omp-conductor 0.19.6 → 0.19.7

package/src/fleet.ts

@@ -391,7 +391,10 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
   // challenge proof never reads it: its acknowledgement is conductor state,
   // so where (or whether) a transcript lives is no longer part of arming
   // (#614).
-  const claimed = deps.claimedSessionFile !== undefined ? deps.claimedSessionFile() : claimedOrchestratorSessionFile(named);
+  const claimed =
+    deps.claimedSessionFile !== undefined
+      ? deps.claimedSessionFile()
+      : claimedOrchestratorSessionFile(named, deps.pidAlive ?? pidAlive);
 
   // Prefer the project's live forum topic so arm challenges land where
   // escalations already do (#318), following the bridge's current claim when the
@@ -399,7 +402,7 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
   let sendTopic: number | undefined;
   if (named !== undefined) {
     try {
-      sendTopic = resolveProjectTopicId(findProject(loadConfig(), named));
+      sendTopic = resolveProjectTopicId(findProject(loadConfig(), named), deps.pidAlive ?? pidAlive);
     } catch {
       /* no project config */
     }
@@ -907,10 +910,17 @@ export interface WorkerPaneIdentity {
   sessionFile?: string;
 }
 
-/** A tracked pane, or the explicit reason there is none. Never a silent claim. */
+/** A tracked pane, or the explicit reason there is none. Never a silent claim.
+ *  The tracked variant names the marked workspace the representation lives in,
+ *  so a caller that just created one can protect it from the same pass's
+ *  empty-workspace cleanup. `phase` names the step that refused — `"split"`
+ *  marks the one failure the re-establishment budget spends whole (#998): a
+ *  terminal that refuses to split will refuse every retry within the pass, so
+ *  burning the budget once beats leaking an attempt per reconciliation pass
+ *  against a wall. */
 export type WorkerPaneOutcome =
-  | { kind: "tracked"; paneId: string; label: string; pid: number }
-  | { kind: "unavailable"; reason: string };
+  | { kind: "tracked"; paneId: string; label: string; pid: number; workspaceId?: string }
+  | { kind: "unavailable"; reason: string; phase?: "split" };
 
 /** One `herdr` invocation, injected so every path is testable with no terminal. */
 export type HerdrRun = (args: readonly string[]) => { ok: boolean; stdout: string; stderr: string };
@@ -920,6 +930,9 @@ export interface WorkerPaneDeps {
   session?: string;
   /** The follower command the pane displays; the CLI by default. */
   viewer?: (identity: WorkerPaneIdentity) => readonly string[];
+  /** The durable ownership half of workspace discovery (#1035 review);
+   *  production wires the conductor store, tests a recorder. */
+  ownership?: WorkspaceOwnership;
 }
 
 /**
@@ -932,9 +945,13 @@ export interface WorkerPaneDeps {
 /**
  * The external-supervisor source every conductor pane report carries.
  *
- * This, not the label, is what proves a pane is conductor's: it is written by
- * `openWorkerPane` and read back by {@link listWorkerPanes}, so the two halves
- * of reconciliation cannot come to disagree about what "ours" means.
+ * Written onto every pane conductor reports against. It is no longer what
+ * proves a pane is conductor's: production repeatedly handed back panes whose
+ * `agent_session` record Herdr had dropped (#1035), so filtering by reported
+ * source quietly exempted exactly the panes that needed cleaning. Ownership is
+ * structural now — conductor creates representations only inside a workspace
+ * it marked itself (see {@link WORKER_WORKSPACE_TOKEN}) — and this source
+ * remains on the reports as the display identity of who speaks for a pane.
  */
 export const WORKER_PANE_SOURCE = "omp-conductor";
 
@@ -950,6 +967,26 @@ export const WORKER_PANE_SOURCE = "omp-conductor";
  */
 export const PANE_REATTEMPT_MAX = 3;
 
+/**
+ * The workspace metadata token that marks a workspace as conductor's
+ * per-project worker surface (#1035).
+ *
+ * Written once at creation (`workspace report-metadata --token
+ * conductor_workers=<project>`) and read back from `workspace list`, so
+ * rediscovery survives daemon and Herdr restarts without trusting the label,
+ * the sidebar position, or whichever workspace happens to be focused. Only
+ * panes inside a marked workspace are ever reconciled here, which is what makes
+ * the operator's own panes invisible to this surface by construction — and
+ * what makes every pane inside a marked workspace conductor's, however Herdr
+ * feels about reporting `agent_session` back.
+ */
+export const WORKER_WORKSPACE_TOKEN = "conductor_workers";
+
+/** The dedicated sibling workspace's display label. Never identity. */
+export function workerWorkspaceLabel(project: string): string {
+  return `${project}-workers`;
+}
+
 export function workerPaneLabel(identity: WorkerPaneIdentity): string {
   return `worker-${identity.project}-${identity.issue}-a${identity.attempt}-${identity.runId.slice(0, 8)}`;
 }
@@ -997,41 +1034,402 @@ function parsePaneId(stdout: string): string | undefined {
   return typeof paneId === "string" && paneId.trim() !== "" ? paneId.trim() : undefined;
 }
 
