fix(maestro): always probe tmux during recovery

#164 skipped the tmux probe whenever the stored boot id differed from the
current one, assuming a changed boot id proves the tmux server is gone. It
does not: a restored state directory, a VM or container snapshot rollback,
or a truncated boot_id file all change it while tmux keeps running with
live sessions. Every one of those sessions was then registered Dormant and
stranded — resume respawns `maestro-<id>`, which collides with the name
tmux still holds, so it failed 502 forever.

Recovery now always runs `tmux list-sessions`, the single source of truth
for liveness the rest of the daemon assumes. The boot id keeps its other
job: telling a reboot from a restart in recovery's log.

The #164 test asserted the old behaviour with tmux still alive, so it is
replaced by one asserting the session is adopted Running, plus one covering
a real reboot — boot id changed and the tmux server dead — still going
dormant.

Refs #174

CLAUDE.md

@@ -14,6 +14,7 @@ maestro daemon            tmux wrapper + session API + SPA on 127.0.0.1:7070
   ├── DELETE   /api/sessions/:id    kill
   ├── POST     /api/sessions/:id/input  type text into a session
   ├── POST     /api/sessions/:id/prompt an agent reports its first prompt (#131)
+  ├── POST     /api/sessions/:id/resume respawn a dormant session, same id (#166)
   ├── GET      /api/info            hostname, version, home dir, spawn presets
   ├── GET      /api/dirs            directory listing (spawn autocomplete)
   ├── GET      /api/recent-dirs     spawn history

crates/maestro-cli/src/sessions.rs

@@ -188,6 +188,7 @@ fn print_session_table(out: &mut impl Write, sessions: &[Session], info: &Daemon
         let status = match s.status {
             SessionStatus::Running => "running",
             SessionStatus::Dead => "dead",
+            SessionStatus::Dormant => "dormant",
         };
         let activity = match s.activity {
             ActivityState::Active => "active",
@@ -252,6 +253,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
+            agent_session_id: None,
         }
     }
 

crates/maestro-cli/tests/against_mock_daemon.rs

@@ -28,6 +28,7 @@ async fn info_carries_version_and_presets() {
             id: "claude".into(),
             label: "Claude".into(),
             command: "claude".into(),
+            resume_command: None,
         }],
         ..Default::default()
     });

crates/maestro-config/src/lib.rs

@@ -129,6 +129,80 @@ pub struct DaemonSection {
     /// `Some(0)` disables history entirely (no log written, no recents read).
     #[serde(default)]
     pub spawn_history_days: Option<u32>,
+    /// What recovery does with sessions that outlived their tmux server —
+    /// after a host reboot, or any restart that finds a sidecar with no pane
+    /// (#167). Default [`ResumeOnBoot::Dormant`].
+    #[serde(default, deserialize_with = "deserialize_resume_on_boot")]
+    pub resume_on_boot: Option<ResumeOnBoot>,
+}
+
+impl DaemonSection {
+    /// The configured `[daemon].resume_on_boot`, or the safe default:
+    /// recovered-but-dead sessions wait for the operator.
+    pub fn resume_on_boot(&self) -> ResumeOnBoot {
+        self.resume_on_boot.unwrap_or_default()
+    }
+}
+
+/// `[daemon].resume_on_boot` — what recovery does with a session whose tmux
+/// pane is gone but whose sidecar is still on disk (#167).
+///
+/// Resuming agents unattended seconds after a reboot is a foot-gun: they run
+/// with whatever flags they were spawned with, with nobody watching. So the
+/// default waits for a human, and `auto` is opted into per host.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum ResumeOnBoot {
+    /// Register each one `Dormant` and wait for the operator to resume it.
+    #[default]
+    Dormant,
+    /// Resume each one during recovery, on the same path a client's
+    /// `POST /api/sessions/:id/resume` takes.
+    Auto,
+    /// Prune the sidecars instead: a reboot is a clean slate.
+    Never,
+}
+
+/// Every `[daemon].resume_on_boot` name and its variant, in documentation
+/// order.
+pub const RESUME_ON_BOOT_POLICIES: &[(&str, ResumeOnBoot)] = &[
+    ("dormant", ResumeOnBoot::Dormant),
+    ("auto", ResumeOnBoot::Auto),
+    ("never", ResumeOnBoot::Never),
+];
+
+impl ResumeOnBoot {
+    /// The name this policy is spelled with in the config file and in logs.
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            ResumeOnBoot::Dormant => "dormant",
+            ResumeOnBoot::Auto => "auto",
+            ResumeOnBoot::Never => "never",
+        }
+    }
+}
+
+fn deserialize_resume_on_boot<'de, D>(deserializer: D) -> Result<Option<ResumeOnBoot>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let raw = Option::<String>::deserialize(deserializer)?;
+    raw.map(|name| {
+        RESUME_ON_BOOT_POLICIES
+            .iter()
+            .find(|(n, _)| *n == name)
+            .map(|(_, policy)| *policy)
+            .ok_or_else(|| {
+                let known = RESUME_ON_BOOT_POLICIES
+                    .iter()
+                    .map(|(n, _)| format!("{n:?}"))
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                D::Error::custom(format!(
+                    "invalid [daemon].resume_on_boot {name:?}; expected one of {known}"
+                ))
+            })
+    })
+    .transpose()
 }
 
 /// `[tui]` — `maestro tui` settings (NAP-275 epic, phase 2 NAP-277).
@@ -313,16 +387,19 @@ pub fn builtin_presets() -> Vec<SpawnPreset> {
             id: "claude".into(),
             label: "Claude".into(),
             command: "claude".into(),
+            resume_command: Some("claude --resume {agent_session}".into()),
         },
         SpawnPreset {
             id: "opencode".into(),
             label: "opencode".into(),
             command: "opencode".into(),
+            resume_command: None,
         },
         SpawnPreset {
             id: "zsh".into(),
             label: "Shell".into(),
             command: "zsh".into(),
+            resume_command: None,
         },
     ]
 }
@@ -334,6 +411,7 @@ pub fn custom_preset() -> SpawnPreset {
         id: CUSTOM_PRESET_ID.into(),
         label: "Custom…".into(),
         command: String::new(),
+        resume_command: None,
     }
 }
 
@@ -507,6 +585,18 @@ auto_install = false
         assert!(custom.command.is_empty());
     }
 
+    #[test]
+    fn builtin_claude_preset_resumes_by_agent_session() {
+        let claude = builtin_presets()
+            .into_iter()
+            .find(|preset| preset.id == "claude")
+            .expect("Claude preset");
+        assert_eq!(
+            claude.resume_command.as_deref(),
+            Some("claude --resume {agent_session}")
+        );
+    }
+
     #[test]
     fn spawn_presets_override_replaces_builtins() {
         // Present list replaces the built-ins entirely; custom still appended.
@@ -515,6 +605,7 @@ auto_install = false
                 id: "fish".into(),
                 label: "fish".into(),
                 command: "fish".into(),
+                resume_command: None,
             }]),
             ..Default::default()
         };
@@ -551,6 +642,7 @@ auto_install = false
                 id: "  ".into(),
                 label: "x".into(),
                 command: "x".into(),
+                resume_command: None,
             }]),
             ..Default::default()
         };
@@ -561,6 +653,7 @@ auto_install = false
                 id: "x".into(),
                 label: "x".into(),
                 command: "".into(),
+                resume_command: None,
             }]),
             ..Default::default()
         };
@@ -578,11 +671,13 @@ auto_install = false
                     id: "a".into(),
                     label: "a".into(),
                     command: "a".into(),
+                    resume_command: None,
                 },
                 SpawnPreset {
                     id: "a".into(),
                     label: "a2".into(),
                     command: "a2".into(),
+                    resume_command: None,
                 },
             ]),
             ..Default::default()
@@ -597,6 +692,7 @@ auto_install = false
                 id: "custom".into(),
                 label: "Custom".into(),
                 command: "whatever".into(),
+                resume_command: None,
             }]),
             ..Default::default()
         };
@@ -632,6 +728,27 @@ presets = [
         assert_eq!(ids, ["claude", "zsh", "custom"]);
     }
 
+    #[test]
+    fn spawn_preset_parses_resume_command_from_issue_example() {
+        let cfg = toml::from_str::<MaestroConfigFile>(
+            r#"
+[spawn]
+presets = [
+  { id = "claude", command = "claude --dangerously-skip-permissions", resume_command = "claude --dangerously-skip-permissions --resume {agent_session}" }
+]
+"#,
+        )
+        .expect("issue #165 example parses");
+
+        let preset = &cfg.spawn.presets.expect("configured presets")[0];
+        assert_eq!(preset.id, "claude");
+        assert_eq!(preset.command, "claude --dangerously-skip-permissions");
+        assert_eq!(
+            preset.resume_command.as_deref(),
+            Some("claude --dangerously-skip-permissions --resume {agent_session}")
+        );
+    }
+
     #[test]
     fn spawn_project_scan_fields_default_to_none() {
         // Absent [spawn].project_* → None; the daemon applies its own defaults.
@@ -732,4 +849,27 @@ bind_addr = "127.0.0.1:9090"
         );
         assert_eq!(cfg.resolve_daemon_url(None), "http://explicit:1");
     }
+
+    #[test]
+    fn resume_on_boot_defaults_to_dormant_and_parses_every_policy() {
+        assert_eq!(
+            MaestroConfigFile::default().daemon.resume_on_boot(),
+            ResumeOnBoot::Dormant,
+            "an absent policy is the safe one"
+        );
+        for (name, expected) in RESUME_ON_BOOT_POLICIES {
+            let cfg = file_with(&format!("[daemon]\nresume_on_boot = \"{name}\"\n"));
+            assert_eq!(cfg.daemon.resume_on_boot(), *expected, "{name}");
+            assert_eq!(expected.as_str(), *name);
+        }
+    }
+
+    #[test]
+    fn resume_on_boot_rejects_an_unknown_policy() {
+        let err = toml::from_str::<MaestroConfigFile>("[daemon]\nresume_on_boot = \"maybe\"\n")
+            .expect_err("unknown policy must not silently fall back");
+        let msg = err.to_string();
+        assert!(msg.contains("resume_on_boot"), "{msg}");
+        assert!(msg.contains("\"auto\""), "{msg}");
+    }
 }

crates/maestro-daemon/src/attach.rs

@@ -26,11 +26,17 @@ pub(crate) async fn serve(
 ) -> Result<(), axum::Error> {
     let (mut sink, mut stream) = socket.split();
 
+    // This client's claim on the shared window size. Registered up front and
+    // released on every exit below, so a socket that dies mid-session stops
+    // constraining the size for the clients still attached.
+    let viewport = manager.attach_viewport();
+
     // NAP-229: send buffered scrollback up-front so the client sees the last
     // screenful immediately instead of a blank terminal. The replay lock the
     // bridge held during snapshot+subscribe guarantees no byte appears both
     // here and on the live receiver, and none is dropped at the seam.
     if !replay.is_empty() && sink.send(Message::Binary(replay)).await.is_err() {
+        manager.release_viewport(id, viewport).await;
         return Ok(());
     }
 
@@ -70,7 +76,7 @@ pub(crate) async fn serve(
                     if let Ok(ctrl) = serde_json::from_str::<ClientControl>(&text) {
                         match ctrl {
                             ClientControl::Resize { cols, rows } => {
-                                let _ = manager.resize(id, cols, rows).await;
+                                let _ = manager.set_viewport(id, viewport, cols, rows).await;
                             }
                             ClientControl::Ping => {
                                 let pong = serde_json::to_string(&ClientControl::Pong)
@@ -88,6 +94,8 @@ pub(crate) async fn serve(
         }
     }
 
+    manager.release_viewport(id, viewport).await;
+
     if session_ended {
         let _ = sink.send(Message::Close(None)).await;
     }

crates/maestro-daemon/src/boot_id.rs

@@ -0,0 +1,65 @@
+//! Tells a daemon restart from a host reboot (#164).
+//!
+//! `/proc/sys/kernel/random/boot_id` is fixed for the life of the kernel and
+//! changes on every boot. [`SessionManager::recover`] compares it against the
+//! value it stored on the previous run and logs which of the two it was.
+//!
+//! It does not decide liveness (#174). A boot id changes without the tmux
+//! server dying whenever the state directory is restored, a VM or container
+//! snapshot is rolled back, or the `boot_id` file is truncated — so recovery
+//! always probes `tmux list-sessions` and the boot id only says whether a
+//! server that did not answer is coming back.
+
+use std::path::Path;
+
+/// Where the daemon reads the running kernel's boot id. Behind a trait so
+/// tests can simulate a changed (or unreadable) boot id without rebooting the
+/// machine.
+pub trait BootIdSource: std::fmt::Debug + Send + Sync + 'static {
+    /// Current boot id, or `None` if it can't be determined (non-Linux,
+    /// restricted `/proc`, missing or empty file).
+    fn current(&self) -> Option<String>;
+}
+
+/// Production source: `/proc/sys/kernel/random/boot_id`.
+#[derive(Debug, Default)]
+pub struct ProcBootId;
+
+impl BootIdSource for ProcBootId {
+    fn current(&self) -> Option<String> {
+        read_boot_id(Path::new("/proc/sys/kernel/random/boot_id"))
+    }
+}
+
+fn read_boot_id(path: &Path) -> Option<String> {
+    let contents = std::fs::read_to_string(path).ok()?;
+    let trimmed = contents.trim();
+    (!trimmed.is_empty()).then(|| trimmed.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reads_trimmed_contents() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("boot_id");
+        std::fs::write(&path, "abc-123\n").unwrap();
+        assert_eq!(read_boot_id(&path).as_deref(), Some("abc-123"));
+    }
+
+    #[test]
+    fn missing_file_returns_none() {
+        let dir = tempfile::tempdir().unwrap();
+        assert_eq!(read_boot_id(&dir.path().join("missing")), None);
+    }
+
+    #[test]
+    fn empty_file_returns_none() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("boot_id");
+        std::fs::write(&path, "\n").unwrap();
+        assert_eq!(read_boot_id(&path), None);
+    }
+}

crates/maestro-daemon/src/cli.rs

@@ -83,7 +83,14 @@ async fn run(config_override: Option<PathBuf>) -> Result<(), Box<dyn Error>> {
     .with_spawn_history(crate::spawn_history::SpawnHistory::new(
         config.spawn_history_path(),
         config.spawn_history_days,
-    ));
+    ))
+    .with_boot_id(
+        config.boot_id_path(),
+        std::sync::Arc::new(crate::boot_id::ProcBootId),
+    )
+    // #167: recovery needs the presets to resolve a resumed session's command,
+    // so `auto` runs the same resume a client's POST would.
+    .with_resume_policy(config.resume_on_boot, config.spawn_presets.clone());
     // Spawned sessions learn where to report back (#103). Derived from the
     // configured bind address; set before any spawn can happen.
     manager.set_daemon_url(format!("http://{}", config.bind_addr));

crates/maestro-daemon/src/config.rs

@@ -97,6 +97,10 @@ pub struct DaemonConfig {
     /// never binds it itself; it serves it so the web client and the TUI read
     /// one knob.
     pub leader: String,
+    /// What recovery does with sessions whose tmux pane is gone but whose
+    /// sidecar survives (#167): `[daemon].resume_on_boot`, default
+    /// [`maestro_config::ResumeOnBoot::Dormant`].
+    pub resume_on_boot: maestro_config::ResumeOnBoot,
 }
 
 impl DaemonConfig {
@@ -112,6 +116,12 @@ impl DaemonConfig {
     pub fn spawn_history_path(&self) -> PathBuf {
         self.state_dir.join("spawn-history.jsonl")
     }
+
+    /// Where recovery records the kernel boot id it saw last (#164):
+    /// `<state_dir>/boot_id`.
+    pub fn boot_id_path(&self) -> PathBuf {
+        self.state_dir.join("boot_id")
+    }
 }
 
