@dsiloed/silo-link 1.19.15 → 1.19.17

package/dist/core/base-tmux-launcher.js

@@ -1,9 +1,14 @@
 import { spawn, execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, copyFileSync, writeFileSync, unlinkSync, readdirSync, readFileSync } from 'node:fs';
+import { existsSync, copyFileSync, writeFileSync, unlinkSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { join, dirname } from 'node:path';
 import { tmpdir, homedir } from 'node:os';
+import { LAUNCH_HEADER } from './launch-binding.js';
+import { healthMonitor } from './health-monitor.js';
+import { isInPollLoop } from './idle-completion.js';
+import { reapStrayProcesses, snapshotStrayProcesses } from './stray-processes.js';
+import { randomUUID } from 'node:crypto';
 /**
  * Abstract base class for tmux-based agent launchers.
  * Implements all shared lifecycle, monitoring, and session management logic.
@@ -103,12 +108,26 @@ export class BaseTmuxLauncher {
     static PROMPT_STALL_THRESHOLD_MS = 3 * 60 * 1000;
     // Re-notify cadence while the SAME stall persists unanswered.
     static PROMPT_STALL_RENOTIFY_MS = 30 * 60 * 1000;
-    lastSessionId = null;
-    // Which conversation lastSessionId belongs to. A pinned resume id replays ONE
-    // conversation's CLI context; multi-conversation daemons (personal) must never
-    // resume it for a different conversation or the worker re-registers under the
-    // old conversation (the nightly-audit-review attribution leak).
-    lastSessionConversationId = null;
+    // Resume ids restored PER CONVERSATION for its next launch (from a dying
+    // session, Rails metadata at boot, or the process-dead sweep). Key 0 holds a
+    // pin of unknown provenance, usable only by a launch with no target
+    // conversation. This replaces the launcher-global `lastSessionId` slot: one
+    // slot shared by every conversation let a capture for conv A become conv B's
+    // `--resume` target (three transcripts pinned to conv 3331 in turn, then
+    // handed to 3337 and 3369 — 2026-08-24). A pinned resume id replays ONE
+    // conversation's CLI context and must never cross conversations.
+    restoredResumeIds = new Map();
+    // resumeId → owning conversation. Survives unregister: a transcript that once
+    // belonged to conv A is never attributed to conv B later in this process
+    // lifetime, even after A's session is gone (the old guard only looked at
+    // LIVE sessions, so 3331's transcript was captured for 3337 the moment 3331
+    // stopped).
+    resumeIdOwner = new Map();
+    // Resume ids minted at launch (Claude `--session-id`), per conversation.
+    mintedResumeIds = new Map();
+    // `${agentSessionId}:${resumeId}` pairs already persisted to Rails — the
+    // metadata PUT happens ONCE per pair, not on every liveness tick.
+    persistedResumeIds = new Set();
     pendingTriggerMessage = null;
     pendingWorkspaceConfig = null;
     pendingWorkspaceCwd = null;
@@ -129,6 +148,42 @@ export class BaseTmuxLauncher {
     // stage's prompt into the config file forever (personal daemon, 2026-08-13 —
     // a 9,948-char Fleet-Auditor prompt naming a long-finished stage execution).
     pendingSessionPrompt = null;
+    // Launch → MCP transport bindings (shared with the MCP server). See launch-binding.ts.
+    launchBindings = null;
+    // One-shot backend linkage for the NEXT launch (agent_session_id /
+    // launch_correlation_id from the control-channel launch payload).
+    pendingLaunchLinkage = null;
+    setLaunchBindings(registry) {
+        this.launchBindings = registry;
+    }
+    setLaunchLinkage(linkage) {
+        this.pendingLaunchLinkage = linkage;
+    }
+    /**
+     * mcp-remote `--header` args that stamp the LOCAL silolink server entry with
+     * this launch's token, so the daemon's MCP server can bind the transport to
+     * the pane on initialize.
+     */
+    launchHeaderArgs(launch) {
+        return launch ? ['--header', `${LAUNCH_HEADER}: ${launch.token}`] : [];
+    }
+    /** Remove per-launch MCP config files older than `maxAgeMs` from `dir` (best-effort). */
+    cleanupPerLaunchConfigs(dir, maxAgeMs = 24 * 60 * 60 * 1000) {
+        try {
+            if (!existsSync(dir))
+                return;
+            const now = Date.now();
+            for (const f of readdirSync(dir)) {
+                const full = join(dir, f);
+                try {
+                    if (now - statSync(full).mtimeMs > maxAgeMs)
+                        unlinkSync(full);
+                }
+                catch { /* already gone */ }
+            }
+        }
+        catch { /* best-effort */ }
+    }
     constructor(config, sessionManager, dsiloedClient, messageQueue, workspaceManager, usageLedger) {
         this.config = config;
         this.sessionManager = sessionManager;
@@ -241,8 +296,18 @@ export class BaseTmuxLauncher {
     // Spare it only while its pane shows genuine new output AND it is still
     // under the hard idle ceiling; past the ceiling a session making no MCP
     // progress is wedged and must be killed regardless of pane animation.