+/**
+ * The workspace and root-pane ids inside `herdr workspace create`'s answer
+ * (`{"id":"cli:workspace:create","result":{"workspace":{…},"root_pane":{…}}}`).
+ * The root pane is the anchor every later split targets, so a create answer
+ * without one is only half a workspace — the caller cleans it up rather than
+ * guessing at a pane to split.
+ */
+function parseCreatedWorkspace(stdout: string): { workspaceId: string; rootPaneId?: string } | undefined {
+  const result = envelopeOf(stdout);
+  if (result === undefined) return undefined;
+  const workspace = result["workspace"];
+  if (workspace === null || typeof workspace !== "object") return undefined;
+  const workspaceId = (workspace as Record<string, unknown>)["workspace_id"];
+  if (typeof workspaceId !== "string" || workspaceId.trim() === "") return undefined;
+  const root = (result as Record<string, unknown>)["root_pane"];
+  const rootPaneId =
+    root !== null && typeof root === "object"
+      ? (root as Record<string, unknown>)["pane_id"]
+      : undefined;
+  return {
+    workspaceId: workspaceId.trim(),
+    ...(typeof rootPaneId === "string" && rootPaneId.trim() !== "" ? { rootPaneId: rootPaneId.trim() } : {}),
+  };
+}
+
+/** The `{result: …}` object of a herdr CLI envelope, or nothing. */
+
+function envelopeOf(stdout: string): Record<string, unknown> | undefined {
+  const line = firstLine(stdout);
+  if (line === "") return undefined;
+  let payload: unknown;
+  try {
+    payload = JSON.parse(line);
+  } catch {
+    return undefined;
+  }
+  if (payload === null || typeof payload !== "object") return undefined;
+  const result = (payload as Record<string, unknown>)["result"];
+  return result === null || typeof result !== "object" ? undefined : (result as Record<string, unknown>);
+}
+
+/** The root-pane id inside a `tab create` answer (`result.root_pane.pane_id`):
+ *  a tab answer carries no workspace object, so {@link parseCreatedWorkspace}
+ *  cannot read it. */
+function parseRootPane(stdout: string): string | undefined {
+  const result = envelopeOf(stdout);
+  const root = result?.["root_pane"];
+  const paneId =
+    root !== null && typeof root === "object" ? (root as Record<string, unknown>)["pane_id"] : undefined;
+  return typeof paneId === "string" && paneId.trim() !== "" ? paneId.trim() : undefined;
+}
+
+/** Every workspace in a `workspace list` answer, with the tokens ownership is read from. */
+function parseWorkspaceList(stdout: string): { workspaces: { workspaceId: string; label?: string; tokens: Record<string, string> }[] } | undefined {
+  const result = envelopeOf(stdout);
+  const raw = result?.["workspaces"];
+  if (!Array.isArray(raw)) return undefined;
+  const workspaces: { workspaceId: string; label?: string; tokens: Record<string, string> }[] = [];
+  for (const entry of raw) {
+    if (entry === null || typeof entry !== "object") continue;
+    const w = entry as Record<string, unknown>;
+    if (typeof w["workspace_id"] !== "string" || w["workspace_id"].trim() === "") continue;
+    const tokens: Record<string, string> = {};
+    if (w["tokens"] !== null && typeof w["tokens"] === "object") {
+      for (const [name, value] of Object.entries(w["tokens"] as Record<string, unknown>)) {
+        if (typeof value === "string") tokens[name] = value;
+      }
+    }
+    workspaces.push({
+      workspaceId: w["workspace_id"],
+      ...(typeof w["label"] === "string" ? { label: w["label"] } : {}),
+      tokens,
+    });
+  }
+  return { workspaces };
+}
+
+/** One pane record out of any `pane list` answer — global or `--workspace`-scoped. */
+export interface ListedPane {
+  paneId: string;
+  /** The run id Herdr still reports for this pane, or "" when it reports none. */
+  runId: string;
+  agent?: string;
+  workspaceId?: string;
+}
+
+/** The panes of a `pane list` answer, carrying whichever fields reconciliation reads. */
+function parsePaneRecords(stdout: string): { panes: ListedPane[] } | undefined {
+  const result = envelopeOf(stdout);
+  const raw = result?.["panes"];
+  if (!Array.isArray(raw)) return undefined;
+  const panes: ListedPane[] = [];
+  for (const entry of raw) {
+    if (entry === null || typeof entry !== "object") continue;
+    const p = entry as Record<string, unknown>;
+    if (typeof p["pane_id"] !== "string" || p["pane_id"].trim() === "") continue;
+    const session = p["agent_session"];
+    const source = session !== null && typeof session === "object" ? (session as Record<string, unknown>)["source"] : undefined;
+    const value = session !== null && typeof session === "object" ? (session as Record<string, unknown>)["value"] : undefined;
+    panes.push({
+      paneId: p["pane_id"].trim(),
+      // Ours by construction inside a marked workspace; the reported session id
+      // is a secondary signal only (#1035), because Herdr has been observed to
+      // drop it while the pane lives on.
+      runId: typeof value === "string" && source === WORKER_PANE_SOURCE ? value : "",
+      ...(typeof p["agent"] === "string" ? { agent: p["agent"] } : {}),
+      ...(typeof p["workspace_id"] === "string" ? { workspaceId: p["workspace_id"] } : {}),
+    });
+  }
+  return { panes };
+}
+
+/** One conductor-marked worker workspace, as discovery returns it. */
+export interface WorkerWorkspace {
+  workspaceId: string;
+  /** The project the marking token binds it to — never derived from the label. */
+  project: string;
+  label?: string;
+}
+
+/**
+ * The durable half of worker-workspace discovery (#1035 review).
+ *
+ * Herdr restores a session's workspaces and panes across a server restart but
+ * drops `report-metadata` tokens — probed live: the restored worker workspace
+ * comes back carrying no tokens at all. Token-only discovery would then ignore
+ * the surface conductor created, build a duplicate beside it, and never be
+ * able to reconcile or remove the restored one's stale panes — exactly the
+ * accumulation this issue exists to end. Ownership is therefore two-legged:
+ * the live token AND the conductor-store record of workspace ids the project
+ * created. Either leg proves ownership; the store is the leg that survives.
+ */
+export interface WorkspaceOwnership {
+  /** Store-recorded workspace ids for a project, oldest first. */
+  recordedWorkspaces(project: string): readonly string[];
+  rememberWorkspace(project: string, workspaceId: string): void;
+  forgetWorkspace(project: string, workspaceId: string): void;
+}
+
+/** Every workspace in a `workspace list` answer, marked or not. */
+function listWorkspacesRaw(
+  deps: { run?: HerdrRun; session?: string } = {},
+): {
+  ok: true;
+  workspaces: { workspaceId: string; label?: string; tokens: Record<string, string> }[];
+} | { ok: false; reason: string } {
+  const run = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  const res = run(["--session", session, "workspace", "list"]);
+  if (!res.ok) {
+    return { ok: false, reason: `herdr workspace list failed: ${firstLine(res.stderr) || "no output"}` };
+  }
+  const parsed = parseWorkspaceList(res.stdout);
+  if (parsed === undefined) return { ok: false, reason: "herdr workspace list was unreadable" };
+  return { ok: true, workspaces: parsed.workspaces };
+}
+
+/**
+ * Every conductor-marked worker workspace Herdr currently has, keyed by nothing:
+ * the caller filters and scopes. Discovery reads the token, not the label — a
+ * renamed workspace is still ours, and a lookalike label without the token is
+ * not (#1035).
+ */
+export function listWorkerWorkspaces(deps: { run?: HerdrRun; session?: string } = {}): {
+  ok: true;
+  workspaces: WorkerWorkspace[];
+} | { ok: false; reason: string } {
+  const listed = listWorkspacesRaw(deps);
+  if (!listed.ok) return listed;
+  const workspaces: WorkerWorkspace[] = [];
+  for (const w of listed.workspaces) {
+    const project = w.tokens[WORKER_WORKSPACE_TOKEN];
+    if (project === undefined || project.trim() === "") continue;
+    workspaces.push({
+      workspaceId: w.workspaceId,
+      project: project.trim(),
+      ...(w.label === undefined ? {} : { label: w.label }),
+    });
+  }
+  return { ok: true, workspaces };
+}
+
+/**
+ * Every worker workspace these projects own on the live Herdr (#1035 review):
+ * token-marked ones plus store-recorded ids that still exist. A recorded id
+ * Herdr no longer lists is dead weight rather than evidence — its workspace is
+ * gone, and reconciliation's removal path is what forgets it.
+ */
+export function ownedWorkerWorkspaces(
+  projects: readonly string[],
+  deps: { run?: HerdrRun; session?: string; ownership?: WorkspaceOwnership } = {},
+): { ok: true; workspaces: WorkerWorkspace[] } | { ok: false; reason: string } {
+  const raw = listWorkspacesRaw(deps);
+  if (!raw.ok) return raw;
+  const scope = new Set(projects);
+  const owned = new Map<string, WorkerWorkspace>();
+  for (const w of raw.workspaces) {
+    const project = w.tokens[WORKER_WORKSPACE_TOKEN]?.trim();
+    if (project === undefined || project === "" || !scope.has(project)) continue;
+    owned.set(w.workspaceId, {
+      workspaceId: w.workspaceId,
+      project,
+      ...(w.label === undefined ? {} : { label: w.label }),
+    });
+    // Adopt token-owned surfaces into the durable leg even when no pane needs
+    // opening this pass. Otherwise an upgrade followed by a Herdr restart can
+    // drop the token before ensureWorkerWorkspace ever records the workspace.
+    deps.ownership?.rememberWorkspace(project, w.workspaceId);
+  }
+  for (const project of projects) {
+    for (const id of deps.ownership?.recordedWorkspaces(project) ?? []) {
+      if (owned.has(id)) continue;
+      const hit = raw.workspaces.find((w) => w.workspaceId === id);
+      if (hit === undefined) {
+        // The workspace disappeared outside conductor. Forget the stale id now
+        // so a future Herdr session cannot reuse it as false ownership.
+        deps.ownership?.forgetWorkspace(project, id);
+        continue;
+      }
+      owned.set(id, { workspaceId: id, project, ...(hit.label === undefined ? {} : { label: hit.label }) });
+    }
+  }
+  return { ok: true, workspaces: [...owned.values()] };
+}
+
+export type WorkerWorkspaceResolution =
+  | { kind: "ready"; workspaceId: string; anchorPaneId: string; created?: true }
+  | { kind: "unavailable"; reason: string };
+
+/**
+ * Find this project's worker workspace or create it — the single door every
+ * split goes through (#1035).
+ *
+ * Identity is two-legged now (#1035 review): the marking token OR the
+ * conductor-store record, so rediscovery after any restart finds the same
+ * workspace whatever Herdr preserved. Duplicates are deliberately NOT
+ * resolved here: closing one blind — without listing its panes or checking
+ * the result — could destroy the only live representation and strand the
+ * durable row pointing at a dead pane. Convergence belongs to
+ * {@link reconcileWorkerPanes}, which attributes every pane first and removes
+ * a duplicate only once nothing living holds it. A discovered workspace with
+ * no panes gets a fresh tab rather than failing forever; a workspace CREATED
+ * by this call is closed again on every later failure, because newly-made
+ * residue is exactly what the acceptance criterion forbids.
+ */
+export function ensureWorkerWorkspace(
+  project: string,
+  deps: { run?: HerdrRun; session?: string; ownership?: WorkspaceOwnership } = {},
+): WorkerWorkspaceResolution {
+  const run = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  const base = ["--session", session];
+
+  let listed = ownedWorkerWorkspaces([project], deps);
+  if (!listed.ok) return { kind: "unavailable", reason: listed.reason };
+
+  for (const existing of [...listed.workspaces].sort((a, b) => (a.workspaceId < b.workspaceId ? -1 : 1))) {
+    const res = run([...base, "pane", "list", "--workspace", existing.workspaceId]);
+    if (!res.ok) {
+      return { kind: "unavailable", reason: `herdr pane list failed: ${firstLine(res.stderr) || "no output"}` };
+    }
+    const parsed = parsePaneRecords(res.stdout);
+    if (parsed === undefined) return { kind: "unavailable", reason: "herdr pane list was unreadable" };
+    let anchor = parsed.panes[0]?.paneId;
+    if (anchor === undefined) {
+      // No pane to split: give the workspace a fresh tab and use its root pane.
+      const tabbed = run([...base, "tab", "create", "--workspace", existing.workspaceId, "--no-focus"]);
+      if (!tabbed.ok) {
+        return { kind: "unavailable", reason: `herdr tab create failed: ${firstLine(tabbed.stderr) || "no output"}` };
+      }
+      anchor = parseRootPane(tabbed.stdout);
+      if (anchor === undefined) {
+        return { kind: "unavailable", reason: "herdr tab create reported no root pane" };
+      }
+    }
+    // Adopted into the store: if this workspace's token is what Herdr drops
+    // next restart, the record below is what still finds it.
+    deps.ownership?.rememberWorkspace(project, existing.workspaceId);
+    return { kind: "ready", workspaceId: existing.workspaceId, anchorPaneId: anchor };
+  }
+
+  const made = run([
+    ...base,
+    "workspace",
+    "create",
+    "--label",
+    workerWorkspaceLabel(project),
+    "--no-focus",
+  ]);
+  if (!made.ok) {
+    return { kind: "unavailable", reason: `herdr workspace create failed: ${firstLine(made.stderr) || "no output"}` };
+  }
+  const parsed = parseCreatedWorkspace(made.stdout);
+  if (parsed === undefined) {
+    return { kind: "unavailable", reason: "herdr workspace create reported no workspace id" };
+  }
+  /** This attempt made the workspace, so every exit from here takes it back. */
+  const discardMade = (): void => {
+    run([...base, "workspace", "close", parsed.workspaceId]);
+    deps.ownership?.forgetWorkspace(project, parsed.workspaceId);
+  };
+  // Mark before use: an unmarked workspace would be invisible to token-side
+  // discovery on the next pass — an empty shell accumulating precisely as
+  // #1035 describes. A failure here takes the half-made workspace with it.
+  const marked = run([
+    ...base,
+    "workspace",
+    "report-metadata",
+    parsed.workspaceId,
+    "--source",
+    WORKER_PANE_SOURCE,
+    "--token",
+    `${WORKER_WORKSPACE_TOKEN}=${project}`,
+  ]);
+  if (!marked.ok) {
+    discardMade();
+    return {
+      kind: "unavailable",
+      reason: `herdr workspace report-metadata failed: ${firstLine(marked.stderr) || "no output"}`,
+    };
+  }
+  if (parsed.rootPaneId === undefined) {
+    // No anchor means no split can ever be targeted; a fresh-made workspace
+    // without one is residue this very attempt must not leave behind
+    // (#1035 review) — so it goes now, not on some later pass.
+    discardMade();
+    return { kind: "unavailable", reason: "herdr workspace create reported no root pane" };
+  }
+  deps.ownership?.rememberWorkspace(project, parsed.workspaceId);
+  return { kind: "ready", workspaceId: parsed.workspaceId, anchorPaneId: parsed.rootPaneId, created: true };
+}
+
 /**
  * Create the pane, run the follower in it, and report the child's identity and
  * initial state — or say exactly why it could not.
  *
- * Every step is checked, and the first failure returns `unavailable` with the
- * reason — and closes the pane the split had already created, because a
- * partially established representation is worse than none: it is a pane the
- * operator would read as a tracked worker, and before #992 it was left behind
- * on every single launch. What this deliberately does NOT do is decide what a
- * failure means for the launch — failing closed versus running degraded is
- * #841's policy, and inventing it here would pre-empt it.
+ * The representation lives in the project's worker workspace (#1035), found or
+ * created first, and the split targets an anchor pane inside it explicitly, so
+ * the operator's own layout is never touched. Every step is checked, and the
+ * first failure returns `unavailable` with the reason and leaves ZERO residue
+ * of this attempt (#1035 review): the pane the split had already created is
+ * closed, and a workspace this call CREATED is closed with it — only surfaces
+ * that already existed are preserved. A partially established representation
+ * is worse than none: it is a pane the operator would read as a tracked
+ * worker, and before #992 it was left behind on every single launch. What
+ * this deliberately does NOT do is decide what a failure means for the launch
+ * — failing closed versus running degraded is #841's policy, and inventing it
+ * here would pre-empt it.
  */
 export function openWorkerPane(identity: WorkerPaneIdentity, deps: WorkerPaneDeps = {}): WorkerPaneOutcome {
   const run = deps.run ?? realHerdrRun;
   const session = deps.session ?? resolveHerdrSession();
   const label = workerPaneLabel(identity);
+  const ensured = ensureWorkerWorkspace(identity.project, deps);
+  if (ensured.kind === "unavailable") return ensured;
   const base = ["--session", session, "pane"];
 