 /// Env-var overrides applied by [`load_config`]. Tests pass explicit
@@ -143,6 +153,8 @@ pub fn load_config(path: &Path, env: EnvOverrides) -> Result<DaemonConfig, Confi
     // validation (#22/#26).
     let spawn_presets = file.spawn.resolve()?;
 
+    let resume_on_boot = daemon.resume_on_boot();
+
     let hostname = daemon.hostname.unwrap_or_else(system_hostname);
     let home_dir = dirs::home_dir()
         .map(|p| p.to_string_lossy().into_owned())
@@ -203,6 +215,7 @@ pub fn load_config(path: &Path, env: EnvOverrides) -> Result<DaemonConfig, Confi
         project_scan_depth,
         hooks_auto_install: file.hooks.auto_install(),
         leader: file.tui.leader().to_string(),
+        resume_on_boot,
     })
 }
 
@@ -283,6 +296,34 @@ auto_install = false
         assert!(!cfg.hooks_auto_install);
     }
 
+    #[test]
+    fn resume_on_boot_defaults_to_dormant_and_reads_the_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("config.toml");
+        std::fs::write(&path, "").unwrap();
+        assert_eq!(
+            load_config(&path, EnvOverrides::default())
+                .unwrap()
+                .resume_on_boot,
+            maestro_config::ResumeOnBoot::Dormant
+        );
+
+        std::fs::write(
+            &path,
+            r#"
+[daemon]
+resume_on_boot = "auto"
+"#,
+        )
+        .unwrap();
+        assert_eq!(
+            load_config(&path, EnvOverrides::default())
+                .unwrap()
+                .resume_on_boot,
+            maestro_config::ResumeOnBoot::Auto
+        );
+    }
+
     #[test]
     fn empty_file_defaults_everything() {
         let dir = tempfile::tempdir().unwrap();

crates/maestro-daemon/src/lib.rs

@@ -12,6 +12,7 @@ pub mod attach;
 /// Naming a session after its first prompt (#131).
 #[cfg(feature = "haiku-autoname")]
 pub mod autoname;
+pub mod boot_id;
 pub mod branches;
 pub mod cli;
 pub mod config;
@@ -24,12 +25,14 @@ pub mod proc;
 pub mod projects;
 pub mod pty;
 pub mod release;
+pub mod resume;
 pub mod session;
 pub mod sidecar;
 pub mod spawn_history;
 #[cfg(feature = "web")]
 pub mod static_bundle;
 pub mod tmux;
+pub mod viewport;
 pub mod worktree;
 pub mod worktree_probe;
 

crates/maestro-daemon/src/local_api.rs

@@ -52,6 +52,7 @@ pub fn router(state: LocalApiState) -> Router {
         .route(routes::patterns::SESSION_ACTIVITY, post(report_activity))
         .route(routes::patterns::SESSION_INPUT, post(send_input))
         .route(routes::patterns::SESSION_FOCUS, post(set_focus))
+        .route(routes::patterns::SESSION_RESUME, post(resume_session))
         .route(
             routes::patterns::SESSION,
             delete(kill_session).patch(rename_session),
@@ -170,6 +171,9 @@ fn session_error_status(code: &str) -> StatusCode {
         // The session outlived its pane: nothing to type into, and nothing
         // the daemon can do about it.
         "not_running" => StatusCode::CONFLICT,
+        // Resume refusals (#166): the session exists and the request was
+        // well-formed, it just cannot be brought back in this state.
+        "already_running" | "cwd_missing" => StatusCode::CONFLICT,
         _ => StatusCode::BAD_GATEWAY,
     }
 }
@@ -307,7 +311,11 @@ async fn report_activity(
     Path(id): Path<Uuid>,
     Json(body): Json<ReportActivityRequest>,
 ) -> Response {
-    match s.manager.report_activity(id, body.state, body.detail).await {
+    match s
+        .manager
+        .report_activity(id, body.state, body.detail, body.session_id)
+        .await
+    {
         Ok(()) => StatusCode::NO_CONTENT.into_response(),
         Err(e) => {
             let info = e.to_error_info();
@@ -364,6 +372,27 @@ async fn set_focus(
     }
 }
 
+/// `POST /api/sessions/:id/resume` (#166): respawn a session that has no pane
+/// under its own id and sidecar, so its name, `created_at`, env and worktree
+/// ownership survive. Answers with the updated session, which also goes out as
+/// `SessionUpdated` to every events subscriber.
+///
+/// Refused with `409` when the session is already running or its `cwd` is
+/// gone; `404` when there is no such session.
+async fn resume_session(State(s): State<LocalApiState>, Path(id): Path<Uuid>) -> Response {
+    match s.manager.resume(id, &s.presets).await {
+        Ok(session) => (StatusCode::OK, Json(session)).into_response(),
+        Err(e) => {
+            let info = e.to_error_info();
+            error_response(
+                session_error_status(&info.code),
+                info.code.as_str(),
+                info.message.as_str(),
+            )
+        }
+    }
+}
+
 fn error_response(status: StatusCode, code: &str, message: &str) -> Response {
     (status, Json(ApiError::new(code, message))).into_response()
 }
@@ -406,6 +435,16 @@ async fn attach_ws(
     ws: axum::extract::WebSocketUpgrade,
 ) -> Result<Response, Response> {
     let Some((replay, rx)) = s.manager.subscribe_pty_with_replay(id).await else {
+        // #166: a session the daemon knows but has no bridge for — a dormant
+        // one — is not missing, it is not running. Reporting it as unknown
+        // left the client unable to tell "gone" from "resumable".
+        if s.manager.has(id).await {
+            return Err(error_response(
+                StatusCode::CONFLICT,
+                "not_attachable",
+                "session has no live pane; resume it first",
+            ));
+        }
         return Err(error_response(
             StatusCode::NOT_FOUND,
             "unknown_session",

crates/maestro-daemon/src/resume.rs

@@ -0,0 +1,99 @@
+//! Choosing the command a resumed session comes back on (#166).
+//!
+//! A session records the command it was spawned with. Bringing it back means
+//! running that preset's `resume_command` (#165) instead, so an agent picks up
+//! its old conversation rather than starting a fresh one. Everything else
+//! about the session — id, sidecar, name, `created_at`, env, worktree — is
+//! untouched, so only the command is decided here.
+
+use maestro_protocol::{Session, SpawnPreset};
+
+/// The command to respawn `session` with.
+///
+/// The preset is matched on the command the session was spawned with, which is
+/// what the sidecar holds. A session with no matching preset, a preset with no
+/// `resume_command`, or a `resume_command` needing an agent session id the
+/// session never reported all fall back to the original command: respawning
+/// what the operator asked for is always honest, where a half-filled resume
+/// template is not.
+pub fn resume_command(session: &Session, presets: &[SpawnPreset]) -> String {
+    presets
+        .iter()
+        .find(|p| p.command == session.command)
+        .and_then(|p| p.resume_command_for(session.agent_session_id.as_deref()))
+        .unwrap_or_else(|| session.command.clone())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+
+    fn presets() -> Vec<SpawnPreset> {
+        vec![
+            SpawnPreset {
+                id: "claude".into(),
+                label: "Claude".into(),
+                command: "claude".into(),
+                resume_command: Some("claude --resume {agent_session}".into()),
+            },
+            SpawnPreset {
+                id: "zsh".into(),
+                label: "Shell".into(),
+                command: "zsh".into(),
+                resume_command: None,
+            },
+        ]
+    }
+
+    fn session(command: &str, agent_session_id: Option<&str>) -> Session {
+        Session {
+            id: uuid::Uuid::new_v4(),
+            cwd: "/tmp".into(),
+            command: command.into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+            status: maestro_protocol::SessionStatus::Dormant,
+            created_at: chrono::Utc::now(),
+            foreground: None,
+            activity: maestro_protocol::ActivityState::Idle,
+            activity_detail: None,
+            last_activity_at: chrono::Utc::now(),
+            activity_since: chrono::Utc::now(),
+            current_cwd: None,
+            blocked_work: None,
+            last_focused_at: None,
+            agent_session_id: agent_session_id.map(str::to_string),
+        }
+    }
+
+    #[test]
+    fn uses_the_matching_presets_resume_command() {
+        assert_eq!(
+            resume_command(&session("claude", Some("conv-7")), &presets()),
+            "claude --resume conv-7"
+        );
+    }
+
+    #[test]
+    fn falls_back_when_the_agent_session_id_is_unknown() {
+        assert_eq!(
+            resume_command(&session("claude", None), &presets()),
+            "claude"
+        );
+    }
+
+    #[test]
+    fn falls_back_for_a_preset_without_a_resume_command() {
+        assert_eq!(resume_command(&session("zsh", None), &presets()), "zsh");
+    }
+
+    #[test]
+    fn falls_back_when_no_preset_matches() {
+        assert_eq!(
+            resume_command(&session("bash --noprofile", Some("conv-7")), &presets()),
+            "bash --noprofile"
+        );
+    }
+}

crates/maestro-daemon/src/session.rs

@@ -7,10 +7,12 @@
 
 use std::collections::{HashMap, HashSet};
 use std::path::PathBuf;
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Arc;
 use std::time::Duration;
 
 use chrono::Utc;
+use maestro_config::ResumeOnBoot;
 use maestro_protocol::{
     ActivityState, CatalogEvent, CreateSessionRequest, ErrorInfo, NameSource, Session,
     SessionStatus, WorktreeSpec, NAME_KEY, NAME_SOURCE_KEY,
@@ -18,11 +20,13 @@ use maestro_protocol::{
 use tokio::sync::{broadcast, Mutex};
 use uuid::Uuid;
 
+use crate::boot_id::BootIdSource;
 use crate::panes::Panes;
 use crate::pty::{pipe_pane_command, PtyBridge};
 use crate::sidecar::{SidecarError, SidecarStore};
 use crate::spawn_history::{RecentDir, SpawnHistory, SpawnHistoryRecord};
 use crate::tmux::TmuxError;
+use crate::viewport::{ViewportId, Viewports};
 use crate::worktree::{WorktreeError, WorktreeManager};
 
