@threadbase-sh/streamer 1.41.1 → 1.42.0

package/dist/index.js

@@ -1148,7 +1148,10 @@ var CodexPtyRunner = class {
     const projectName = options.projectName ?? basename(options.projectPath);
     const proc = nodePty.spawn(
       resolveCodexExe(),
-      ["resume", sessionId, "--cd", options.projectPath, "--no-alt-screen"],
+      // `sessionId` stays the runner's map key — only argv carries the
+      // provider-side id, so a resumed Codex session keeps the placeholder id
+      // its client already navigated to.
+      ["resume", options.resumeId ?? sessionId, "--cd", options.projectPath, "--no-alt-screen"],
       {
         name: "xterm-256color",
         cols: PTY_COLS,
@@ -3073,7 +3076,7 @@ import {
   existsSync as existsSync11,
   watch as fsWatch,
   readdirSync as readdirSync6,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   statSync as statSync9
 } from "fs";
 import { realpath as realpath2 } from "fs/promises";
@@ -4101,6 +4104,86 @@ function redactValue(value) {
   return value;
 }
 
+// src/services/sessions/resumeIdentity.ts
+function resumeIdForRow(row) {
+  if (row.provider !== CODEX_CLI_PROVIDER) return row.session_id;
+  return row.bound_conversation_id;
+}
+
+// src/services/sessions/rehydrateSessions.ts
+var REHYDRATE_MAX = 25;
+var REHYDRATE_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
+var AGENT_EXIT_SOURCES = /* @__PURE__ */ new Set(["exit", "process-exit"]);
+function rehydrateSkipReason(row, opts) {
+  if (resumeIdForRow(row) == null) return "codex_unbound";
+  if (!opts.projectExists(row.project_path)) return "project_missing";
+  if (opts.now - row.status_updated_at > REHYDRATE_WINDOW_MS) return "too_old";
+  if (AGENT_EXIT_SOURCES.has(row.status_source) && row.failure_reason == null) {
+    return "agent_exited";
+  }
+  return null;
+}
+function rowToStubSession(row) {
+  return {
+    id: row.session_id,
+    provider: row.provider,
+    projectPath: row.project_path,
+    projectName: row.project_name,
+    branch: row.branch,
+    // No PTY exists for a stub, so this is the only truthful status.
+    status: "idle",
+    startedAt: new Date(row.started_at),
+    completedAt: row.completed_at != null ? new Date(row.completed_at) : null,
+    promptCount: row.prompt_count,
+    lastOutput: "",
+    rehydrated: true,
+    ...row.session_name != null && { sessionName: row.session_name },
+    ...row.project_id != null && { projectId: row.project_id },
+    ...row.bound_conversation_id != null && { boundConversationId: row.bound_conversation_id },
+    ...row.resumed_from_conversation_id != null && {
+      resumedFromConversationId: row.resumed_from_conversation_id
+    },
+    ...row.failure_reason != null && { failureReason: row.failure_reason },
+    ...row.last_activity_at != null && { lastActivityAt: new Date(row.last_activity_at) },
+    // Only `shutdown` crosses over. It is the one registry source that is also a
+    // wire StatusSource *and* that genuinely describes the `idle` above — the
+    // streamer stopped this session. A crashed row still says `transition` over
+    // a `running` status, and copying that here would attach observed-confidence
+    // provenance to a status we derived at boot, so leave it unset instead.
+    ...row.status_source === "shutdown" && {
+      statusSource: "shutdown",
+      statusUpdatedAt: new Date(row.status_updated_at),
+      // `status` above had to flatten to `idle`, which erases whether the agent
+      // was mid-answer when we stopped it. Carried separately so a client can
+      // say "interrupted mid-response" without a novel SessionStatus value.
+      // Gated on the same `shutdown` source: a crashed row's `running` is a
+      // frozen value nobody confirmed, not an observation.
+      ...(row.status === "running" || row.status === "waiting_input") && {
+        interruptedStatus: row.status
+      }
+    }
+  };
+}
+
+// src/utils/bootToken.ts
+import { readFileSync as readFileSync5 } from "fs";
+import os from "os";
+var cached2;
+function currentBootToken() {
+  if (cached2 === void 0) cached2 = computeBootToken();
+  return cached2;
+}
+function computeBootToken() {
+  if (process.platform === "linux") {
+    try {
+      const bootId = readFileSync5("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      if (bootId) return bootId;
+    } catch {
+    }
+  }
+  return String(Math.round((Date.now() - os.uptime() * 1e3) / 1e4));
+}
+
 // src/api/routes/diagnostics.routes.ts
 function providerCheck(name, resolve2) {
   try {
@@ -4180,6 +4263,49 @@ var createDiagnosticsRoutes = (deps) => {
     );
     return c.json(redactValue(buildReport(checks)));
   });
+  app.get("/sessions", (c) => {
+    const repo = deps.managedSessionsRepo();
+    if (!repo) {
+      return c.json(
+        { error: "Session registry is unavailable", code: "REGISTRY_UNAVAILABLE" },
+        503
+      );
+    }
+    const rows = repo.listAll();
+    const verdicts = deps.sessionVerdicts();
+    const bootToken = currentBootToken();
+    const now = Date.now();
+    const sessions = rows.map((row) => {
+      const verdict = verdicts.get(row.session_id);
+      const skip = rehydrateSkipReason(row, { now, projectExists: existsSync5 });
+      return {
+        sessionId: row.session_id,
+        provider: row.provider,
+        status: row.status,
+        statusSource: row.status_source,
+        statusUpdatedAt: new Date(row.status_updated_at).toISOString(),
+        // Whether the recorded pid is probeable at all this boot, not whether
+        // it is alive — a mismatch means the question was never asked.
