unsnooze 1.10.0 → 1.12.2

package/src/resumer.js

@@ -6,6 +6,7 @@
 
 import { writeFileSync, readFileSync, unlinkSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
+import { spawnSync } from 'node:child_process';
 import { getMultiplexer } from './multiplexer.js';
 import {
   RESUMER_LOCK, STATE_DIR, POLL_INTERVAL_MS, STAGGER_MS, VERIFY_DELAY_MS,
@@ -27,7 +28,7 @@ import { workspaceFingerprint, workspaceChanged, describeChange } from './worksp
 import { notify } from './notify.js';
 import { UNSNOOZE_BIN } from './spawn.js';
 import { makeLogger } from './logger.js';
-import { createLeaseId, leaseMatches } from './lease.js';
+import { createLeaseId, leaseMatches, paneOwnedByRecord } from './lease.js';
 import { autoReapIfEnabled, attachHint } from './reap.js';
 
 const log = makeLogger('resumer');
@@ -39,14 +40,46 @@ function pidAlive(pid) {
   try { process.kill(pid, 0); return true; } catch { return false; }
 }
 
-export function acquireSingleton() {
-  mkdirSync(STATE_DIR, { recursive: true });
+// Is the lock-holder pid actually an unsnooze resumer? Pids get recycled: a
+// lock naming a live-but-unrelated program would otherwise be honored forever
+// and stops would never dispatch. Lock acquirers are only ever `_resumer` or
+// `daemon` processes, so require both tokens — a bare /unsnooze/ substring
+// would let any process that merely mentions the name squat the lock.
+// No evidence (empty/failed ps) → true: never steal on doubt.
+export function looksLikeResumerCommand(cmd) {
+  const c = String(cmd || '').trim();
+  if (c === '') return true;
+  return /unsnooze/i.test(c) && /(?:^|\s)(?:_resumer|daemon)(?:\s|$)/.test(c);
+}
+
+function defaultIsResumer(pid) {
   try {
-    const pid = parseInt(readFileSync(RESUMER_LOCK, 'utf-8'), 10);
-    if (Number.isFinite(pid) && pid !== process.pid && pidAlive(pid)) return false;
-  } catch { /* no lock */ }
-  writeFileSync(RESUMER_LOCK, String(process.pid));
-  return true;
+    const r = spawnSync('ps', ['-o', 'command=', '-p', String(pid)], { encoding: 'utf-8' });
+    if (r.error || r.status !== 0) return true;
+    return looksLikeResumerCommand(r.stdout);
+  } catch {
+    return true;
+  }
+}
+
+// Atomic acquire: `wx` create wins or loses the race outright — no
+// read-check-write window. A held lock is honored only when its pid is alive
+// AND looks like a resumer; stale/garbage/recycled locks are replaced.
+export function acquireSingleton({ isResumer = defaultIsResumer } = {}) {
+  mkdirSync(STATE_DIR, { recursive: true });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      writeFileSync(RESUMER_LOCK, String(process.pid), { flag: 'wx' });
+      return true;
+    } catch { /* lock exists — inspect the holder below */ }
+    let pid = NaN;
+    try { pid = parseInt(readFileSync(RESUMER_LOCK, 'utf-8'), 10); }
+    catch { /* vanished between wx and read — retry the create */ }
+    if (pid === process.pid) return true;   // we already hold it
+    if (Number.isFinite(pid) && pidAlive(pid) && isResumer(pid)) return false;
+    try { unlinkSync(RESUMER_LOCK); } catch { /* raced with another cleaner */ }
+  }
+  return false;   // lost the post-cleanup race to another acquirer
 }
 
 export function releaseSingleton() {
@@ -56,6 +89,23 @@ export function releaseSingleton() {
   } catch { /* already gone */ }
 }
 