 /// Capacity of the session-events broadcast channel. A subscriber that falls
@@ -60,7 +64,10 @@ pub struct SessionRecord {
     /// `base_repo` from the original `WorktreeSpec`. Needed because `git
     /// worktree remove` is invoked from the base repo.
     pub worktree_base_repo: Option<PathBuf>,
-    pub bridge: PtyBridge,
+    /// The PTY bridge feeding this session's attach stream. `None` for a
+    /// `Dormant` session (#162): there is no pane behind it, so there is
+    /// nothing to pipe and nothing to attach to.
+    pub bridge: Option<PtyBridge>,
     /// Agent-reported activity (#105) still within its TTL. While in force it
     /// outranks the activity pass's own inference; when it lapses, inference
     /// resumes and [`Session::activity_detail`] is cleared with it. This
@@ -106,6 +113,15 @@ pub enum SessionError {
     /// a stray keystroke on an attach socket, which is dropped.
     #[error("session is no longer running: {0}")]
     NotRunning(Uuid),
+    /// A resume (#166) was asked for a session that is already running. There
+    /// is nothing to bring back, and respawning would strand the pane that is
+    /// already there.
+    #[error("session is already running: {0}")]
+    AlreadyRunning(Uuid),
+    /// A resume (#166) was asked for a session whose working directory is
+    /// gone. Nothing can be resumed in a directory that no longer exists.
+    #[error("session working directory no longer exists: {0}")]
+    CwdMissing(PathBuf),
     /// The kill was refused (#79): the session's worktree holds unsaved work.
     /// Nothing happened — the session keeps running and the tree is untouched,
     /// so it stays the operator's handle on their own unfinished work.
@@ -124,6 +140,8 @@ impl SessionError {
             SessionError::InvalidEnv(_) => "invalid_env",
             SessionError::NotRunning(_) => "not_running",
             SessionError::KillGuarded(_) => "kill_guarded",
+            SessionError::AlreadyRunning(_) => "already_running",
+            SessionError::CwdMissing(_) => "cwd_missing",
         };
         let unsaved_work = match self {
             SessionError::KillGuarded(b) => Some(*b),
@@ -166,6 +184,38 @@ struct Inner {
     report_ttl: Duration,
     sessions: Mutex<HashMap<Uuid, SessionRecord>>,
     events: broadcast::Sender<CatalogEvent>,
+    /// Sizes reported by the clients attached to each session, and what tmux
+    /// was last told. See [`crate::viewport`] for why the window is not simply
+    /// set to whatever arrived most recently.
+    viewports: Mutex<Viewports>,
+    /// Hands out [`ViewportId`]s. Monotonic for the daemon's lifetime, so a
+    /// client that reconnects never collides with the registration its
+    /// previous socket has not finished releasing.
+    next_viewport: AtomicU64,
+    /// Boot-id tracking for `recover` (#164). `None` — the default — means
+    /// reboot detection is unwired, which behaves exactly like a boot id
+    /// that could never be read: always fall back to probing tmux.
+    boot_id: Option<BootIdConfig>,
+    /// What recovery does with a session whose pane is gone (#167), and the
+    /// presets an `auto` resume resolves its command from. Defaults to
+    /// [`ResumeOnBoot::Dormant`] with no presets: register and wait.
+    resume_policy: ResumeOnBoot,
+    resume_presets: Vec<maestro_protocol::SpawnPreset>,
+}
+
+/// Where recovery persists the boot id it last saw, and how it reads the
+/// current one. See [`crate::boot_id`].
+struct BootIdConfig {
+    path: PathBuf,
+    source: Arc<dyn BootIdSource>,
+}
+
+impl std::fmt::Debug for BootIdConfig {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("BootIdConfig")
+            .field("path", &self.path)
+            .finish_non_exhaustive()
+    }
 }
 
 impl SessionManager {
@@ -206,6 +256,11 @@ impl SessionManager {
                 report_ttl: crate::activity::REPORT_TTL,
                 sessions: Mutex::new(HashMap::new()),
                 events,
+                viewports: Mutex::new(Viewports::new()),
+                next_viewport: AtomicU64::new(0),
+                boot_id: None,
+                resume_policy: ResumeOnBoot::default(),
+                resume_presets: Vec::new(),
             }),
         }
     }
@@ -235,6 +290,41 @@ impl SessionManager {
         self
     }
 
+    /// Wire boot-id tracking for `recover` (#164). Builder, called once right
+    /// after construction like the other `with_*` methods. Without it,
+    /// `recover` always falls back to probing tmux — the same as a boot id
+    /// that could never be read.
+    ///
+    /// # Panics
+    ///
+    /// If the handle has already been cloned.
+    pub fn with_boot_id(mut self, path: PathBuf, source: Arc<dyn BootIdSource>) -> Self {
+        let inner = Arc::get_mut(&mut self.inner)
+            .expect("with_boot_id must be called before the SessionManager is cloned");
+        inner.boot_id = Some(BootIdConfig { path, source });
+        self
+    }
+
+    /// Wire the `[daemon].resume_on_boot` policy (#167) and the spawn presets
+    /// an `auto` resume resolves each session's command from. Builder, called
+    /// once right after construction like the other `with_*` methods. Without
+    /// it, recovery behaves as [`ResumeOnBoot::Dormant`].
+    ///
+    /// # Panics
+    ///
+    /// If the handle has already been cloned.
+    pub fn with_resume_policy(
+        mut self,
+        policy: ResumeOnBoot,
+        presets: Vec<maestro_protocol::SpawnPreset>,
+    ) -> Self {
+        let inner = Arc::get_mut(&mut self.inner)
+            .expect("with_resume_policy must be called before the SessionManager is cloned");
+        inner.resume_policy = policy;
+        inner.resume_presets = presets;
+        self
+    }
+
     /// Set the daemon's own HTTP base URL (#103), exported to every session
     /// spawned afterwards as `MAESTRO_URL`. Unlike the `with_*` builders this
     /// is a plain setter: the daemon runner learns its bound address after
@@ -279,7 +369,10 @@ impl SessionManager {
     /// unknown to this daemon.
     pub async fn subscribe_pty(&self, id: Uuid) -> Option<broadcast::Receiver<Vec<u8>>> {
         let sessions = self.inner.sessions.lock().await;
-        sessions.get(&id).map(|r| r.bridge.subscribe())
+        sessions
+            .get(&id)
+            .and_then(|r| r.bridge.as_ref())
+            .map(|b| b.subscribe())
     }
 
     /// Subscribe to a session's PTY broadcast and return the replay buffer
@@ -298,19 +391,26 @@ impl SessionManager {
         let (result, updated) = {
             let mut sessions = self.inner.sessions.lock().await;
             let rec = sessions.get_mut(&id)?;
-            rec.session.last_focused_at = Some(Utc::now());
-            let updated = rec.session.clone();
+            let SessionRecord {
+                session, bridge, ..
+            } = &mut *rec;
+            // #162: a dormant session has no bridge and no pane — nothing was
+            // ever piped for it, so there is no stream to hand back and the
+            // attach reads as unknown. Checked before anything is stamped.
+            let bridge = bridge.as_ref()?;
+            session.last_focused_at = Some(Utc::now());
+            let updated = session.clone();
             // For a live session, tmux's own screen beats the byte tail: the
             // tail starts mid-stream, so a full-screen program (an agent TUI)
             // replayed from it renders as garbage until something forces a
             // repaint. A dead session has no pane left to capture, so it
             // keeps the byte tail.
-            let alive = rec.session.status == SessionStatus::Running;
+            let alive = session.status == SessionStatus::Running;
             // The capture shells out to tmux while the replay lock is held,
             // which parks the reader for the length of one tmux round-trip.
             // That only happens on attach, and the alternative is a seam in
             // the stream.
-            let result = rec.bridge.subscribe_with_snapshot(|| {
+            let result = bridge.subscribe_with_snapshot(|| {
                 if !alive {
                     return None;
                 }
@@ -466,6 +566,7 @@ impl SessionManager {
             // fresh tree has nothing in the way anyway.
             blocked_work: None,
             last_focused_at: None,
+            agent_session_id: None,
         };
 
         if let Err(e) = self.inner.sidecar.write(&session) {
@@ -487,7 +588,7 @@ impl SessionManager {
                     fifo_path,
                     worktree_path,
                     worktree_base_repo,
-                    bridge,
+                    bridge: Some(bridge),
                     reported_activity: None,
                     settled: false,
                     #[cfg(feature = "haiku-autoname")]
@@ -524,6 +625,112 @@ impl SessionManager {
         Ok(session)
     }
 
+    /// Bring a session that has no pane back to life (#166).
+    ///
+    /// The session comes back under the **same** uuid and the same sidecar, so
+    /// `metadata.name`, `created_at`, `env` and worktree ownership all survive
+    /// — only the tmux session and the PTY bridge are new. That is the whole
+    /// point: spawning a fresh session at the same path instead produces a
+    /// stranger with no worktree to clean up on kill.
+    ///
+    /// The command is [`crate::resume::resume_command`]: the matching preset's
+    /// `resume_command` (#165) with the session's own agent conversation id
+    /// substituted in, falling back to the command the session was spawned
+    /// with. `Session::command` keeps the original either way, so a second
+    /// resume still resolves the same preset.
+    ///
+    /// Refused for a session that is already running, and for one whose `cwd`
+    /// has disappeared — neither is something a respawn could fix.
+    pub async fn resume(
+        &self,
+        id: Uuid,
+        presets: &[maestro_protocol::SpawnPreset],
+    ) -> Result<Session, SessionError> {
+        let mut session = {
+            let sessions = self.inner.sessions.lock().await;
+            let rec = sessions.get(&id).ok_or(SessionError::NotFound(id))?;
+            if rec.session.status == SessionStatus::Running {
+                return Err(SessionError::AlreadyRunning(id));
+            }
+            rec.session.clone()
+        };
+        if !session.cwd.exists() {
+            return Err(SessionError::CwdMissing(session.cwd.clone()));
+        }
+        let command = crate::resume::resume_command(&session, presets);
+
+        // Same fifo path as the original spawn: it is derived from the id, and
+        // `mkfifo` tolerates the stale node the previous run left behind.
+        let fifo_path = self.inner.fifo_dir.join(format!("{id}.fifo"));
+        let bridge =
+            PtyBridge::start_with_replay(fifo_path.clone(), self.inner.replay_bytes).await?;
+        let mut session_env = sanitize_env(&session.env)?;
+        session_env.insert("MAESTRO_SESSION_ID".into(), id.to_string());
+        if let Some(url) = self
+            .inner
+            .daemon_url
+            .lock()
+            .expect("daemon_url mutex")
+            .clone()
+        {
+            session_env.insert("MAESTRO_URL".into(), url);
+        }
+        let spawned = {
+            let tmux = self.inner.tmux.clone();
+            let cwd = session.cwd.clone();
+            let command = command.clone();
+            let sink = pipe_pane_command(&fifo_path);
+            tmux_blocking(move || tmux.new_session_piped(id, &cwd, &command, &session_env, &sink))
+                .await
+        };
+        if let Err(e) = spawned {
+            // `bridge` drops here, closing the FIFO reader. Nothing else was
+            // touched, so the session stays exactly as dormant as it was.
+            return Err(SessionError::Tmux(e));
+        }
+
+        session.status = SessionStatus::Running;
+        // A resumed session is producing its initial output again; the
+        // watcher refines this on its next tick, exactly as after a spawn.
+        session.foreground = None;
+        session.activity = ActivityState::Active;
+        session.activity_detail = None;
+        session.last_activity_at = Utc::now();
+        session.activity_since = Utc::now();
+        session.current_cwd = None;
+        session.last_focused_at = None;
+
+        if let Err(e) = self.inner.sidecar.write(&session) {
+            // tmux already spawned; kill it rather than leave a pane the
+            // sidecar does not describe.
+            let tmux = self.inner.tmux.clone();
+            let _ = tmux_blocking(move || tmux.kill_session(id)).await;
+            return Err(SessionError::Sidecar(e));
+        }
+
+        {
+            let mut sessions = self.inner.sessions.lock().await;
+            let Some(rec) = sessions.get_mut(&id) else {
+                // Killed while we were spawning. Undo the pane instead of
+                // leaving one behind with no record of it.
+                let tmux = self.inner.tmux.clone();
+                let _ = tmux_blocking(move || tmux.kill_session(id)).await;
+                return Err(SessionError::NotFound(id));
+            };
+            rec.session = session.clone();
+            rec.fifo_path = fifo_path;
+            rec.bridge = Some(bridge);
+            rec.reported_activity = None;
+            rec.settled = false;
+            rec.focused_since = None;
+            rec.awaiting_suppressed = false;
+        }
+        let _ = self.inner.events.send(CatalogEvent::SessionUpdated {
+            session: session.clone(),
+        });
+        Ok(session)
+    }
+
     /// Best-effort removal of a worktree created earlier in `create` when a
     /// later step fails. No-op when the request had no worktree.
     fn rollback_worktree(&self, base: &Option<PathBuf>, path: &Option<PathBuf>) {
@@ -639,8 +846,20 @@ impl SessionManager {
     /// and start a `PtyBridge`. Sessions whose sidecar references a `cwd`
     /// that no longer exists are still adopted — the spec does not require
     /// us to repair them.
+    ///
+    /// #164/#174: the kernel's boot id says whether the host rebooted since
+    /// the last run, but it never decides which sessions are alive —
+    /// `tmux list-sessions` does, always, which is what the rest of the
+    /// daemon assumes. A boot id can change without the tmux server dying
+    /// (a restored state directory, a VM or container snapshot restore, a
+    /// truncated `boot_id` file); skipping the probe then registered every
+    /// live session `Dormant`, and resume could never bring one back because
+    /// the tmux name was still taken. The boot id is now only a signal that a
+    /// tmux server which did not answer is not coming back, and it names
+    /// itself in recovery's log.
     pub async fn recover(&self) -> Result<usize, SessionError> {
         tokio::fs::create_dir_all(&self.inner.fifo_dir).await?;
+        let rebooted = self.check_boot_id().await;
         let live = {
             let tmux = self.inner.tmux.clone();
             tmux_blocking(move || tmux.list_sessions()).await?
@@ -671,6 +890,7 @@ impl SessionManager {
                     current_cwd: None,
                     blocked_work: None,
                     last_focused_at: None,
+                    agent_session_id: None,
                 },
             };
             let fifo_path = self.inner.fifo_dir.join(format!("{id}.fifo"));
@@ -695,7 +915,7 @@ impl SessionManager {
                     // directory blocks that branch forever (#54 review).
                     worktree_path: session.worktree.as_ref().map(|w| w.path.clone()),
                     worktree_base_repo: session.worktree.as_ref().map(|w| w.base_repo.clone()),
-                    bridge,
+                    bridge: Some(bridge),
                     reported_activity: None,
                     settled: false,
                     #[cfg(feature = "haiku-autoname")]
@@ -710,16 +930,191 @@ impl SessionManager {
                 .send(CatalogEvent::SessionAdded { session });
             adopted += 1;
         }
+        self.register_dormant(rebooted).await;
         Ok(adopted)
     }
 
