Prevent autoresume from duplicating live agent sessions - #11358

5939eaf Integrate file preview refresh and stale surface fixes (manaflow-ai#10623)
f2062d3 Prevent autoresume from duplicating live agent sessions (manaflow-ai#11358)
ae18c88 analytics: attribute paid checkouts to the surface, client and channel that opened them (manaflow-ai#12118)
3e0edaa perf: make reload-config surface fanout incremental (manaflow-ai#10564)

Brings in #12131 (cmux notify inside a machine), #12154, #12144 (cmux cr
bootstrap), #12112 (cloud notifications with per-client acks), #10623,
#11358, #12118.

Conflicts resolved:
- cmux.xcodeproj/project.pbxproj: cmuxTests group children — kept both
  sides (CloudFileDeliveryTests from this branch, CloudNotificationSyncTests
  from main); normalized, test-wiring lint ok (813 test files).
- web/scripts/check-devbox-image-reachable.ts: took main's portable
  entry-point guard over this branch's typed import.meta.main fix.

Checks on the merged tree: 18 web suites 372 pass / 0 fail, tsc clean, shim
image copy byte-identical, sh -n clean, swiftc -parse on every file both
sides touched, VMClientError switch still exhaustive, no duplicate
definitions introduced.

Claude-Session: https://claude.ai/code/session_01QBDetMeke87gUWzvok9LWr

Three things stopped the second and later relaunches from resuming Pi:

- `cmux restore` aborted on the app's `busy` admission answer. The
  ownership-sensitive process scan fails closed when hook stores keep
  changing, which is routine while restored panes fire their session-start
  hooks; the pane was left at a bare shell and its binding retired. The CLI
  now waits through a bounded, front-loaded retry budget when the answer is
  marked retryable, and says so once on stderr.
- Deferred restores cancelled every pending launch on the first unsettled
  scan. They now wait for a bounded number of settle attempts, pausing so the
  churn can subside instead of scanning back to back.
- Since #11358 a process must show its session id in argv or the
  environment to count as a session's process. Pi overwrites its argv with a
  bare title and nothing exports that variable for it, so a fresh Pi's own
  hook-recorded PID no longer proved liveness and the staleness reconciliation
  retired its binding. The hook record, and the pane's foreground process for
  that pane's binding, now vouch for a missing session identity while a
  contradicting one still rejects, restoring the pre-#11358 behavior for
  exactly those two callers.

Refs #12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: cover Pi session-start resume binding

* fix: keep Pi session-start resume binding trusted

* test: cover same-session agent-hook resume binding downgrades

Fresh and restored Pi panes keep issuing the pre-fix extension's public
`surface resume set --source agent-hook` write until every running Pi process
has reloaded the refreshed extension. Cover the store-level rule that such a
write must not demote a trusted auto-resume binding for the same session.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: keep trusted agent-hook resume bindings through same-session downgrades

The Pi extension template no longer re-publishes its binding, but every Pi
process that already loaded the old extension keeps sending the public
`surface resume set --source agent-hook` write until it restarts, and the
on-disk extension is only refreshed once the new CLI sees a session-start.
That covers every pane restored on the first relaunch after updating: cmux
stored the `auto_resume`-less write as manual, and the following relaunch
restored a bare shell instead of Pi.

Reject a same-session agent-hook write that would demote a trusted binding,
atomically with the workspace and Dock store mutations, next to the existing
Codex provenance gate. The socket reports the binding the surface kept
instead of an empty-command failure, so the old extension's follow-up
verification and third-party tooling read the effective state.

Fixes #12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: cover TUI prompt marks retiring live agent resume bindings

Pi's interactive TUI emits OSC 133 prompt and command marks while the agent
keeps running, so cmux sees the pane flip between idle and busy on every
turn. Cover the restored-agent lifecycle rule that such a flip must not
demote a hook-published binding while the agent's process is verifiably
alive, in both the workspace and Dock stores, while an exited agent still
retires its binding.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: keep live agent resume bindings across TUI prompt marks

Pi's interactive TUI emits OSC 133 prompt and command marks while the agent
keeps running, so cmux's shell-activity state flips between idle and busy on
every turn. The restored-agent lifecycle read the first busy flip after an
idle hook publish as an unrelated command replacing the agent, and the first
idle flip after a resumed launch as the agent exiting, and demoted the
binding to manual either way. Every fresh or restored Pi pane therefore lost
automatic resume within seconds, healing only when the next prompt-submit
hook re-published it, and the following relaunch restored a bare shell.