+// Exponential backoff between failed resume attempts: 1m, 2m, 4m, 8m … capped
+// at 30m. Without it, a due record whose resetAt already passed retries every
+// poll tick and burns all MAX_RESUME_ATTEMPTS in ~2 minutes (observed).
+// A transient hook-spawned resumer keeps holding the singleton lock through
+// the backoff window — intentional, and consistent with it holding the lock
+// through a multi-hour reset wait (the daemon politely waits either way).
+export function retryBackoffMs(attempts, { baseMs = 60_000, maxMs = 1_800_000 } = {}) {
+  return Math.min(baseMs * 2 ** Math.max(0, attempts - 1), maxMs);
+}
+
+// Waiting behind a legitimately-held lock is normal (a transient hook-spawned
+// resumer riding out a long reset); logging it every 30s tick for hours is
+// not. First tick, then every 30th (~15 min).
+export function shouldLogLockWait(n) {
+  return n === 1 || n % 30 === 0;
+}
+
 // Due sessions that are actually allowed to dispatch: everything when
 // autoResume is on; only explicitly `resume-now`-marked (manual) records when
 // it's off. Stops stay tracked either way.
@@ -205,6 +255,179 @@ function rescheduleProbe(rec, now = Date.now()) {
   return 'probe';
 }
 
