comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/terminal-durable-wiring.js

@@ -1,31 +1,32 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * The DUR-01 / DUR-02 / LIVE-01 / ENDURE-01 daemon DURABILITY WIRING (165-07 Task 4) — the
- * integration glue that ties the phase's pure siblings + durable stores into the live
- * registry + wake seams. Extracted from `setup-terminal-tools.ts` to keep that file under the
- * 800-line architecture cap; the wiring is exercised by the registry/wake/reaper unit suites
- * + the integration tier (no unit test of its own — it is composition, not logic).
+ * The daemon DURABILITY WIRING for terminal drives — the integration glue that ties the pure
+ * durability siblings + durable stores into the live registry + wake seams. Extracted from
+ * `setup-terminal-tools.ts` to keep that file under the 800-line architecture cap; the wiring
+ * is exercised by the registry/wake/reaper unit suites + the integration tier (no unit test of
+ * its own — it is composition, not logic).
  *
  * Two construction sites:
  *   1. {@link buildAgentTerminalDurability} — PER-AGENT (called from `getOrCreateTerminalRegistry`):
- *      the descriptor store (165-07 Task 1) + the `has-session` probe + the recover/unrecoverable
- *      hooks (→ the registry's `durability` dep, consumed by 165-06's recover-on-boot + the
- *      durable-aware lost gate) + the `isBusy` reaper predicate (165-08's seam, bound to 165-02's
+ *      the descriptor store + the `has-session` probe + the recover/unrecoverable
+ *      hooks (→ the registry's `durability` dep, consumed by recover-on-boot + the
+ *      durable-aware lost gate) + the `isBusy` reaper predicate (bound to
  *      `busyOrHung`). On a re-attach it emits the content-free `terminal:drive_reattached`
- *      (I5 same-allow-entry, I3 ids-only); on a genuinely-gone session it emits the EXISTING
- *      `terminal:session_state(state:"lost")` + a content-free unrecoverable reason (NOTIFY-01
- *      layers the user-facing `failed` downstream).
+ *      (the re-attach runs under the SAME persisted allow-entry; the record carries ids only);
+ *      on a genuinely-gone session it emits the EXISTING
+ *      `terminal:session_state(state:"lost")` + a content-free unrecoverable reason (the wake
+ *      notify layer adds the user-facing `failed` downstream).
  *   2. {@link buildWakeDurabilityDeps} — DAEMON-WIDE (spread into `setupTerminalWake`): the
- *      DUR-02 journal store (165-07 Task 1, the persist-on-set + resume-on-re-attach point) +
- *      the LIVE-01 `checkLiveness` (the worker `status` round-trip mapped to a `BusySignal` — a
- *      CLASSIFIER perception, NEVER a screen read, I2) + the `refreshLastActivity` unify (a busy
+ *      drive-journal store (the persist-on-set + resume-on-re-attach point) +
+ *      the `checkLiveness` backstop (the worker `status` round-trip mapped to a `BusySignal` — a
+ *      CLASSIFIER perception, NEVER a screen read) + the lastActivity unify (a busy
  *      backstop verdict advances the handle's lastActivity so the idle reaper never evicts a
- *      quiet-but-busy compile, I9).
+ *      quiet-but-busy compile).
  *
  * The `isTmuxAlive` probe is the daemon-side `tmux has-session -t comis-<id>` (exit 0 ⇒ alive),
  * resolved against a `tmuxPath` the composition root detects once (`which tmux`). Absent tmux
- * ⇒ the probe is always-false (a durable session degrades to today's lost floor at runtime —
- * §7.1.5's runtime fallback, NOT a config-time hard-require, I1).
+ * ⇒ the probe is always-false (a durable session degrades to the lost floor at runtime —
+ * a runtime fallback, NOT a config-time hard-require).
  *
  * @module
  */
@@ -34,15 +35,15 @@ import { readlinkSync } from "node:fs";
 import { createSessionDescriptorStore, } from "./terminal-session-descriptor-persistence.js";
 import { persistDriveJournal, loadDriveJournal, removeDriveJournal, } from "./terminal-drive-journal-persistence.js";
 import { busyOrHung, buildTmuxHasSessionArgv, buildTmuxKillArgv, terminalWorkerDir, resolveTmuxSocketPath, } from "@comis/skills/tools";
-/** The stamped registry owner for a drive-scoped session — the forcing-use-case owner (I5). */
+/** The stamped registry owner for a drive-scoped session — the forcing-use-case owner. */
 function driveOwner(agentId) {
     return { agentId, sessionKey: "" };
 }
-/** ISSUE-3 (live VPS 2026-06-16): the session's STAMPED owner — recovered via the registry's
- *  getOwner seam (the worker→event re-publish drops the (userId, sessionKey) for a channel/API
- *  drive), else the forcing-use-case driveOwner. So the LIVE-01 backstop + the ENDURE-01 idle
- *  exclusion resolve a channel/API detached drive's LIVE session instead of misjudging it gone or
- *  idle (cross-owner) and silently stranding / evicting it. */
+/** The session's STAMPED owner — recovered via the registry's getOwner seam (the worker→event
+ *  re-publish drops the (userId, sessionKey) for a channel/API drive), else the forcing-use-case
+ *  driveOwner. So the liveness backstop + the idle exclusion resolve a channel/API detached
+ *  drive's LIVE session instead of misjudging it gone or idle (cross-owner) and silently
+ *  stranding / evicting it. */
 function resolveStampedOwner(registry, sessionId, agentId) {
     return registry?.getOwner?.(sessionId) ?? driveOwner(agentId);
 }
@@ -51,7 +52,7 @@ function resolveStampedOwner(registry, sessionId, agentId) {
  * the per-agent durability wiring + the daemon-wide wake backstop share ONE `which tmux`).