Before a shell-activity flip invalidates or retires an agent-hook binding,
require evidence that the agent is gone. Cheapest first: the hook-registered
`<kind>.<session>` PID whose process generation still matches, the live agent
index with revalidated process evidence, and the pane's foreground process
validated against the agent identity, which covers the window before the
session-start hook registers a PID. A live agent's busy flip now records the
observed running phase instead; an exited agent still retires its binding.

Refs #12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* ci: gate the agent resume binding regressions

The full sharded app-host run tolerates Swift Testing assertion failures, so
the new resume-binding suites would not turn CI red on their own. Run them on
the focused non-tolerant shard alongside the other regression guards.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: cover deferred restores surviving staleness reconciliation

After a relaunch the only process evidence for a restored binding is the
hook-recorded PID that died with the previous app instance. While the restore
is still deferred behind its ownership scan nothing owns the binding, so the
staleness reconciliation could retire it and the scan then cancelled the
launch. Cover the rule that a deferred restore keeps its binding, while an
exited agent without a pending restore still retires.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: keep deferred restores from being retired as stale

A restore deferred behind its ownership scan has not launched yet, so the
absence of a live process is expected rather than proof that the agent
exited. Treat a pending deferred restore for the same session as in-flight
ownership in the staleness check, so the scan can still admit the launch and
a relaunch restores the agent instead of a bare shell.

Refs #12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: cover restore admission retries and settling deferred restores

Right after a relaunch several restored panes fire their session-start hooks
at once, so the app's ownership-sensitive process scan cannot settle for a
few seconds and answers `busy` with `retryable`. Cover the CLI retry budget
for that answer, the bounded settle loop deferred restores wait on, and the
pane-foreground fallback rejecting a contradicting Pi session identity.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: keep resumes of resumes working through restore-time hook storms

Three things stopped the second and later relaunches from resuming Pi:

- `cmux restore` aborted on the app's `busy` admission answer. The
  ownership-sensitive process scan fails closed when hook stores keep
  changing, which is routine while restored panes fire their session-start
  hooks; the pane was left at a bare shell and its binding retired. The CLI
  now waits through a bounded, front-loaded retry budget when the answer is
  marked retryable, and says so once on stderr.
- Deferred restores cancelled every pending launch on the first unsettled
  scan. They now wait for a bounded number of settle attempts, pausing so the
  churn can subside instead of scanning back to back.
- Since #11358 a process must show its session id in argv or the
  environment to count as a session's process. Pi overwrites its argv with a
  bare title and nothing exports that variable for it, so a fresh Pi's own
  hook-recorded PID no longer proved liveness and the staleness reconciliation
  retired its binding. The hook record, and the pane's foreground process for
  that pane's binding, now vouch for a missing session identity while a
  contradicting one still rejects, restoring the pre-#11358 behavior for
  exactly those two callers.

Refs #12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* refactor: share the restore admission retry runner with the unit bundle

The CLI's sources are not compiled into the unit-test bundle, where `CMUXCLI`
names an unrelated alias, so the retry loop moves into CMUXAgentLaunch as a
generic runner with an injected error classifier. The CLI keeps its structured
`busy`/retryable classifier as a thin adapter, and the tests exercise the
shared runner directly.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: cover restore refreshes scoped to the restored agent's hook store

Every agent on a Mac writes its own hook store into the shared hook
directory, so whole-directory quiescence almost never holds on a busy
machine. Cover an ownership refresh that settles on the requested kind's
hook store alone: churn in another kind's store no longer fails it closed,
churn in the requested kind's store still does, and the filename and
fingerprint helpers behind that decision.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: settle restore ownership on the restored agent's hook store alone

The ownership-sensitive refresh behind `cmux restore` admission and deferred
relaunch restores failed closed whenever anything in the shared hook
directory changed across two consecutive scans. Every agent on the Mac
writes its own `<kind>-hook-sessions.json` there on every hook, so on a
machine running a few Claude or Codex sessions the directory is never quiet
for the two scans, every deferred Pi restore was cancelled, and every
`cmux restore` answered busy. Dogfood on this Mac reproduced it: all three
restored Pi panes were cancelled 27 seconds after relaunch while nothing of
theirs had run.