+        //
+        // NOT named for the boot token it derives from: `redactValue`'s
+        // SECRET_KEY_RE matches any key containing "token", so `bootTokenMatches`
+        // was scrubbed to the string "[redacted]" and the field shipped useless.
+        // The regex is deliberately over-broad for a payload meant to be pasted
+        // into bug reports, so the field moved rather than the guard.
+        recordedThisBoot: row.boot_token != null && row.boot_token === bootToken,
+        // Absent when this boot never classified the row: a clean restart
+        // stamps completed_at on the way out, which takes it out of the probe
+        // set entirely. That absence is itself the answer.
+        lifecycle: verdict?.lifecycle ?? null,
+        lifecycleReason: verdict?.reason ?? null,
+        rehydrated: skip == null,
+        rehydrateSkipReason: skip,
+        projectExists: existsSync5(row.project_path),
+        projectPath: redactPath(row.project_path)
+      };
+    });
+    return c.json(redactValue({ generatedAt: (/* @__PURE__ */ new Date()).toISOString(), sessions }));
+  });
   return app;
 };
 
@@ -4330,7 +4456,7 @@ import { Hono as Hono11 } from "hono";
 import { hostname as hostname2 } from "os";
 
 // src/config/update-config.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join10 } from "path";
 import { parse as parseYaml } from "yaml";
@@ -4353,7 +4479,7 @@ function loadUpdateConfig(opts = {}) {
   const path = opts.path ?? DEFAULT_CONFIG_PATH;
   let raw;
   try {
-    raw = readFileSync5(path, "utf-8");
+    raw = readFileSync6(path, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -5185,7 +5311,7 @@ import { dirname as dirname7 } from "path";
 import { setImmediate as yieldToEventLoop } from "timers/promises";
 
 // src/db/sqlite-migrate.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync7 } from "fs";
 import { dirname as dirname6, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getMigrationsDir2() {
@@ -5217,7 +5343,7 @@ function runSqliteMigrations(db, migrationsDir) {
       skipped.push(file);
       continue;
     }
-    const sql = readFileSync6(join12(dir, file), "utf-8");
+    const sql = readFileSync7(join12(dir, file), "utf-8");
     const tx = db.transaction(() => {
       db.exec(sql);
       recordApplied.run(file, (/* @__PURE__ */ new Date()).toISOString());
@@ -5247,8 +5373,8 @@ function isAgentLine(line, entrypoints = DEFAULT_AGENT_ENTRYPOINTS) {
 function isAgentFile(filePath, entrypoints = DEFAULT_AGENT_ENTRYPOINTS) {
   if (entrypoints.size === 0) return false;
   const key = cacheKey(filePath, entrypoints);
-  const cached2 = fileDecisionCache.get(key);
-  if (cached2 !== void 0) return cached2;
+  const cached3 = fileDecisionCache.get(key);
+  if (cached3 !== void 0) return cached3;
   let fd;
   try {
     fd = openSync2(filePath, "r");
@@ -5904,9 +6030,9 @@ var ConversationCache = class _ConversationCache {
   classifyAgentFile(filePath, mtimeMs, fileSize) {
     if (this.agentEntrypoints.size === 0) return false;
     const entrypointsKey = this.agentEntrypointsKey();
-    const cached2 = this.stmts.getFileMetadata.get(filePath);
-    if (cached2 && cached2.mtime_ms === mtimeMs && cached2.file_size === fileSize && cached2.agent_entrypoints_key === entrypointsKey) {
-      return cached2.is_agent === 1;
+    const cached3 = this.stmts.getFileMetadata.get(filePath);
+    if (cached3 && cached3.mtime_ms === mtimeMs && cached3.file_size === fileSize && cached3.agent_entrypoints_key === entrypointsKey) {
+      return cached3.is_agent === 1;
     }
     const isAgent = isAgentFile(filePath, this.agentEntrypoints);
     this.stmts.upsertFileMetadata.run({
@@ -6611,11 +6737,17 @@ var ConversationsRepository = class {
 };
 
 // src/db/repositories/managed-sessions.repository.ts
+var PROBE_SET_MAX = 200;
+var DIAGNOSTICS_MAX = 200;
+var TERMINAL_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
 var ManagedSessionsRepository = class {
   upsertStmt;
   updateStatusStmt;
+  bindStmt;
   getStmt;
   listNonTerminalStmt;
+  listAllStmt;
+  pruneTerminalStmt;
   listRecoverableStmt;
   deleteStmt;
   constructor(db) {
@@ -6625,13 +6757,13 @@ var ManagedSessionsRepository = class {
         status, status_source, status_updated_at, started_at, completed_at,
         last_activity_at, prompt_count, session_name, project_id,
         bound_conversation_id, resumed_from_conversation_id, failure_reason,
-        streamer_instance_id
+        streamer_instance_id, boot_token