  * Mirrors the `which bwrap` probe in `buildTerminalEgressDeps`. `undefined` ⇒ no tmux on this
  * host ⇒ the `isTmuxAlive` probe is always-false (a durable drive degrades to the lost floor at
- * runtime, §7.1.5). The blocking `which` runs at most once; never on the hot path.
+ * runtime). The blocking `which` runs at most once; never on the hot path.
  */
 let cachedTmuxPath = "unresolved";
 export function resolveDaemonTmuxPath() {
@@ -69,11 +70,10 @@ export function resolveDaemonTmuxPath() {
 /**
  * Build the daemon-side `has-session` liveness probe: `tmux -S <socket> has-session -t
  * comis-<id>` (exit 0 ⇒ alive). Returns `false` on ANY non-zero exit / throw (the SAFE
- * direction — a probe that cannot confirm alive must never assert it, mirroring 165-01's
- * bias). Absent `tmuxPath` ⇒ always-false (a durable session falls back to the lost floor
- * at runtime, I1).
+ * direction — a probe that cannot confirm alive must never assert it). Absent `tmuxPath` ⇒
+ * always-false (a durable session falls back to the lost floor at runtime).
  *
- * DUR-01: the probe MUST target the SAME `-S` socket the worker binds
+ * The probe MUST target the SAME `-S` socket the worker binds
  * (`<dataDir>/terminal-worker/tmux.sock`) — NOT tmux's default /tmp socket. systemd
  * `PrivateTmp=yes` privatizes /tmp per daemon start, so a default-socket probe in the
  * restarted daemon would find NOTHING and falsely declare every survived durable session
@@ -85,11 +85,11 @@ export function buildIsTmuxAlive(tmuxPath, socketPath, run = (bin, args) => {
 }) {
     if (tmuxPath === undefined)
         return () => false;
-    // RECUR-03 (option A): the probe takes an OPTIONAL per-session `socket` — the PER-BOOT server
-    // the session lives on (`handle.tmuxSocket` / `descriptor.tmuxSocket`). A restart's surviving
-    // durable sits on its OWN (prior-boot) socket while a new session is on this boot's socket, so
-    // the probe MUST target the session's own server, not one fixed socket. Absent ⇒ `socketPath`
-    // (the legacy/default — a pre-RECUR-03 descriptor or a non-per-boot caller).
+    // The probe takes an OPTIONAL per-session `socket` — the PER-BOOT server the session lives on
+    // (`handle.tmuxSocket` / `descriptor.tmuxSocket`). A restart's surviving durable sits on its
+    // OWN (prior-boot) socket while a new session is on this boot's socket, so the probe MUST target
+    // the session's own server, not one fixed socket. Absent ⇒ `socketPath` (the default — a
+    // descriptor without a per-session socket, or a non-per-boot caller).
     return (name, socket) => {
         try {
             const [bin, ...args] = buildTmuxHasSessionArgv({ tmuxPath, socketPath: socket ?? socketPath, name });
@@ -127,7 +127,7 @@ export function buildKillTmux(tmuxPath, socketPath, run = (bin, args) => {
     };
 }
 /**
- * RECUR-02 (live VPS 2026-06-17) — the stranded-mount-namespace predicate. A durable tmux
+ * The stranded-mount-namespace predicate. A durable tmux
  * server kept alive across a daemon restart by `KillMode=process` was forked by the PRIOR
  * daemon generation, so it lives in that generation's mount namespace. systemd `PrivateTmp`/
  * `ProtectHome`/`ProtectSystem` give EVERY daemon START a fresh mount ns, so after a restart the
@@ -167,7 +167,7 @@ function defaultReadDaemonMntNs() {
     }
 }
 /**
- * RECUR-02 — at daemon boot, if the durable tmux server SURVIVED into a stranded prior-generation
+ * At daemon boot, if the durable tmux server SURVIVED into a stranded prior-generation
  * mount namespace ({@link isTmuxServerStranded}), tear it down (`kill-server`) so the next
  * `new-session` starts a FRESH server in THIS daemon's live ns (where new `bwrap` sessions work).
  * Its surviving durable sessions are intentionally killed — they would otherwise be a half-dead
@@ -180,7 +180,7 @@ function defaultReadDaemonMntNs() {
 export function recreateStrandedTmuxServerOnBoot(deps) {
     const { socketPath, tmuxPath, logger } = deps;
     // No tmux on this host → there is no durable server to strand (durable already degrades to the
-    // lost floor at runtime, §7.1.5). Nothing to recreate.