Judge "settled" by evidence instead: capture each hook-store file's on-disk
fingerprint when a loader starts, and let a refresh scoped to the restored
kinds return as soon as the applied load reflects those kinds' current
files. Writes for other kinds neither force another pass nor fail closed;
a write for the restored kind still does. Admission scopes to the requested
kind and deferred restores to the kinds they still hold. Unscoped callers
keep the whole-directory rule.

Also parse `--session` for the built-in Pi kind when no registration is
attached, so a pane-foreground fallback rejects a Pi resumed into a
different session while a bare fresh Pi is still vouched for.

Refs #12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: call the stat syscall unqualified in hook-store fingerprinting

`Darwin.stat(_:_:)` resolves to the `stat` struct initializer inside a
closure, which the unit bundle build rejected. The unqualified call picks
the syscall overload.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* chore: normalize project file after merging main

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: align Claude hook pane-clear tests with semantic notification admission

#11976 stopped the Claude prompt-submit and pre-tool-use hooks from sending
`clear_notifications` themselves: they journal the turn start or state
change at the resolved target and the app's reconciler clears that pane.
The two moved-pane tests still asserted the old send, so main's focused
notification-routing shard has been red since that merge. Assert the
journal event's target instead, keep the sibling-pane and workspace-wide
negatives, and leave the SessionEnd test, whose send still exists, alone.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: bound foreground vouching to the session's recorded process

Review follow-ups on the restored-agent liveness evidence:

- A pane's foreground process that shows no session identity vouched for
  the binding unconditionally. Once the session has registered its own
  process, a different bare Pi in the same pane is another agent, so only
  that registered process may vouch without naming the session; an
  explicit `--session` still decides either way.
- The workspace and Dock lifecycles each re-implemented the same evidence
  order. `RestoredAgentLiveness` is now the one evaluator; each container
  supplies only its runtime table, workspace identity, and foreground pid.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: let a dead recorded process stop bounding foreground vouching

The previous bound forwarded the session's recorded PID to the foreground
check unconditionally, so a dead PID left in the runtime table blocked
vouching for a Pi resumed in place (hibernation resume, manual `cmux
restore`) whose argv is already a bare title, and the first prompt mark
could retire it again. Bound bare vouching to the recorded process only
while that process still exists. A wrongly kept binding self-heals within a
second when a stranger's own session-start hook replaces it; a wrongly
retired one stays retired until the next prompt.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* chore: mirror the warning-budget and test-compile fixes from #12168

main's macOS lane is red on the Swift warning budget (five over-budget
warnings) and the CmuxTerminal test bundle's compile; #12168 fixes both but
has not merged yet. Carry the same six source hunks here so this PR's CI can
pass on its own; they are identical to #12168 and merge away when it lands.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: avoid exec race in PID routing regression

* test: remove nondeterministic lane assertion sleep

* review: make liveness evaluator constructable and settle lane test

* test: reflect inconclusive Pi session index semantics

* ci: allow injected fake retry sleeper in determinism gate

* test: reject unidentified replacement Pi processes

* fix: require session identity for foreground Pi liveness

* fix: reconcile Pi restore coverage with fresh-scan admission

* test: cover scrubbed CLI child environment isolation

* fix: isolate CLI fixtures and correct resume test expectations

* fix: retain main Bonsplit revision after merge

* test: exec the PID-routing fixture into a non-platform image

Since macOS 26 the kernel returns no environment for an exec'd platform
binary such as `/bin/sh` or `/bin/sleep`, even to a same-user reader, and a
copied `/bin/sh` refuses to exec at all. The delivery-target fixture exec'd
into `/bin/sh`, so its post-exec scope read could never see
CMUX_SURFACE_ID and the test failed on every Darwin 25 host (six of six
runs on a fleet mini, and the app-host shard on CI). Real agents are node or
bun processes, whose environment stays readable, and so does the Xcode
toolchain's python this fixture now execs into.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: give hook CLI invocations one 30-second wall bound

