id ${resumeId} already owned by conv=${otherOwner.conversationId} — NOT capturing it for conv=${conversationId} (shared cwd). Leaving fresh.`);
+        // Ownership guard. detectResumeId is cwd-scoped ("most recent transcript in
+        // the launch cwd"), so when two conversations share a cwd it can return the
+        // OTHER conversation's transcript. Never pin an id that a different
+        // conversation owns — live (2026-07-18: conv 2170 stole conv 2158's id and
+        // the 2170 pane ended up polling 2158) or previously seen (2026-08-24: once
+        // 3331 stopped, its transcript was captured for 3337, then 3337's for 3369).
+        const priorOwner = this.resumeIdOwner.get(resumeId);
+        if (priorOwner !== undefined && priorOwner !== conversationId) {
+            console.warn(`${this.getLogTag()} Resume id ${resumeId} is owned by conv=${priorOwner} — NOT capturing it for conv=${conversationId} (${source}). Leaving fresh.`);
             return;
         }
-        // No change — already captured this id.
-        if (this.lastSessionId === resumeId && session.resumeId === resumeId)
+        const otherLive = this.sessionManager.getAll().find((s) => s.resumeId === resumeId && s.conversationId !== conversationId);
+        if (otherLive) {
+            console.warn(`${this.getLogTag()} Resume id ${resumeId} already owned by live conv=${otherLive.conversationId} — NOT capturing it for conv=${conversationId} (shared cwd). Leaving fresh.`);
             return;
-        this.lastSessionId = resumeId;
-        this.lastSessionConversationId = conversationId || session.conversationId || null;
-        session.resumeId = resumeId;
-        session.claudeResumeId = resumeId; // keep legacy alias in sync
+        }
+        this.resumeIdOwner.set(resumeId, conversationId);
+        const changed = session.resumeId !== resumeId;
+        if (changed) {
+            if (session.resumeId) {
+                console.log(`${this.getLogTag()} Resume id for conv=${conversationId}: ${session.resumeId} → ${resumeId} (${source})`);
+            }
+            session.resumeId = resumeId;
+            session.claudeResumeId = resumeId; // keep legacy alias in sync
+        }
         if (this.dsiloedClient && session.agentSessionId) {
+            const key = `${session.agentSessionId}:${resumeId}`;
+            if (this.persistedResumeIds.has(key))
+                return;
+            this.persistedResumeIds.add(key);
             // MERGE — only the resume keys; a full replace would wipe workspace_* and
             // server-set keys. Persist BOTH a generic key and the legacy claude key the
             // bridge startup / remote_load_context already read.
@@ -1547,11 +1688,14 @@ export class BaseTmuxLauncher {
                 cli_resume_id: resumeId,
                 claude_resume_id: resumeId,
             }).then(() => {
-                console.log(`${this.getLogTag()} Captured resume id ${resumeId} for conv=${conversationId} (agent session ${session.agentSessionId})`);
-            }).catch(err => console.error(`${this.getLogTag()} Failed to persist resume id:`, err));
+                console.log(`${this.getLogTag()} Captured resume id ${resumeId} for conv=${conversationId} (agent session ${session.agentSessionId}, ${source})`);
+            }).catch(err => {
+                this.persistedResumeIds.delete(key); // retry on the next tick
+                console.error(`${this.getLogTag()} Failed to persist resume id:`, err);
+            });
         }
-        else {
-            console.log(`${this.getLogTag()} Captured resume id ${resumeId} for conv=${conversationId} (in-memory only)`);
+        else if (changed) {
+            console.log(`${this.getLogTag()} Captured resume id ${resumeId} for conv=${conversationId} (in-memory only, ${source})`);
         }
     }
     // Returns true if usage was found and a report was initiated (used by the
@@ -1585,7 +1729,7 @@ export class BaseTmuxLauncher {
             }
         }
         cwd ||= ledgerEntry?.cwd || this.getWorkingDirectory();
-        const cliSessionId = this.lastSessionId ?? session?.resumeId ?? ledgerEntry?.cliSessionId ?? null;
+        const cliSessionId = session?.resumeId ?? ledgerEntry?.cliSessionId ?? this.restoredResumeIds.get(conversationId) ?? null;
         let extracted;
         try {
             extracted = this.extractTranscriptUsage(cwd, cliSessionId);
@@ -1707,7 +1851,7 @@ export class BaseTmuxLauncher {
             agentSessionId: session.agentSessionId,
             cliType: this.getCliType(),
             cwd: cwd || this.getWorkingDirectory(),
-            cliSessionId: session.resumeId || this.lastSessionId || undefined,
+            cliSessionId: session.resumeId || undefined,
             tmuxSession,
         });
     }
@@ -1788,9 +1932,19 @@ export class BaseTmuxLauncher {
         // inbound message. Skips sessions with undelivered messages so we
         // never kill mid-delivery.
         const killAfter = this.getIdleKillAfterMs();
-        if (killAfter > 0) {
+        const resurrectDefault = this.getResurrectIdleKillMs();
+        if (killAfter > 0 || resurrectDefault > 0) {
             for (const s of sessions) {
-                if (now - s.lastActivity.getTime() <= killAfter)
+                // A resurrect (auto-launched) session gets its own, always-on
+                // threshold: the tightest of the configured idle-kill and the
+                // resurrect wind-down. Deliberate sessions keep the configured
+                // idle-kill semantics exactly (0 = never).