-    shouldSuppressIdleKill(tmuxName, idleMs) {
-        return idleMs < this.getIdleKillHardCeilMs() && this.isActivelyThinking(tmuxName);
+    //
+    // A session in its remote_poll loop is never spared: it has told us, via
+    // the poll tool itself, that it has nothing to do. Its pane churns anyway
+    // (tool-call counters, spinner, "still nothing — continuing to poll"), and
+    // that churn used to pass as "genuine new output" — every Doug video
+    // session on 2026-08-26 ran 4h past its threshold to the 8h hard ceiling.
+    shouldSuppressIdleKill(tmuxName, idleMs, session) {
+        if (idleMs >= this.getIdleKillHardCeilMs())
+            return false;
+        if (session && isInPollLoop(session))
+            return false;
+        return this.isActivelyThinking(tmuxName);
     }
     /**
      * Whether to paste the prompt in tmux bracketed-paste mode (`paste-buffer -p`).
@@ -417,6 +482,18 @@ export class BaseTmuxLauncher {
         console.log(`${this.getLogTag()} Nudged ${this.tmuxSessions.size} session(s) (attempt ${this.nudgeCount + 1})`);
         return true;
     }
+    /**
+     * Nudge a single conversation's pane. Unlike nudge() this is not throttled:
+     * it answers a deliberate operator/control-channel request for THIS pane.
+     */
+    nudgeConversation(conversationId, message) {
+        const name = this.tmuxNameForConversation(conversationId);
+        if (!name)
+            return false;
+        this.sendLineToPane(name, message || 'Continue polling SiloLink for messages. Do not stop the poll loop.');
+        console.log(`${this.getLogTag()} Nudged "${name}" (conv ${conversationId})`);
+        return true;
+    }
     /**
      * Proactive heartbeat — sent when the session is alive but silent AND the
      * inbound queue is empty. The existing nudge() only fires when there are
@@ -447,13 +524,29 @@ export class BaseTmuxLauncher {
                 return false;
         }
         this.lastHeartbeatAt = now;
-        const message = 'Heartbeat check: if you are idle, call remote_poll to resume checking for messages. If you are mid-task, ignore this and keep going.';
-        for (const [name] of this.tmuxSessions) {
-            this.sendLineToPane(name, message);
+        let finalReported = 0;
+        for (const [name, info] of this.tmuxSessions) {
+            const session = info.conversationId ? this.sessionManager.getByConversationId(info.conversationId) : undefined;
+            const done = !!session?.finalReportAt;
+            if (done)
+                finalReported++;
+            this.sendLineToPane(name, BaseTmuxLauncher.heartbeatMessage(done));
         }
-        console.log(`${this.getLogTag()} Heartbeat nudge sent to ${this.tmuxSessions.size} session(s)`);
+        console.log(`${this.getLogTag()} Heartbeat nudge sent to ${this.tmuxSessions.size} session(s)${finalReported ? ` (${finalReported} told to unregister — final report already filed)` : ''}`);
         return true;
     }
+    /**
+     * The heartbeat line typed into a pane. A session that has already filed
+     * its final report is told to END, not to keep polling: the generic
+     * "call remote_poll" wording kept finished workers answering "Mid-task,
+     * continuing" for hours (Doug's video sessions, 2026-08-26). Everything
+     * else keeps the classic wording, which is what idle prod agents rely on.
+     */
+    static heartbeatMessage(finalReportFiled) {
+        return finalReportFiled
+            ? 'Heartbeat check: you already posted your final report and no new work has arrived. Call remote_unregister now to end this session. Only if you are still mid-task, ignore this and keep going.'
+            : 'Heartbeat check: if you are idle, call remote_poll to resume checking for messages. If you are mid-task, ignore this and keep going.';
+    }
     isEnabled() { return this.enabled; }
     isAutoRespawnEnabled() { return this.enabled && this.isAutoRespawnConfigured(); }
     hasLiveProcess() { return this.tmuxSessions.size > 0; }
@@ -465,6 +558,10 @@ export class BaseTmuxLauncher {
         // isAutoRespawnEnabled() at their own call sites.
         if (!this.enabled)
             return;
+        // Idempotent: a second call must not overwrite idleCheckTimer and orphan
+        // the first interval (the Codex launcher used to be started twice).