       ) VALUES (
         @session_id, @provider, @pid, @cmdline, @project_path, @project_name, @branch,
         @status, @status_source, @status_updated_at, @started_at, @completed_at,
         @last_activity_at, @prompt_count, @session_name, @project_id,
         @bound_conversation_id, @resumed_from_conversation_id, @failure_reason,
-        @streamer_instance_id
+        @streamer_instance_id, @boot_token
       )
       ON CONFLICT(session_id) DO UPDATE SET
         pid = excluded.pid,
@@ -6650,7 +6782,8 @@ var ManagedSessionsRepository = class {
         bound_conversation_id = excluded.bound_conversation_id,
         resumed_from_conversation_id = excluded.resumed_from_conversation_id,
         failure_reason = excluded.failure_reason,
-        streamer_instance_id = excluded.streamer_instance_id
+        streamer_instance_id = excluded.streamer_instance_id,
+        boot_token = excluded.boot_token
     `);
     this.updateStatusStmt = db.prepare(`
       UPDATE managed_sessions
@@ -6664,11 +6797,27 @@ var ManagedSessionsRepository = class {
              session_name = COALESCE(@session_name, session_name)
        WHERE session_id = @session_id
     `);
+    this.bindStmt = db.prepare(`
+      UPDATE managed_sessions
+         SET bound_conversation_id = @bound_conversation_id
+       WHERE session_id = @session_id
+    `);
     this.getStmt = db.prepare("SELECT * FROM managed_sessions WHERE session_id = ?");
     this.listNonTerminalStmt = db.prepare(`
       SELECT * FROM managed_sessions
        WHERE completed_at IS NULL
        ORDER BY started_at ASC
+       LIMIT @limit
+    `);
+    this.listAllStmt = db.prepare(`
+      SELECT * FROM managed_sessions
+       ORDER BY status_updated_at DESC
+       LIMIT @limit
+    `);
+    this.pruneTerminalStmt = db.prepare(`
+      DELETE FROM managed_sessions
+       WHERE completed_at IS NOT NULL
+         AND completed_at < @before
     `);
     this.listRecoverableStmt = db.prepare(`
       SELECT * FROM managed_sessions
@@ -6701,7 +6850,10 @@ var ManagedSessionsRepository = class {
       bound_conversation_id: session.boundConversationId ?? null,
       resumed_from_conversation_id: session.resumedFromConversationId ?? null,
       failure_reason: session.failureReason ?? null,
-      streamer_instance_id: streamerInstanceId
+      streamer_instance_id: streamerInstanceId,
+      // Recorded, never backfilled: the pid above is only probeable while this
+      // token still matches the running machine.
+      boot_token: currentBootToken()
     });
   }
   /**
@@ -6722,12 +6874,48 @@ var ManagedSessionsRepository = class {
       session_name: fields.sessionName ?? null
     });
   }
+  /**
+   * Persist the Codex rollout id discovered after spawn.
+   *
+   * Its own statement rather than a `recordSpawn` re-run: the binding arrives
+   * while the session is live, and re-upserting would also rewrite `cmdline`
+   * with an id that is *not* in a fresh Codex process's argv, turning the
+   * reconciler's identity check into a false `orphaned`. Without this write the
+   * binding lives only in memory and dies with the streamer — which is the
+   * whole reason a restarted Codex session could not be resumed (G6).
+   */
+  recordBinding(sessionId, boundConversationId) {
+    this.bindStmt.run({
+      session_id: sessionId,
+      bound_conversation_id: boundConversationId
+    });
+  }
   get(sessionId) {
     return this.getStmt.get(sessionId) ?? null;
   }
-  /** Rows with no recorded completion — the reconciler's probe set. */
-  listNonTerminal() {
-    return this.listNonTerminalStmt.all();
+  /**
+   * Rows with no recorded completion — the reconciler's probe set.
+   *
+   * Capped. Callers must compare the result length against the limit and say so
+   * when it clips: a silently truncated probe set reads as "we checked
+   * everything" when it did not.
+   */
+  listNonTerminal(limit = PROBE_SET_MAX) {
+    return this.listNonTerminalStmt.all({ limit });
+  }
+  /** Every row, most recently touched first, for the diagnostics surface. */
+  listAll(limit = DIAGNOSTICS_MAX) {
+    return this.listAllStmt.all({ limit });
+  }
+  /**
+   * Delete terminal rows older than `olderThanMs`, returning how many went.
+   *
+   * Only rows carrying a `completed_at` are eligible, so nothing the reconciler
+   * or rehydrator might still want is reachable from here — a row without one
+   * is by definition unfinished business, however old it looks.