+    // lost floor at runtime). Nothing to recreate.
     if (tmuxPath === undefined)
         return { stranded: false, killed: false };
     const readServerMntNs = deps.readServerMntNs ?? ((s) => defaultReadServerMntNs(s, tmuxPath));
@@ -212,7 +212,7 @@ export function recreateStrandedTmuxServerOnBoot(deps) {
     return { stranded: true, killed: true };
 }
 /**
- * RECUR-02 — the dataDir-bound boot step the composition root calls ONCE before any registry's
+ * The dataDir-bound boot step the composition root calls ONCE before any registry's
  * recover-on-boot. Resolves the daemon tmux path + the durable `-S` socket (the SAME derivation
  * the liveness probe uses) and delegates to {@link recreateStrandedTmuxServerOnBoot}. Thin
  * composition (no logic of its own — the decision is unit-tested on the delegate), mirroring the
@@ -229,16 +229,16 @@ export function recreateStrandedTmuxServerForDataDir(dataDir, logger) {
  * Build the per-agent registry `durability` dep + the reaper `isBusy` predicate.
  *
  * `durability` (→ `createTerminalSessionRegistry`): the descriptor store + the `has-session`
- * probe + the two content-free hooks. `onReattached` → `terminal:drive_reattached` (I5 — the
+ * probe + the two content-free hooks. `onReattached` → `terminal:drive_reattached` (the
  * re-attach runs under the SAME persisted allow-entry; the emit carries ids only). On a
  * genuinely-gone durable session `onUnrecoverable` → the EXISTING `terminal:session_state(
- * state:"lost")` + a content-free unrecoverable reason (NO `failed` member; NOTIFY-01 layers it).
+ * state:"lost")` + a content-free unrecoverable reason (NO `failed` member; the wake notify layer adds it).
  *
- * `isBusy` (→ the reaper, 165-08's seam): bound to 165-02's `busyOrHung` over the session's
- * `alive` (the handle is still `running` AND, for a durable session, its tmux is alive) + the
- * progress window (`nowMs - lastActivity`, which the LIVE-01 backstop keeps fresh for a
- * genuinely-busy compile via `checkLiveness`/`refreshLastActivity`). So a quiet-but-busy
- * multi-hour build is excluded from idle eviction (I9), while a genuinely-idle session is not.
+ * `isBusy` (→ the reaper): bound to `busyOrHung` over the session's `alive` (the handle is still
+ * `running` AND, for a durable session, its tmux is alive) + the progress window (`nowMs -
+ * lastActivity`, which the liveness backstop keeps fresh for a genuinely-busy compile via
+ * `checkLiveness`). So a quiet-but-busy multi-hour build is excluded from idle eviction, while a
+ * genuinely-idle session is not.
  */
 export function buildAgentTerminalDurability(i) {
     const tmuxSocketPath = resolveTmuxSocketPath(terminalWorkerDir(i.dataDir));
@@ -251,42 +251,41 @@ export function buildAgentTerminalDurability(i) {
         isTmuxAlive,
         killTmuxSession,
         onReattached: ({ sessionId, agentId }) => {
-            // DUR-01 (I5/I3): the re-attach ran under the SAME persisted allow-entry; the content-free
-            // record carries ids only (the screen the drive resumed on rides the detached tmux, never the bus).
+            // The re-attach ran under the SAME persisted allow-entry; the content-free record carries
+            // ids only (the screen the drive resumed on rides the detached tmux, never the bus).
             //
-            // ME-01 (165-REVIEW) — observability note: this fires from the registry's recover-on-boot,
-            // which can run DURING the FLOOR-01 boot sweep BEFORE setupTerminalWake subscribes
-            // terminal:drive_reattached (the boot race). So the BUS event may be lost on the boot path
-            // (BL-02's lazy-seed makes RESUME independent of it). `terminal:drive_reattached` is also NOT
-            // in observability's TRAJECTORY_BRIDGE_MAPPING (no trajectory record). Therefore the
-            // AUTHORITATIVE §9 "reconstruct a 40h drive's restart via comis explain" record is the INFO
-            // log BELOW (it fires here regardless of any subscriber), NOT the bus event — by design.
+            // Observability note: this fires from the registry's recover-on-boot, which can run DURING
+            // the boot sweep BEFORE setupTerminalWake subscribes terminal:drive_reattached (the boot
+            // race). So the BUS event may be lost on the boot path (the journal's lazy-seed makes RESUME
+            // independent of it). `terminal:drive_reattached` is also NOT in observability's
+            // TRAJECTORY_BRIDGE_MAPPING (no trajectory record). Therefore the AUTHORITATIVE record for
+            // reconstructing a long-running drive's restart via `comis explain` is the INFO log BELOW
+            // (it fires here regardless of any subscriber), NOT the bus event — by design.
             i.eventBus.emit("terminal:drive_reattached", { sessionId, agentId, reason: "tmux_alive", timestamp: i.nowMs() });
             i.logger.info({ sessionId, agentId, step: "drive_reattached" }, "terminal durable drive re-attached on recover-on-boot");
         },
         onUnrecoverable: ({ sessionId, agentId, reason }) => {
-            // DUR-02 (I10): a genuinely-gone durable session → the EXISTING lost state + a content-free
-            // unrecoverable reason (the journal is PRESERVED by the holder; NOTIFY-01 layers `failed`).