The Claude hook harnesses bounded each CLI invocation at five or ten
seconds. A hook that prints its verdict and exits normally still needs a
few socket round-trips through a mock server scheduled on the test
process's global queues, and loaded CI runners twice took longer than that:
the process exited 0 with the expected output but was recorded as timed
out. The CLI's own non-actionable client deadlines are far shorter than 30
seconds, so a hook that genuinely hangs still fails.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: keep the routing fixture within its file-length budget

The platform-binary note grew the file past its merge-base length, which
scripts/swift_file_length_budget.py rejects. Fold it into the two comment
lines the fixture already had.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: let the bash-integration guard outlive its background reporters

`set -m` puts the reporters the shell integration forks into their own
process groups, so killing the interactive shell's group leaves them briefly
alive and still writing into the scratch tree. `TemporaryDirectory` then
raced them on a shared CI runner and failed with ENOTEMPTY, taking
linux-preflight and every macOS lane with it. Remove the tree once the
reporters have stopped, and tolerate leftovers after five seconds.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: stop XCTest wait timeouts from crashing the app host in SSH host suite

SSHConfiguredRemoteCommandHostTests is a Swift Testing suite that borrows a
hand-built CLINotifyProcessIntegrationRegressionTests instance for its mock
socket helpers. Its four `processSupport.wait(for:timeout:)` calls route a
timeout through XCTestCase issue recording, and that instance has no
testCaseRun, so XCTest raises NSInternalInconsistencyException and aborts the
whole app host. In CI run 34402005479 shard 1 that abort turned an ordinary
5-second mock-socket timeout into "unexpected" failures and a red shard.

Wait through a standalone XCTWaiter instead and report the timeout as a
Swift Testing expectation, so a slow CLI fails only this test.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: report empty CLI JSON output as an assertion failure, not a thrown error

`jsonPayload(from:)` and `notificationRows(from:)` let `JSONSerialization`
throw when the CLI under test printed nothing. XCTest records that as a thrown
error, and `scripts/ci/classify-app-host-test-output.py` counts thrown errors
as "unexpected" failures, the same bucket as an app-host crash, so a single
slow CLI invocation turned the whole tolerant app-host shard red (CI runs
34402005479 and 34414657622, shard 1, via
testSSHPersistentPTYJSONResolvesSessionIDWhenWorkspaceCreateOmitsSurfaceID).

Parse with `try?` and let `XCTUnwrap` report the missing payload, so the test
still fails with the raw output in the message but as an ordinary failure.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* refactor: keep merged test helpers within file budgets

* fix: remove duplicate CodeRouter fixture from main merge

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

…11358)

* test: cover live owner restore admission

* fix: block restores for live agent sessions

* fix: retain process providers for restore validation

* fix: keep restore owner pids unlocalized

* refactor: isolate live owner session key

* fix: handle hook-store owner validation

* test: cover agent restore through shared relay policy

* fix: keep restore methods in shared relay policy

…#12115)

* test: cover Pi session-start resume binding

* fix: keep Pi session-start resume binding trusted

* test: cover same-session agent-hook resume binding downgrades

Fresh and restored Pi panes keep issuing the pre-fix extension's public
`surface resume set --source agent-hook` write until every running Pi process
has reloaded the refreshed extension. Cover the store-level rule that such a
write must not demote a trusted auto-resume binding for the same session.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: keep trusted agent-hook resume bindings through same-session downgrades

The Pi extension template no longer re-publishes its binding, but every Pi
process that already loaded the old extension keeps sending the public
`surface resume set --source agent-hook` write until it restarts, and the
on-disk extension is only refreshed once the new CLI sees a session-start.
That covers every pane restored on the first relaunch after updating: cmux
stored the `auto_resume`-less write as manual, and the following relaunch
restored a bare shell instead of Pi.