+// --- shared decision core (dispatchOne acts on it, planFor narrates it) -----
+// These helpers are DECISION-ONLY: no state writes, no notifications, no
+// keystrokes. `unsnooze preview` reuses them verbatim, so the dry-run cannot
+// drift from what dispatch actually does.
+
+// Workspace guard: returns the (possibly suffixed) message, or a hold.
+export function evaluateWorkspaceGuard(rec, message, { fingerprint = workspaceFingerprint } = {}) {
+  const mode = getConfig('workspaceGuard');
+  if (!rec.workspace || mode === 'off' || rec.manual) return { message, hold: null, informed: null };
+  const change = workspaceChanged(rec, fingerprint(rec.cwd));
+  if (!change) return { message, hold: null, informed: null };
+  const desc = describeChange(change);
+  if (mode === 'pause') return { message, hold: { reason: `workspace changed (${desc})`, desc }, informed: null };
+  return {
+    message: message + `\n\nHeads up: this workspace changed while the session was stopped (${desc}). Re-read the current state of the repo before continuing.`,
+    hold: null,
+    informed: desc,
+  };
+}
+
+// Context-size guard: returns a hold, an inform note, or neither.
+export function evaluateContextGuard(rec, agent, { contextTokens = null } = {}) {
+  const mode = getConfig('contextGuard');
+  if (mode === 'off' || rec.manual) return { hold: null, note: null, tokens: null };
+  const estimate = contextTokens
+    ?? (typeof agent.contextTokens === 'function' ? r => agent.contextTokens(r) : null);
+  let tokens = null;
+  try { tokens = estimate ? estimate(rec) : null; } catch { tokens = null; }
+  if (tokens == null || tokens < getConfig('contextGuardTokens')) return { hold: null, note: null, tokens };
+  const size = approxTokens(tokens);
+  if (mode === 'pause') return { hold: { reason: `context ${size} tokens`, size }, note: null, tokens };
+  return {
+    hold: null,
+    note: `${rec.cwd}: waking a ${size}-token session — its full context is re-read at full (uncached) price`,
+    tokens,
+  };
+}
+
+// Read-only live-pane classification: liveness, busy/menu/idle content, and
+// the identity/liveness ownership triad. Never sends anything.
+export async function assessPane(rec, agent, { mux, matchesLease = leaseMatches } = {}) {
+  if (!rec.pane) return { alive: false };
+  let alive = false;
+  try { alive = await mux.paneAlive(rec.pane); } catch { alive = false; }
+  if (!alive) return { alive: false };
+  let text;
+  try { text = await mux.capturePane(rec.pane, CAPTURE_LINES); }
+  catch (err) { return { alive: true, captureError: err.message }; }
+  const busy = isBusy(text, agent.patterns.busyPatterns);
+  const d = detectLimit(text, PANE_SCAN_LINES, agent.patterns);
+  const menu = !!(agent.menu && agent.menu.isPrompt(text, PANE_SCAN_LINES));
+  let cmd = null;
+  try { cmd = await mux.paneCurrentCommand?.(rec.pane); }
+  catch (err) { log(`${rec.key}: pane command lookup failed: ${err.message}`); }
+  const contentOwned = menu || d.hit || agent.patterns.idleRegex.test(text);
+  // Two independent questions, both required before touching the pane:
+  //   identity — is this pane still OURS? (stamp/lease; false VETOES)
+  //   liveness — is our agent still RUNNING in it? (lease pid+birth, or the
+  //     foreground command; the stamp alone never counts — it outlives the
+  //     agent and the pane may now be the user's shell.)
+  const identity = await paneOwnedByRecord(rec, { mux, matchesLease });
+  const leased = await matchesLease(rec, { mux });
+  const owned = identity !== false && (leased || agent.isForegroundCommand(cmd));
+  const authorized = owned && contentOwned;
+  return { alive: true, text, busy, d, menu, cmd, contentOwned, identity, leased, owned, authorized };
+}
+
+// Dry-run: what WOULD dispatch do with this record right now, and why.
+// Read-only pane captures only — never mutates state, types, or opens panes.
+export async function planFor(rec, {
+  mux = resolveRecordMux(rec), matchesLease = leaseMatches,
+  fingerprint = workspaceFingerprint, contextTokens = null, now = Date.now(),
+} = {}) {
+  const agent = getAgent(rec.agent);
+  const gates = [];
+  const base = { key: rec.key, sessionId: rec.sessionId, agent: agent.id, cwd: rec.cwd, status: rec.status, gates };
+
+  if (rec.status !== 'stopped') {
+    if (rec.status === 'resuming') {
+      gates.push('resume in flight — the next tick verifies the outcome');
+      return { ...base, action: 'verifying' };
+    }
+    gates.push(`status ${rec.status} — nothing to dispatch`);
+    return { ...base, action: 'none' };
+  }
+  // Gate order mirrors runResumer exactly: give-up only ever happens to
+  // records that pass dueForDispatch (due AND auto-or-manual AND not held),
+  // so paused/held/backing-off records are narrated as such even when their
+  // attempt counter is maxed — dispatch is genuinely still waiting on them.
+  if (!getConfig('autoResume') && !rec.manual) {
+    gates.push('paused — autoResume is off (`unsnooze resume-now` overrides)');
+    return { ...base, action: 'paused' };
+  }
+  if (rec.workspaceHold && !rec.manual) {
+    gates.push(`held: ${rec.holdReason ?? 'guard hold'} — \`unsnooze resume-now\` wakes it`);
+    return { ...base, action: 'held' };
+  }
+  const isProbe = rec.resetSource === 'fallback' && !rec.manual;
+  if ((rec.resetAt || 0) > now) {
+    gates.push(`not due — ${isProbe ? 'next probe' : 'resets'} ${new Date(rec.resetAt).toLocaleString()}`);
+    if (isProbe) gates.push('reset time unknown — cheap pane probes stand in for a schedule');
+    return { ...base, action: isProbe ? 'probe' : 'waiting', at: rec.resetAt };
+  }
+  if ((rec.attempts || 0) >= MAX_RESUME_ATTEMPTS) {
+    gates.push(`attempts ${rec.attempts}/${MAX_RESUME_ATTEMPTS} exhausted — would be marked failed (re-arms on a fresh detection)`);
+    return { ...base, action: 'give-up' };
+  }
+  if (isProbe) {
+    // Past the hard ceiling, rescheduleProbe deterministically stops probing
+    // and dispatch falls through to a REAL wake — narrate that, not a probe.
+    const ceiling = (rec.detectedAt || now) + FALLBACK_RESET_MS + RESET_MARGIN_MS;
+    if (now < ceiling) {
+      gates.push('reset time unknown — would probe the pane/transcript before any resume (a cleared banner resumes immediately)');
+      return { ...base, action: 'probe', at: rec.resetAt };
+    }
+    gates.push('probe ceiling reached — probing is over, a real resume follows');
+  }
+
+  // Same message precedence and guard evaluation dispatch uses.
+  let message = rec.resumeMessage ?? resolveResumeMessage(agent.id);
+  const ws = evaluateWorkspaceGuard(rec, message, { fingerprint });
+  if (ws.hold) {
+    gates.push(`would hold: ${ws.hold.reason} (workspaceGuard=pause)`);
+    return { ...base, action: 'held' };
+  }
+  message = ws.message;
+  if (ws.informed) gates.push(`workspace changed (${ws.informed}) — the wake message warns the agent`);
+  const ctx = evaluateContextGuard(rec, agent, { contextTokens });
+  if (ctx.hold) {
+    gates.push(`would hold: ${ctx.hold.reason} (contextGuard=pause)`);
+    return { ...base, action: 'held' };
+  }
+  if (ctx.note) gates.push(`big-context wake: ~${approxTokens(ctx.tokens)} tokens re-read at full (uncached) price`);
+
+  // Same live-pane classification dispatch uses.
+  const a = await assessPane(rec, agent, { mux, matchesLease });
+  if (a.alive) {
+    if (a.captureError) {
+      gates.push(`pane capture failed (${a.captureError}) — dispatch would record the error and retry with backoff`);
+      return { ...base, action: 'retry', target: { pane: rec.pane } };
+    }
+    if (a.busy) {
+      gates.push('agent is mid-work (busy footer) — dispatch defers, never interrupts');
+      return { ...base, action: 'busy', target: { pane: rec.pane } };
+    }
+    if (a.menu && a.authorized) {
+      if (!getConfig('menuAutoAnswer')) {
+        gates.push('limit menu on screen but menuAutoAnswer is off — would wait for you');
+        return { ...base, action: 'menu-held', target: { pane: rec.pane } };
+      }
+      return { ...base, action: 'drive-menu', target: { pane: rec.pane } };
+    }
+    if (a.authorized) return { ...base, action: 'inject', target: { pane: rec.pane }, message };
+    if (a.owned && !a.menu) {
+      gates.push('pane is ours but not at an idle prompt — dispatch defers');
+      return { ...base, action: 'busy', target: { pane: rec.pane } };
+    }
+    if (a.identity === false) gates.push('pane id was recycled — demonstrably not ours anymore');
+    else gates.push('pane content/ownership unproven — no keystrokes allowed');
+  } else if (rec.pane) {
+    gates.push('original pane is gone');
+  } else {
+    gates.push('no pane recorded (GUI/transcript detection)');
+  }
+
+  const target = await reviveTarget(mux, rec);
+  const resume = agent.resumeArgs(rec.sessionId, message);
+  return {
+    ...base, action: 'reopen', target: { session: target }, message,
+    argv: [agent.id, ...resume.args], messageViaPane: !!resume.messageViaPane,
+  };
+}
+
 // Ordered safety decision. Returns: busy | retry | progress | held | injected | reopen | probe.
 export async function dispatchOne(rec, {
   mux = resolveRecordMux(rec), resolveMux = null,
@@ -230,92 +453,66 @@ export async function dispatchOne(rec, {
 