+            // A genuinely-gone durable session → the EXISTING lost state + a content-free unrecoverable
+            // reason (the journal is PRESERVED by the holder; the wake notify layer adds `failed`).
             // errorKind is the literal "dependency" (a gone backend) — the closed-union invariant
             // requires a literal here, not the forwarded payload field (which is always "dependency").
             //
-            // CR-01 (Phase 166): stamp `unrecoverable:true` + thread the content-free `reason` (e.g.
-            // "tmux_session_gone") onto the lost emit. This is the ONLY emit site that marks the lost
-            // genuine — the worker-crash respawn (setup-terminal-tools.ts:321) + the reaper's plain
-            // lost (setup-terminal-tools.ts:243) deliberately leave both UNSET, so NOTIFY-01 reports
-            // `failed` ONLY for THIS genuine death (I9/I10). The reason rides the user-facing `failed`
-            // outcome + the §2.7 WARN so `comis explain` names the actual cause (WR-03), not a generic
-            // "session_lost".
+            // Stamp `unrecoverable:true` + thread the content-free `reason` (e.g. "tmux_session_gone")
+            // onto the lost emit. This is the ONLY emit site that marks the lost genuine — the
+            // worker-crash respawn + the reaper's plain lost (both in setup-terminal-tools.ts)
+            // deliberately leave both UNSET, so the notify layer reports `failed` ONLY for THIS genuine
+            // death. The reason rides the user-facing `failed` outcome + the §2.7 WARN so `comis explain`
+            // names the actual cause, not a generic "session_lost".
             i.eventBus.emit("terminal:session_state", { sessionId, agentId, state: "lost", unrecoverable: true, reason, durationMs: 0, timestamp: i.nowMs() });
             i.logger.warn({ sessionId, agentId, reason, hint: `a durable terminal drive could not be re-attached (${reason}); flipped lost with the journal preserved for a fresh drive`, errorKind: "dependency", step: "drive_unrecoverable" }, "terminal durable drive unrecoverable on recover-on-boot");
         },
     };
-    // ENDURE-01 / I9 (165-08's seam): the reaper idle-exclusion predicate, bound to 165-02's
-    // busyOrHung. A durable session whose detached tmux is alive is alive regardless of the
-    // worker; a non-durable running session is alive while the handle is running. The progress
-    // window is `nowMs - lastActivity` — kept fresh for a genuinely-busy compile by the LIVE-01
-    // backstop (checkLiveness's status round-trip + refreshLastActivity), so a quiet-but-busy
-    // build reads `busy` and is excluded from idle eviction; a genuinely-idle session reads `hung`.
+    // The reaper idle-exclusion predicate, bound to `busyOrHung`. A durable session whose detached
+    // tmux is alive is alive regardless of the worker; a non-durable running session is alive while
+    // the handle is running. The progress window is `nowMs - lastActivity` — kept fresh for a
+    // genuinely-busy compile by the liveness backstop (checkLiveness's status round-trip), so a
+    // quiet-but-busy build reads `busy` and is excluded from idle eviction; a genuinely-idle session
+    // reads `hung`.
     const isBusy = (s) => {
         const reg = i.registries.get(i.agentId);
         const handle = reg?.get(s.sessionId, resolveStampedOwner(reg, s.sessionId, i.agentId));
@@ -316,89 +315,135 @@ export function buildTerminalWakeDurability(i) {
         }),
         heartbeatMs: i.config?.drive?.heartbeatMs ?? 90_000,
         maxCostUsd: i.config?.drive?.maxCostUsd ?? null,
-        // NOTIFY-01 (166-03): default "terminal" (today's intent — done/failed fire, the escalation
-        // always fires); NOTIFY-02: default 1h (a coarse spam-free user heartbeat; 0 = terminal-only).
+        // Default "terminal" (done/failed fire, the escalation always fires); the heartbeat default is
+        // 1h (a coarse spam-free user heartbeat; 0 = terminal-only).
         notifyPolicy: i.config?.drive?.notify ?? "terminal",
         heartbeatNotifyMs: i.config?.drive?.heartbeatNotifyMs ?? 3_600_000,
     };
 }
 /**
- * Build the daemon-wide DUR-02 journal store + the LIVE-01 `checkLiveness`/`refreshLastActivity`
- * the wake holder consumes (spread into `setupTerminalWake`).
+ * Build the daemon-wide drive-journal store + the `checkLiveness` liveness check the wake holder
+ * consumes (spread into `setupTerminalWake`).
  *
- * - `driveJournalStore`: a thin `DriveJournalStorePort` wrapping the 165-04 fs-safe module
- *   functions bound to `dataDir` (persist-on-set + recover/load on re-attach + the explicit-only
- *   remove). Best-effort/total throughout (the module swallows faults).