-  const split = run([...base, "split", "--direction", "down", "--ratio", "0.3"]);
+  /** Undo everything this attempt built so far — the split's pane once there
+   *  is one, and always a workspace this call itself created (#1035 review). */
+  const abandon = (reason: string, phase?: "split", paneId?: string): WorkerPaneOutcome => {
+    if (paneId !== undefined) run([...base, "close", paneId]);
+    if (ensured.created === true) {
+      run(["--session", session, "workspace", "close", ensured.workspaceId]);
+      deps.ownership?.forgetWorkspace(identity.project, ensured.workspaceId);
+    }
+    return { kind: "unavailable", reason, ...(phase === undefined ? {} : { phase }) };
+  };
+
+  // The explicit target is the whole point (#1035): the split names a pane
+  // inside the worker workspace, so whichever pane the operator happens to be
+  // looking at is never touched.
+  const split = run([
+    ...base,
+    "split",
+    "--pane",
+    ensured.anchorPaneId,
+    "--direction",
+    "down",
+    "--ratio",
+    "0.3",
+    "--no-focus",
+  ]);
   if (!split.ok) {
-    return { kind: "unavailable", reason: `herdr pane split failed: ${firstLine(split.stderr) || "no output"}` };
+    return abandon(
+      `herdr pane split failed: ${firstLine(split.stderr) || "no output"}`,
+      "split",
+    );
   }
   const paneId = parsePaneId(split.stdout);
   if (paneId === undefined) {
-    return { kind: "unavailable", reason: "herdr pane split reported no pane id" };
+    return abandon("herdr pane split reported no pane id");
   }
-  // The split has created a pane. From here every exit must take it with it.
-  const abandon = (reason: string): WorkerPaneOutcome => {
-    run([...base, "close", paneId]);
-    return { kind: "unavailable", reason };
-  };
 