-    /// Forward keystrokes to a session's pane. A dead session is read-only —
-    /// its pane is gone, so this is a no-op rather than a tmux failure the
-    /// client would have to interpret.
+    /// Compare the running kernel's boot id against the one recovery stored
+    /// last time (#164), then persist the current one for next time. Returns
+    /// `true` only when both are known and differ — a host reboot.
+    ///
+    /// A missing stored value (first run) or an unreadable current one
+    /// (non-Linux, restricted `/proc`, unwired in this build) both read as
+    /// "no reboot". Either way the tmux probe runs (#174): the answer only
+    /// tells recovery whether a tmux server that did not answer is coming
+    /// back, never which sessions are alive.
+    async fn check_boot_id(&self) -> bool {
+        let Some(cfg) = &self.inner.boot_id else {
+            return false;
+        };
+        let Some(current) = cfg.source.current() else {
+            return false;
+        };
+        let stored = tokio::fs::read_to_string(&cfg.path)
+            .await
+            .ok()
+            .map(|s| s.trim().to_string())
+            .filter(|s| !s.is_empty());
+        let rebooted = stored.is_some_and(|s| s != current);
+        if let Some(parent) = cfg.path.parent() {
+            let _ = tokio::fs::create_dir_all(parent).await;
+        }
+        if let Err(e) = tokio::fs::write(&cfg.path, &current).await {
+            tracing::warn!(error = ?e, path = %cfg.path.display(), "recover: failed to persist boot id");
+        }
+        rebooted
+    }
+
+    /// Second recovery pass (#162): register every sidecar tmux had nothing to
+    /// adopt as a [`SessionStatus::Dormant`] session.
+    ///
+    /// A host reboot kills the tmux server, so the first pass runs over an
+    /// empty list and every session would otherwise disappear from the API
+    /// while its sidecar sat untouched on disk. A dormant record keeps the id,
+    /// name, cwd, command, worktree and `created_at` — everything the sidecar
+    /// holds — so the operator still has a record of what was running. It has
+    /// no tmux session and no [`PtyBridge`] behind it: it cannot be attached
+    /// to, cannot be typed into, and is skipped by both watcher passes. The
+    /// only thing left to do with one is dismiss it, which removes the sidecar
+    /// so the next recovery does not bring it back.
+    ///
+    /// Activity is not carried over: whatever the session was doing, it is not
+    /// doing it now. The rest of the sidecar is left as written.
+    ///
+    /// #163: a sidecar whose `cwd` no longer exists is pruned instead —
+    /// nothing can be resumed in a directory that is gone, so the honest move
+    /// is to delete the sidecar rather than register a record no operator can
+    /// act on. A sidecar whose `cwd` still exists is kept regardless of age.
+    ///
+    /// `rebooted` (#164) only changes what gets logged: a detected reboot
+    /// names the count even when it is zero, so the operator sees that
+    /// recovery told a reboot from a restart instead of a log that stays
+    /// silent either way. It never decides membership — everything here got
+    /// here by tmux not holding it (#174).
+    async fn register_dormant(&self, rebooted: bool) {
+        let stored = match self.inner.sidecar.load_all() {
+            Ok(stored) => stored,
+            Err(e) => {
+                tracing::warn!(error = ?e, "recover: reading sidecars for dormant sessions failed");
+                return;
+            }
+        };
+        let mut registered = Vec::new();
+        let mut pruned = 0usize;
+        let mut discarded = 0usize;
+        {
+            let mut sessions = self.inner.sessions.lock().await;
+            for mut session in stored {
+                if sessions.contains_key(&session.id) {
+                    // Adopted live by the first pass; its sidecar is on disk too.
+                    continue;
+                }
+                if !session.cwd.exists() {
+                    if let Err(e) = self.inner.sidecar.delete(session.id) {
+                        tracing::warn!(error = ?e, id = %session.id, "recover: failed to prune sidecar with missing cwd");
+                    }
+                    pruned += 1;
+                    continue;
+                }
+                if self.inner.resume_policy == ResumeOnBoot::Never {
+                    // #167: this host wants a reboot to be a clean slate, so
+                    // the sidecar goes the way #163's does — nothing is
+                    // registered and the next recovery finds nothing.
+                    if let Err(e) = self.inner.sidecar.delete(session.id) {
+                        tracing::warn!(error = ?e, id = %session.id, "recover: failed to prune sidecar under resume_on_boot=never");
+                    }
+                    discarded += 1;
+                    continue;
+                }
+                let id = session.id;
+                session.status = SessionStatus::Dormant;
+                session.foreground = None;
+                session.activity = ActivityState::Idle;
+                session.activity_detail = None;
+                sessions.insert(
+                    id,
+                    SessionRecord {
+                        session: session.clone(),
+                        fifo_path: self.inner.fifo_dir.join(format!("{id}.fifo")),
+                        // Still known, so a dismissal cleans the worktree up —
+                        // the same reason recovery restores it for a live
+                        // session (#54 review).
+                        worktree_path: session.worktree.as_ref().map(|w| w.path.clone()),
+                        worktree_base_repo: session.worktree.as_ref().map(|w| w.base_repo.clone()),
+                        bridge: None,
+                        reported_activity: None,
+                        settled: false,
+                        #[cfg(feature = "haiku-autoname")]
+                        naming: false,
+                        focused_since: None,
+                        awaiting_suppressed: false,
+                    },
+                );
+                registered.push(session);
+            }
+        }
+        if rebooted {
+            tracing::info!(
+                dormant = registered.len(),
+                "host rebooted, sessions dormant"
+            );
+        } else if !registered.is_empty() {
+            tracing::info!(
+                dormant = registered.len(),
+                "registered sessions with no live tmux as dormant"
+            );
+        }
+        if pruned > 0 {
+            tracing::info!(pruned, "pruned sidecars whose cwd no longer exists");
+        }
+        let resumable: Vec<Uuid> = registered.iter().map(|s| s.id).collect();
+        for session in registered {
+            let _ = self
+                .inner
+                .events
+                .send(CatalogEvent::SessionAdded { session });
+        }
+
+        // #167: say which policy ran and how many sessions it acted on, so a
+        // host that resumes agents unattended says so in its own log. The
+        // match is exhaustive on purpose: a fourth policy must decide what it
+        // does here rather than inherit whichever arm happened to be last.
+        match self.inner.resume_policy {
+            ResumeOnBoot::Dormant => tracing::info!(
+                policy = ResumeOnBoot::Dormant.as_str(),
+                sessions = resumable.len(),
+                "resume_on_boot: sessions left dormant for the operator"
+            ),
+            ResumeOnBoot::Never => tracing::info!(
+                policy = ResumeOnBoot::Never.as_str(),
+                sessions = discarded,
+                "resume_on_boot: pruned the sidecars of sessions with no live pane"
+            ),
+            ResumeOnBoot::Auto => {
+                tracing::info!(
+                    policy = ResumeOnBoot::Auto.as_str(),
+                    sessions = resumable.len(),
+                    "resume_on_boot: resuming sessions with no live pane"
+                );
+                let presets = self.inner.resume_presets.clone();
+                for id in resumable {
+                    // The same call the client's POST /api/sessions/:id/resume
+                    // makes — one resume path, not two.
+                    if let Err(e) = self.resume(id, &presets).await {
+                        tracing::warn!(error = %e, id = %id, "resume_on_boot=auto: resume failed; session stays dormant");
+                    }
+                }
+            }
+        }
+    }
+
+    /// Forward keystrokes to a session's pane. A dead or dormant session is
+    /// read-only — its pane is gone, so this is a no-op rather than a tmux
+    /// failure the client would have to interpret.
     pub async fn send_keys(&self, id: Uuid, bytes: &[u8]) -> Result<(), SessionError> {
         match self.status(id).await {
             None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead) => return Ok(()),
+            Some(SessionStatus::Dead | SessionStatus::Dormant) => return Ok(()),
             Some(SessionStatus::Running) => {}
         }
         let tmux = self.inner.tmux.clone();
@@ -732,13 +1127,15 @@ impl SessionManager {
     /// Type `text` into a session's pane, with an Enter after it when
     /// `submit` is set.
     ///
-    /// Unlike [`Self::send_keys`], a dead session is an error: the caller
-    /// asked for text to land somewhere, and a silent success would let a
-    /// script believe an agent had been told something it never heard.
+    /// Unlike [`Self::send_keys`], a dead or dormant session is an error: the
+    /// caller asked for text to land somewhere, and a silent success would let
+    /// a script believe an agent had been told something it never heard.
     pub async fn send_input(&self, id: Uuid, text: &str, submit: bool) -> Result<(), SessionError> {
         match self.status(id).await {
             None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead) => return Err(SessionError::NotRunning(id)),
+            Some(SessionStatus::Dead | SessionStatus::Dormant) => {
+                return Err(SessionError::NotRunning(id))
+            }
             Some(SessionStatus::Running) => {}
         }
         let tmux = self.inner.tmux.clone();
@@ -756,12 +1153,12 @@ impl SessionManager {
         Ok(())
     }
 
-    /// Resize a session's window. No-op for a dead session, as with
+    /// Resize a session's window. No-op for a dead or dormant session, as with
     /// [`Self::send_keys`].
     pub async fn resize(&self, id: Uuid, cols: u16, rows: u16) -> Result<(), SessionError> {
         match self.status(id).await {
             None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead) => return Ok(()),
+            Some(SessionStatus::Dead | SessionStatus::Dormant) => return Ok(()),
             Some(SessionStatus::Running) => {}
         }
         let tmux = self.inner.tmux.clone();
@@ -770,6 +1167,52 @@ impl SessionManager {
             .map_err(SessionError::Tmux)
     }
 
+    /// Register a client that is about to start reporting its display size,
+    /// and hand back the handle it reports under.
+    ///
+    /// Cheap and infallible: the session it will report against is not
+    /// consulted until the first [`Self::set_viewport`].
+    pub fn attach_viewport(&self) -> ViewportId {
+        self.inner.next_viewport.fetch_add(1, Ordering::Relaxed)
+    }
+
+    /// A client reported the size it can display.
+    ///
+    /// The shared tmux window is resized only when the size arbitrated across
+    /// every attached client actually changes — see [`crate::viewport`]. Two
+    /// clients of different sizes used to resize the window past each other on
+    /// every report, which leaves a full-screen agent repainting into rows it
+    /// never clears and looking, to the operator, like a pane that has stopped
+    /// accepting input.
+    pub async fn set_viewport(
+        &self,
+        id: Uuid,
+        viewport: ViewportId,
+        cols: u16,
+        rows: u16,
+    ) -> Result<(), SessionError> {
+        let target = self
+            .inner
+            .viewports
+            .lock()
+            .await
+            .set(id, viewport, cols, rows);
+        match target {
+            Some((cols, rows)) => self.resize(id, cols, rows).await,
+            None => Ok(()),
+        }
+    }
+
+    /// Drop a detached client's claim on the window size, resizing to what the
+    /// clients still attached can display. Errors are the caller's to ignore:
+    /// a socket closing because its session died has nothing left to resize.
+    pub async fn release_viewport(&self, id: Uuid, viewport: ViewportId) {
+        let target = self.inner.viewports.lock().await.release(id, viewport);
+        if let Some((cols, rows)) = target {
+            let _ = self.resize(id, cols, rows).await;
+        }
+    }
+
     /// Rename a session (#125): set `metadata.name`, or clear it when the
     /// requested name is blank so the session falls back to its command.
     ///
@@ -823,11 +1266,18 @@ impl SessionManager {
     /// A report that changes the effective state restarts `activity_since`
     /// (#104's clock); re-reporting an unchanged state only extends the TTL
     /// and stays silent on the event stream at steady state.
+    ///
+    /// `agent_session_id` (#161) is the agent's own conversation id, parsed
+    /// by the caller from the hook payload's `session_id` field. It is
+    /// written once — the first report that carries one wins — and the
+    /// sidecar is only rewritten on that transition, never on every report,
+    /// since an agent's session id never changes mid-session.
     pub async fn report_activity(
         &self,
         id: Uuid,
         state: ActivityState,
         detail: Option<String>,
+        agent_session_id: Option<String>,
     ) -> Result<(), SessionError> {
         let updated = {
             let mut sessions = self.inner.sessions.lock().await;
@@ -843,7 +1293,16 @@ impl SessionManager {
                 state,
                 self.inner.report_ttl,
             ));
-            changed.then(|| rec.session.clone())
+            let newly_identified =
+                rec.session.agent_session_id.is_none() && agent_session_id.is_some();
+            if newly_identified {
+                rec.session.agent_session_id = agent_session_id;
+                self.inner
+                    .sidecar
+                    .write(&rec.session)
+                    .map_err(SessionError::Sidecar)?;
+            }
+            (changed || newly_identified).then(|| rec.session.clone())
         };
         if let Some(session) = updated {
             let _ = self
@@ -1116,7 +1575,11 @@ async fn run_activity_pass(inner: &Arc<Inner>) {
                     rec.session.activity_detail = None;
                 }
             }
-            let idle = rec.bridge.idle_for();
+            // Only `Running` sessions reach this pass, and every one of them
+            // has a bridge; a dormant session has neither pane nor bridge.
+            let Some(idle) = rec.bridge.as_ref().map(|b| b.idle_for()) else {
+                continue;
+            };
             // #105: while a report is in force it supplies the state and
             // nothing here may overwrite it; only an unreported session is
             // decided by inference.
@@ -1234,8 +1697,10 @@ async fn run_blocked_work_pass(inner: &Arc<Inner>) {
 /// alone and stays attached to the dead record for a later forced dismissal
 /// (#81), which leaves it on disk too.
 ///
-/// Dead sessions do not survive a daemon restart: [`SessionManager::recover`]
-/// adopts only what tmux still holds.
+/// A dead session does not come back as dead across a daemon restart: its
+/// sidecar survives, so [`SessionManager::recover`]'s second pass registers it
+/// as [`SessionStatus::Dormant`] (#162) — accurate either way, since neither
+/// has a pane behind it.
 async fn mark_session_dead(inner: &Arc<Inner>, id: Uuid) {
     let flipped = {
         let mut sessions = inner.sessions.lock().await;
@@ -1244,7 +1709,9 @@ async fn mark_session_dead(inner: &Arc<Inner>, id: Uuid) {
                 record.session.status = SessionStatus::Dead;
                 // Release anyone attached; the scrollback survives for a later
                 // attach.
-                record.bridge.seal();
+                if let Some(bridge) = record.bridge.as_mut() {
+                    bridge.seal();
+                }
                 let session = record.session.clone();
                 let worktree = record
                     .worktree_base_repo
@@ -1265,6 +1732,7 @@ async fn mark_session_dead(inner: &Arc<Inner>, id: Uuid) {
             // The tree is settled (removed); a stale "in the way" would
             // describe something the session no longer holds.
             session.blocked_work = None;
+            session.worktree = None;
             let mut sessions = inner.sessions.lock().await;
             if let Some(record) = sessions.get_mut(&id) {
                 record.session.worktree = None;