+   */
+  pruneTerminal(olderThanMs = TERMINAL_RETENTION_MS) {
+    return this.pruneTerminalStmt.run({ before: Date.now() - olderThanMs }).changes;
   }
   /**
    * Rows a restart could bring back: still open, or closed by our own shutdown,
@@ -7074,7 +7262,7 @@ import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync9 } from "fs";
 
 // src/services/cache-integrity/alertStore.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir7 } from "os";
 import { dirname as dirname8, join as join14 } from "path";
 function alertStatePath() {
@@ -7083,7 +7271,7 @@ function alertStatePath() {
 }
 function loadAlertState() {
   try {
-    const parsed = JSON.parse(readFileSync7(alertStatePath(), "utf-8"));
+    const parsed = JSON.parse(readFileSync8(alertStatePath(), "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
@@ -8696,8 +8884,14 @@ function readIdempotencyKey(body) {
 }
 
 // src/services/sessions/reconcileSessions.ts
-async function classifySession(row, probe, currentInstanceId) {
+var PRE_BOOT_REASON = "recorded before this machine boot";
+async function classifySession(row, probe, currentInstanceId, currentBootToken2 = null) {
   const { session_id: sessionId } = row;
+  const resumable = (reason) => resumeIdForRow(row) == null ? {
+    sessionId,
+    lifecycle: "failed",
+    reason: "Codex session ended before its rollout id was known"
+  } : { sessionId, lifecycle: "resumable", reason };
   if (row.completed_at != null) {
     const clean = probe.endedCleanly?.(row) ?? row.failure_reason == null;
     return {
@@ -8707,18 +8901,19 @@ async function classifySession(row, probe, currentInstanceId) {
     };
   }
   if (row.pid == null) {
-    return { sessionId, lifecycle: "resumable", reason: "no pid recorded" };
+    return resumable("no pid recorded");
+  }
+  if (currentBootToken2 != null && row.boot_token !== currentBootToken2) {
+    return resumable(PRE_BOOT_REASON);
   }
   if (!probe.isPidAlive(row.pid)) {
-    const clean = probe.endedCleanly?.(row) ?? false;
-    if (clean) {
+    if (probe.endedCleanly?.(row)) {
       return { sessionId, lifecycle: "completed", reason: "process gone, history ended cleanly" };
     }
-    return {
-      sessionId,
-      lifecycle: "resumable",
-      reason: "process gone, resumable from provider history"
-    };
+    if (row.failure_reason != null) {
+      return { sessionId, lifecycle: "failed", reason: "process gone, failure recorded" };
+    }
+    return resumable("process gone, resumable from provider history");
   }
   const args = await probe.getProcessArgs(row.pid);
   const token = row.cmdline;
@@ -8736,52 +8931,10 @@ async function classifySession(row, probe, currentInstanceId) {
     reason: sameRun ? "owned by this run" : "survived a previous streamer run"
   };
 }
-async function reconcileSessions(rows, probe, currentInstanceId) {
-  return Promise.all(rows.map((row) => classifySession(row, probe, currentInstanceId)));
-}
-
-// src/services/sessions/rehydrateSessions.ts
-var REHYDRATE_MAX = 25;
-var REHYDRATE_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
-var AGENT_EXIT_SOURCES = /* @__PURE__ */ new Set(["exit", "process-exit"]);
-function shouldRehydrate(row, opts) {
-  if (!opts.projectExists(row.project_path)) return false;
-  if (opts.now - row.status_updated_at > REHYDRATE_WINDOW_MS) return false;
-  if (AGENT_EXIT_SOURCES.has(row.status_source) && row.failure_reason == null) return false;
-  return true;
-}
-function rowToStubSession(row) {
-  return {
-    id: row.session_id,
-    provider: row.provider,
-    projectPath: row.project_path,
-    projectName: row.project_name,
-    branch: row.branch,
-    // No PTY exists for a stub, so this is the only truthful status.
-    status: "idle",
-    startedAt: new Date(row.started_at),
-    completedAt: row.completed_at != null ? new Date(row.completed_at) : null,
-    promptCount: row.prompt_count,
-    lastOutput: "",
-    rehydrated: true,
-    ...row.session_name != null && { sessionName: row.session_name },
-    ...row.project_id != null && { projectId: row.project_id },
-    ...row.bound_conversation_id != null && { boundConversationId: row.bound_conversation_id },
-    ...row.resumed_from_conversation_id != null && {
-      resumedFromConversationId: row.resumed_from_conversation_id
-    },
-    ...row.failure_reason != null && { failureReason: row.failure_reason },
-    ...row.last_activity_at != null && { lastActivityAt: new Date(row.last_activity_at) },
-    // Only `shutdown` crosses over. It is the one registry source that is also a
-    // wire StatusSource *and* that genuinely describes the `idle` above — the
-    // streamer stopped this session. A crashed row still says `transition` over
-    // a `running` status, and copying that here would attach observed-confidence
-    // provenance to a status we derived at boot, so leave it unset instead.