   const named = run([...base, "rename", paneId, label]);
   if (!named.ok) {
-    return abandon(`herdr pane rename failed: ${firstLine(named.stderr) || "no output"}`);
+    return abandon(`herdr pane rename failed: ${firstLine(named.stderr) || "no output"}`, undefined, paneId);
   }
 
   // Identity before display: the pane must be attributable to this exact run
@@ -1052,12 +1450,16 @@ export function openWorkerPane(identity: WorkerPaneIdentity, deps: WorkerPaneDep
     WORKER_PANE_SOURCE,
   ]);
   if (!identified.ok) {
-    return abandon(`herdr pane report-agent-session failed: ${firstLine(identified.stderr) || "no output"}`);
+    return abandon(
+      `herdr pane report-agent-session failed: ${firstLine(identified.stderr) || "no output"}`,
+      undefined,
+      paneId,
+    );
   }
 
   const started = run([...base, "run", paneId, ...deps.viewer?.(identity) ?? defaultViewer(identity)]);
   if (!started.ok) {
-    return abandon(`herdr pane run failed: ${firstLine(started.stderr) || "no output"}`);
+    return abandon(`herdr pane run failed: ${firstLine(started.stderr) || "no output"}`, undefined, paneId);
   }
 
   // A worker that has just spawned is working by definition. The ongoing
@@ -1065,9 +1467,9 @@ export function openWorkerPane(identity: WorkerPaneIdentity, deps: WorkerPaneDep
   // events — never from the pane's output.
   const reported = reportWorkerPaneState(paneId, label, "working", { run, session });
   if (!reported.ok) {
-    return abandon(reported.reason);
+    return abandon(reported.reason, undefined, paneId);
   }
-  return { kind: "tracked", paneId, label, pid: identity.pid };
+  return { kind: "tracked", paneId, label, pid: identity.pid, workspaceId: ensured.workspaceId };
 }
 
 /** Report one lifecycle state for a tracked pane. Monotonic `seq` is the caller's. */
@@ -1100,12 +1502,11 @@ export function reportWorkerPaneState(
 }
 
 /**
- * Hand lifecycle authority back when the worker is gone.
- *
- * Release, never close: whether a settled worker's pane is closed, kept, or
- * retained for N settlements is #841's documented policy, and a slice that
- * closed panes here would decide it by accident. Releasing says only "conductor
- * no longer speaks for this agent", which is exactly what is true.
+ * Hand lifecycle authority back when conductor no longer speaks for a pane's
+ * agent. Half of {@link retireWorkerPane}: it says "this agent record is no
+ * longer ours" without removing anything, which is what reconciliation wants
+ * for a pane it is about to close anyway but also stands alone for callers
+ * that only re-report identity (#842's adopt path).
  */
 export function releaseWorkerPane(
   paneId: string,
@@ -1131,71 +1532,153 @@ export function releaseWorkerPane(
     : { ok: false, reason: `herdr pane release-agent failed: ${firstLine(res.stderr) || "no output"}` };
 }
 