+        if (this.idleCheckTimer)
+            return;
         // Reap tmux sessions left over from a prior daemon run before the
         // monitor starts. The new daemon's tmuxSessions map is empty by
         // definition, and the spawned CCs in those panes were bound to the
@@ -550,6 +647,7 @@ export class BaseTmuxLauncher {
             console.log(`${this.getLogTag()} Startup reap: left ${skipped.length} pane(s) owned elsewhere/unmarked: ${skipped.join(', ')}`);
         }
         if (reaped.length > 0) {
+            healthMonitor.noteReapedAtBoot(reaped.length);
             console.log(`${this.getLogTag()} Reaped ${reaped.length} orphan tmux session(s) from prior daemon run: ${reaped.join(', ')}`);
         }
         // Fix #3 (main-checkout guard): a prior daemon run may have left a shared
@@ -693,10 +791,23 @@ export class BaseTmuxLauncher {
         return prompt;
     }
     setLastResumeId(resumeId, conversationId) {
-        this.lastSessionId = resumeId;
-        this.lastSessionConversationId = conversationId ?? null;
+        this.restoredResumeIds.set(conversationId ?? 0, resumeId);
+        if (conversationId)
+            this.resumeIdOwner.set(resumeId, conversationId);
         console.log(`${this.getLogTag()} Restored resume ID: ${resumeId} (conv=${conversationId ?? 'unknown'})`);
     }
+    /** The resume id minted at launch for a conversation (Claude), if any. */
+    getMintedResumeId(conversationId) {
+        return this.mintedResumeIds.get(conversationId);
+    }
+    /**
+     * Public entry to the capture path — the Bridge calls it right after it
+     * pre-registers a launched session so a minted id lands on the Session (and
+     * is persisted once) immediately rather than on the next liveness tick.
+     */
+    syncResumeId(conversationId) {
+        this.captureResumeId(conversationId);
+    }
     /**
      * The resume id to use when launching for `conversationId`, or null to launch
      * fresh. Only a pin captured for the SAME conversation may be resumed — a pin
@@ -707,32 +818,35 @@ export class BaseTmuxLauncher {
     resumeTargetFor(conversationId) {
         // Per-conversation pin is authoritative: each Session stores the resume id
         // captured for ITS OWN transcript, so two conversations sharing a cwd never
-        // resume each other's CLI session. The global lastSessionId is only a
-        // fallback, and only when it was captured for THIS same conversation.
+        // resume each other's CLI session. The per-conversation restored id is the
+        // fallback (dying session / Rails metadata at boot). Nothing else — a pin
+        // from another conversation or of unknown provenance launches fresh.
         if (conversationId) {
             const pinned = this.sessionManager.getByConversationId(conversationId)?.resumeId;
             if (pinned)
                 return pinned;
-            if (this.lastSessionConversationId !== conversationId) {
-                if (this.lastSessionId) {
-                    console.warn(`${this.getLogTag()} Resume id ${this.lastSessionId} belongs to conv=${this.lastSessionConversationId ?? 'unknown'} — launching conv=${conversationId} fresh instead of resuming it.`);
-                }
-                return null;
+            const restored = this.restoredResumeIds.get(conversationId);
+            if (restored)
+                return restored;
+            const orphanPin = this.restoredResumeIds.get(0);
+            if (orphanPin) {
+                console.warn(`${this.getLogTag()} Resume id ${orphanPin} has no recorded conversation — launching conv=${conversationId} fresh instead of resuming it.`);
             }
+            return null;
         }
-        return this.lastSessionId;
+        return this.restoredResumeIds.get(0) ?? null;
     }
     /**
      * Forget a resume target that turned out to be unresumable so the next
      * relaunch starts FRESH instead of re-crashing on the same `--resume <id>`.
-     * Clears all three stores captureResumeId writes to: the global `lastSessionId`,
-     * the in-memory SessionInfo (which finishPaneTeardown would otherwise restore),
+     * Clears every store a resume target lives in: the per-conversation restored
+     * and minted ids, the in-memory SessionInfo (which finishPaneTeardown would otherwise restore),
      * and the persisted rails AgentSession metadata (so a daemon restart can't
      * resurrect it). Best-effort; never throws into the teardown path.