Reject a same-session agent-hook write that would demote a trusted binding,
atomically with the workspace and Dock store mutations, next to the existing
Codex provenance gate. The socket reports the binding the surface kept
instead of an empty-command failure, so the old extension's follow-up
verification and third-party tooling read the effective state.

Fixes manaflow-ai#12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: cover TUI prompt marks retiring live agent resume bindings

Pi's interactive TUI emits OSC 133 prompt and command marks while the agent
keeps running, so cmux sees the pane flip between idle and busy on every
turn. Cover the restored-agent lifecycle rule that such a flip must not
demote a hook-published binding while the agent's process is verifiably
alive, in both the workspace and Dock stores, while an exited agent still
retires its binding.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: keep live agent resume bindings across TUI prompt marks

Pi's interactive TUI emits OSC 133 prompt and command marks while the agent
keeps running, so cmux's shell-activity state flips between idle and busy on
every turn. The restored-agent lifecycle read the first busy flip after an
idle hook publish as an unrelated command replacing the agent, and the first
idle flip after a resumed launch as the agent exiting, and demoted the
binding to manual either way. Every fresh or restored Pi pane therefore lost
automatic resume within seconds, healing only when the next prompt-submit
hook re-published it, and the following relaunch restored a bare shell.

Before a shell-activity flip invalidates or retires an agent-hook binding,
require evidence that the agent is gone. Cheapest first: the hook-registered
`<kind>.<session>` PID whose process generation still matches, the live agent
index with revalidated process evidence, and the pane's foreground process
validated against the agent identity, which covers the window before the
session-start hook registers a PID. A live agent's busy flip now records the
observed running phase instead; an exited agent still retires its binding.

Refs manaflow-ai#12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* ci: gate the agent resume binding regressions

The full sharded app-host run tolerates Swift Testing assertion failures, so
the new resume-binding suites would not turn CI red on their own. Run them on
the focused non-tolerant shard alongside the other regression guards.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: cover deferred restores surviving staleness reconciliation

After a relaunch the only process evidence for a restored binding is the
hook-recorded PID that died with the previous app instance. While the restore
is still deferred behind its ownership scan nothing owns the binding, so the
staleness reconciliation could retire it and the scan then cancelled the
launch. Cover the rule that a deferred restore keeps its binding, while an
exited agent without a pending restore still retires.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: keep deferred restores from being retired as stale

A restore deferred behind its ownership scan has not launched yet, so the
absence of a live process is expected rather than proof that the agent
exited. Treat a pending deferred restore for the same session as in-flight
ownership in the staleness check, so the scan can still admit the launch and
a relaunch restores the agent instead of a bare shell.

Refs manaflow-ai#12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: cover restore admission retries and settling deferred restores

Right after a relaunch several restored panes fire their session-start hooks
at once, so the app's ownership-sensitive process scan cannot settle for a
few seconds and answers `busy` with `retryable`. Cover the CLI retry budget
for that answer, the bounded settle loop deferred restores wait on, and the
pane-foreground fallback rejecting a contradicting Pi session identity.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: keep resumes of resumes working through restore-time hook storms

Three things stopped the second and later relaunches from resuming Pi:

- `cmux restore` aborted on the app's `busy` admission answer. The
  ownership-sensitive process scan fails closed when hook stores keep
  changing, which is routine while restored panes fire their session-start
  hooks; the pane was left at a bare shell and its binding retired. The CLI
  now waits through a bounded, front-loaded retry budget when the answer is
  marked retryable, and says so once on stderr.
- Deferred restores cancelled every pending launch on the first unsettled
  scan. They now wait for a bounded number of settle attempts, pausing so the
  churn can subside instead of scanning back to back.
- Since manaflow-ai#11358 a process must show its session id in argv or the
  environment to count as a session's process. Pi overwrites its argv with a
  bare title and nothing exports that variable for it, so a fresh Pi's own
  hook-recorded PID no longer proved liveness and the staleness reconciliation
  retired its binding. The hook record, and the pane's foreground process for
  that pane's binding, now vouch for a missing session identity while a
  contradicting one still rejects, restoring the pre-manaflow-ai#11358 behavior for
  exactly those two callers.