- * - `checkLiveness(sessionId, agentId)`: the LIVE-01 single liveness check — the registry
- *   `status` round-trip (the worker's CLASSIFIER perception — `working`/`stuck`/`exited` — NOT a
- *   screen read, I2) mapped to a `BusySignal`. A `stuck` classifier verdict → `noProgressMs >
- *   stuckMs` → hung; `working`/`awaiting-input` → busy; `exited`/gone → not alive → hung. The
- *   `status` round-trip ALSO stamps the handle's `lastActivity` as a side effect (the registry's
- *   status method) — that IS the ENDURE-01 idle-reaper unify (I9): a busy verdict's liveness
- *   check refreshes lastActivity, so the idle sweep never evicts a quiet-but-busy compile. No
- *   SEPARATE refresh hook is needed (165-REVIEW LO-03 removed the redundant `refreshLastActivity`
- *   dep that double-stamped what `status` already does).
+ * - `driveJournalStore`: a thin `DriveJournalStorePort` wrapping the fs-safe journal-persistence
+ *   module functions bound to `dataDir` (persist-on-set + recover/load on re-attach + the
+ *   explicit-only remove). Best-effort/total throughout (the module swallows faults).
+ * - `checkLiveness(sessionId, agentId)`: the single liveness check — the registry `status`
+ *   round-trip (the worker's CLASSIFIER perception — `working`/`stuck`/`exited` — NOT a screen
+ *   read) mapped to a `BusySignal`. A `stuck` classifier verdict → `noProgressMs > stuckMs` →
+ *   hung; `working`/`awaiting-input` → busy; `exited`/gone → not alive → hung. The `status`
+ *   round-trip ALSO stamps the handle's `lastActivity` as a side effect (the registry's status
+ *   method) — that IS the idle-reaper unify: a busy verdict's liveness check refreshes
+ *   lastActivity, so the idle sweep never evicts a quiet-but-busy compile. No SEPARATE refresh
+ *   hook is needed (a dedicated refresh dep would double-stamp what `status` already does).
  */
+/**
+ * A CONTENT-FREE digest of a screen render — a cheap 32-bit rolling checksum used ONLY for the
+ * idle-reap change-detection (a producing drive's screen advances; a truly-idle one is static).
+ * Never logged, bridged, or persisted (the no-screen-bridge invariant holds — this is a hash, not
+ * the bytes). A rare collision merely risks a false-idle, the SAFE direction (the reaper is
+ * bounded by idleTtlMs regardless). Total + pure.
+ */
+function digestScreen(screen) {
+    let h = 5381;
+    for (let idx = 0; idx < screen.length; idx++)
+        h = ((h * 33) ^ screen.charCodeAt(idx)) >>> 0;
+    return `${screen.length}:${h}`;
+}
 export function buildWakeDurabilityDeps(i) {
     const isTmuxAlive = buildIsTmuxAlive(resolveDaemonTmuxPath(), resolveTmuxSocketPath(terminalWorkerDir(i.dataDir)));
     const driveJournalStore = {
         persist: (agentId, sessionId, journal) => persistDriveJournal({ dataDir: i.dataDir }, agentId, sessionId, journal),
-        // The resume read is per-session lazy (165-REVIEW BL-02/ME-03) — NO bulk recover.
+        // The resume read is per-session lazy — NO bulk recover.
         load: (agentId, sessionId) => loadDriveJournal({ dataDir: i.dataDir }, agentId, sessionId),
         remove: (agentId, sessionId) => removeDriveJournal({ dataDir: i.dataDir }, agentId, sessionId),
     };
+    // The last content-free screen digest per session, for the idle-reap change-detection in
+    // checkLiveness (see the awaiting-input branch). Daemon-lifetime + small (keyed by sessionId,
+    // bounded by worker.maxSessions); pruned on the gone/exited early returns.
+    const screenDigests = new Map();
     const checkLiveness = async (sessionId, agentId) => {
         const registry = i.registries.get(agentId);
         if (registry === undefined)
             return undefined; // no registry for the agent → gone
-        const owner = resolveStampedOwner(registry, sessionId, agentId); // ISSUE-3: the live channel/API session's stamped owner
+        const owner = resolveStampedOwner(registry, sessionId, agentId); // the live channel/API session's stamped owner
         const handle = registry.get(sessionId, owner);
-        if (handle === undefined)
-            return undefined; // gone → the backstop skips it
-        // LINGER-01 (webhook-claude-cli-tdd-20260701-backstop): capture the idle clock BEFORE the probe.
-        // The `status` round-trip below stamps `lastActivity = now` (the LO-03 I9 unify — keeps a
-        // quiet-but-busy compile fresh so the reaper never false-evicts it). But an UNATTENDED
-        // (webhook/cron, owner sessionKey "") drive that has cleanly SETTLED (awaiting-input) is
-        // classified BUSY, so that same passive stamp keeps a FINISHED drive warm forever → the
-        // ENDURE-01 idle reaper's `now - lastActivity > idleTtlMs` cap can never fire and the idle drive
-        // lingers until clean-restart. For that one case we restore the pre-probe value below so the
-        // reaper measures idleness from the drive's last REAL activity. (An interactive drive is left
-        // warm — a human owns its lifecycle; a working/stuck drive is untouched — never a false-evict.)