+/** Close one pane outright. The pane holds only ever a follower, so closing
+ *  it cannot reach the authoritative worker — that child belongs to the
+ *  daemon's process tree, not to any terminal (#1035). */
+export function closeWorkerPane(
+  paneId: string,
+  deps: { run?: HerdrRun; session?: string } = {},
+): { ok: true } | { ok: false; reason: string } {
+  const run = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  const res = run(["--session", session, "pane", "close", paneId]);
+  return res.ok
+    ? { ok: true }
+    : { ok: false, reason: `herdr pane close failed: ${firstLine(res.stderr) || "no output"}` };
+}
+
+/**
+ * Retire one run's visual representation (#1035): hand lifecycle authority
+ * back to Herdr, then close the pane.
+ *
+ * #841 originally stopped at release, and production showed what that leaves:
+ * panes advertising `working` for runs that had settled hours earlier, their
+ * follower long exited, a bare shell where a worker used to be. A settled run
+ * keeps no representation. The close reaches only the follower — the
+ * authoritative child was never in the pane, so nothing here can signal it.
+ *
+ * A close failure is reported, not swallowed: the next reconciliation pass
+ * sees the pane as unclaimed junk and closes it again, so one refusal costs a
+ * pass rather than the representation.
+ */
+export function retireWorkerPane(
+  paneId: string,
+  label: string,
+  deps: { run?: HerdrRun; session?: string; seq?: number } = {},
+): { ok: true } | { ok: false; reason: string } {
+  const released = releaseWorkerPane(paneId, label, deps);
+  if (!released.ok) return released;
+  return closeWorkerPane(paneId, deps);
+}
+
 /**
- * Hand back the pane a dead worker left behind (#842).
+ * Hand back the representation a dead worker left behind (#842), retired for
+ * good by closing it (#1035) — but only once the recorded pane is PROVEN still
+ * conductor's (#1035 review).
  *
  * Called for every run a restart reaps. The recorded pid is deliberately NOT
  * consulted for liveness: a `session-host` child dies with the daemon that owned
  * its verb socket, so an orphaned row's worker is gone whatever pid it carries —
  * and pids are reused, so checking one is how a stranger's process comes to read
- * as a live worker. A run with no recorded pane is a no-op, not a failure: it
- * never had one to release.
+ * as a live worker. The same reuse argument applies to pane ids: after a Herdr
+ * restart the stored `w2:pT` may belong to a pane in somebody else's workspace,
+ * so a blind release+close could destroy a stranger's terminal. Ownership is
+ * therefore proven before anything is closed:
+ *
+ * - the pane must be listed inside a workspace conductor OWNS — a
+ *   {@link WORKER_WORKSPACE_TOKEN}-marked one, or one the store recorded for
+ *   the run's project (#1035 review: Herdr restarts restore workspaces without
+ *   their tokens, and a token-only check would leave the restored pane
+ *   unretired forever); and
  */
 export function releaseOrphanedWorkerPane(
-  run: { paneId?: string; paneLabel?: string },
-  deps: { run?: HerdrRun; session?: string; seq?: number } = {},
-): { kind: "none" } | { kind: "released"; paneId: string } | { kind: "failed"; paneId: string; reason: string } {
+  run: { paneId?: string; paneLabel?: string; runId?: string; project?: string },
+  deps: { run?: HerdrRun; session?: string; seq?: number; ownership?: WorkspaceOwnership } = {},
+):
+  | { kind: "none" }
+  | { kind: "released"; paneId: string }
+  | { kind: "failed"; paneId: string; reason: string }
+  | { kind: "unowned"; paneId: string; reason: string } {
   if (run.paneId === undefined || run.paneLabel === undefined) return { kind: "none" };
-  const released = releaseWorkerPane(run.paneId, run.paneLabel, deps);
-  return released.ok
+  const discovered = ownedWorkerWorkspaces(run.project === undefined ? [] : [run.project], deps);
+  if (!discovered.ok) {
+    return { kind: "failed", paneId: run.paneId, reason: discovered.reason };
+  }
+  const runFn = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  let home: string | undefined;
+  let reportedAgent: string | undefined;
+  let reportedSession: string | undefined;
+  for (const ws of discovered.workspaces) {
+    const res = runFn(["--session", session, "pane", "list", "--workspace", ws.workspaceId]);
+    if (!res.ok) {
+      return {
+        kind: "failed",
+        paneId: run.paneId,
+        reason: `herdr pane list failed: ${firstLine(res.stderr) || "no output"}`,
+      };
+    }
+    const parsed = parsePaneRecords(res.stdout);
+    if (parsed === undefined) {
+      return { kind: "failed", paneId: run.paneId, reason: "herdr pane list was unreadable" };
+    }
+    const found = parsed.panes.find((pane) => pane.paneId === run.paneId);
+    if (found !== undefined && home === undefined) {
+      home = ws.workspaceId;
+      if (found.agent !== undefined) reportedAgent = found.agent;
+      if (found.runId !== "") reportedSession = found.runId;
+    }
+  }
+  if (home === undefined) {
+    // Not in any marked workspace: either already retired or never ours to
+    // touch. Both answers close nothing.
+    return { kind: "none" };
+  }
+  if (
+    (reportedAgent !== undefined && reportedAgent !== run.paneLabel) ||
+    (reportedSession !== undefined && run.runId !== undefined && reportedSession !== run.runId)
+  ) {
+    return {
+      kind: "unowned",
+      paneId: run.paneId,
+      reason: `pane ${run.paneId} in marked workspace ${home} reports another identity (agent ${reportedAgent ?? "none"}, session ${reportedSession ?? "none"})`,
+    };
+  }
+  const retired = retireWorkerPane(run.paneId, run.paneLabel, deps);
+  return retired.ok
     ? { kind: "released", paneId: run.paneId }
-    : { kind: "failed", paneId: run.paneId, reason: released.reason };
+    : { kind: "failed", paneId: run.paneId, reason: retired.reason };
 }
 
 /**
- * Every conductor-owned pane Herdr currently has, keyed by the run id it was
- * reported under (#841).
+ * Every pane inside a conductor-marked worker workspace (#1035).
  *
- * Read from `pane list`'s own agent-session record, never from a label pattern:
- * the label is what a human reads, and matching on it is exactly how a stale
- * lookalike (a renamed pane, a pane from a previous fleet) gets mistaken for a
- * live worker. `source` proves conductor reported it; `value` is the run id.
+ * Ownership here is structural: conductor created the workspace, marked it,
+ * and splits into it exclusively, so every pane inside it is conductor's
+ * however Herdr feels about reporting `agent_session` back — production has
+ * repeatedly handed back worker panes with that record dropped to null, which
+ * is why the previous source-filtered listing could not see the very panes
+ * that needed cleaning. The reported session id still rides along as a
+ * secondary attribution signal; an empty run id means "unattributable", and
+ * unattributable panes in a marked workspace are exactly the stale shells
+ * this surface exists to converge away.
  */
 export function listWorkerPanes(
   deps: { run?: HerdrRun; session?: string } = {},
-): { ok: true; panes: { paneId: string; runId: string; label?: string }[] } | { ok: false; reason: string } {
+): { ok: true; panes: (ListedPane & { project: string })[] } | { ok: false; reason: string } {
+  const workspaces = listWorkerWorkspaces(deps);
+  if (!workspaces.ok) return workspaces;
   const run = deps.run ?? realHerdrRun;
   const session = deps.session ?? resolveHerdrSession();
-  const res = run(["--session", session, "pane", "list"]);
-  if (!res.ok) {
-    return { ok: false, reason: `herdr pane list failed: ${firstLine(res.stderr) || "no output"}` };
-  }
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(res.stdout);
-  } catch (err) {
-    return { ok: false, reason: `herdr pane list was unreadable: ${err instanceof Error ? err.message : String(err)}` };
-  }
-  const panes = (parsed as { result?: { panes?: unknown[] } }).result?.panes;
-  if (!Array.isArray(panes)) return { ok: false, reason: "herdr pane list carried no pane array" };
-  const owned: { paneId: string; runId: string; label?: string }[] = [];
-  for (const pane of panes) {
-    const p = pane as {
-      pane_id?: unknown;
-      agent?: unknown;
-      agent_session?: { source?: unknown; value?: unknown };
-    };
-    if (typeof p.pane_id !== "string") continue;
-    if (p.agent_session?.source !== WORKER_PANE_SOURCE) continue;
-    const runId = p.agent_session.value;
-    // Ours by source but carrying no run id: an identity nobody can resolve is
-    // not an identity. Reported as a pane with an empty run id so the caller
-    // treats it as stale rather than silently ignoring it.
-    owned.push({
-      paneId: p.pane_id,
-      runId: typeof runId === "string" ? runId : "",
-      ...(typeof p.agent === "string" ? { label: p.agent } : {}),
-    });
+  const owned: (ListedPane & { project: string })[] = [];
+  for (const ws of workspaces.workspaces) {
+    const res = run(["--session", session, "pane", "list", "--workspace", ws.workspaceId]);
+    if (!res.ok) {
+      return { ok: false, reason: `herdr pane list failed: ${firstLine(res.stderr) || "no output"}` };
+    }
+    const parsed = parsePaneRecords(res.stdout);
+    if (parsed === undefined) return { ok: false, reason: "herdr pane list carried no pane array" };
+    for (const pane of parsed.panes) owned.push({ ...pane, project: ws.project });
   }
   return { ok: true, panes: owned };
 }
@@ -1213,43 +1696,147 @@ export interface LiveWorkerPane {
   sessionFile?: string;
 }
 