      */
     clearResumeId(conversationId) {
-        this.lastSessionId = null;
-        this.lastSessionConversationId = null;
+        this.restoredResumeIds.delete(conversationId || 0);
+        this.mintedResumeIds.delete(conversationId);
         const session = conversationId
             ? this.sessionManager.getByConversationId(conversationId)
             : this.sessionManager.getAll()[0];
@@ -784,7 +898,9 @@ export class BaseTmuxLauncher {
         for (const [name, info] of this.tmuxSessions) {
             if (info.conversationId === conversationId) {
                 this.capturePaneTail(name, reason); // also reports token usage (see capturePaneTail)
+                const strays = this.snapshotStrays(conversationId);
                 spawn('tmux', ['kill-session', '-t', name], { stdio: 'ignore' });
+                this.reapStrays(strays, reason);
                 this.tmuxSessions.delete(name);
                 const wsId = this.tmuxSessionWorkspaces.get(name);
                 if (wsId && this.workspaceManager) {
@@ -813,13 +929,15 @@ export class BaseTmuxLauncher {
         });
     }
     kill() {
-        for (const [name] of this.tmuxSessions) {
+        for (const [name, info] of this.tmuxSessions) {
             this.capturePaneTail(name, 'kill-all');
             const wsSessionId = this.tmuxSessionWorkspaces.get(name);
             if (wsSessionId && this.workspaceManager) {
                 this.workspaceManager.removeWorktree(wsSessionId);
             }
+            const strays = info.conversationId ? this.snapshotStrays(info.conversationId) : null;
             spawn('tmux', ['kill-session', '-t', name], { stdio: 'ignore' });
+            this.reapStrays(strays, 'kill-all');
         }
         this.tmuxSessions.clear();
         this.tmuxSessionWorkspaces.clear();
@@ -828,6 +946,44 @@ export class BaseTmuxLauncher {
             this.tmuxMonitorTimer = null;
         }
     }
+    /**
+     * Value of the SILOLINK_PANE env marker every process under a pane inherits:
+     * `<owner-env>:conv<id>`. Env-qualified because conversation ids are only
+     * unique per platform host — a DEV and a PROD daemon on one laptop can both
+     * own a "conv 3432".
+     */
+    paneMarker(conversationId) {
+        return `${this.ownerEnv()}:conv${conversationId}`;
+    }
+    /**
+     * Stray-process reaping (2026-08-26): killing a tmux session kills the shell
+     * and the CLI, but anything the CLI started detached (a backgrounded
+     * `ffmpeg`, `nohup node …`) is re-parented to init and lives on — one
+     * orphaned ffmpeg from a finished Doug video session pinned a core at 114%
+     * for 6h43m. Process lineage is gone by then, but the ENVIRONMENT is
+     * inherited: every pane is launched with SILOLINK_PANE=<env>:conv<id>, so
+     * survivors are findable by marker. Snapshot BEFORE the kill (so a relaunch
+     * of the same conversation seconds later is never in the set), sweep after.
+     */
+    snapshotStrays(conversationId) {
+        try {
+            return snapshotStrayProcesses(this.paneMarker(conversationId));
+        }
+        catch (err) {
+            console.warn(`${this.getLogTag()} stray-process snapshot failed for conv ${conversationId}: ${err}`);
+            return null;
+        }
+    }
+    reapStrays(snapshot, reason) {
+        if (!snapshot || snapshot.pids.length === 0)
+            return;
+        reapStrayProcesses(snapshot).then(result => {
+            if (result.killed.length === 0)
+                return;
+            console.warn(`${this.getLogTag()} reaped ${result.killed.length} stray process(es) left behind by ${snapshot.marker} (reason: ${reason}): ` +
+                result.killed.map(p => `${p.pid} ${p.command}`).join(' | '));
+        }).catch(err => console.warn(`${this.getLogTag()} stray-process sweep failed for ${snapshot.marker}: ${err}`));
+    }
     /**
      * Capture the last ~200 lines of a tmux pane and log them. Called before
      * kill-session so the last output survives the kill. The `remain-on-exit on`
@@ -1128,7 +1284,21 @@ export class BaseTmuxLauncher {
             // deterministic and independent of racy shared-state approvals.
             const mcpToolAllowlist = this.pendingMcpToolAllowlist;
             this.pendingMcpToolAllowlist = null;
-            const mcpExtraArgs = await this.setupMcpConfig(cwd, mcpToolAllowlist);
+            // Per-launch identity: the token rides into the CLI's MCP config as an
+            // X-SiloLink-Launch header, and the binding lets remote_register tell
+            // which pane is calling (see launch-binding.ts).