   // Stale-workspace guard: another session (or a human) may have moved the
   // repo while this one slept. Manual resumes (resume-now) always proceed.
-  const guardMode = getConfig('workspaceGuard');
-  if (rec.workspace && guardMode !== 'off' && !rec.manual) {
-    const change = workspaceChanged(rec, fingerprint(rec.cwd));
-    if (change) {
-      const desc = describeChange(change);
-      if (guardMode === 'pause') {
-        setStatus(key, 'stopped', { workspaceHold: true, holdReason: `workspace changed (${desc})` });
-        notifier('unsnooze: session held', `${rec.cwd}: workspace changed while stopped (${desc}) — run: unsnooze resume-now`, { context: ctxOf(rec) });
-        log(`${key}: workspace changed (${desc}) — held (workspaceGuard=pause)`);
-        return 'held';
-      }
-      resumeMessage += `\n\nHeads up: this workspace changed while the session was stopped (${desc}). Re-read the current state of the repo before continuing.`;
-      log(`${key}: workspace changed (${desc}) — informing agent in the wake message`);
-    }
+  // Decision comes from the shared evaluator (planFor uses the same one);
+  // dispatch owns the side effects.
+  const ws = evaluateWorkspaceGuard(rec, resumeMessage, { fingerprint });
+  if (ws.hold) {
+    setStatus(key, 'stopped', { workspaceHold: true, holdReason: ws.hold.reason });
+    notifier('unsnooze: session held', `${rec.cwd}: workspace changed while stopped (${ws.hold.desc}) — run: unsnooze resume-now`, { context: ctxOf(rec) });
+    log(`${key}: workspace changed (${ws.hold.desc}) — held (workspaceGuard=pause)`);
+    return 'held';
   }
+  if (ws.informed) log(`${key}: workspace changed (${ws.informed}) — informing agent in the wake message`);
+  resumeMessage = ws.message;
 