crates/maestro-daemon/src/viewport.rs

@@ -0,0 +1,186 @@
+//! What size the shared tmux window should be, given every client watching it.
+//!
+//! A tmux window has one size, but a session can have several clients attached
+//! at once — two browser panes, a browser and the TUI. Each reports the size
+//! *it* can display, and applying whichever arrived last makes the window
+//! flip-flop. Every flip forces a full-screen application (Claude Code, vim) to
+//! repaint at a new height, and the rows it drew at the old height are never
+//! cleared: the operator ends up looking at a stale input box, types into a
+//! box that is not where the screen says it is, and concludes the pane is
+//! stuck.
+//!
+//! So the window is sized to the smallest attached client on each axis — the
+//! same rule tmux uses for its own multiple clients, and the only size every
+//! client can render without truncation. The size last handed to tmux is
+//! remembered, so a report that changes nothing costs no `tmux` fork at all.
+
+use std::collections::HashMap;
+
+use uuid::Uuid;
+
+/// One attached client within a session. Allocated by
+/// [`crate::session::SessionManager`] and opaque to everything else.
+pub type ViewportId = u64;
+
+/// Per-session client sizes, and what tmux was last told.
+#[derive(Debug, Default)]
+pub struct Viewports {
+    clients: HashMap<Uuid, HashMap<ViewportId, (u16, u16)>>,
+    applied: HashMap<Uuid, (u16, u16)>,
+}
+
+impl Viewports {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Record what `viewport` can display. Returns the size tmux must be set
+    /// to, or `None` when the window already has it.
+    pub fn set(
+        &mut self,
+        session: Uuid,
+        viewport: ViewportId,
+        cols: u16,
+        rows: u16,
+    ) -> Option<(u16, u16)> {
+        self.clients
+            .entry(session)
+            .or_default()
+            .insert(viewport, (cols, rows));
+        self.settle(session)
+    }
+
+    /// Drop a client that has detached. Returns the size tmux must be set to
+    /// now that it no longer constrains the window.
+    ///
+    /// The last client leaving settles nothing: the window keeps the size it
+    /// has rather than snapping to some remembered default no one is watching.
+    pub fn release(&mut self, session: Uuid, viewport: ViewportId) -> Option<(u16, u16)> {
+        let clients = self.clients.get_mut(&session)?;
+        clients.remove(&viewport);
+        if clients.is_empty() {
+            self.clients.remove(&session);
+            self.applied.remove(&session);
+            return None;
+        }
+        self.settle(session)
+    }
+
+    /// The smallest size every attached client can render, but only when it
+    /// differs from what tmux was last told.
+    ///
+    /// A zero on either axis is a client that cannot display anything yet — a
+    /// pane still laying out, a hidden tab — and must not drag the shared
+    /// window down with it, so it is held but left out of the arbitration.
+    fn settle(&mut self, session: Uuid) -> Option<(u16, u16)> {
+        let clients = self.clients.get(&session)?;
+        let mut cols = u16::MAX;
+        let mut rows = u16::MAX;
+        for &(c, r) in clients.values() {
+            if c == 0 || r == 0 {
+                continue;
+            }
+            cols = cols.min(c);
+            rows = rows.min(r);
+        }
+        if cols == u16::MAX || rows == u16::MAX {
+            return None;
+        }
+        let target = (cols, rows);
+        if self.applied.get(&session) == Some(&target) {
+            return None;
+        }
+        self.applied.insert(session, target);
+        Some(target)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_first_report_settles_the_window() {
+        let mut v = Viewports::new();
+        let s = Uuid::new_v4();
+        assert_eq!(v.set(s, 1, 80, 24), Some((80, 24)));
+    }
+
+    #[test]
+    fn a_report_that_changes_nothing_costs_no_resize() {
+        let mut v = Viewports::new();
+        let s = Uuid::new_v4();
+        v.set(s, 1, 80, 24);
+        assert_eq!(v.set(s, 1, 80, 24), None);
+        assert_eq!(v.set(s, 1, 80, 24), None);
+    }
+
+    /// The bug this module exists for: two clients of different sizes used to
+    /// resize the window past each other on every report.
+    #[test]
+    fn two_clients_settle_on_the_smaller_instead_of_fighting() {
+        let mut v = Viewports::new();
+        let s = Uuid::new_v4();
+        assert_eq!(v.set(s, 1, 53, 46), Some((53, 46)));
+        assert_eq!(v.set(s, 2, 53, 20), Some((53, 20)));
+        // Whatever order they re-report in, the answer stays the smaller one.
+        assert_eq!(v.set(s, 1, 53, 46), None);
+        assert_eq!(v.set(s, 2, 53, 20), None);
+        assert_eq!(v.set(s, 1, 53, 46), None);
+    }
+
+    #[test]
+    fn each_axis_is_arbitrated_on_its_own() {
+        let mut v = Viewports::new();
+        let s = Uuid::new_v4();
+        v.set(s, 1, 200, 20);
+        assert_eq!(v.set(s, 2, 53, 46), Some((53, 20)));
+    }
+
+    #[test]
+    fn a_zero_sized_client_does_not_shrink_the_window() {
+        let mut v = Viewports::new();
+        let s = Uuid::new_v4();
+        assert_eq!(v.set(s, 1, 80, 24), Some((80, 24)));
+        assert_eq!(v.set(s, 2, 0, 0), None);
+        assert_eq!(v.set(s, 2, 0, 30), None);
+    }
+
+    #[test]
+    fn releasing_the_small_client_gives_the_window_back() {
+        let mut v = Viewports::new();
+        let s = Uuid::new_v4();
+        v.set(s, 1, 80, 46);
+        v.set(s, 2, 80, 20);
+        assert_eq!(v.release(s, 2), Some((80, 46)));
+    }
+
+    #[test]
+    fn releasing_the_last_client_settles_nothing() {
+        let mut v = Viewports::new();
+        let s = Uuid::new_v4();
+        v.set(s, 1, 80, 24);
+        assert_eq!(v.release(s, 1), None);
+        // ...and the session is forgotten, so a fresh attach settles again.
+        assert_eq!(v.set(s, 2, 80, 24), Some((80, 24)));
+    }
+
+    #[test]
+    fn releasing_an_unknown_viewport_is_harmless() {
+        let mut v = Viewports::new();
+        let s = Uuid::new_v4();
+        assert_eq!(v.release(s, 7), None);
+        v.set(s, 1, 80, 24);
+        assert_eq!(v.release(s, 7), None);
+    }
+
+    #[test]
+    fn sessions_do_not_arbitrate_against_each_other() {
+        let mut v = Viewports::new();
+        let a = Uuid::new_v4();
+        let b = Uuid::new_v4();
+        assert_eq!(v.set(a, 1, 80, 24), Some((80, 24)));
+        assert_eq!(v.set(b, 2, 53, 20), Some((53, 20)));
+        assert_eq!(v.set(a, 1, 80, 24), None);
+    }
+}

crates/maestro-daemon/tests/activity_report.rs

@@ -18,6 +18,7 @@ use uuid::Uuid;
 
 struct Fixture {
     manager: SessionManager,
+    sidecar: SidecarStore,
     _tmux: TmuxFixture,
     _state_dir: TempDir,
 }
@@ -25,15 +26,17 @@ struct Fixture {
 async fn fixture(ttl: Duration) -> Fixture {
     let tmux = TmuxFixture::new();
     let state_dir = TempDir::new().unwrap();
+    let sidecar = SidecarStore::new(state_dir.path().join("sessions"));
     let manager = SessionManager::new(
         Arc::new(tmux.tmux.clone()),
-        SidecarStore::new(state_dir.path().join("sessions")),
+        sidecar.clone(),
         WorktreeManager::new(None),
         state_dir.path().join("fifos"),
     )
     .with_activity_report_ttl(ttl);
     Fixture {
         manager,
+        sidecar,
         _tmux: tmux,
         _state_dir: state_dir,
     }
@@ -67,7 +70,7 @@ async fn report_on_unknown_session_is_not_found() {
     let fx = fixture(Duration::from_secs(300)).await;
     let err = fx
         .manager
-        .report_activity(Uuid::new_v4(), ActivityState::Idle, None)
+        .report_activity(Uuid::new_v4(), ActivityState::Idle, None, None)
         .await
         .unwrap_err();
     assert!(matches!(err, maestro_daemon::SessionError::NotFound(_)));
@@ -83,6 +86,7 @@ async fn report_sets_error_state_and_detail() {
             id,
             ActivityState::Error,
             Some("cargo build failed: link error".into()),
+            None,
         )
         .await
         .unwrap();
@@ -101,7 +105,7 @@ async fn replacing_a_report_replaces_both_state_and_detail() {
     let id = spawn_sleeping(&fx.manager).await;
 
     fx.manager
-        .report_activity(id, ActivityState::Error, Some("first failure".into()))
+        .report_activity(id, ActivityState::Error, Some("first failure".into()), None)
         .await
         .unwrap();
     fx.manager
@@ -109,6 +113,7 @@ async fn replacing_a_report_replaces_both_state_and_detail() {
             id,
             ActivityState::AwaitingInput,
             Some("needs approval".into()),
+            None,
         )
         .await
         .unwrap();
@@ -125,7 +130,7 @@ async fn detail_is_capped_server_side() {
 
     let long = "x".repeat(10_000);
     fx.manager
-        .report_activity(id, ActivityState::Error, Some(long))
+        .report_activity(id, ActivityState::Error, Some(long), None)
         .await
         .unwrap();
 
@@ -144,7 +149,12 @@ async fn reported_state_survives_watcher_ticks_until_the_ttl_then_inference_resu
     fx.manager.start_liveness_watcher(Duration::from_millis(50));
 
     fx.manager
-        .report_activity(id, ActivityState::Error, Some("agent died mid-run".into()))
+        .report_activity(
+            id,
+            ActivityState::Error,
+            Some("agent died mid-run".into()),
+            None,
+        )
         .await
         .unwrap();
 
@@ -162,3 +172,73 @@ async fn reported_state_survives_watcher_ticks_until_the_ttl_then_inference_resu
     })
     .await;
 }
+
+#[tokio::test]
+async fn a_reported_session_id_is_recorded_on_the_session() {
+    let fx = fixture(Duration::from_secs(300)).await;
+    let id = spawn_sleeping(&fx.manager).await;
+
+    fx.manager
+        .report_activity(id, ActivityState::Active, None, Some("conv-abc123".into()))
+        .await
+        .unwrap();
+
+    let s = observed(&fx.manager, id).await;
+    assert_eq!(s.agent_session_id.as_deref(), Some("conv-abc123"));
+}
+
+/// #161: a session id does not change mid-session, so once set it is never
+/// overwritten by a later report — even one that names a different id.
+#[tokio::test]
+async fn a_reported_session_id_is_written_once_and_never_replaced() {
+    let fx = fixture(Duration::from_secs(300)).await;
+    let id = spawn_sleeping(&fx.manager).await;
+
+    fx.manager
+        .report_activity(id, ActivityState::Active, None, Some("conv-first".into()))
+        .await
+        .unwrap();
+    fx.manager
+        .report_activity(id, ActivityState::Active, None, Some("conv-second".into()))
+        .await
+        .unwrap();
+
+    let s = observed(&fx.manager, id).await;
+    assert_eq!(s.agent_session_id.as_deref(), Some("conv-first"));
+}
+
+#[tokio::test]
+async fn a_reported_session_id_survives_recovery_from_the_sidecar() {
+    let fx = fixture(Duration::from_secs(300)).await;
+    let id = spawn_sleeping(&fx.manager).await;
+
+    fx.manager
+        .report_activity(id, ActivityState::Active, None, Some("conv-abc123".into()))
+        .await
+        .unwrap();
+
+    let stored = fx
+        .sidecar
+        .read(id)
+        .expect("sidecar read")
+        .expect("sidecar present");
+    assert_eq!(stored.agent_session_id.as_deref(), Some("conv-abc123"));
+
+    // The sidecar holding the id is only half the claim: a restarted daemon
+    // has to carry it back onto the recovered session, which is what a resume
+    // reads. Build a parallel manager over the same tmux server and state
+    // dirs and recover through it.
+    let revived = SessionManager::new(
+        Arc::new(fx._tmux.tmux.clone()),
+        fx.sidecar.clone(),
+        WorktreeManager::new(None),
+        fx._state_dir.path().join("fifos"),
+    );
+    revived.recover().await.expect("recover");
+    let recovered = observed(&revived, id).await;
+    assert_eq!(
+        recovered.agent_session_id.as_deref(),
+        Some("conv-abc123"),
+        "the recovered session must carry the agent session id, not just the sidecar"
+    );
+}

crates/maestro-daemon/tests/attach.rs

@@ -94,6 +94,74 @@ async fn rejects_unknown_session() {
     assert!(format!("{err}").contains("404"));
 }
 