-    ...row.status_source === "shutdown" && {
-      statusSource: "shutdown",
-      statusUpdatedAt: new Date(row.status_updated_at)
-    }
-  };
+async function reconcileSessions(rows, probe, currentInstanceId, currentBootToken2 = null) {
+  return Promise.all(
+    rows.map((row) => classifySession(row, probe, currentInstanceId, currentBootToken2))
+  );
 }
 
 // src/types.ts
@@ -8972,7 +9125,8 @@ function managedToResponse(s, ptyAttached) {
     ...s.resumedFromConversationId != null && {
       resumedFromConversationId: s.resumedFromConversationId
     },
-    ...s.boundConversationId != null && { boundConversationId: s.boundConversationId }
+    ...s.boundConversationId != null && { boundConversationId: s.boundConversationId },
+    ...s.interruptedStatus != null && { interruptedStatus: s.interruptedStatus }
   };
 }
 function discoveredToResponse(d, conversationId) {
@@ -9517,7 +9671,7 @@ var StreamerServer = class {
   idempotency = new IdempotencyStore();
   // sessionId → lifecycle verdict from boot reconciliation. Only holds sessions
   // this run did NOT spawn; live ones derive their lifecycle from ptyAttached.
-  sessionLifecycles = /* @__PURE__ */ new Map();
+  sessionVerdicts = /* @__PURE__ */ new Map();
   // Periodic sweep that releases PTYs no agent is using. Null until listen().
   idleReaperTimer = null;
   // Map of clientId → WS socket (populated by the "register" WS handshake)
@@ -9776,7 +9930,14 @@ var StreamerServer = class {
         this.sessionStore.updateManaged(session.id, {
           status: session.status,
           completedAt: session.completedAt,
-          ...session.lastActivityAt != null && { lastActivityAt: session.lastActivityAt }
+          ...session.lastActivityAt != null && { lastActivityAt: session.lastActivityAt },
+          // The runner derives this from the first user message, on its own
+          // copy of the session. Without mirroring it here SessionStore never
+          // learns it, so a fresh live session is served with no sessionName
+          // even though the registry has one — the name only appeared after a
+          // restart rebuilt the row as a stub. Guarded so a runner that has not
+          // derived one yet cannot blank a name set by enrichResumedSessionAsync.
+          ...session.sessionName != null && { sessionName: session.sessionName }
         });
         this.managedSessionsRepo?.recordStatus(
           session.id,
@@ -9883,6 +10044,8 @@ var StreamerServer = class {
       sessionsRepo: () => this.sessionsRepo,
       cacheMetadataRepo: () => this.cacheMetadataRepo,
       runtimeStore: () => this.runtimeStore,
+      managedSessionsRepo: () => this.managedSessionsRepo,
+      sessionVerdicts: () => this.sessionVerdicts,
       ptyAttachedIds: () => this.ptyAttachedIds(),
       handleListSessions: (url, res) => this.handleListSessions(url, res),
       handleSessionsCount: (res) => this.handleSessionsCount(res),
@@ -10080,12 +10243,12 @@ var StreamerServer = class {
    * it.
    */
   withReconciledLifecycle(sessions) {
-    if (this.sessionLifecycles.size === 0) return sessions;
+    if (this.sessionVerdicts.size === 0) return sessions;
     return sessions.map((s) => {
       if (s.ptyAttached) return s;
-      const verdict = this.sessionLifecycles.get(s.id);
+      const verdict = this.sessionVerdicts.get(s.id);
       if (!verdict) return s;
-      return { ...s, lifecycle: verdict, lifecycleSource: "reconcile" };
+      return { ...s, lifecycle: verdict.lifecycle, lifecycleSource: "reconcile" };
     });
   }
   addSessionSubscriber(sessionId, ws) {
@@ -10153,14 +10316,30 @@ var StreamerServer = class {
     let verdicts = [];
     try {
       const rows = this.managedSessionsRepo.listNonTerminal();
+      if (rows.length === PROBE_SET_MAX) {
+        this.log.warn(
+          `[reconcile] probe set hit its cap of ${PROBE_SET_MAX} \u2014 older rows skipped`,
+          {
+            event: "registry.probe_truncated",
+            limit: PROBE_SET_MAX
+          }
+        );
+      }
       if (rows.length === 0) return [];
       verdicts = await reconcileSessions(
         rows,
         { isPidAlive, getProcessArgs },
-        this.streamerInstanceId
+        this.streamerInstanceId,
+        currentBootToken()
       );
       for (const v of verdicts) {
-        this.sessionLifecycles.set(v.sessionId, v.lifecycle);
+        this.sessionVerdicts.set(v.sessionId, v);
+        if (v.reason === PRE_BOOT_REASON) {
+          this.log.info(`[reconcile] ${v.sessionId} predates this machine boot \u2014 pid not probed`, {
+            event: "sessions.boot_token_mismatch",
+            sessionId: v.sessionId
+          });
+        }
         if (v.lifecycle === "completed" || v.lifecycle === "failed") {
           this.managedSessionsRepo.recordStatus(v.sessionId, "idle", "reconcile", {
             completedAt: /* @__PURE__ */ new Date()
@@ -10182,6 +10361,30 @@ var StreamerServer = class {
     }
     return verdicts;
   }
+  /**
+   * Drop finished sessions the registry has held long enough (plan Phase 4).