+export type StaleCause = "settled" | "duplicate" | "unidentified";
+
 export type WorkerPaneReconciliation =
-  /** The recorded pane is still there and still carries this run — nothing done. */
+  /** The recorded pane is still there and its follower is alive — nothing done. */
   | { kind: "intact"; runId: string; paneId: string }
-  /** Herdr lost the pane (a restart); a new one now represents the same child. */
+  /** The pane stands but its follower table could not decide life or death:
+   *  no evidence, no destruction (#1035 review). The visual may be stale; the
+   *  caller says so once instead of gambling a live worker's representation. */
+  | { kind: "visual-unreadable"; runId: string; paneId: string; reason: string }
+  /** The run had no usable representation; a new one now represents the same
+   *  child — a Herdr restart, a missing pane, or a follower that had exited. */
   | { kind: "reassociated"; runId: string; paneId: string; label: string }
   /** No representation, and the reason. The run keeps working regardless.
    *  `attempted` marks the ones that spent a re-establishment attempt (#998),
-   *  so the caller can bound them; the no-pid case costs nothing. */
-  | { kind: "untracked"; runId: string; reason: string; attempted?: true }
+   *  so the caller can bound them; the no-pid case costs nothing. `phase`
+   *  carries {@link WorkerPaneOutcome}'s split marker through. */
+  | { kind: "untracked"; runId: string; reason: string; attempted?: true; phase?: "split" }
   /** The attempt budget for this run is spent, so nothing was tried this pass
    *  (#998). Before this existed, a run whose pane could not be created was
    *  retried on every reconciliation pass forever — and each attempt leaked a
    *  pane until #992, ending in `ghostty error -2` once enough had piled up. */
   | { kind: "attempts-exhausted"; runId: string; attempts: number }
-  /** A conductor pane whose run is not live: handed back to Herdr. */
-  | { kind: "stale-released"; paneId: string; runId: string }
-  | { kind: "stale-release-failed"; paneId: string; runId: string; reason: string };
+  /** A conductor-workspace pane with no live run behind it: authority handed
+   *  back and the pane closed. `settled` — the run finished and its retirement
+   *  never landed; `duplicate` — a second representation of one live run, or
+   *  the one a fresh replacement displaced; `unidentified` — a representation
+   *  whose run id nobody can resolve any more, the bare shells production
+   *  accumulated (#1035). */
+  | { kind: "stale-released"; paneId: string; runId: string; cause: StaleCause }
+  | { kind: "stale-release-failed"; paneId: string; runId: string; reason: string; cause: StaleCause }
+  /** A scoped marked workspace nobody's live run holds any more, emptied by
+   *  the cleanup above, is closed (#1035). Every marked workspace converges,
+   *  not just one per project (#1035 review). */
+  | { kind: "workspace-removed"; project: string; workspaceId: string }
+  | { kind: "workspace-remove-failed"; project: string; workspaceId: string; reason: string };
+
+/** The verdict the foreground process table supports about one pane's
+ *  read-only follower. Terminal output is never read: this says whether the
+ *  *visual* is alive, nothing more, and settlement stays the store's business
+ *  (#1035). `unknown` is a real verdict, not an error — recognition of
+ *  `omp-conductor` in the table is positive evidence of life, but its absence
+ *  is only evidence of death when every entry carries enough identity (name or
+ *  argv) to rule it out. Real Herdr answers name + argv; a table with blanked
+ *  or missing fields, no shell pid, or no entries at all cannot decide, and a
+ *  pane destroyed on a guess we did not have is a live worker gone blind. */
+export type FollowerPulse =
+  | { pulse: "alive" }
+  | { pulse: "dead" }
+  | { pulse: "unknown"; reason: string };
+
+export function followerPulseFromProcessInfo(info: ProcessInfo): FollowerPulse {
+  const procs = Array.isArray(info.foreground_processes) ? info.foreground_processes : undefined;
+  if (procs === undefined || procs.length === 0) {
+    return { pulse: "unknown", reason: "process-info carried no foreground process table" };
+  }
+  const shell = typeof info.shell_pid === "number" ? info.shell_pid : undefined;
+  let nonShell = false;
+  for (const proc of procs) {
+    const parts = [proc.name ?? "", proc.argv0 ?? "", ...(proc.argv ?? [])];
+    const isShell = shell !== undefined && proc.pid === shell;
+    if (!isShell && !parts.some((a) => a !== "")) {
+      return { pulse: "unknown", reason: `foreground pid ${proc.pid ?? "unknown"} carries no name or argv` };
+    }
+    if (!isShell) {
+      nonShell = true;
+      if (parts.some((a) => a.toLowerCase() === "omp-conductor" || a.toLowerCase().endsWith("/omp-conductor"))) {
+        return { pulse: "alive" };
+      }
+    }
+  }
+  if (!nonShell && shell === undefined) {
+    return { pulse: "unknown", reason: "process-info named neither a shell nor any identifiable process" };
+  }
+  return { pulse: "dead" };
+}
+
+/**
+ * Probe one pane's follower liveness. A probe that cannot be read, or a table
+ * that cannot decide, answers `unknown` rather than dead: destroying a
+ * representation on evidence we do not have is how a healthy worker goes blind
+ * mid-run.
+ */
+export function paneFollowerAlive(
+  paneId: string,
+  deps: { run?: HerdrRun; session?: string } = {},
+): FollowerPulse {
+  const run = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  const res = run(["--session", session, "pane", "process-info", "--pane", paneId]);
+  if (!res.ok) {
+    return {
+      pulse: "unknown",
+      reason: `herdr pane process-info failed: ${firstLine(res.stderr) || "no output"}`,
+    };
+  }
+  try {
+    return followerPulseFromProcessInfo(parseHerdrProcessInfo(res.stdout, paneId));
+  } catch (err) {
+    return { pulse: "unknown", reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+function firstLine(text: string): string {
+  return text.split("\n", 1)[0]?.trim() ?? "";
+}
+/** The kill syscall, injectable so error mapping is testable without one. */
+export type KillFn = (pid: number, sig: NodeJS.Signals | 0) => void;
+
+const realKill: KillFn = (pid, sig) => {
+  process.kill(pid, sig);
+};
 