+                const resurrectAfter = this.resurrectIdleKillThresholdMs(s.conversationId);
+                const thresholds = [killAfter, resurrectAfter].filter(t => t > 0);
+                if (thresholds.length === 0)
+                    continue;
+                const effectiveKillAfter = Math.min(...thresholds);
+                if (now - s.lastActivity.getTime() <= effectiveKillAfter)
                     continue;
                 if (this.messageQueue?.hasUndeliveredMessages(s.sessionId))
                     continue;
@@ -1805,6 +1959,18 @@ export class BaseTmuxLauncher {
                     continue;
                 }
                 const idleMin = Math.round((now - s.lastActivity.getTime()) / 60000);
+                if (resurrectAfter > 0 && now - s.lastActivity.getTime() > resurrectAfter) {
+                    // Wind-down, not a plain kill: close the rails-side row FIRST with a
+                    // reason the backend's completion relay recognizes as
+                    // nothing-to-announce (model_api skips the dispatcher re-wake for
+                    // 'resurrect-idle:*'), THEN kill the pane. The later process-dead
+                    // completion is an idempotent no-op server-side.
+                    console.log(`${this.getLogTag()} Resurrect wind-down: conv ${s.conversationId} auto-launched session idle ${idleMin}min (threshold ${Math.round(resurrectAfter / 60000)}min) — closing session + pane`);
+                    this.completeAgentSessionRow(s, `resurrect-idle:${idleMin}min`);
+                    this.killByConversation(s.conversationId, `resurrect-idle:${idleMin}min`);
+                    this.autoLaunchedConversations.delete(s.conversationId);
+                    continue;
+                }
                 console.log(`${this.getLogTag()} Idle-kill: conv ${s.conversationId} idle ${idleMin}min (threshold ${Math.round(killAfter / 60000)}min) — killing CC; auto-respawn will pick up next inbound`);
                 this.killByConversation(s.conversationId, `idle-kill:${idleMin}min`);
             }
@@ -2015,6 +2181,30 @@ export class BaseTmuxLauncher {
             this.killByConversation(s.conversationId, `wedged-session:${idleMin}min`);
         }
     }
+    /**
+     * Wedge verdict for one conversation, from the SAME primitives
+     * reapWedgedSessions uses: pane present + capturable, not actively thinking,
+     * and substantive content frozen for at least FROZEN_THRESHOLD_MS. Used by the
+     * stale-on-inbound recycler (2026-08-23: it recycled on MCP silence alone and
+     * killed live panes mid-work — conv 3337 six times in one evening).
+     */
+    isSessionWedged(conversationId) {
+        const paneName = this.tmuxNameForConversation(conversationId);
+        if (!paneName)
+            return { wedged: false, reason: 'no-pane', paneName: null };
+        if (this.capturePaneTailForProgress(paneName) === null) {
+            return { wedged: false, reason: 'pane-gone', paneName };
+        }
+        if (this.isActivelyThinking(paneName))
+            return { wedged: false, reason: 'pane-active', paneName };
+        const prog = this.paneProgress.get(paneName);
+        const frozenMs = prog ? Date.now() - prog.lastChangeAt : 0;
+        const frozenMin = Math.round(frozenMs / 60000);
+        if (frozenMs < BaseTmuxLauncher.FROZEN_THRESHOLD_MS) {
+            return { wedged: false, reason: `frozen-${frozenMin}min<threshold`, paneName };
+        }
+        return { wedged: true, reason: `frozen-${frozenMin}min`, paneName };
+    }
     isActivelyThinking(tmuxSession) {
         const now = Date.now();
         const prev = this.paneProgress.get(tmuxSession);
@@ -2104,4 +2294,12 @@ export class BaseTmuxLauncher {
         }
     }
 }
+/**
+ * Startup-reap decision: reap ONLY a pane this env provably owns. Unmarked
+ * (legacy) and other-env panes are left alone — cross-env kills are strictly
+ * worse than a leaked pane, which the backend reconciles anyway.
+ */
+export function shouldReapOrphanPane(ownerEnv, myEnv) {
+    return ownerEnv !== null && ownerEnv === myEnv;
+}
 //# sourceMappingURL=base-tmux-launcher.js.map