   // Context-size guard: the prompt cache expired hours ago, so the first wake
   // message re-reads the session's entire context at full (uncached) price.
-  // Estimate the size from the agent's transcript; `pause` holds big sessions,
-  // `inform` notifies the user — but only once the wake actually lands, since
-  // dispatchOne re-runs on every busy/retry tick. Manual resumes proceed.
-  let contextNote = null;
-  const ctxGuardMode = getConfig('contextGuard');
-  if (ctxGuardMode !== 'off' && !rec.manual) {
-    const estimate = contextTokens
-      ?? (typeof agent.contextTokens === 'function' ? r => agent.contextTokens(r) : null);
-    let tokens = null;
-    try { tokens = estimate ? estimate(rec) : null; } catch { /* unknown size — skip */ }
-    if (tokens != null && tokens >= getConfig('contextGuardTokens')) {
-      const size = approxTokens(tokens);
-      if (ctxGuardMode === 'pause') {
-        setStatus(key, 'stopped', { workspaceHold: true, holdReason: `context ${size} tokens` });
-        notifier('unsnooze: session held', `${rec.cwd}: waking would re-read ${size} tokens of context at full (uncached) price — run: unsnooze resume-now`, { context: ctxOf(rec) });
-        log(`${key}: context ${size} tokens ≥ threshold — held (contextGuard=pause)`);
-        return 'held';
-      }
-      contextNote = `${rec.cwd}: waking a ${size}-token session — its full context is re-read at full (uncached) price`;
-      log(`${key}: context ${size} tokens — informing (contextGuard=inform)`);
-    }
+  // `pause` holds big sessions, `inform` notifies the user — but only once
+  // the wake actually lands, since dispatchOne re-runs on every busy/retry
+  // tick. Manual resumes proceed.
+  const ctx = evaluateContextGuard(rec, agent, { contextTokens });
+  if (ctx.hold) {
+    setStatus(key, 'stopped', { workspaceHold: true, holdReason: ctx.hold.reason });
+    notifier('unsnooze: session held', `${rec.cwd}: waking would re-read ${ctx.hold.size} tokens of context at full (uncached) price — run: unsnooze resume-now`, { context: ctxOf(rec) });
+    log(`${key}: context ${ctx.hold.size} tokens ≥ threshold — held (contextGuard=pause)`);
+    return 'held';
   }
+  const contextNote = ctx.note;
+  if (contextNote) log(`${key}: context ${approxTokens(ctx.tokens)} tokens — informing (contextGuard=inform)`);
   const notifyContext = () => {
     if (contextNote) notifier('unsnooze: big-context wake', contextNote, { context: ctxOf(rec) });
   };
   const reopenGuarded = () =>
     reopen(rec, { mux, resolveMux, agent, resumeMessage, selfCmd, onDelivered: notifyContext });
 
-  // Live-pane path: only if the pane still exists AND the agent CLI is its
-  // foreground command (pane ids get recycled — never inject into a random
-  // program).
-  if (rec.pane && await mux.paneAlive(rec.pane)) {
-    let text;
-    try { text = await mux.capturePane(rec.pane, CAPTURE_LINES); }
-    catch (err) {
-      setStatus(key, 'stopped', { lastError: `capture: ${err.message}` });
+  // Live-pane path: classification comes from the shared assessPane (planFor
+  // narrates the identical assessment); dispatch owns every side effect.
+  const a = await assessPane(rec, agent, { mux, matchesLease });
+  if (a.alive) {
+    if (a.captureError) {
+      setStatus(key, 'stopped', { lastError: `capture: ${a.captureError}` });
       return 'retry';
     }
-    if (isBusy(text, agent.patterns.busyPatterns)) return 'busy';
-    const d = detectLimit(text, PANE_SCAN_LINES, agent.patterns);
-    const menu = !!(agent.menu && agent.menu.isPrompt(text, PANE_SCAN_LINES));
-    let cmd = null;
-    try { cmd = await mux.paneCurrentCommand(rec.pane); }
-    catch (err) { log(`${key}: pane command lookup failed: ${err.message}`); }
-    const contentOwned = menu || d.hit || agent.patterns.idleRegex.test(text);
-    const leased = await matchesLease(rec, { mux });
-    const owned = leased || agent.isForegroundCommand(cmd);
-    const authorized = owned && contentOwned;
-
-    if (menu) {
-      if (!authorized) return reopenGuarded();
+    if (a.busy) return 'busy';
+    if (a.menu) {
+      if (!a.authorized) return reopenGuarded();
       if (!getConfig('menuAutoAnswer')) return 'held';
       try {
-        if (await driveMenu(mux, rec.pane, agent, text)) return 'progress';
+        if (await driveMenu(mux, rec.pane, agent, a.text)) return 'progress';
         setStatus(key, 'stopped', { lastError: 'menu drive: wait option unavailable' });
       } catch (err) {
         setStatus(key, 'stopped', { lastError: `menu drive: ${err.message}` });
       }
       return 'retry';
     }
-    if (authorized) {
+    if (a.authorized) {
       setStatus(key, 'resuming', { lastAttemptAt: Date.now(), lastError: null, verifyRetries: 0 });
       await mux.sendText(rec.pane, resumeMessage);
       log(`${key}: sent continue via ${rec.mux} ${rec.paneOwner ?? '-'}:${rec.pane}`);
       notifyContext();
       return 'injected';
     }
-    if (owned) return 'busy';
+    if (a.owned) return 'busy';
   }
 