Refs manaflow-ai#12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* refactor: share the restore admission retry runner with the unit bundle

The CLI's sources are not compiled into the unit-test bundle, where `CMUXCLI`
names an unrelated alias, so the retry loop moves into CMUXAgentLaunch as a
generic runner with an injected error classifier. The CLI keeps its structured
`busy`/retryable classifier as a thin adapter, and the tests exercise the
shared runner directly.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: cover restore refreshes scoped to the restored agent's hook store

Every agent on a Mac writes its own hook store into the shared hook
directory, so whole-directory quiescence almost never holds on a busy
machine. Cover an ownership refresh that settles on the requested kind's
hook store alone: churn in another kind's store no longer fails it closed,
churn in the requested kind's store still does, and the filename and
fingerprint helpers behind that decision.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: settle restore ownership on the restored agent's hook store alone

The ownership-sensitive refresh behind `cmux restore` admission and deferred
relaunch restores failed closed whenever anything in the shared hook
directory changed across two consecutive scans. Every agent on the Mac
writes its own `<kind>-hook-sessions.json` there on every hook, so on a
machine running a few Claude or Codex sessions the directory is never quiet
for the two scans, every deferred Pi restore was cancelled, and every
`cmux restore` answered busy. Dogfood on this Mac reproduced it: all three
restored Pi panes were cancelled 27 seconds after relaunch while nothing of
theirs had run.

Judge "settled" by evidence instead: capture each hook-store file's on-disk
fingerprint when a loader starts, and let a refresh scoped to the restored
kinds return as soon as the applied load reflects those kinds' current
files. Writes for other kinds neither force another pass nor fail closed;
a write for the restored kind still does. Admission scopes to the requested
kind and deferred restores to the kinds they still hold. Unscoped callers
keep the whole-directory rule.

Also parse `--session` for the built-in Pi kind when no registration is
attached, so a pane-foreground fallback rejects a Pi resumed into a
different session while a bare fresh Pi is still vouched for.

Refs manaflow-ai#12084

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: call the stat syscall unqualified in hook-store fingerprinting

`Darwin.stat(_:_:)` resolves to the `stat` struct initializer inside a
closure, which the unit bundle build rejected. The unqualified call picks
the syscall overload.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* chore: normalize project file after merging main

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: align Claude hook pane-clear tests with semantic notification admission

manaflow-ai#11976 stopped the Claude prompt-submit and pre-tool-use hooks from sending
`clear_notifications` themselves: they journal the turn start or state
change at the resolved target and the app's reconciler clears that pane.
The two moved-pane tests still asserted the old send, so main's focused
notification-routing shard has been red since that merge. Assert the
journal event's target instead, keep the sibling-pane and workspace-wide
negatives, and leave the SessionEnd test, whose send still exists, alone.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: bound foreground vouching to the session's recorded process

Review follow-ups on the restored-agent liveness evidence:

- A pane's foreground process that shows no session identity vouched for
  the binding unconditionally. Once the session has registered its own
  process, a different bare Pi in the same pane is another agent, so only
  that registered process may vouch without naming the session; an
  explicit `--session` still decides either way.
- The workspace and Dock lifecycles each re-implemented the same evidence
  order. `RestoredAgentLiveness` is now the one evaluator; each container
  supplies only its runtime table, workspace identity, and foreground pid.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* fix: let a dead recorded process stop bounding foreground vouching

The previous bound forwarded the session's recorded PID to the foreground
check unconditionally, so a dead PID left in the runtime table blocked
vouching for a Pi resumed in place (hibernation resume, manual `cmux
restore`) whose argv is already a bare title, and the first prompt mark
could retire it again. Bound bare vouching to the recorded process only
while that process still exists. A wrongly kept binding self-heals within a
second when a stranger's own session-start hook replaces it; a wrongly
retired one stays retired until the next prompt.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* chore: mirror the warning-budget and test-compile fixes from manaflow-ai#12168

main's macOS lane is red on the Swift warning budget (five over-budget
warnings) and the CmuxTerminal test bundle's compile; manaflow-ai#12168 fixes both but
has not merged yet. Carry the same six source hunks here so this PR's CI can
pass on its own; they are identical to manaflow-ai#12168 and merge away when it lands.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EvVAUmXgi8CoNwXyrbCugH