 /**
- * Make Herdr's conductor-owned panes agree with the live run set (#841).
+ * Make the conductor-owned worker workspaces agree with the live run set
+ * (#841, reworked by #1035).
  *
  * Idempotent by construction: a second pass over an already-reconciled fleet
- * returns `intact` for every live run and finds no stale panes, so repeated
- * daemon or Herdr restarts converge rather than accumulate.
+ * returns `intact` for every live run and finds nothing left to close, so
+ * repeated launch/settlement/restart cycles converge instead of accumulating.
  *
- * Three rules, and each exists to refuse a specific way this goes wrong:
+ * Four rules, and each exists to refuse a specific way this goes wrong:
  *
- * - **A live run's pane is re-created, never duplicated.** Re-association is
- *   keyed on the run id Herdr itself reports, so a pane that is still there is
- *   left alone. Only a run whose pane Herdr no longer has gets a new one.
- * - **Cleanup is by exact identity, never by name or age.** A pane is stale only
- *   when the run id it carries is absent from the live set. A worker's own pane
- *   can therefore never be released while its run is live, whatever it is called
- *   and however old it is.
- * - **Nothing here can stop a worker.** The only mutation is `release-agent`,
- *   which hands lifecycle authority back to Herdr; the authoritative child is
- *   never signalled, and its pane is never closed.
+ * - **Only owned workspaces are touched.** Scope is the projects of the live
+ *   set plus the caller's managed list; ownership is the marking token OR the
+ *   conductor-store record (#1035 review), so a Herdr restart that drops
+ *   tokens still finds the restored surface. A pane in another project's
+ *   worker workspace is invisible to this pass, which is what keeps conductor
+ *   and veltrosecurity from discovering, reusing, or cleaning each other.
+ * - **Attribution is exact, structural first.** A pane belongs to the live run
+ *   the store recorded it under; the session id Herdr reports is the fallback.
+ *   Everything else in an owned workspace — a settled run's leftover, a
+ *   duplicate of a live run, a representation whose identity Herdr dropped —
+ *   is closed, because inside an owned workspace "ours" and "junk" are the
+ *   only options and leaving junk is what filled the operator's layout.
+ * - **A live run keeps exactly one living representation.** Duplicates fold
+ *   into the recorded pane; a pane whose follower has exited is replaced while
+ *   the run is live; a missing pane is recreated — all bounded by the same
+ *   re-establishment budget (#998).
+ * - **Nothing here can stop a worker.** Panes hold followers only; the
+ *   authoritative child lives in the daemon's process tree and is never
+ *   signalled, and worker liveness comes from the caller's live set alone.
  */
 export function reconcileWorkerPanes(
   live: readonly LiveWorkerPane[],
@@ -1258,39 +1845,184 @@ export function reconcileWorkerPanes(
    *  and a daemon restart legitimately gets a fresh budget (#998). */
   attempts: ReadonlyMap<string, number> = new Map(),
   maxAttempts = PANE_REATTEMPT_MAX,
+  /** Projects this pass manages even when they have no live runs: their stale
+   *  panes are cleaned and a workspace left empty by that cleanup is removed. */
+  managedProjects: readonly string[] = [],
 ): { ok: true; outcomes: WorkerPaneReconciliation[] } | { ok: false; reason: string } {
-  const listed = listWorkerPanes(deps);
-  if (!listed.ok) return { ok: false, reason: listed.reason };
-  const byRun = new Map(listed.panes.map((pane) => [pane.runId, pane]));
-  const liveIds = new Set(live.map((worker) => worker.runId));
+  const run = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  const base = ["--session", session];
+
+  const scope = new Set([...managedProjects, ...live.map((worker) => worker.project)]);
+  const discovered = ownedWorkerWorkspaces([...scope], deps);
+  if (!discovered.ok) return { ok: false, reason: discovered.reason };
+  // Deterministic order so outcomes and closes are reproducible pass to pass.
+  const scoped = [...discovered.workspaces].sort((a, b) => (a.workspaceId < b.workspaceId ? -1 : 1));
+
+  // Every marked workspace of every scoped project converges (#1035 review):
+  // duplicate token-marked workspaces are cleaned like any other, so a settled
+  // project cannot keep stale shells in a second marked surface nobody tracks.
+  const entries: { ws: WorkerWorkspace; panes: ListedPane[] }[] = [];
+  for (const ws of scoped) {
+    const res = run([...base, "pane", "list", "--workspace", ws.workspaceId]);
+    if (!res.ok) {
+      // An unreadable workspace is not evidence that anything is stale, so the
+      // pass mutates nothing rather than closing on a guess.
+      return { ok: false, reason: `herdr pane list failed: ${firstLine(res.stderr) || "no output"}` };
+    }
+    const parsed = parsePaneRecords(res.stdout);
+    if (parsed === undefined) return { ok: false, reason: "herdr pane list carried no pane array" };
+    entries.push({ ws, panes: parsed.panes });
+  }
+
+  const liveByRun = new Map(live.map((worker) => [worker.runId, worker]));
   const outcomes: WorkerPaneReconciliation[] = [];
+  /** Panes this pass will close, with the identity the outcome names. */
+  const junk = new Map<string, { runId: string; cause: StaleCause; agent?: string }>();
+  /** Panes still standing when cleanup ends, keyed to their workspace — an
+   *  occupied workspace survives, whichever marked surface it sits in. */
+  const standingWs = new Map<string, string>();
+  /** Workspaces that gained a representation this pass, read from the tracked
+   *  outcomes: their listing predates the new pane, so removal never judges
+   *  them on it. */
+  const openedWs = new Set<string>();
+
+  /** One representation per live run: the pane plus the marked workspace that
+   *  holds it. Attribution runs across ALL of a project's marked workspaces,
+   *  because the recorded pane may sit in any of them. */
+  const held = new Map<string, { pane: ListedPane; wsId: string }>();
+  for (const entry of entries) {
+    const projectLive = live.filter((worker) => worker.project === entry.ws.project);
+    for (const pane of entry.panes) {
+      standingWs.set(pane.paneId, entry.ws.workspaceId);
+      const owner =
+        projectLive.find((worker) => worker.paneId === pane.paneId) ??
+        (pane.runId === "" ? undefined : liveByRun.get(pane.runId));
+      if (owner === undefined || owner.project !== entry.ws.project) {
+        // Not attributable to any live run of this project: a settled run's
+        // leftover (still carrying its old id) or an unidentified shell.
+        junk.set(pane.paneId, {
+          runId: pane.runId,
+          cause: pane.runId === "" ? "unidentified" : "settled",
+          ...(pane.agent === undefined ? {} : { agent: pane.agent }),
+        });
+        continue;
+      }
+      const bucket = held.get(owner.runId);
+      if (bucket === undefined) {
+        held.set(owner.runId, { pane, wsId: entry.ws.workspaceId });
+        continue;
+      }
+      // Exactly one focusable representation per live run: the recorded pane
+      // wins so the durable row stays true without a write; the other is a
+      // duplicate (#1035).
+      const keep =
+        bucket.pane.paneId === owner.paneId
+          ? bucket
+          : pane.paneId === owner.paneId
+            ? { pane, wsId: entry.ws.workspaceId }
+            : bucket;
+      const drop = keep.pane.paneId === bucket.pane.paneId ? pane : bucket.pane;
+      held.set(owner.runId, keep);
+      junk.set(drop.paneId, {
+        runId: owner.runId,
+        cause: "duplicate",
+        ...(drop.agent === undefined ? {} : { agent: drop.agent }),
+      });
+    }
+  }
 