+            const launch = { token: randomUUID(), conversationId };
+            const linkage = this.pendingLaunchLinkage;
+            this.pendingLaunchLinkage = null;
+            if (conversationId && this.launchBindings) {
+                this.launchBindings.register({
+                    token: launch.token,
+                    conversationId,
+                    agentSessionId: linkage?.agentSessionId,
+                    launchCorrelationId: linkage?.launchCorrelationId,
+                });
+            }
+            const mcpExtraArgs = await this.setupMcpConfig(cwd, mcpToolAllowlist, launch);
             if (Array.isArray(mcpExtraArgs) && mcpExtraArgs.length > 0)
                 args.push(...mcpExtraArgs);
             // Fetch agent launch context
@@ -1225,9 +1395,13 @@ export class BaseTmuxLauncher {
             // runs daemons AND has the hook installed. Uses an `env` prefix (not
             // getAgentEnv) because tmux doesn't propagate caller env to panes on an
             // already-running server.
+            // SILOLINK_PANE=<env>:conv<id> is inherited by everything the CLI spawns,
+            // detached or not — it is how stray subprocesses are found after the
+            // pane is gone (see snapshotStrays).
+            const paneEnv = conversationId ? [`SILOLINK_PANE=${this.paneMarker(conversationId)}`] : [];
             const tmuxArgs = [
                 'new-session', '-d', '-s', tmuxSession, '-c', cwd, '-x', '200', '-y', '50',
-                'env', 'SILOLINK_MANAGED=1', command, ...args,
+                'env', 'SILOLINK_MANAGED=1', ...paneEnv, command, ...args,
             ];
             const tmuxCreate = spawn('tmux', tmuxArgs, {
                 stdio: 'ignore',
@@ -1259,10 +1433,16 @@ export class BaseTmuxLauncher {
                 return false;
             }
             console.log(`${this.getLogTag()} tmux session "${tmuxSession}" created`);
-            this.tmuxSessions.set(tmuxSession, { conversationId: conversationId || 0, startedAt: new Date(), cwd });
+            const mintedSessionId = conversationId ? this.mintedResumeIds.get(conversationId) : undefined;
+            this.tmuxSessions.set(tmuxSession, { conversationId: conversationId || 0, startedAt: new Date(), cwd, mintedSessionId });
             if (workspaceSessionId) {
                 this.tmuxSessionWorkspaces.set(tmuxSession, workspaceSessionId);
             }
+            // A minted id needs no discovery — pin it on an already-registered session
+            // (relaunch) right away. A fresh launch's session is pre-registered by the
+            // Bridge afterwards, which calls syncResumeId.
+            if (mintedSessionId && conversationId)
+                this.captureResumeId(conversationId);
             // Wait for agent to be ready, then send the prompt
             const sessionToPrompt = tmuxSession;
             const promptToSend = this.formatPrompt(prompt);
@@ -1439,7 +1619,7 @@ export class BaseTmuxLauncher {
                     // forget that id so finishPaneTeardown relaunches FRESH instead of
                     // re-issuing the same doomed `--resume`/`resume` and looping forever.
                     // Applies to every CLI via the per-launcher isResumeFailure() override.
-                    const hadResumeTarget = this.lastSessionId != null
+                    const hadResumeTarget = this.restoredResumeIds.has(info.conversationId)
                         || this.sessionManager.getByConversationId(info.conversationId)?.resumeId != null;
                     if (hadResumeTarget && this.isResumeFailure(paneContent)) {
                         console.warn(`${this.getLogTag()} Pane died on an unresumable session for conv=${info.conversationId} — clearing resume id and relaunching fresh.`);
@@ -1469,12 +1649,12 @@ export class BaseTmuxLauncher {
         const stillRegistered = this.sessionManager.getByConversationId(conversationId);
         if (!stillRegistered)
             return;
-        // RESTORE resume id from the dying SESSION's stored value (not a stale
-        // global) BEFORE we unregister it — this is what lets the auto-respawn relaunch
-        // the SAME CLI session (`--resume <id>`) and continue an in-progress task
-        // instead of starting fresh. Best-effort: if the worker never captured an id
-        // (capture failed / CLI has no resume), lastSessionId stays null and the
-        // relaunch falls back to a fresh session — current behavior, never blocked.