   return reopenGuarded();
@@ -337,6 +534,10 @@ async function reopen(rec, { mux, resolveMux, agent, resumeMessage, selfCmd, onD
   try {
     address = await mux.newWindow(target, rec.cwd || homedir(), launchSpec);
   } catch (err) {
+    // Log it — a revival that cannot even spawn the multiplexer (e.g. tmux
+    // ENOENT under launchd's bare PATH) otherwise fails 5 times in total
+    // silence, with the only evidence buried in a soon-swept record.
+    log(`${key}: new-window failed in session "${target}": ${err.message}`);
     setStatus(key, 'stopped', {
       attempts: (rec.attempts || 0) + 1,
       lastError: `new-window: ${err.message}`,
@@ -344,6 +545,11 @@ async function reopen(rec, { mux, resolveMux, agent, resumeMessage, selfCmd, onD
     });
     return 'retry';
   }
+  // Stamp the fresh pane as ours (best-effort; tmux only) so later close /
+  // inject decisions can prove identity even after the agent process exits.
+  if (address?.pane && typeof mux.stampPaneOwner === 'function') {
+    try { await mux.stampPaneOwner(address.pane, leaseId); } catch { /* legacy tmux */ }
+  }
   // Persist the revival target as muxSession so future joins and attach hints
   // name the session the pane actually lives in.
   updateState(state => {
@@ -388,8 +594,11 @@ async function reopen(rec, { mux, resolveMux, agent, resumeMessage, selfCmd, onD
 function recordVerifyRetry(rec, lastError) {
   const verifyRetries = (rec.verifyRetries || 0) + 1;
   if (verifyRetries >= MAX_VERIFY_RETRIES) {
+    const attempts = (rec.attempts || 0) + 1;
     setStatus(rec.key, 'stopped', {
-      attempts: (rec.attempts || 0) + 1,
+      attempts,
+      // Same backoff (and same manual exemption) as routed retries.
+      resetAt: rec.manual ? Date.now() : Date.now() + retryBackoffMs(attempts),
       lastError,
       verifyRetries: 0,
     });
@@ -449,7 +658,7 @@ export async function verifyOne(key, { resolveMux = resolveRecordMux } = {}) {
   return 'resumed';
 }
 