   for (const worker of live) {
-    const held = byRun.get(worker.runId);
-    if (held !== undefined) {
-      outcomes.push({ kind: "intact", runId: worker.runId, paneId: held.paneId });
+    const hold = held.get(worker.runId);
+    if (hold === undefined) {
+      // No representation anywhere in the marked workspaces. Only the pid makes
+      // a replacement honest: the pane represents an exact child, so without
+      // one there is nothing to represent and inventing a pane would be the
+      // silent claim this whole surface exists to avoid.
+      if (worker.pid === undefined) {
+        outcomes.push({
+          kind: "untracked",
+          runId: worker.runId,
+          reason: "no session-host pid was ever recorded for this run",
+        });
+        continue;
+      }
+      // The budget, checked before the attempt: an exhausted run is skipped
+      // silently here and reported once by the caller (#998).
+      const spent = attempts.get(worker.runId) ?? 0;
+      if (spent >= maxAttempts) {
+        outcomes.push({ kind: "attempts-exhausted", runId: worker.runId, attempts: spent });
+        continue;
+      }
+      const opened = openWorkerPane(
+        {
+          project: worker.project,
+          issue: worker.issue,
+          attempt: worker.attempt,
+          runId: worker.runId,
+          pid: worker.pid,
+          ...(worker.sessionFile === undefined ? {} : { sessionFile: worker.sessionFile }),
+        },
+        deps,
+      );
+      if (opened.kind === "tracked") {
+        if (opened.workspaceId !== undefined) openedWs.add(opened.workspaceId);
+        outcomes.push({
+          kind: "reassociated",
+          runId: worker.runId,
+          paneId: opened.paneId,
+          label: opened.label,
+        });
+      } else {
+        outcomes.push({
+          kind: "untracked",
+          runId: worker.runId,
+          reason: opened.reason,
+          attempted: true,
+          ...(opened.phase === undefined ? {} : { phase: opened.phase }),
+        });
+      }
+      continue;
+    }
+    // The pane stands. Whether it still shows anything is the follower's
+    // question, asked only to decide the *visual* — never settlement (#1035).
+    // A probe that cannot be read, or a table that cannot decide, is no
+    // evidence the visual died: it is reported and the pane keeps standing,
+    // because a live worker's representation is never destroyed on a guess.
+    const pulse = paneFollowerAlive(hold.pane.paneId, deps);
+    if (pulse.pulse !== "dead") {
+      outcomes.push(
+        pulse.pulse === "alive"
+          ? { kind: "intact", runId: worker.runId, paneId: hold.pane.paneId }
+          : {
+              kind: "visual-unreadable",
+              runId: worker.runId,
+              paneId: hold.pane.paneId,
+              reason: pulse.reason,
+            },
+      );
       continue;
     }
-    // Herdr does not have this run's pane. Only the pid makes a replacement
-    // honest: the pane represents an exact child, so without one there is
-    // nothing to represent and inventing a pane would be the silent claim this
-    // whole surface exists to avoid.
+    // The follower has provably exited. A replacement represents the exact
+    // child, so a run with no recorded pid keeps its dead pane rather than
+    // gaining a representation of nobody — reported so the record drops and
+    // the next pass reads the orphan as junk.
     if (worker.pid === undefined) {
       outcomes.push({
         kind: "untracked",
         runId: worker.runId,
-        reason: "no session-host pid was ever recorded for this run",
+        reason: "follower exited but no session-host pid was ever recorded; not replacing",
       });
       continue;
     }
-    // The budget, checked before the attempt: an exhausted run is skipped
-    // silently here and reported once by the caller (#998).
     const spent = attempts.get(worker.runId) ?? 0;
     if (spent >= maxAttempts) {
+      // Out of budget: the dead pane keeps its last state until a restart
+      // refreshes the budget or the run settles and retires it outright.
       outcomes.push({ kind: "attempts-exhausted", runId: worker.runId, attempts: spent });
       continue;
     }
-    const opened = openWorkerPane(
+    const replaced = openWorkerPane(
       {
         project: worker.project,
         issue: worker.issue,
@@ -1301,36 +2033,89 @@ export function reconcileWorkerPanes(
       },
       deps,
     );
-    outcomes.push(
-      opened.kind === "tracked"
-        ? { kind: "reassociated", runId: worker.runId, paneId: opened.paneId, label: opened.label }
-        : { kind: "untracked", runId: worker.runId, reason: opened.reason, attempted: true },
-    );
+    if (replaced.kind === "tracked") {
+      if (replaced.workspaceId !== undefined) openedWs.add(replaced.workspaceId);
+      outcomes.push({
+        kind: "reassociated",
+        runId: worker.runId,
+        paneId: replaced.paneId,
+        label: replaced.label,
+      });
+      junk.set(hold.pane.paneId, {
+        runId: worker.runId,
+        cause: "duplicate",
+        ...(hold.pane.agent === undefined ? {} : { agent: hold.pane.agent }),
+      });
+    } else {
+      outcomes.push({
+        kind: "untracked",
+        runId: worker.runId,
+        reason: replaced.reason,
+        attempted: true,
+        ...(replaced.phase === undefined ? {} : { phase: replaced.phase }),
+      });
+      // The replacement failed; the dead pane has nothing left to show, so it
+      // goes now rather than advertising a worker for another pass. Its record
+      // is dropped either way, so a survivor is junk next pass.
+      closeWorkerPane(hold.pane.paneId, deps);
+      standingWs.delete(hold.pane.paneId);
+    }
   }
 
-  for (const pane of listed.panes) {
-    if (liveIds.has(pane.runId)) continue;
-    const released = releaseWorkerPane(pane.paneId, pane.label ?? "", deps);
+  for (const [paneId, info] of junk) {
+    const released =
+      info.agent === undefined ? ({ ok: true } as const) : releaseWorkerPane(paneId, info.agent, deps);
+    if (released.ok) {
+      const closed = closeWorkerPane(paneId, deps);
+      if (closed.ok) {
+        standingWs.delete(paneId);
+        outcomes.push({ kind: "stale-released", paneId, runId: info.runId, cause: info.cause });
+        continue;
+      }
+      outcomes.push({
+        kind: "stale-release-failed",
+        paneId,
+        runId: info.runId,
+        reason: closed.reason,
+        cause: info.cause,
+      });
+      continue;
+    }
+    outcomes.push({
+      kind: "stale-release-failed",
+      paneId,
+      runId: info.runId,
+      reason: released.reason,
+      cause: info.cause,
+    });
+  }
+
+  // Every scoped marked workspace whose panes the cleanup above emptied, and
+  // that gained no representation this pass, is closed — however many marked
+  // surfaces a project accumulated (#1035 review). A live project's primary
+  // workspace survives because its representation keeps it standing; extras
+  // converge away; repeated cycles hold at zero shells.
+  for (const entry of entries) {
+    if (openedWs.has(entry.ws.workspaceId)) continue;
+    if ([...standingWs.values()].some((wsId) => wsId === entry.ws.workspaceId)) continue;
+    const res = run([...base, "workspace", "close", entry.ws.workspaceId]);
+    if (res.ok) deps.ownership?.forgetWorkspace(entry.ws.project, entry.ws.workspaceId);
+    // A failed close keeps the record: the workspace may still exist, and
+    // forgetting ownership of a live surface is how orphans are manufactured.
     outcomes.push(
-      released.ok
-        ? { kind: "stale-released", paneId: pane.paneId, runId: pane.runId }
-        : { kind: "stale-release-failed", paneId: pane.paneId, runId: pane.runId, reason: released.reason },
+      res.ok
+        ? { kind: "workspace-removed", project: entry.ws.project, workspaceId: entry.ws.workspaceId }
+        : {
+            kind: "workspace-remove-failed",
+            project: entry.ws.project,
+            workspaceId: entry.ws.workspaceId,
+            reason: `herdr workspace close failed: ${firstLine(res.stderr) || "no output"}`,
+          },
     );
   }
   return { ok: true, outcomes };
 }
 
-function firstLine(text: string): string {
-  return text.split("\n", 1)[0]?.trim() ?? "";
-}
-
-/** The kill syscall, injectable so error mapping is testable without one. */
-export type KillFn = (pid: number, sig: NodeJS.Signals | 0) => void;
-
-const realKill: KillFn = (pid, sig) => {
-  process.kill(pid, sig);
-};
-
 /**
  * What a failed `kill` proves.
  *
@@ -2556,10 +3341,13 @@ export function sessionsRoot(): string {
  * claim-only verdict consumes this — the challenge proof reads conductor
  * state, not transcripts (#614).
  */
-function claimedOrchestratorSessionFile(named: string | undefined): string | undefined {
+function claimedOrchestratorSessionFile(
+  named: string | undefined,
+  alive?: (pid: number) => boolean,
+): string | undefined {
   if (named === undefined) return undefined;
   try {
-    return resolveClaimedSessionFile(findProject(loadConfig(), named));
+    return resolveClaimedSessionFile(findProject(loadConfig(), named), alive);
   } catch {
     return undefined;
   }