+        // RESTORE resume id from the dying SESSION's stored value BEFORE we
+        // unregister it — this is what lets the auto-respawn relaunch the SAME CLI
+        // session (`--resume <id>`) and continue an in-progress task instead of
+        // starting fresh. Best-effort: if the worker never captured an id (capture
+        // failed / CLI has no resume), nothing is restored and the relaunch falls
+        // back to a fresh session — never blocked.
         const resumeId = stillRegistered.resumeId || stillRegistered.claudeResumeId;
         if (resumeId) {
             this.setLastResumeId(resumeId, conversationId);
@@ -1555,23 +1735,27 @@ export class BaseTmuxLauncher {
      *
      * Best-effort: returns null on any failure. NEVER throws into the launch path.
      */
-    detectResumeId(_cwd) {
+    detectResumeId(_cwd, _notBefore) {
         return null;
     }
     /**
-     * Capture the running worker's CLI session id and remember it so the next
-     * respawn relaunches the SAME session (`--resume`). Stores on three places:
-     *   1. `this.lastSessionId` — what buildLaunchPrompt reads to add resume args.
-     *   2. the SessionInfo (`resumeId`) — survives in-memory so finishPaneTeardown
-     *      can restore it just before relaunch (keyed off the SESSION, not a stale
-     *      global).
-     *   3. the rails AgentSession metadata (`cli_resume_id` + legacy
-     *      `claude_resume_id`) — survives a daemon restart so bridge startup /
-     *      remote_load_context can restore it.
+     * Pin the running worker's CLI session id on its Session so the next respawn
+     * relaunches the SAME session (`--resume`). Two sources, in order:
+     *   1. the id MINTED at launch (Claude `--session-id`) — authoritative, no
+     *      discovery, never overwritten;
+     *   2. discovery from the CLI's on-disk transcript (Gemini/Codex, and Claude
+     *      launches that resumed) — accepted only if the transcript was touched
+     *      at/after the pane's startedAt.
+     * Either way the id is refused when another conversation owns it — a LIVE
+     * session or any conversation seen earlier this process lifetime
+     * (`resumeIdOwner`, which survives unregister). Stores on the Session
+     * (`resumeId`) and persists `cli_resume_id` + legacy `claude_resume_id` to the
+     * rails AgentSession metadata ONCE per (agent session, id) pair — that
+     * survives a daemon restart so bridge startup / remote_load_context can
+     * restore it.
      *
-     * Idempotent + throttled by the caller (runs on the live-usage tick and once
-     * shortly after launch). Best-effort — a capture failure leaves prior state
-     * intact and never blocks anything.
+     * Idempotent; runs on the liveness tick and once right after launch.
+     * Best-effort — a capture failure leaves prior state intact and never blocks.
      */
     captureResumeId(conversationId) {
         const session = conversationId
@@ -1580,44 +1764,64 @@ export class BaseTmuxLauncher {
         if (!session)
             return;
         // Locate by the ACTUAL launch cwd (same resolution extractTranscriptUsage uses).
-        let cwd;
-        for (const info of this.tmuxSessions.values()) {
-            if (info.conversationId === conversationId) {
-                cwd = info.cwd;
+        let info;
+        for (const candidate of this.tmuxSessions.values()) {
+            if (candidate.conversationId === conversationId) {
+                info = candidate;
                 break;
             }
         }
-        cwd ||= this.getWorkingDirectory();
+        const cwd = info?.cwd || this.getWorkingDirectory();
+        const minted = info?.mintedSessionId ?? this.mintedResumeIds.get(conversationId);
         let resumeId = null;
-        try {
-            resumeId = this.detectResumeId(cwd);
+        let source;
+        if (minted) {
+            resumeId = minted;
+            source = 'minted';
         }
-        catch (err) {
-            console.warn(`${this.getLogTag()} detectResumeId failed for conv=${conversationId}: ${err}`);
-            return;
+        else {
+            try {
+                resumeId = this.detectResumeId(cwd, info?.startedAt);
+            }
+            catch (err) {
+                console.warn(`${this.getLogTag()} detectResumeId failed for conv=${conversationId}: ${err}`);
+                return;
+            }
+            source = 'discovered';
         }
         if (!resumeId)
             return;
-        // Cross-conversation guard: detectResumeId is cwd-scoped ("most recent
-        // transcript in the launch cwd"), so when two conversations share a cwd it
-        // can return the OTHER conversation's transcript. Never pin a transcript id
-        // that a different live conversation's session already owns — that would
-        // make this conversation resume the other's CLI session (observed 2026-07-18:
-        // conv 2170 stole conv 2158's id, both in the demo-kit cwd, so the 2170
-        // pane ended up polling 2158). Leave this conversation fresh instead.