+        if (handle === undefined) {
+            screenDigests.delete(sessionId);
+            return undefined;
+        } // gone → the backstop skips it
+        // Capture the idle clock BEFORE the probe. The `status` round-trip below stamps
+        // `lastActivity = now` (the idle-reaper unify — keeps a quiet-but-busy compile fresh so the
+        // reaper never false-evicts it). But an UNATTENDED (webhook/cron, owner sessionKey "") drive
+        // that has cleanly SETTLED (awaiting-input) is classified BUSY, so that same passive stamp
+        // keeps a FINISHED drive warm forever → the idle reaper's `now - lastActivity > idleTtlMs` cap
+        // can never fire and the idle drive lingers until clean-restart. For that one case we restore
+        // the pre-probe value below so the reaper measures idleness from the drive's last REAL
+        // activity. (An interactive drive is left warm — a human owns its lifecycle; a working/stuck
+        // drive is untouched — never a false-evict.)
         const idleClockBeforeProbe = handle.lastActivity;
         const isUnattended = owner.sessionKey === "";
         // The SINGLE liveness check: the worker `status` round-trip (CLASSIFIER perception, NOT a
-        // screen read — I2). It also refreshes the handle's lastActivity as a side effect.
+        // screen read). It also refreshes the handle's lastActivity as a side effect.
         const status = await registry.status(sessionId, owner);
         const stuckMs = i.workerStuckMs;
-        if (status.state === "exited")
+        if (status.state === "exited") {
+            screenDigests.delete(sessionId);
             return { alive: false, noProgressMs: 0, stuckMs };
+        }
         // For a durable session also require the detached tmux to be alive (a wedged-but-present
         // worker whose tmux died is hung). `stuck` from the classifier → past the no-progress window.
         const tmuxOk = handle.durable !== true || (handle.tmuxName !== undefined && isTmuxAlive(handle.tmuxName, handle.tmuxSocket));
-        if (!tmuxOk)
+        if (!tmuxOk) {
+            screenDigests.delete(sessionId);
             return { alive: false, noProgressMs: 0, stuckMs };
+        }
         if (status.state === "stuck")
             return { alive: true, noProgressMs: stuckMs + 1, stuckMs };
         // working / awaiting-input → busy (recent progress; the classifier did not flag no-progress).
-        // DELIVER-01 (#2): surface `awaiting-input` (a settled prompt — a backgrounded drive that
-        // finished its current work and is idle at its prompt) so the backstop can deliver a one-time
-        // "finished — waiting for input" notification. A backgrounded drive emits no fd3 attention
-        // once promoted, so without this the completion is never delivered. Purely additive — the
-        // busy verdict is unchanged (awaiting-input is busy, never hung).
+        // Surface `awaiting-input` (a settled prompt — a backgrounded drive that finished its current
+        // work and is idle at its prompt) so the backstop can deliver a one-time "finished — waiting
+        // for input" notification. A backgrounded drive emits no fd3 attention once promoted, so
+        // without this the completion is never delivered. Purely additive — the busy verdict is
+        // unchanged (awaiting-input is busy, never hung).
         if (status.state === "awaiting-input") {
-            // LINGER-01: a SETTLED unattended drive made no progress — do NOT let the passive probe's
-            // stamp refresh its idle clock, or the reaper's idleTtlMs cap can never evict the finished
-            // drive. Restoring the pre-probe value keeps the completion signal (below) intact while
-            // letting idleness accrue from the last real activity. Interactive drives keep the warm stamp.
-            if (isUnattended)
-                handle.lastActivity = idleClockBeforeProbe;
+            // A SETTLED unattended drive made no progress — do NOT let the passive probe's stamp refresh
+            // its idle clock, or the reaper's idleTtlMs cap can never evict the finished drive. Restoring
+            // the pre-probe value keeps the completion signal (below) intact while letting idleness
+            // accrue from the last real activity. Interactive drives keep the warm stamp.
+            //
+            // The classifier reports `awaiting-input` for a coding CLI (e.g. Claude Code) that parks its
+            // cursor at its persistent `❯` composer WHILE autonomously working — subagents running, a
+            // long autonomous phase building, the status timer/token counter advancing. Freezing the
+            // idle clock UNCONDITIONALLY would let the reaper EVICT a still-PRODUCING unattended drive at
+            // idleTtlMs, mid-work (a drive was reaped ~30min in while it was still committing). So freeze
+            // ONLY when the drive is TRULY idle: the on-screen render is UNCHANGED across probes. A
+            // CHANGING screen (real progress) keeps the fresh stamp so the reaper never evicts a working
+            // drive. The digest is CONTENT-FREE (a cheap checksum, never logged/bridged — the
+            // no-screen-bridge invariant holds); a read fault falls back to the SAFE freeze, and a
+            // truly-done drive (static screen) still evicts.