* test: avoid exec race in PID routing regression

* test: remove nondeterministic lane assertion sleep

* review: make liveness evaluator constructable and settle lane test

* test: reflect inconclusive Pi session index semantics

* ci: allow injected fake retry sleeper in determinism gate

* test: reject unidentified replacement Pi processes

* fix: require session identity for foreground Pi liveness

* fix: reconcile Pi restore coverage with fresh-scan admission

* test: cover scrubbed CLI child environment isolation

* fix: isolate CLI fixtures and correct resume test expectations

* fix: retain main Bonsplit revision after merge

* test: exec the PID-routing fixture into a non-platform image

Since macOS 26 the kernel returns no environment for an exec'd platform
binary such as `/bin/sh` or `/bin/sleep`, even to a same-user reader, and a
copied `/bin/sh` refuses to exec at all. The delivery-target fixture exec'd
into `/bin/sh`, so its post-exec scope read could never see
CMUX_SURFACE_ID and the test failed on every Darwin 25 host (six of six
runs on a fleet mini, and the app-host shard on CI). Real agents are node or
bun processes, whose environment stays readable, and so does the Xcode
toolchain's python this fixture now execs into.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: give hook CLI invocations one 30-second wall bound

The Claude hook harnesses bounded each CLI invocation at five or ten
seconds. A hook that prints its verdict and exits normally still needs a
few socket round-trips through a mock server scheduled on the test
process's global queues, and loaded CI runners twice took longer than that:
the process exited 0 with the expected output but was recorded as timed
out. The CLI's own non-actionable client deadlines are far shorter than 30
seconds, so a hook that genuinely hangs still fails.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: keep the routing fixture within its file-length budget

The platform-binary note grew the file past its merge-base length, which
scripts/swift_file_length_budget.py rejects. Fold it into the two comment
lines the fixture already had.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: let the bash-integration guard outlive its background reporters

`set -m` puts the reporters the shell integration forks into their own
process groups, so killing the interactive shell's group leaves them briefly
alive and still writing into the scratch tree. `TemporaryDirectory` then
raced them on a shared CI runner and failed with ENOTEMPTY, taking
linux-preflight and every macOS lane with it. Remove the tree once the
reporters have stopped, and tolerate leftovers after five seconds.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: stop XCTest wait timeouts from crashing the app host in SSH host suite

SSHConfiguredRemoteCommandHostTests is a Swift Testing suite that borrows a
hand-built CLINotifyProcessIntegrationRegressionTests instance for its mock
socket helpers. Its four `processSupport.wait(for:timeout:)` calls route a
timeout through XCTestCase issue recording, and that instance has no
testCaseRun, so XCTest raises NSInternalInconsistencyException and aborts the
whole app host. In CI run 34402005479 shard 1 that abort turned an ordinary
5-second mock-socket timeout into "unexpected" failures and a red shard.

Wait through a standalone XCTWaiter instead and report the timeout as a
Swift Testing expectation, so a slow CLI fails only this test.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: report empty CLI JSON output as an assertion failure, not a thrown error

`jsonPayload(from:)` and `notificationRows(from:)` let `JSONSerialization`
throw when the CLI under test printed nothing. XCTest records that as a thrown
error, and `scripts/ci/classify-app-host-test-output.py` counts thrown errors
as "unexpected" failures, the same bucket as an app-host crash, so a single
slow CLI invocation turned the whole tolerant app-host shard red (CI runs
34402005479 and 34414657622, shard 1, via
testSSHPersistentPTYJSONResolvesSessionIDWhenWorkspaceCreateOmitsSurfaceID).

Parse with `try?` and let `XCTUnwrap` report the missing payload, so the test
still fails with the raw output in the message but as an ordinary failure.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* refactor: keep merged test helpers within file budgets

* fix: remove duplicate CodeRouter fixture from main merge

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>