-        const otherOwner = this.sessionManager.getAll().find((s) => s.resumeId === resumeId && s.conversationId !== conversationId);
-        if (otherOwner) {
-            console.warn(`${this.getLogTag()} Resume id ${resumeId} already owned by conv=${otherOwner.conversationId} — NOT capturing it for conv=${conversationId} (shared cwd). Leaving fresh.`);
+        // Ownership guard. detectResumeId is cwd-scoped ("most recent transcript in
+        // the launch cwd"), so when two conversations share a cwd it can return the
+        // OTHER conversation's transcript. Never pin an id that a different
+        // conversation owns — live (2026-07-18: conv 2170 stole conv 2158's id and
+        // the 2170 pane ended up polling 2158) or previously seen (2026-08-24: once
+        // 3331 stopped, its transcript was captured for 3337, then 3337's for 3369).
+        const priorOwner = this.resumeIdOwner.get(resumeId);
+        if (priorOwner !== undefined && priorOwner !== conversationId) {
+            console.warn(`${this.getLogTag()} Resume id ${resumeId} is owned by conv=${priorOwner} — NOT capturing it for conv=${conversationId} (${source}). Leaving fresh.`);
             return;
         }
-        // No change — already captured this id.
-        if (this.lastSessionId === resumeId && session.resumeId === resumeId)
+        const otherLive = this.sessionManager.getAll().find((s) => s.resumeId === resumeId && s.conversationId !== conversationId);
+        if (otherLive) {
+            console.warn(`${this.getLogTag()} Resume id ${resumeId} already owned by live conv=${otherLive.conversationId} — NOT capturing it for conv=${conversationId} (shared cwd). Leaving fresh.`);
             return;
-        this.lastSessionId = resumeId;
-        this.lastSessionConversationId = conversationId || session.conversationId || null;
-        session.resumeId = resumeId;
-        session.claudeResumeId = resumeId; // keep legacy alias in sync
+        }
+        this.resumeIdOwner.set(resumeId, conversationId);
+        const changed = session.resumeId !== resumeId;
+        if (changed) {
+            healthMonitor.noteResumeCapture();
+            if (session.resumeId) {
+                console.log(`${this.getLogTag()} Resume id for conv=${conversationId}: ${session.resumeId} → ${resumeId} (${source})`);
+            }
+            session.resumeId = resumeId;
+            session.claudeResumeId = resumeId; // keep legacy alias in sync
+        }
         if (this.dsiloedClient && session.agentSessionId) {
+            const key = `${session.agentSessionId}:${resumeId}`;
+            if (this.persistedResumeIds.has(key))
+                return;
+            this.persistedResumeIds.add(key);
             // MERGE — only the resume keys; a full replace would wipe workspace_* and
             // server-set keys. Persist BOTH a generic key and the legacy claude key the
             // bridge startup / remote_load_context already read.
@@ -1625,11 +1829,14 @@ export class BaseTmuxLauncher {
                 cli_resume_id: resumeId,
                 claude_resume_id: resumeId,
             }).then(() => {
-                console.log(`${this.getLogTag()} Captured resume id ${resumeId} for conv=${conversationId} (agent session ${session.agentSessionId})`);
-            }).catch(err => console.error(`${this.getLogTag()} Failed to persist resume id:`, err));
+                console.log(`${this.getLogTag()} Captured resume id ${resumeId} for conv=${conversationId} (agent session ${session.agentSessionId}, ${source})`);
+            }).catch(err => {
+                this.persistedResumeIds.delete(key); // retry on the next tick
+                console.error(`${this.getLogTag()} Failed to persist resume id:`, err);
+            });
         }
-        else {
-            console.log(`${this.getLogTag()} Captured resume id ${resumeId} for conv=${conversationId} (in-memory only)`);
+        else if (changed) {
+            console.log(`${this.getLogTag()} Captured resume id ${resumeId} for conv=${conversationId} (in-memory only, ${source})`);
         }
     }
     // Returns true if usage was found and a report was initiated (used by the
@@ -1663,7 +1870,7 @@ export class BaseTmuxLauncher {
             }
         }
         cwd ||= ledgerEntry?.cwd || this.getWorkingDirectory();
-        const cliSessionId = this.lastSessionId ?? session?.resumeId ?? ledgerEntry?.cliSessionId ?? null;
+        const cliSessionId = session?.resumeId ?? ledgerEntry?.cliSessionId ?? this.restoredResumeIds.get(conversationId) ?? null;
         let extracted;
         try {
             extracted = this.extractTranscriptUsage(cwd, cliSessionId);
@@ -1689,7 +1896,10 @@ export class BaseTmuxLauncher {
         }).then((result) => {
             // 'rejected' means the server can never accept it — settle the entry rather
             // than leave it to be retried on every future startup sweep, forever.