+            if (isUnattended) {
+                let producing = false;
+                try {
+                    const view = await registry.read(sessionId, owner);
+                    const digest = digestScreen(view.screen);
+                    const prev = screenDigests.get(sessionId);
+                    producing = prev !== undefined && digest !== prev;
+                    screenDigests.set(sessionId, digest);
+                }
+                catch {
+                    /* read unavailable/failed → treat as not-producing → the safe freeze */
+                }
+                if (!producing)
+                    handle.lastActivity = idleClockBeforeProbe;
+            }
             return { alive: true, noProgressMs: 0, stuckMs, awaitingInput: true };
         }
         return { alive: true, noProgressMs: 0, stuckMs };
     };
-    // LO-03 (165-REVIEW): NO separate refreshLastActivity — checkLiveness's `registry.status`
-    // round-trip already stamps the handle's lastActivity (the registry's status side effect), so
-    // a busy backstop verdict's liveness check IS the ENDURE-01 idle-reaper unify (I9). A separate
-    // refresh hook double-stamped what status already does (dead weight) and is removed.
+    // NO separate refreshLastActivity — checkLiveness's `registry.status` round-trip already stamps
+    // the handle's lastActivity (the registry's status side effect), so a busy backstop verdict's
+    // liveness check IS the idle-reaper unify. A separate refresh hook would double-stamp what
+    // status already does (dead weight), so there is none.
     return { driveJournalStore, checkLiveness };
 }

package/node_modules/@comis/daemon/dist/wiring/terminal-session-descriptor-persistence.d.ts

@@ -41,7 +41,7 @@ export interface SessionDescriptorPersistenceDeps {
 export declare function descriptorDir(dataDir: string, agentId: string): string;
 /**
  * Construct the daemon-side durable descriptor store bound to one `(dataDir, agentId)` —
- * the {@link SessionDescriptorStorePort} the registry deps inject (165-07 Task 4). All
+ * the {@link SessionDescriptorStorePort} the registry deps inject. All
  * three methods are best-effort + total (never throw): `persist` swallows a write fault
  * (the registry handle is the runtime source of truth), `recover` skips a corrupt /
  * unreadable file (never crashes boot), `remove` is ENOENT-tolerant.

package/node_modules/@comis/daemon/dist/wiring/terminal-session-descriptor-persistence.js

@@ -8,26 +8,25 @@
 // runtime, so a write that cannot complete degrades to "this session is missed on the
 // next recover" (it is flipped `lost` on boot, never re-attached), never a throw.
 /**
- * The DUR-01 DAEMON-side durable SESSION-DESCRIPTOR store — the daemon impl of the
- * {@link SessionDescriptorStorePort} the registry's recover-on-boot (165-06) consumes,
- * and the SIBLING of the DUR-02 journal store ({@link
- * ./terminal-drive-journal-persistence.js}).
+ * The DAEMON-side durable SESSION-DESCRIPTOR store — the daemon impl of the
+ * {@link SessionDescriptorStorePort} the registry's recover-on-boot consumes, and the
+ * SIBLING of the drive-journal store ({@link ./terminal-drive-journal-persistence.js}).
  *
- * WHY THIS EXISTS (the DUR-01 gap, framed in terminal-reattach-match.ts). The tmux
- * re-attach MECHANISM already ships (deterministic `comis-<id>` name + `has-session`-
+ * WHY THIS EXISTS (the durable-reattach gap, framed in terminal-reattach-match.ts). The
+ * tmux re-attach MECHANISM already ships (deterministic `comis-<id>` name + `has-session`-
  * gated create-vs-reattach + a linux survival test). The genuine gap is one layer UP:
  * the registry's `sessionId` is an ephemeral `randomUUID()` it never persists, and there
  * is no recover-on-boot — so on a daemon restart its `sessions` Map starts EMPTY and a
- * healthy 40h drive whose `comis-<old-id>` is STILL alive under tmux is wrongly flipped
- * `lost`. This store persists the {@link SessionDescriptor} IDENTITY (the I5
+ * healthy multi-day drive whose `comis-<old-id>` is STILL alive under tmux is wrongly
+ * flipped `lost`. This store persists the {@link SessionDescriptor} IDENTITY (the
  * allowId/owner/scope/tmuxName) at create-time so the registry's recover-on-boot
- * (`applyRecoveredSessions`, 165-06) can run each through 165-01's pure
- * `reattachDecision` and re-attach the survivors instead of flipping them `lost`.
+ * (`applyRecoveredSessions`) can run each through the pure `reattachDecision` and
+ * re-attach the survivors instead of flipping them `lost`.
  *
  * **Daemon-side placement (a deliberate CO-LOCATION CHOICE, NOT a forced constraint).**
  * It lives in the daemon layer as a sibling of `terminal-wake-persistence.ts` +
  * `terminal-drive-journal-persistence.ts` because it is co-located with the daemon-side
- * recover-on-boot wiring (165-07 Task 4 injects it onto the registry deps). The
+ * recover-on-boot wiring (which injects it onto the registry deps). The
  * `skills → observability` edge it would otherwise traverse is ALLOWED (the architecture
  * graph permits `skills: {shared, core, observability}`), so this is a placement
  * decision, not a workaround for a forbidden edge — it mirrors exactly where the journal
@@ -39,32 +38,31 @@
  * unlink-then-`O_CREAT | O_EXCL | O_NOFOLLOW` atomic create with a defensive `fchmod`) —
  * with `dataDir` threaded as the `confinedBaseDir` ancestor-symlink defense.