-export function routeDispatchOutcome(result, rec, deferCounts, { maxBusyDefers = MAX_BUSY_DEFERS } = {}) {
+export function routeDispatchOutcome(result, rec, deferCounts, { maxBusyDefers = MAX_BUSY_DEFERS, now = Date.now() } = {}) {
   if (result === 'busy') {
     const n = (deferCounts.get(rec.key) || 0) + 1;
     deferCounts.set(rec.key, n);
@@ -460,8 +669,14 @@ export function routeDispatchOutcome(result, rec, deferCounts, { maxBusyDefers =
     return { verify: false, waitBusy: true };
   }
   if (result === 'retry') {
+    const attempts = (rec.attempts || 0) + 1;
     setStatus(rec.key, 'stopped', {
-      attempts: (rec.attempts || 0) + 1,
+      attempts,
+      // Back off before the next attempt — a due record retried on every poll
+      // tick exhausts MAX_RESUME_ATTEMPTS in minutes. Manual records are
+      // exempt: `resume-now` promised an immediate wake, so a transient error
+      // must not silently defer it.
+      resetAt: rec.manual ? now : now + retryBackoffMs(attempts),
       lastError: readState().sessions[rec.key]?.lastError,
       verifyRetries: 0,
     });
@@ -490,11 +705,13 @@ export async function runResumer({
     if (!watcher || !getConfig('guiWatch')) return;
     try { await watcher.tick(); } catch (err) { log(`watcher tick failed: ${err.message}`); }
   };
+  let lockWaits = 0;
   while (!acquireSingleton()) {
     if (!persistent) { log('another resumer is running — exiting'); return 0; }
     if (signal?.aborted) return 0;
     await tickWatcher();
-    log('another resumer holds the lock — daemon waiting');
+    lockWaits += 1;
+    if (shouldLogLockWait(lockWaits)) log('another resumer holds the lock — daemon waiting');
     await sleep(pollInterval);
   }
   updateState(state => { state.resumerPid = process.pid; });
@@ -529,7 +746,7 @@ export async function runResumer({
         if ((s.attempts || 0) >= MAX_RESUME_ATTEMPTS) {
           setStatus(s.key, 'failed', { lastError: 'max resume attempts exceeded', verifyRetries: 0 });
           log(`${s.key}: giving up after ${s.attempts} attempts`);
-          notify('unsnooze gave up ⚠️', `${s.cwd}: ${s.attempts} resume attempts failed — check \`unsnooze status\``, { context: ctxOf(s) });
+          notify('unsnooze gave up ⚠️', `${s.cwd}: ${s.attempts} resume attempts failed — check \`unsnooze status\``, { context: ctxOf(s), priority: 4 });
         }
       }
 

package/src/settings.js

@@ -18,6 +18,14 @@ export const DEFAULTS = {
   menuAutoAnswer: true,    // may unsnooze drive Claude's limit menu (send keys)?
   notifications: true,     // desktop notifications on detect/resume
   notifyChannel: 'auto',   // auto | native | osc | bell
+  // ntfy push (https://ntfy.sh) — ADDITIVE to notifyChannel; off until a
+  // topic is set. ntfy.sh topics are public: the name is the password —
+  // use `unsnooze config set ntfyTopic $(unsnooze doctor)`-style random
+  // names (generateNtfyTopic) or a self-hosted/authed server.
+  ntfyTopic: '',           // '' = ntfy off
+  ntfyServer: 'https://ntfy.sh',
+  ntfyToken: '',           // optional Bearer token (tk_…) for authed servers
+  ntfyPrivacy: 'full',     // full | terse (terse: never push cwd paths)
   guiWatch: true,          // daemon watches transcripts/rollouts for GUI-session stops
   updateCheck: true,       // daily registry version check + update notices/toast
   workspaceGuard: 'inform', // repo changed while stopped: off | inform | pause
@@ -40,6 +48,10 @@ const ENV_NAMES = {
   menuAutoAnswer: 'UNSNOOZE_MENU_AUTO_ANSWER',
   notifications: 'UNSNOOZE_NOTIFICATIONS',
   notifyChannel: 'UNSNOOZE_NOTIFY_CHANNEL',
+  ntfyTopic: 'UNSNOOZE_NTFY_TOPIC',
+  ntfyServer: 'UNSNOOZE_NTFY_SERVER',
+  ntfyToken: 'UNSNOOZE_NTFY_TOKEN',
+  ntfyPrivacy: 'UNSNOOZE_NTFY_PRIVACY',
   guiWatch: 'UNSNOOZE_GUI_WATCH',
   updateCheck: 'UNSNOOZE_UPDATE_CHECK',
   workspaceGuard: 'UNSNOOZE_WORKSPACE_GUARD',
@@ -72,6 +84,7 @@ const ENUMS = {
   workspaceGuard: ['off', 'inform', 'pause'],
   contextGuard: ['off', 'inform', 'pause'],
   notifyChannel: ['auto', 'native', 'osc', 'bell'],
+  ntfyPrivacy: ['full', 'terse'],
 };
 
 function parseBool(raw) {

package/src/state.js

@@ -5,7 +5,7 @@
 // quarantine. All synchronous — callers are short-lived or infrequent.
 
 import {
-  mkdirSync, rmdirSync, readFileSync, writeFileSync, renameSync,
+  mkdirSync, rmSync, readFileSync, writeFileSync, renameSync,
   existsSync, statSync,
 } from 'node:fs';
 import { join } from 'node:path';
@@ -27,30 +27,51 @@ function sleepSync(ms) {
   Atomics.wait(new Int32Array(buf), 0, 0, ms);
 }
 