+   *
+   * The registry is authoritative and never rebuilt from the cache, so nothing
+   * else would ever remove a row: without this it grows for the life of the
+   * install, and every boot pays for rows about sessions from months ago.
+   */
+  pruneTerminalSessions() {
+    if (!this.managedSessionsRepo) return;
+    try {
+      const pruned = this.managedSessionsRepo.pruneTerminal();
+      if (pruned > 0) {
+        this.log.info(`[registry] pruned ${pruned} terminal session row(s)`, {
+          event: "registry.pruned",
+          pruned
+        });
+      }
+    } catch (err) {
+      this.log.warn("[registry] failed to prune terminal sessions", {
+        event: "registry.prune_failed",
+        err
+      });
+    }
+  }
   /**
    * Seed the session list with what previous runs left behind (persistence plan
    * Phase 1, gaps G1/G2/G8).
@@ -10208,15 +10411,29 @@ var StreamerServer = class {
       const truncated = rows.length > REHYDRATE_MAX;
       const candidates = truncated ? rows.slice(0, REHYDRATE_MAX) : rows;
       if (candidates.length === 0) return;
-      const lifecycleByVerdict = new Map(verdicts.map((v) => [v.sessionId, v.lifecycle]));
+      const verdictById = new Map(verdicts.map((v) => [v.sessionId, v]));
       let rehydrated = 0;
+      const skippedBy = {};
       for (const row of candidates) {
         if (this.sessionStore.getManaged(row.session_id)) continue;
-        if (!shouldRehydrate(row, { now, projectExists: existsSync11 })) continue;
+        const skip = rehydrateSkipReason(row, { now, projectExists: existsSync11 });
+        if (skip) {
+          skippedBy[skip] = (skippedBy[skip] ?? 0) + 1;
+          this.log.info(`[rehydrate] skipped ${row.session_id}: ${skip}`, {
+            event: "sessions.rehydrate_skipped",
+            sessionId: row.session_id,
+            reason: skip
+          });
+          continue;
+        }
         this.sessionStore.addManaged(rowToStubSession(row));
-        this.sessionLifecycles.set(
+        this.sessionVerdicts.set(
           row.session_id,
-          lifecycleByVerdict.get(row.session_id) ?? "resumable"
+          verdictById.get(row.session_id) ?? {
+            sessionId: row.session_id,
+            lifecycle: "resumable",
+            reason: "recovered from the registry at boot"
+          }
         );
         if (row.completed_at != null) this.selfPtyEndedAt.set(row.session_id, row.completed_at);
         rehydrated++;
@@ -10225,6 +10442,7 @@ var StreamerServer = class {
         event: "sessions.rehydrated",
         rehydrated,
         skipped: candidates.length - rehydrated,
+        skippedBy,
         truncated
       });
     } catch (err) {
@@ -10316,7 +10534,7 @@ var StreamerServer = class {
     const now = /* @__PURE__ */ new Date();
     for (const session of this.ptyManager.listSessions()) {
       try {
-        this.managedSessionsRepo.recordStatus(session.id, "idle", "shutdown", {
+        this.managedSessionsRepo.recordStatus(session.id, session.status, "shutdown", {
           completedAt: now,
           lastActivityAt: session.lastActivityAt ?? null,
           promptCount: session.promptCount
@@ -10554,7 +10772,10 @@ var StreamerServer = class {
           );
           this.scannerPersistenceDisabled = true;
         }
-        void this.reconcilePreviousSessions().then((v) => this.rehydratePreviousSessions(v));
+        void this.reconcilePreviousSessions().then((v) => {
+          this.rehydratePreviousSessions(v);
+          this.pruneTerminalSessions();
+        });
         if (this.skipStartupWarmup) {
           this.log.debug?.("startup warm-up scan skipped (skipStartupWarmup)", {
             event: "cache.warmup_skipped"
@@ -12122,32 +12343,85 @@ var StreamerServer = class {
       json(res, 400, { error: "Missing sessionId" });
       return;
     }
+    const outcome = await this.resumeSession({
+      sessionId,
+      force: body.force === true,
+      projectName: body.projectName,
+      branch: body.branch
+    });
+    if (!outcome.ok) {
+      switch (outcome.reason) {
+        case "history_file_missing":
+          json(res, 404, {
+            error: "Conversation history file is missing; it can no longer be resumed",
+            code: "history_file_missing"
+          });
+          return;
+        case "no_project_path":
+          json(res, 400, { error: "Could not determine project path" });
+          return;
+        case "conversation_busy":
+          json(res, 409, {
+            error: "This conversation looks active in another session",
+            code: "CONVERSATION_BUSY",
+            detectedBy: outcome.detectedBy,
+            lastActivityMs: outcome.lastActivityMs,
+            likelyOwner: outcome.likelyOwner
+          });
+          return;
+      }
+    }
+    if (outcome.alreadyRunning) {
+      json(res, 200, outcome.response);
+      return;
+    }
+    this.broadcastOrUnicastSessionList(req);
+    json(res, 201, outcome.response ?? outcome.session);
+  }
+  /**
+   * Resume a session, from an HTTP request or from the boot path.