+/// #166: a session the daemon knows but has no bridge for is not unknown, it
+/// is not running. `404 unknown_session` made "gone" and "resumable" look the
+/// same to a client that could have offered a resume.
+#[tokio::test]
+async fn dormant_session_is_not_attachable_rather_than_unknown() {
+    let h = spawn_daemon_ws().await;
+    let cwd = TempDir::new().unwrap();
+    let session = h
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .unwrap();
+
+    // The host reboot: tmux is gone, the sidecar is not, and a fresh manager
+    // registers the session dormant.
+    h._fx.tmux.tmux.kill_server().unwrap();
+    let dormant = SessionManager::new(
+        std::sync::Arc::new(h._fx.tmux.tmux.clone()),
+        maestro_daemon::sidecar::SidecarStore::new(h._fx.sidecar_dir()),
+        maestro_daemon::worktree::WorktreeManager::new(None),
+        h._fx.fifo_dir(),
+    );
+    dormant.recover().await.unwrap();
+    let dormant_addr = serve_manager(dormant).await;
+
+    let err = connect_attach(dormant_addr, session.id).await.unwrap_err();
+    let tokio_tungstenite::tungstenite::Error::Http(resp) = err else {
+        panic!("want an HTTP rejection, got {err}");
+    };
+    assert_eq!(resp.status().as_u16(), 409);
+    let body: maestro_protocol::ApiError =
+        serde_json::from_slice(resp.body().as_deref().expect("error body")).unwrap();
+    assert_eq!(body.error.code, "not_attachable");
+
+    // A session that really is unknown still reads as unknown.
+    let err = connect_attach(dormant_addr, Uuid::new_v4())
+        .await
+        .unwrap_err();
+    assert!(format!("{err}").contains("404"));
+}
+
+/// Serve `manager` on its own listener, for tests that need a second daemon
+/// over the same tmux/sidecar state.
+async fn serve_manager(manager: SessionManager) -> SocketAddr {
+    let router = local_api::router(local_api::state_for(
+        manager,
+        "test-host",
+        "/home/test",
+        Vec::new(),
+        std::sync::Arc::new(maestro_daemon::projects::ProjectScanner::disabled()),
+        maestro_config::DEFAULT_LEADER,
+    ));
+    let listener = TcpListener::bind(SocketAddr::from((Ipv4Addr::LOCALHOST, 0)))
+        .await
+        .unwrap();
+    let addr = listener.local_addr().unwrap();
+    tokio::spawn(async move {
+        let _ = axum::serve(listener, router).await;
+    });
+    addr
+}
+
 #[tokio::test]
 async fn pty_round_trip_through_real_tmux() {
     let h = spawn_daemon_ws().await;

crates/maestro-daemon/tests/local_api.rs

@@ -526,6 +526,33 @@ async fn post_activity_reports_error_with_detail() {
     assert_eq!(s.activity_detail.as_deref(), Some("cargo build failed"));
 }
 
+/// #161: a reported `session_id` lands on the session as `agent_session_id`.
+#[tokio::test]
+async fn post_activity_records_the_reported_session_id() {
+    let h = spawn("naps-laptop").await;
+    let id = spawn_via_manager(&h).await;
+
+    let resp = reqwest::Client::new()
+        .post(url(h.addr, &format!("/api/sessions/{id}/activity")))
+        .json(&serde_json::json!({
+            "state": "Active",
+            "session_id": "conv-abc123"
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), reqwest::StatusCode::NO_CONTENT);
+
+    let sessions: Vec<Session> = reqwest::get(url(h.addr, "/api/sessions"))
+        .await
+        .unwrap()
+        .json()
+        .await
+        .unwrap();
+    let s = sessions.iter().find(|s| s.id == id).unwrap();
+    assert_eq!(s.agent_session_id.as_deref(), Some("conv-abc123"));
+}
+
 #[tokio::test]
 async fn post_activity_to_unknown_session_returns_404() {
     let h = spawn("naps-laptop").await;

crates/maestro-daemon/tests/resume.rs

@@ -0,0 +1,359 @@
+//! End-to-end tests for `POST /api/sessions/:id/resume` (#166) and the
+//! manager call behind it, against real tmux.
+//!
+//! The point of resume is that the session comes back under the *same* uuid
+//! and sidecar — name, `created_at`, env and worktree ownership intact — with
+//! only the tmux session and the PTY bridge new.
+
+mod common;
+
+use std::collections::HashMap;
+use std::net::{Ipv4Addr, SocketAddr};
+use std::sync::Arc;
+use std::time::Duration;
+
+use common::{wait_for_async, DaemonFixture};
+use maestro_daemon::{local_api, SessionError, SessionManager};
+use maestro_protocol::{CreateSessionRequest, Session, SessionStatus, SpawnPreset};
+use tempfile::TempDir;
+use tokio::net::TcpListener;
+use tokio::sync::oneshot;
+use uuid::Uuid;
+
+/// A fresh manager over the same tmux server, sidecars and fifos — what the
+/// daemon builds after a restart.
+fn revive(fx: &DaemonFixture) -> SessionManager {
+    SessionManager::new(
+        Arc::new(fx.tmux.tmux.clone()),
+        maestro_daemon::sidecar::SidecarStore::new(fx.sidecar_dir()),
+        maestro_daemon::worktree::WorktreeManager::new(None),
+        fx.fifo_dir(),
+    )
+}
+
+/// Create a session, then simulate the host reboot that leaves it dormant:
+/// the tmux server dies, the sidecar stays, a new manager recovers.
+async fn dormant_session(
+    fx: &DaemonFixture,
+    cwd: &TempDir,
+    command: &str,
+    name: &str,
+) -> (SessionManager, Session) {
+    let mut metadata = HashMap::new();
+    metadata.insert(
+        maestro_protocol::NAME_KEY.to_string(),
+        serde_json::Value::String(name.into()),
+    );
+    let session = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: command.into(),
+            env: HashMap::from([("MAESTRO_TEST_ENV".to_string(), "kept".to_string())]),
+            metadata,
+            worktree: None,
+        })
+        .await
+        .expect("create");
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+    let revived = revive(fx);
+    revived.recover().await.expect("recover");
+    (revived, session)
+}
+
+fn marker_preset(command: &str, marker_dir: &TempDir) -> Vec<SpawnPreset> {
+    vec![SpawnPreset {
+        id: "agent".into(),
+        label: "Agent".into(),
+        command: command.into(),
+        resume_command: Some(format!(
+            "sh -c 'touch {}/resumed-{{agent_session}}; sleep 30'",
+            marker_dir.path().display()
+        )),
+    }]
+}
+
+/// The keystone: a dormant session comes back running under its own id, with
+/// its name, `created_at`, env and sidecar untouched.
+#[tokio::test]
+async fn resume_brings_a_dormant_session_back_under_the_same_id() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let (manager, original) = dormant_session(&fx, &cwd, "sleep 30", "long-runner").await;
+    assert_eq!(
+        manager.status(original.id).await,
+        Some(SessionStatus::Dormant)
+    );
+
+    let resumed = manager.resume(original.id, &[]).await.expect("resume");
+
+    assert_eq!(resumed.id, original.id, "same uuid");
+    assert_eq!(resumed.status, SessionStatus::Running);
+    assert_eq!(resumed.created_at, original.created_at);
+    assert_eq!(resumed.cwd, original.cwd);
+    assert_eq!(resumed.command, original.command);
+    assert_eq!(resumed.env, original.env);
+    assert_eq!(
+        resumed
+            .metadata
+            .get(maestro_protocol::NAME_KEY)
+            .and_then(|v| v.as_str()),
+        Some("long-runner")
+    );
+
+    // tmux really holds it again, and the sidecar is the same file, updated.
+    let live = fx.tmux.tmux.list_sessions().expect("list");
+    assert_eq!(live, vec![original.id]);
+    let stored = maestro_daemon::sidecar::SidecarStore::new(fx.sidecar_dir())
+        .read(original.id)
+        .expect("read sidecar")
+        .expect("sidecar still there");
+    assert_eq!(stored.status, SessionStatus::Running);
+    assert_eq!(stored.created_at, original.created_at);
+
+    // And it is attachable again, which a dormant session never was.
+    assert!(manager
+        .subscribe_pty_with_replay(original.id)
+        .await
+        .is_some());
+}
+
+/// The worktree the session owns stays the session's, so killing the resumed
+/// session still cleans the tree up.
+#[tokio::test]
+async fn resume_keeps_worktree_ownership() {
+    let fx = DaemonFixture::new();
+    let repo = TempDir::new().unwrap();
+    common::init_repo(repo.path());
+
+    let session = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: repo.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: Some(maestro_protocol::WorktreeSpec {
+                base_repo: repo.path().to_path_buf(),
+                branch: "feature".into(),
+                create_branch: true,
+            }),
+        })
+        .await
+        .expect("create");
+    let worktree = session.worktree.clone().expect("worktree");
+
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+    let manager = revive(&fx);
+    manager.recover().await.expect("recover");
+    let resumed = manager.resume(session.id, &[]).await.expect("resume");
+
+    assert_eq!(resumed.worktree, Some(worktree.clone()));
+    assert_eq!(
+        resumed.cwd, worktree.path,
+        "resumed inside its own worktree"
+    );
+}
+
+/// The command comes from the preset's `resume_command`, with the session's
+/// own agent conversation id (#161) substituted in.
+#[tokio::test]
+async fn resume_runs_the_presets_resume_command() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let markers = TempDir::new().unwrap();
+    let presets = marker_preset("sleep 30", &markers);
+
+    let (manager, session) = dormant_session(&fx, &cwd, "sleep 30", "agentic").await;
+    // The agent reported its conversation id before the reboot, so it is on
+    // the sidecar and the resume template can be filled in.
+    fx.manager
+        .report_activity(
+            session.id,
+            maestro_protocol::ActivityState::Idle,
+            None,
+            Some("conv-42".into()),
+        )
+        .await
+        .ok();
+    // Re-read the sidecar the report updated.
+    let manager = {
+        drop(manager);
+        let m = revive(&fx);
+        m.recover().await.expect("recover");
+        m
+    };
+
+    manager.resume(session.id, &presets).await.expect("resume");
+
+    let marker = markers.path().join("resumed-conv-42");
+    wait_for_async(Duration::from_secs(5), || {
+        let marker = marker.clone();
+        async move { marker.exists() }
+    })
+    .await;
+}
+
+/// A session that is already running has nothing to bring back, and
+/// respawning would strand the pane that is already there.
+#[tokio::test]
+async fn resume_refuses_a_running_session() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let session = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+
+    let err = fx
+        .manager
+        .resume(session.id, &[])
+        .await
+        .expect_err("already running");
+    assert!(matches!(err, SessionError::AlreadyRunning(id) if id == session.id));
+    assert_eq!(err.to_error_info().code, "already_running");
+}
+
+/// Nothing can be resumed in a directory that no longer exists.
+#[tokio::test]
+async fn resume_refuses_when_the_cwd_is_gone() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let (manager, session) = dormant_session(&fx, &cwd, "sleep 30", "homeless").await;
+
+    std::fs::remove_dir_all(cwd.path()).unwrap();
+
+    let err = manager
+        .resume(session.id, &[])
+        .await
+        .expect_err("cwd is gone");
+    assert_eq!(err.to_error_info().code, "cwd_missing");
+    assert_eq!(
+        manager.status(session.id).await,
+        Some(SessionStatus::Dormant),
+        "a refused resume leaves the session exactly as it was"
+    );
+}
+
+#[tokio::test]
+async fn resume_of_an_unknown_session_is_not_found() {
+    let fx = DaemonFixture::new();
+    let err = fx
+        .manager
+        .resume(Uuid::new_v4(), &[])
+        .await
+        .expect_err("unknown");
+    assert_eq!(err.to_error_info().code, "not_found");
+}
+
+// ---------------------------------------------------------------------------
+// HTTP surface
+// ---------------------------------------------------------------------------
+
+struct Harness {
+    addr: SocketAddr,
+    _shutdown: oneshot::Sender<()>,
+}
+
+async fn serve(manager: SessionManager, presets: Vec<SpawnPreset>) -> Harness {
+    let router = local_api::router(local_api::state_for(
+        manager,
+        "test-host",
+        "/home/test",
+        presets,
+        Arc::new(maestro_daemon::projects::ProjectScanner::disabled()),
+        maestro_config::DEFAULT_LEADER,
+    ));
+    let listener = TcpListener::bind(SocketAddr::from((Ipv4Addr::LOCALHOST, 0)))
+        .await
+        .unwrap();
+    let addr = listener.local_addr().unwrap();
+    let (tx, rx) = oneshot::channel::<()>();
+    tokio::spawn(async move {
+        let _ = axum::serve(listener, router)
+            .with_graceful_shutdown(async move {
+                let _ = rx.await;
+            })
+            .await;
+    });
+    Harness {
+        addr,
+        _shutdown: tx,
+    }
+}
+
+#[tokio::test]
+async fn post_resume_returns_the_revived_session() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let (manager, session) = dormant_session(&fx, &cwd, "sleep 30", "web-resumed").await;
+    let h = serve(manager, Vec::new()).await;
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://{}{}",
+            h.addr,
+            maestro_protocol::routes::session_resume(session.id)
+        ))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), reqwest::StatusCode::OK);
+    let body: Session = resp.json().await.unwrap();
+    assert_eq!(body.id, session.id);
+    assert_eq!(body.status, SessionStatus::Running);
+}
+
+#[tokio::test]
+async fn post_resume_on_a_running_session_is_a_conflict() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let session = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+    let h = serve(fx.manager.clone(), Vec::new()).await;
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://{}{}",
+            h.addr,
+            maestro_protocol::routes::session_resume(session.id)
+        ))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), reqwest::StatusCode::CONFLICT);
+    let err: maestro_protocol::ApiError = resp.json().await.unwrap();
+    assert_eq!(err.error.code, "already_running");
+}
+
+#[tokio::test]
+async fn post_resume_on_an_unknown_session_is_404() {
+    let fx = DaemonFixture::new();
+    let h = serve(fx.manager.clone(), Vec::new()).await;
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://{}{}",
+            h.addr,
+            maestro_protocol::routes::session_resume(Uuid::new_v4())
+        ))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), reqwest::StatusCode::NOT_FOUND);
+}