  *
- * **The confined durable dir (resolved Q2, the journal store's sibling):**
+ * **The confined durable dir (the journal store's sibling):**
  * `<dataDir>/terminal-drive/<agentId>/descriptors/<sessionId>.json` — the confined
  * background-task per-agent pattern (runtime state OUT of the agent's user-visible
  * `<agentWs>/terminal/` workspace), the journal store's `journals/` sibling.
  *
- * **Content-free + I5 identity (I3 / T-165-26).** The descriptor is content-free BY
- * CONSTRUCTION (ids/enums/counts only — `serializeDescriptor`); this store persists those
- * opaque bytes verbatim and never re-structures them into a credential field. The
- * persisted file is mode-`0o600` in a `0o700` confined dir (V8). The recovered descriptor
- * carries the SAME allowId/owner/scope it was persisted with — durability changes WHERE,
- * never WHAT.
+ * **Content-free identity.** The descriptor is content-free BY CONSTRUCTION (ids/enums/
+ * counts only — `serializeDescriptor`); this store persists those opaque bytes verbatim
+ * and never re-structures them into a credential field. The persisted file is mode-`0o600`
+ * in a `0o700` confined dir. The recovered descriptor carries the SAME allowId/owner/scope
+ * it was persisted with — durability changes WHERE, never WHAT.
  *
  * **The port is INSTANCE-bound to one `(dataDir, agentId)`** because
  * `SessionDescriptorStorePort.persist(descriptor)`/`recover()`/`remove(sessionId)` are
- * the agent-scoped surface the registry deps inject; the daemon (165-07 Task 4)
- * constructs one per agent. `persist` reads the agent from the descriptor's
- * `owner.agentId` for an audit cross-check but the store's confinement root is the bound
- * `agentId` (the registry only ever persists its own sessions).
+ * the agent-scoped surface the registry deps inject; the daemon constructs one per agent.
+ * `persist` reads the agent from the descriptor's `owner.agentId` for an audit cross-check
+ * but the store's confinement root is the bound `agentId` (the registry only ever persists
+ * its own sessions).
  *
  * **TOTAL recover (the recovery contract).** A corrupt-after-crash descriptor is a
- * corrupt-SKIP via 165-01's `deserializeDescriptor` (it REJECTS a missing/wrong-typed
- * identity field to `undefined`, never a partially-trusted authorization object — unlike
- * the journal's safe-default); a file that fails to even READ is skipped. `recover` NEVER
+ * corrupt-SKIP via `deserializeDescriptor` (it REJECTS a missing/wrong-typed identity
+ * field to `undefined`, never a partially-trusted authorization object — unlike the
+ * journal's safe-default); a file that fails to even READ is skipped. `recover` NEVER
  * crashes the daemon constructor (a degenerate `dataDir`/`agentId` → an empty list).
  *
- * **I10 preserve-on-failure.** `persist`/`recover` NEVER delete a descriptor — {@link
+ * **Preserve-on-failure.** `persist`/`recover` NEVER delete a descriptor — {@link
  * SessionDescriptorStorePort.remove} is the DISTINCT explicit call (the registry calls it
  * on a genuinely-gone / cleanly-evicted session).
  *
@@ -90,7 +88,7 @@ export function descriptorDir(dataDir, agentId) {
 }
 /**
  * Construct the daemon-side durable descriptor store bound to one `(dataDir, agentId)` —
- * the {@link SessionDescriptorStorePort} the registry deps inject (165-07 Task 4). All
+ * the {@link SessionDescriptorStorePort} the registry deps inject. All
  * three methods are best-effort + total (never throw): `persist` swallows a write fault
  * (the registry handle is the runtime source of truth), `recover` skips a corrupt /
  * unreadable file (never crashes boot), `remove` is ENOENT-tolerant.
@@ -107,7 +105,7 @@ export function createSessionDescriptorStore(deps) {
         persist(descriptor) {
             // Best-effort: a failure (a PathTraversalError from a degenerate dataDir/agentId,
             // an unwritable target, a write fault) is SWALLOWED — it must not propagate off the
-            // registry's create path (the in-memory handle already exists). NEVER deletes (I10).
+            // registry's create path (the in-memory handle already exists). NEVER deletes.
             try {
                 const dir = descriptorDir(deps.dataDir, deps.agentId);
                 ensure({ dir, mode: 0o700, confinedBaseDir: deps.dataDir });
@@ -178,7 +176,7 @@ export function createSessionDescriptorStore(deps) {
             return recovered;
         },
         remove(sessionId) {
-            // The DISTINCT explicit delete (I10: persist/recover NEVER delete; only this does).
+            // The DISTINCT explicit delete (persist/recover NEVER delete; only this does).
             // ENOENT-tolerant; per the module's all-best-effort contract a genuine fault is
             // swallowed too (the lingering file is overwritten/skipped on the next boot).
             let filePath;