-            if (result !== 'failed' && final)
+            // 'failed' and 'blocked' (terminal 403 — endpoint blocked, no request made)
+            // both keep the entry; 'blocked' is silent here because the tracker
+            // already logged the transition once.
+            if ((result === 'reported' || result === 'rejected') && final)
                 this.usageLedger?.remove(conversationId);
             if (result === 'rejected') {
                 console.warn(`${this.getLogTag()} Usage unreportable for conv=${conversationId} — entry settled (not retryable)`);
@@ -1785,7 +1995,7 @@ export class BaseTmuxLauncher {
             agentSessionId: session.agentSessionId,
             cliType: this.getCliType(),
             cwd: cwd || this.getWorkingDirectory(),
-            cliSessionId: session.resumeId || this.lastSessionId || undefined,
+            cliSessionId: session.resumeId || undefined,
             tmuxSession,
         });
     }
@@ -1888,7 +2098,7 @@ export class BaseTmuxLauncher {
                 // NEW output. A pane frozen past FROZEN_THRESHOLD_MS is wedged and gets
                 // killed despite any spinner animation.
                 const tmuxName = this.tmuxNameForConversation(s.conversationId);
-                if (tmuxName && this.shouldSuppressIdleKill(tmuxName, now - s.lastActivity.getTime())) {
+                if (tmuxName && this.shouldSuppressIdleKill(tmuxName, now - s.lastActivity.getTime(), s)) {
                     console.log(`${this.getLogTag()} conv ${s.conversationId} past idle-kill threshold but pane shows active work — suppressing idle-kill`);
                     continue;
                 }
@@ -2103,6 +2313,11 @@ export class BaseTmuxLauncher {
             const idleMs = now - s.lastActivity.getTime();
             if (idleMs < BaseTmuxLauncher.WEDGED_SESSION_MS)
                 continue;
+            // An empty remote_poll does NOT advance lastActivity, so a healthy idle
+            // poller looks MCP-silent here. Its poll loop is the liveness proof —
+            // never a wedge, regardless of what its pane hash does.
+            if (isInPollLoop(s, now))
+                continue;
             const tmuxName = this.tmuxNameForConversation(s.conversationId);
             if (!tmuxName)
                 continue; // no pane — the dead-pane reconcile owns it
@@ -2115,6 +2330,36 @@ export class BaseTmuxLauncher {
             this.killByConversation(s.conversationId, `wedged-session:${idleMin}min`);
         }
     }
+    /**
+     * Wedge verdict for one conversation, from the SAME primitives
+     * reapWedgedSessions uses: pane present + capturable, not actively thinking,
+     * and substantive content frozen for at least FROZEN_THRESHOLD_MS. Used by the
+     * stale-on-inbound recycler (2026-08-23: it recycled on MCP silence alone and
+     * killed live panes mid-work — conv 3337 six times in one evening).
+     */
+    isSessionWedged(conversationId) {
+        const paneName = this.tmuxNameForConversation(conversationId);
+        if (!paneName)
+            return { wedged: false, reason: 'no-pane', paneName: null };
+        if (this.capturePaneTailForProgress(paneName) === null) {
+            return { wedged: false, reason: 'pane-gone', paneName };
+        }
+        // In its poll loop ⇒ alive AND idle. Reported as 'polling' rather than
+        // 'pane-active' so idle-completion acts on it (a parked worker) while the
+        // recycler still leaves it alone (not wedged).
+        const session = this.sessionManager.getByConversationId(conversationId);
+        if (session && isInPollLoop(session))
+            return { wedged: false, reason: 'polling', paneName };
+        if (this.isActivelyThinking(paneName))
+            return { wedged: false, reason: 'pane-active', paneName };
+        const prog = this.paneProgress.get(paneName);
+        const frozenMs = prog ? Date.now() - prog.lastChangeAt : 0;
+        const frozenMin = Math.round(frozenMs / 60000);
+        if (frozenMs < BaseTmuxLauncher.FROZEN_THRESHOLD_MS) {
+            return { wedged: false, reason: `frozen-${frozenMin}min<threshold`, paneName };
+        }
+        return { wedged: true, reason: `frozen-${frozenMin}min`, paneName };
+    }
     isActivelyThinking(tmuxSession) {
         const now = Date.now();
         const prev = this.paneProgress.get(tmuxSession);