crates/maestro-daemon/tests/resume_policy.rs

@@ -0,0 +1,161 @@
+//! `[daemon].resume_on_boot` (#167): what recovery does with sessions whose
+//! tmux pane is gone but whose sidecar survived, against real tmux.
+//!
+//! The default is deliberately the timid one. Resuming agents unattended
+//! seconds after a reboot is a foot-gun, so `auto` is opted into per host and
+//! `never` throws the sidecars away instead.
+
+mod common;
+
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::Duration;
+
+use common::{wait_for_async, DaemonFixture};
+use maestro_config::ResumeOnBoot;
+use maestro_daemon::SessionManager;
+use maestro_protocol::{CreateSessionRequest, Session, SessionStatus, SpawnPreset};
+use tempfile::TempDir;
+
+/// A fresh manager over the same tmux server, sidecars and fifos — what the
+/// daemon builds after a restart — carrying `policy`.
+fn revive(fx: &DaemonFixture, policy: ResumeOnBoot, presets: Vec<SpawnPreset>) -> SessionManager {
+    SessionManager::new(
+        Arc::new(fx.tmux.tmux.clone()),
+        maestro_daemon::sidecar::SidecarStore::new(fx.sidecar_dir()),
+        maestro_daemon::worktree::WorktreeManager::new(None),
+        fx.fifo_dir(),
+    )
+    .with_resume_policy(policy, presets)
+}
+
+/// A preset whose `resume_command` touches a marker file, so a test can see
+/// that the resumed session ran the resume command rather than the original.
+fn marker_preset(command: &str, marker_dir: &TempDir) -> Vec<SpawnPreset> {
+    vec![SpawnPreset {
+        id: "agent".into(),
+        label: "Agent".into(),
+        command: command.into(),
+        resume_command: Some(format!(
+            "sh -c 'touch {}/resumed; sleep 30'",
+            marker_dir.path().display()
+        )),
+    }]
+}
+
+async fn create(fx: &DaemonFixture, cwd: &TempDir, command: &str) -> Session {
+    fx.manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: command.into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create")
+}
+
+/// The default: a reboot leaves the session listed but not running, waiting
+/// for the operator.
+#[tokio::test]
+async fn dormant_is_the_default_and_leaves_the_session_waiting() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let session = create(&fx, &cwd, "sleep 30").await;
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+
+    let revived = revive(&fx, ResumeOnBoot::Dormant, Vec::new());
+    revived.recover().await.expect("recover");
+
+    assert_eq!(
+        revived.status(session.id).await,
+        Some(SessionStatus::Dormant)
+    );
+    assert!(fx
+        .sidecar_dir()
+        .join(format!("{}.json", session.id))
+        .exists());
+    assert!(
+        fx.tmux.tmux.list_sessions().expect("list").is_empty(),
+        "nothing was respawned"
+    );
+}
+
+/// `auto` brings each one back itself, down the same path a client's resume
+/// takes: same uuid, same sidecar, the preset's `resume_command`.
+#[tokio::test]
+async fn auto_resumes_every_dormant_session_during_recovery() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let markers = TempDir::new().unwrap();
+    let session = create(&fx, &cwd, "sleep 30").await;
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+
+    let revived = revive(&fx, ResumeOnBoot::Auto, marker_preset("sleep 30", &markers));
+    revived.recover().await.expect("recover");
+
+    assert_eq!(
+        revived.status(session.id).await,
+        Some(SessionStatus::Running),
+        "auto resumed it"
+    );
+    assert_eq!(
+        fx.tmux.tmux.list_sessions().expect("list"),
+        vec![session.id],
+        "back under the same uuid"
+    );
+    let stored = maestro_daemon::sidecar::SidecarStore::new(fx.sidecar_dir())
+        .read(session.id)
+        .expect("read sidecar")
+        .expect("same sidecar");
+    assert_eq!(stored.created_at, session.created_at);
+    assert_eq!(stored.command, "sleep 30", "the original command is kept");
+
+    // It really ran the preset's resume command, not the spawn command.
+    let marker = markers.path().join("resumed");
+    wait_for_async(Duration::from_secs(5), || {
+        let marker = marker.clone();
+        async move { marker.exists() }
+    })
+    .await;
+    assert!(marker.exists(), "resume_command ran");
+}
+
+/// `never` makes a reboot a clean slate: the sidecars go, and the session is
+/// not listed at all.
+#[tokio::test]
+async fn never_prunes_the_sidecars_instead() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let session = create(&fx, &cwd, "sleep 30").await;
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+
+    let revived = revive(&fx, ResumeOnBoot::Never, Vec::new());
+    revived.recover().await.expect("recover");
+
+    assert!(!revived.has(session.id).await, "not listed");
+    assert!(
+        !fx.sidecar_dir()
+            .join(format!("{}.json", session.id))
+            .exists(),
+        "sidecar pruned"
+    );
+    assert!(fx.tmux.tmux.list_sessions().expect("list").is_empty());
+}
+
+/// The policy only decides what happens to sessions that lost their pane. A
+/// session tmux still holds is adopted running by the first pass under every
+/// policy — including `never`, which must not delete a live session's sidecar.
+#[tokio::test]
+async fn the_policy_leaves_sessions_tmux_still_holds_alone() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let live = create(&fx, &cwd, "sleep 30").await;
+
+    let revived = revive(&fx, ResumeOnBoot::Never, Vec::new());
+    assert_eq!(revived.recover().await.expect("recover"), 1);
+
+    assert_eq!(revived.status(live.id).await, Some(SessionStatus::Running));
+    assert!(fx.sidecar_dir().join(format!("{}.json", live.id)).exists());
+}

crates/maestro-daemon/tests/session_decisions.rs

@@ -555,3 +555,63 @@ async fn spawn_overrides_client_supplied_maestro_variables() {
         Some(&"http://127.0.0.1:7070".to_string())
     );
 }
+
+/// Two clients attached to one session used to resize the shared window past
+/// each other on every report they made. Every flip repaints a full-screen
+/// agent at a new height and orphans the rows it drew at the old one, which
+/// reads to the operator as a pane that has stopped taking input.
+#[tokio::test]
+async fn clients_of_different_sizes_do_not_resize_the_window_past_each_other() {
+    let fx = Fx::new();
+    let s = fx.manager.create(fx.request("bash")).await.expect("create");
+    let web = fx.manager.attach_viewport();
+    let tui = fx.manager.attach_viewport();
+
+    fx.manager.set_viewport(s.id, web, 53, 46).await.unwrap();
+    fx.manager.set_viewport(s.id, tui, 53, 20).await.unwrap();
+    // Both keep reporting, as a browser's ResizeObserver and the TUI's own
+    // redraw loop do. Neither report changes the arbitrated size.
+    for _ in 0..5 {
+        fx.manager.set_viewport(s.id, web, 53, 46).await.unwrap();
+        fx.manager.set_viewport(s.id, tui, 53, 20).await.unwrap();
+    }
+
+    let resizes: Vec<_> = fx
+        .fake
+        .calls()
+        .into_iter()
+        .filter_map(|c| match c {
+            Call::ResizeWindow { cols, rows, .. } => Some((cols, rows)),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(
+        resizes,
+        vec![(53, 46), (53, 20)],
+        "the window was resized more than the arbitrated size actually changed"
+    );
+}
+
+/// The smaller client leaving hands the window back to the one still attached.
+#[tokio::test]
+async fn releasing_a_client_resizes_to_what_is_left() {
+    let fx = Fx::new();
+    let s = fx.manager.create(fx.request("bash")).await.expect("create");
+    let web = fx.manager.attach_viewport();
+    let tui = fx.manager.attach_viewport();
+    fx.manager.set_viewport(s.id, web, 80, 46).await.unwrap();
+    fx.manager.set_viewport(s.id, tui, 80, 20).await.unwrap();
+
+    fx.manager.release_viewport(s.id, tui).await;
+
+    let resizes: Vec<_> = fx
+        .fake
+        .calls()
+        .into_iter()
+        .filter_map(|c| match c {
+            Call::ResizeWindow { cols, rows, .. } => Some((cols, rows)),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(resizes, vec![(80, 46), (80, 20), (80, 46)]);
+}

crates/maestro-daemon/tests/session_manager.rs

@@ -9,6 +9,7 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use common::{init_bare_repo, init_repo, push_all_to_origin, wait_for_async, DaemonFixture};
+use maestro_daemon::sidecar::SidecarStore;
 use maestro_daemon::SessionError;
 use maestro_protocol::CreateSessionRequest;
 use maestro_protocol::{CatalogEvent, SessionStatus, WorktreeSpec};
@@ -140,6 +141,390 @@ async fn recover_adopts_existing_tmux_sessions() {
     assert_eq!(snap[0].command, "sleep 30");
 }
 
+/// #162: a host reboot kills the tmux server, so recovery finds nothing to
+/// adopt while every sidecar is still on disk. Those sessions come back as
+/// `Dormant` — a record of what was running — rather than vanishing from the
+/// API and leaving the operator with nothing.
+#[tokio::test]
+async fn recover_registers_orphaned_sidecars_as_dormant() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let mut metadata = HashMap::new();
+    metadata.insert(
+        maestro_protocol::NAME_KEY.to_string(),
+        serde_json::Value::String("after-reboot".into()),
+    );
+
+    let s = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata,
+            worktree: None,
+        })
+        .await
+        .expect("create");
+
+    // The reboot: the tmux server is gone, the sidecar is untouched.
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+
+    let revived = revive(&fx);
+    let adopted = revived.recover().await.expect("recover");
+    assert_eq!(adopted, 0, "no live tmux session left to adopt");
+
+    let snap = revived.snapshot().await;
+    assert_eq!(snap.len(), 1, "the sidecar's session is still listed");
+    assert_eq!(snap[0].id, s.id);
+    assert_eq!(snap[0].status, SessionStatus::Dormant);
+    assert_eq!(snap[0].command, "sleep 30");
+    assert_eq!(snap[0].cwd, s.cwd);
+    assert_eq!(snap[0].created_at, s.created_at);
+    assert_eq!(
+        snap[0]
+            .metadata
+            .get(maestro_protocol::NAME_KEY)
+            .and_then(|v| v.as_str()),
+        Some("after-reboot"),
+    );
+}
+
+/// #162: a session tmux still holds is adopted `Running` by the first pass and
+/// must not be re-registered as dormant by the second — the sidecar is on disk
+/// for both.
+#[tokio::test]
+async fn recover_does_not_mark_adopted_sessions_dormant() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+
+    let live = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create live");
+    let orphan = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 31".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create orphan");
+    // Only the second session loses its pane.
+    fx.tmux.tmux.kill_session(orphan.id).expect("kill session");
+
+    let revived = revive(&fx);
+    assert_eq!(revived.recover().await.expect("recover"), 1);
+
+    let mut snap = revived.snapshot().await;
+    snap.sort_by_key(|s| s.command.clone());
+    assert_eq!(snap.len(), 2);
+    assert_eq!(snap[0].id, live.id);
+    assert_eq!(snap[0].status, SessionStatus::Running);
+    assert_eq!(snap[1].id, orphan.id);
+    assert_eq!(snap[1].status, SessionStatus::Dormant);
+}
+
+/// #163: a sidecar whose `cwd` no longer exists is pruned instead of
+/// registered dormant — the worktree it pointed at is gone, so there is
+/// nothing left to resume.
+#[tokio::test]
+async fn recover_deletes_sidecar_when_cwd_gone() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let cwd_path = cwd.path().to_path_buf();
+
+    let s = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd_path.clone(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+    drop(cwd);
+    std::fs::remove_dir_all(&cwd_path).ok();
+    assert!(!cwd_path.exists());
+
+    let revived = revive(&fx);
+    let adopted = revived.recover().await.expect("recover");
+    assert_eq!(adopted, 0);
+
+    assert!(!revived.has(s.id).await);
+    assert!(!fx.sidecar_dir().join(format!("{}.json", s.id)).exists());
+}
+
+/// #163: a sidecar whose `cwd` still exists is left alone regardless of age
+/// — it is registered dormant like any other orphan.
+#[tokio::test]
+async fn recover_keeps_dormant_sidecar_when_cwd_exists() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+
+    let s = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+
+    let revived = revive(&fx);
+    revived.recover().await.expect("recover");
+
+    assert!(revived.has(s.id).await);
+    assert!(fx.sidecar_dir().join(format!("{}.json", s.id)).exists());
+    let snap = revived.snapshot().await;
+    assert_eq!(snap[0].status, SessionStatus::Dormant);
+}
+
+/// #164: a fake [`maestro_daemon::boot_id::BootIdSource`] lets tests simulate
+/// a changed (or unreadable) boot id without rebooting the machine.
+#[derive(Debug)]
+struct FakeBootId(Option<String>);
+
+impl maestro_daemon::boot_id::BootIdSource for FakeBootId {
+    fn current(&self) -> Option<String> {
+        self.0.clone()
+    }
+}
+
+fn revive_with_boot_id(
+    fx: &DaemonFixture,
+    boot_id_path: PathBuf,
+    current: Option<&str>,
+) -> maestro_daemon::SessionManager {
+    maestro_daemon::SessionManager::new(
+        Arc::new(fx.tmux.tmux.clone()),
+        maestro_daemon::sidecar::SidecarStore::new(fx.sidecar_dir()),
+        maestro_daemon::worktree::WorktreeManager::new(None),
+        fx.fifo_dir(),
+    )
+    .with_boot_id(
+        boot_id_path,
+        Arc::new(FakeBootId(current.map(String::from))),
+    )
+}
+
+/// #174: a boot id can change without the tmux server dying — a restored
+/// state directory, a VM or container snapshot restore, a truncated
+/// `boot_id` file. `tmux list-sessions` stays the single source of truth for
+/// liveness, so a session tmux still holds is adopted `Running` no matter
+/// what the boot id says. Registering it dormant instead stranded it: resume
+/// would collide with the tmux name still in use and fail forever.
+#[tokio::test]
+async fn recover_adopts_live_session_when_boot_id_changed() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let s = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+
+    let boot_id_path = fx.state_dir.path().join("boot_id");
+    std::fs::write(&boot_id_path, "previous-boot").unwrap();
+
+    // tmux session is still alive: the probe runs and finds it.
+    let revived = revive_with_boot_id(&fx, boot_id_path.clone(), Some("current-boot"));
+    let adopted = revived.recover().await.expect("recover");
+    assert_eq!(adopted, 1, "tmux still holds the session; adopt it");
+
+    let snap = revived.snapshot().await;
+    assert_eq!(snap.len(), 1);
+    assert_eq!(snap[0].id, s.id);
+    assert_eq!(snap[0].status, SessionStatus::Running);
+
+    // The current boot id is now the stored one, for the next comparison.
+    assert_eq!(
+        std::fs::read_to_string(&boot_id_path).unwrap().trim(),
+        "current-boot"
+    );
+}
+
+/// #164, still true after #174: a real reboot takes the tmux server with it,
+/// so the probe comes back empty and every sidecar is registered dormant.
+#[tokio::test]
+async fn recover_registers_dormant_when_boot_id_changed_and_tmux_gone() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let s = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+
+    let boot_id_path = fx.state_dir.path().join("boot_id");
+    std::fs::write(&boot_id_path, "previous-boot").unwrap();
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+
+    let revived = revive_with_boot_id(&fx, boot_id_path, Some("current-boot"));
+    let adopted = revived.recover().await.expect("recover");
+    assert_eq!(adopted, 0, "no tmux server survived the reboot");
+
+    let snap = revived.snapshot().await;
+    assert_eq!(snap.len(), 1);
+    assert_eq!(snap[0].id, s.id);
+    assert_eq!(snap[0].status, SessionStatus::Dormant);
+}
+
+/// #164: an unchanged boot id is a plain restart — recovery probes tmux as
+/// before and adopts the still-live session `Running`.
+#[tokio::test]
+async fn recover_probes_tmux_when_boot_id_unchanged() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let s = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+
+    let boot_id_path = fx.state_dir.path().join("boot_id");
+    std::fs::write(&boot_id_path, "same-boot").unwrap();
+
+    let revived = revive_with_boot_id(&fx, boot_id_path, Some("same-boot"));
+    let adopted = revived.recover().await.expect("recover");
+    assert_eq!(adopted, 1);
+    let snap = revived.snapshot().await;
+    assert_eq!(snap[0].id, s.id);
+    assert_eq!(snap[0].status, SessionStatus::Running);
+}
+
+/// #164: no stored boot id (first run ever, or an older build that never
+/// wrote one) means there is nothing to compare against — falls back to
+/// today's probe-based recovery rather than assuming a reboot.
+#[tokio::test]
+async fn recover_falls_back_to_probe_when_no_stored_boot_id() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    fx.manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+
+    let boot_id_path = fx.state_dir.path().join("boot_id");
+    assert!(!boot_id_path.exists());
+
+    let revived = revive_with_boot_id(&fx, boot_id_path.clone(), Some("current-boot"));
+    let adopted = revived.recover().await.expect("recover");
+    assert_eq!(adopted, 1, "no stored boot id; falls back to probing tmux");
+    assert_eq!(
+        std::fs::read_to_string(&boot_id_path).unwrap().trim(),
+        "current-boot"
+    );
+}
+
+/// #164: an unreadable current boot id (non-Linux, restricted `/proc`) falls
+/// back to today's behaviour rather than failing startup or assuming a
+/// reboot.
+#[tokio::test]
+async fn recover_falls_back_to_probe_when_boot_id_unreadable() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    fx.manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+
+    let boot_id_path = fx.state_dir.path().join("boot_id");
+    std::fs::write(&boot_id_path, "stored-boot").unwrap();
+
+    let revived = revive_with_boot_id(&fx, boot_id_path, None);
+    let adopted = revived.recover().await.expect("recover");
+    assert_eq!(adopted, 1, "boot id unreadable; falls back to probing tmux");
+}
+
+/// #162: dismissing a dormant session is the one thing that can be done to it
+/// — no tmux call to fail, and the sidecar goes with it so the next recovery
+/// does not resurrect it.
+#[tokio::test]
+async fn dormant_session_can_be_dismissed() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+
+    let s = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+
+    let revived = revive(&fx);
+    revived.recover().await.expect("recover");
+    revived.kill(s.id, false).await.expect("dismiss");
+
+    assert!(!revived.has(s.id).await);
+    assert!(!fx.sidecar_dir().join(format!("{}.json", s.id)).exists());
+}
+
+/// A second `SessionManager` over the same dirs and the same tmux server —
+/// what a daemon restart looks like from inside a test.
+fn revive(fx: &DaemonFixture) -> maestro_daemon::SessionManager {
+    maestro_daemon::SessionManager::new(
+        Arc::new(fx.tmux.tmux.clone()),
+        maestro_daemon::sidecar::SidecarStore::new(fx.sidecar_dir()),
+        maestro_daemon::worktree::WorktreeManager::new(None),
+        fx.fifo_dir(),
+    )
+}
+
 /// Regression for NAP-253: the very first bytes a freshly-spawned command
 /// writes must reach the replay buffer. Before the fix, `pipe-pane` was a
 /// separate tmux invocation that ran after `new-session` + an async FIFO
@@ -954,6 +1339,65 @@ async fn natural_exit_of_a_pristine_worktree_removes_it() {
     );
 }
 