+   *
+   * Extracted from `handleResume` so both callers hit the **same collision
+   * probe** (plan Phase 7c). The probe is what stops this streamer attaching to
+   * a conversation an external terminal already owns; a second, hand-adapted
+   * copy of this sequence in the boot path is how two agents end up appending
+   * to one JSONL at 4am with nobody watching.
+   *
+   * Returns a typed reason rather than writing a response, so the HTTP caller
+   * maps it to a status code and the boot caller logs it.
+   */
+  async resumeSession(opts) {
+    const { sessionId } = opts;
     if (this.ptyManager.hasSession(sessionId)) {
-      const resp2 = this.sessionStore.get(sessionId, this.ptyAttachedIds());
-      if (resp2) {
-        json(res, 200, resp2);
-        return;
+      const resp = this.sessionStore.get(sessionId, this.ptyAttachedIds());
+      if (resp) {
+        return { ok: true, alreadyRunning: true, session: null, response: resp };
+      }
+    }
+    let jsonlPath = this.findJsonlPath(sessionId);
+    let conv = await this.findConversationByUuid(sessionId);
+    let historyId = sessionId;
+    let registryProvider;
+    if (!jsonlPath && !conv) {
+      const row = this.managedSessionsRepo?.get(sessionId) ?? null;
+      const boundId = row ? resumeIdForRow(row) : null;
+      if (boundId != null && boundId !== sessionId) {
+        historyId = boundId;
+        registryProvider = row?.provider;
+        jsonlPath = this.findJsonlPath(boundId);
+        conv = await this.findConversationByUuid(boundId);
       }
     }
-    const jsonlPath = this.findJsonlPath(sessionId);
     const jsonlCwd = jsonlPath ? await this.readCwdFromJsonl(jsonlPath) : null;
-    const conv = await this.findConversationByUuid(sessionId);
     const projectPath = jsonlCwd ?? conv?.projectPath;
     if (!projectPath) {
-      if (!conv && !jsonlPath) {
-        json(res, 404, {
-          error: "Conversation history file is missing; it can no longer be resumed",
-          code: "history_file_missing"
-        });
-        return;
-      }
-      json(res, 400, { error: "Could not determine project path" });
-      return;
+      if (!conv && !jsonlPath) return { ok: false, reason: "history_file_missing" };
+      return { ok: false, reason: "no_project_path" };
     }
     let discovered = [];
-    const cached2 = this.discoveryCache;
-    if (cached2 && Date.now() - cached2.fetchedAt < DISCOVERY_TTL_MS) {
-      discovered = cached2.entries;
+    const cached3 = this.discoveryCache;
+    if (cached3 && Date.now() - cached3.fetchedAt < DISCOVERY_TTL_MS) {
+      discovered = cached3.entries;
     } else {
       try {
         discovered = await Promise.race([
@@ -12163,45 +12437,50 @@ var StreamerServer = class {
       }
     }
     const busy = conversationBusy({
-      conversationId: sessionId,
+      // The id another owner's argv would actually carry — for a placeholder
+      // that is the bound rollout id, not the one the client asked for.
+      conversationId: historyId,
       projectPath,
       jsonlPath,
       discovered,
       windowMs: resolveResumeBusyWindowMs(),
       selfPtyEndedAt: this.selfPtyEndedAt.get(sessionId) ?? null
     });
-    if (busy.busy && body.force !== true) {
-      json(res, 409, {
-        error: "This conversation looks active in another session",
-        code: "CONVERSATION_BUSY",
+    if (busy.busy && opts.force !== true) {
+      return {
+        ok: false,
+        reason: "conversation_busy",
         detectedBy: busy.detectedBy,
         lastActivityMs: busy.lastActivityMs,
         likelyOwner: busy.likelyOwner
-      });
-      return;
+      };
     }
     if (busy.busy) {
       this.contendedSessions.add(sessionId);
     }
-    const cachedConvMeta = this.cache?.getMetaById(sessionId);
-    const provider = coerceProviderForRunner(conv?.provider ?? cachedConvMeta?.provider);
+    const cachedConvMeta = this.cache?.getMetaById(historyId);
+    const provider = coerceProviderForRunner(
+      conv?.provider ?? cachedConvMeta?.provider ?? registryProvider
+    );
     this.discoveryCache = null;
     const session = await this.ptyManager.start(sessionId, {
       provider,
       projectPath,
-      projectName: body.projectName,
-      branch: body.branch,
+      projectName: opts.projectName,
+      branch: opts.branch,
+      // Omitted on every ordinary resume, so argv is unchanged there.