+const LOCK_TIMEOUT_MS = (() => {
+  const v = parseInt(process.env.UNSNOOZE_LOCK_TIMEOUT_MS ?? '', 10);
+  return Number.isFinite(v) ? v : 5_000;
+})();
+
+// Is the pid recorded inside the lock dir still alive? Old-version locks have
+// no pid file — unknown (null) so age-based stealing still applies to them.
+function lockHolderAlive() {
+  try {
+    const pid = parseInt(readFileSync(join(LOCK_DIR, 'pid'), 'utf-8'), 10);
+    if (!Number.isFinite(pid)) return null;
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === 'ESRCH' ? false : null;   // dead vs unreadable/no-permission
+  }
+}
+
 function acquireLock() {
-  const deadline = Date.now() + 5_000;
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
   for (;;) {
     try {
       mkdirSync(LOCK_DIR);
+      // Record the holder so a slow-but-alive writer is never robbed — age
+      // alone can't tell a hung process from a busy one.
+      try { writeFileSync(join(LOCK_DIR, 'pid'), String(process.pid)); } catch { /* best-effort */ }
       return;
     } catch (err) {
       if (err.code !== 'EEXIST') { mkdirSync(STATE_DIR, { recursive: true }); continue; }
       try {
         const age = Date.now() - statSync(LOCK_DIR).mtimeMs;
-        if (age > STALE_LOCK_MS) {
-          rmdirSync(LOCK_DIR);   // steal stale lock from a killed process
+        if (age > STALE_LOCK_MS && lockHolderAlive() !== true) {
+          rmSync(LOCK_DIR, { recursive: true, force: true });   // steal from a dead/unknown holder
           log(`stole stale lock (age ${Math.round(age)}ms)`);
           continue;
         }
       } catch { /* lock vanished between check and stat — retry */ }
-      if (Date.now() > deadline) throw new Error('unsnooze: state lock timeout after 5s');
+      if (Date.now() > deadline) throw new Error(`unsnooze: state lock timeout after ${LOCK_TIMEOUT_MS}ms`);
       sleepSync(50);
     }
   }
 }
 
 function releaseLock() {
-  try { rmdirSync(LOCK_DIR); } catch { /* already gone */ }
+  try { rmSync(LOCK_DIR, { recursive: true, force: true }); } catch { /* already gone */ }
 }
 
 export function readState() {
@@ -191,10 +212,14 @@ function findDuplicate(state, record) {
   return null;
 }
 
-export function setStatus(key, status, extra = {}) {
+// `expect`: compare-and-set — apply only while the record is still in one of
+// the listed statuses. Sweepers that decide from a snapshot (markStaleAbandoned)
+// must not clobber a record that moved on (e.g. to 'resumed') mid-decision.
+export function setStatus(key, status, extra = {}, { expect = null } = {}) {
   return updateState(state => {
     const s = state.sessions[key];
     if (!s) return state;
+    if (expect && !expect.includes(s.status)) return state;
     Object.assign(s, extra, { status });
     return state;
   });
@@ -225,7 +250,10 @@ export async function sweepRecords({ resolveMux } = {}) {
   const state = readState();
   const drop = [];
   for (const rec of Object.values(state.sessions)) {
-    if (!['resumed', 'failed', 'cancelled'].includes(rec.status)) continue;
+    // 'failed' is deliberately NOT swept: its lastError is the post-mortem
+    // ("why didn't my session wake?") and a give-up was once erased within
+    // 30 seconds of happening. Age-based prune() owns failed-record expiry.
+    if (!['resumed', 'cancelled'].includes(rec.status)) continue;
     if (!rec.pane) {
       drop.push(rec.key);
       continue;
@@ -267,10 +295,12 @@ export async function markStaleAbandoned({
       }
     }
     if (!dead) continue;
+    // CAS: the async liveness probe races real resumes — only mark failed if
+    // the record is still where the snapshot saw it.
     setStatus(rec.key, 'failed', {
       lastError: rec.pane ? 'stale: pane dead' : 'stale: pane absent',
       verifyRetries: 0,
-    });
+    }, { expect: ['stopped', 'resuming'] });
     marked += 1;
     log(`${rec.key}: marked failed (stale abandoned, detectedAt ${new Date(rec.detectedAt || 0).toISOString()})`);
   }