+      ...historyId !== sessionId && { resumeId: historyId },
       claudeFlags: this.claudeFlags,
       claudeExtraArgs: this.claudeExtraArgs,
       ...this.spawnFlagOverrides()
     });
+    if (historyId !== sessionId) session.boundConversationId = historyId;
     this.sessionStore.addManaged(session);
     this.recordSessionSpawn(session);
-    void this.watchConversationFile(sessionId);
-    const resp = this.sessionStore.get(session.id, this.ptyAttachedIds());
-    this.broadcastOrUnicastSessionList(req);
-    json(res, 201, resp ?? session);
+    void this.watchConversationFile(sessionId, historyId);
+    const response = this.sessionStore.get(session.id, this.ptyAttachedIds());
     this.enrichResumedSessionAsync(sessionId, projectPath, conv);
+    return { ok: true, alreadyRunning: false, session, response };
   }
   enrichResumedSessionAsync(sessionId, projectPath, conv) {
     try {
@@ -12214,18 +12493,18 @@ var StreamerServer = class {
         session.filePath = conv.filePath ?? void 0;
       }
       if (!this.cache || !this.projectsRepo || !this.conversationsRepo) return;
-      const cached2 = this.cache.getMetaById(sessionId);
-      if (cached2) {
-        session.model = cached2.model ?? void 0;
-        session.preview = cached2.preview ?? void 0;
-        const first = cached2.firstMessage ? JSON.parse(cached2.firstMessage) : null;
-        const last = cached2.lastMessage ? JSON.parse(cached2.lastMessage) : null;
+      const cached3 = this.cache.getMetaById(sessionId);
+      if (cached3) {
+        session.model = cached3.model ?? void 0;
+        session.preview = cached3.preview ?? void 0;
+        const first = cached3.firstMessage ? JSON.parse(cached3.firstMessage) : null;
+        const last = cached3.lastMessage ? JSON.parse(cached3.lastMessage) : null;
         session.firstMessageText = first?.text ?? void 0;
         session.firstMessageAt = first?.timestamp ? new Date(first.timestamp).toISOString() : void 0;
         session.lastMessageText = last?.text ?? void 0;
         session.lastMessageAt = last?.timestamp ? new Date(last.timestamp).toISOString() : void 0;
       }
-      let resolvedProjectId = cached2?.projectId ?? null;
+      let resolvedProjectId = cached3?.projectId ?? null;
       if (!resolvedProjectId) {
         const project = this.projectsRepo.upsertProjectByPath(projectPath);
         resolvedProjectId = project.id;
@@ -12797,9 +13076,12 @@ var StreamerServer = class {
     }
   }
   // ─── File Watcher Wiring ─────────────────────────────────────────
-  async watchConversationFile(sessionId) {
+  // `historyId` is the id the provider filed the history under, which for a
+  // fresh Codex session is its rollout id rather than our placeholder. The map
+  // stays keyed by `sessionId` — that is what broadcasts resolve against.
+  async watchConversationFile(sessionId, historyId = sessionId) {
     try {
-      const conversation = await this.findConversationByUuid(sessionId);
+      const conversation = await this.findConversationByUuid(historyId);
       if (conversation?.filePath) {
         this.sessionFileMap.set(sessionId, conversation.filePath);
         this.fileWatcher.watch(conversation.filePath);
@@ -12813,7 +13095,7 @@ var StreamerServer = class {
   // file isn't slurped in full.
   readFirstLineSessionId(filePath) {
     try {
-      const content = readFileSync8(filePath, "utf8");
+      const content = readFileSync9(filePath, "utf8");
       const nl = content.indexOf("\n");
       const firstLine = nl === -1 ? content : content.slice(0, nl);
       if (!firstLine.trim()) return null;
@@ -12863,7 +13145,7 @@ var StreamerServer = class {
       cleanup();
       this.sessionFileMap.set(sessionId, resolvedFilePath);
       try {
-        const existing = readFileSync8(resolvedFilePath, "utf8").split("\n").filter(Boolean);
+        const existing = readFileSync9(resolvedFilePath, "utf8").split("\n").filter(Boolean);
         if (existing.length > 0) {
           this.broadcastConversationLines(sessionId, existing);
         }
@@ -12916,7 +13198,7 @@ var StreamerServer = class {
     };
     const matchesProjectPath = (candidatePath) => {
       try {
-        const firstLine = readFileSync8(candidatePath, "utf8").split("\n", 1)[0];
+        const firstLine = readFileSync9(candidatePath, "utf8").split("\n", 1)[0];
         if (!firstLine) return null;
         const parsed = JSON.parse(firstLine);
         if (parsed?.type !== "session_meta") return null;
@@ -12962,10 +13244,19 @@ var StreamerServer = class {
           const codexSessionId = match.id;
           cleanup();
           this.sessionStore.updateManaged(sessionId, { boundConversationId: codexSessionId });
+          try {
+            this.managedSessionsRepo?.recordBinding(sessionId, codexSessionId);
+          } catch (err) {
+            this.log.warn("[registry] failed to record Codex rollout binding", {
+              event: "registry.binding_write_failed",
+              sessionId,
+              err
+            });
+          }
           this.sessionFileMap.set(sessionId, candidatePath);
           this.fileWatcher.watch(candidatePath);
           try {
-            const existing = readFileSync8(candidatePath, "utf8").split("\n").filter(Boolean);
+            const existing = readFileSync9(candidatePath, "utf8").split("\n").filter(Boolean);
             if (existing.length > 0) {
               this.broadcastConversationLines(sessionId, existing);
             }