+/// #172: `mark_session_dead` clears the worktree off the in-memory record
+/// when a pristine tree settles, but the local `session` clone it writes to
+/// the sidecar and broadcasts must be cleared the same way — otherwise the
+/// sidecar keeps naming a tree the daemon just removed, and a recovery from
+/// that sidecar advertises a branch and path that no longer exist.
+#[tokio::test]
+async fn natural_exit_of_a_pristine_worktree_clears_it_from_the_sidecar() {
+    let fx = DaemonFixture::new();
+    let repo = TempDir::new().unwrap();
+    init_repo(repo.path());
+    let wt_path = repo.path().join("worktrees").join("feat").join("sidecar");
+
+    let s = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: repo.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: Some(WorktreeSpec {
+                base_repo: repo.path().to_path_buf(),
+                branch: "feat/sidecar".into(),
+                create_branch: true,
+            }),
+        })
+        .await
+        .expect("create");
+
+    // Push everything so the branch has no unpushed commits: fully pristine.
+    let origin = TempDir::new().unwrap();
+    init_bare_repo(origin.path());
+    push_all_to_origin(repo.path(), origin.path());
+
+    fx.tmux.tmux.kill_session(s.id).expect("kill tmux directly");
+    fx.manager.start_liveness_watcher(Duration::from_millis(50));
+    wait_for_async(Duration::from_secs(3), || async {
+        fx.manager.status(s.id).await == Some(SessionStatus::Dead)
+    })
+    .await;
+    wait_for_async(Duration::from_secs(3), || async {
+        fx.manager.is_settled(s.id).await == Some(true)
+    })
+    .await;
+
+    assert!(
+        !wt_path.exists(),
+        "a pristine worktree leaves nothing behind"
+    );
+
+    let sidecar = SidecarStore::new(fx.sidecar_dir())
+        .read(s.id)
+        .expect("sidecar read")
+        .expect("sidecar exists");
+    assert!(
+        sidecar.worktree.is_none(),
+        "the sidecar must not keep naming a worktree the daemon already removed"
+    );
+}
+
 fn run_git_in(dir: &std::path::Path, args: &[&str]) {
     let out = Command::new("git")
         .arg("-C")

crates/maestro-daemon/tests/sidecar.rs

@@ -32,6 +32,7 @@ fn sample(id: Uuid) -> Session {
         current_cwd: Some(PathBuf::from("/tmp/work/crates")),
         blocked_work: None,
         last_focused_at: None,
+        agent_session_id: Some("conv-abc123".into()),
     }
 }
 

crates/maestro-hooks/src/lib.rs

@@ -84,15 +84,23 @@ if [ "$state" = "Prompt" ]; then
         >/dev/null 2>&1 || true
     exit 0
 fi
-body="{\"state\":\"$state\"}"
+fields="\"state\":\"$state\""
 # StopFailure payloads carry the outcome in "error". Only a plain enum
 # spelling is reported as the detail — anything else (quotes, backslashes,
 # prose) would risk breaking the JSON body, and the spelling already names
 # the failure.
 detail=$(printf '%s' "$payload" | sed -n 's/.*"error"[[:space:]]*:[[:space:]]*"\([a-z_]*\)".*/\1/p')
 if [ -n "$detail" ]; then
-    body="{\"state\":\"$state\",\"detail\":\"$detail\"}"
+    fields="$fields,\"detail\":\"$detail\""
 fi
+# Every Claude Code hook payload carries its own conversation id (#161).
+# Constrained to a safe charset for the same reason as "detail" above: it is
+# spliced into the JSON body unescaped.
+session_id=$(printf '%s' "$payload" | sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([A-Za-z0-9_-]*\)".*/\1/p')
+if [ -n "$session_id" ]; then
+    fields="$fields,\"session_id\":\"$session_id\""
+fi
+body="{$fields}"
 curl -fsS --connect-timeout 1 --max-time 2 \
     -H 'Content-Type: application/json' \
     -d "$body" \

crates/maestro-hooks/src/tests.rs

@@ -128,6 +128,41 @@ fn script_reports_the_error_spelling_as_detail() {
     assert!(request.contains(r#""detail":"rate_limit""#), "{request}");
 }
 
+/// #161: the payload's own `session_id` — the agent's conversation id — is
+/// parsed out and forwarded in the activity body, so the daemon can persist
+/// it on the session.
+#[test]
+fn script_forwards_the_payloads_session_id_in_the_activity_body() {
+    let request = capture_request(|url| {
+        sh(
+            HOOK_SCRIPT,
+            &["Active"],
+            &owned_envs(&session_envs(&url)),
+            br#"{"session_id":"conv-abc123","hook_event_name":"PreToolUse"}"#,
+        )
+    });
+    assert!(request.contains(r#""state":"Active""#), "{request}");
+    assert!(
+        request.contains(r#""session_id":"conv-abc123""#),
+        "{request}"
+    );
+}
+
+/// A payload without a `session_id` (or one with an unexpected shape) must
+/// never produce a broken body — no `session_id` field is posted.
+#[test]
+fn script_posts_no_session_id_when_the_payload_has_none() {
+    let request = capture_request(|url| {
+        sh(
+            HOOK_SCRIPT,
+            &["AwaitingInput"],
+            &owned_envs(&session_envs(&url)),
+            br#"{"hook_event_name":"Stop","stop_hook_active":false}"#,
+        )
+    });
+    assert!(!request.contains("session_id"), "{request}");
+}
+
 /// An `error` value that is not a plain enum spelling (or a payload without
 /// one at all) must never produce a broken body — no detail is posted.
 #[test]

crates/maestro-protocol/src/display.rs

@@ -284,6 +284,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
+            agent_session_id: None,
         }
     }
 

crates/maestro-protocol/src/lib.rs

@@ -116,6 +116,13 @@ pub struct Session {
     /// sorts a never-focused session after every session that has one.
     #[serde(default)]
     pub last_focused_at: Option<DateTime<Utc>>,
+    /// The conversation id the agent running in this session reported for
+    /// itself (#161), parsed from a hook's `session_id` field. Written once,
+    /// from the first activity report that carries one, and left alone after
+    /// — an agent's own session id does not change mid-session. `None` for
+    /// sessions that never run an agent (plain shells) or predate the field.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub agent_session_id: Option<String>,
 }
 
 /// Default for [`Session::last_activity_at`] when an older payload omits it.
@@ -123,10 +130,38 @@ fn epoch() -> DateTime<Utc> {
     DateTime::from_timestamp(0, 0).expect("unix epoch is a valid timestamp")
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+/// Lifecycle of a session as the daemon knows it.
+///
+/// Deserializes leniently, like [`ActivityState`] (#162): an unknown spelling
+/// from a newer daemon reads as [`SessionStatus::Dead`] instead of failing the
+/// whole `Session`. `Dead` is the safe degrade — an unrecognised session is
+/// one this client must not treat as having a live pane to type into.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 pub enum SessionStatus {
     Running,
     Dead,
+    /// Known from its sidecar, with no tmux session behind it (#162). The
+    /// daemon registers these at recovery time for every sidecar tmux had
+    /// nothing to adopt — after a host reboot, that is every session there
+    /// was. There is no pane and no PTY bridge: a dormant session is a record
+    /// of what was running, listed so the operator still has it, and the only
+    /// thing that can be done to it is dismissing it.
+    Dormant,
+}
+
+impl<'de> Deserialize<'de> for SessionStatus {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let s = String::deserialize(deserializer)?;
+        Ok(match s.as_str() {
+            "Running" => Self::Running,
+            "Dormant" => Self::Dormant,
+            // Known or not, any other spelling degrades to the inert variant.
+            _ => Self::Dead,
+        })
+    }
 }
 
 /// Inferred session activity, orthogonal to [`SessionStatus`] (NAP-340). The
@@ -184,6 +219,11 @@ pub struct ReportActivityRequest {
     /// The daemon caps its length server-side.
     #[serde(default)]
     pub detail: Option<String>,
+    /// The agent's own conversation id (#161), forwarded from the hook
+    /// payload's `session_id` field. `None` for hook events that don't carry
+    /// one, or hooks predating this field.
+    #[serde(default)]
+    pub session_id: Option<String>,
 }
 
 /// Reject an unknown [`ActivityState`] spelling instead of degrading it to
@@ -489,8 +529,34 @@ impl ApiError {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SpawnPreset {
     pub id: String,
+    #[serde(default)]
     pub label: String,
     pub command: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resume_command: Option<String>,
+}
+
+/// Placeholder a preset's `resume_command` may carry for the agent's own
+/// conversation id (#165), substituted from [`Session::agent_session_id`].
+pub const AGENT_SESSION_PLACEHOLDER: &str = "{agent_session}";
+
+impl SpawnPreset {
+    /// The command that resumes a session spawned from this preset, with
+    /// [`AGENT_SESSION_PLACEHOLDER`] filled in from `agent_session`.
+    ///
+    /// `None` when the preset has no `resume_command` — a plain shell has
+    /// nothing to resume — and also when the template asks for an agent
+    /// session id the session never reported: `claude --resume` with an empty
+    /// id resumes nothing, so the caller is better off respawning the original
+    /// command than running a broken one.
+    pub fn resume_command_for(&self, agent_session: Option<&str>) -> Option<String> {
+        let template = self.resume_command.as_deref()?;
+        if !template.contains(AGENT_SESSION_PLACEHOLDER) {
+            return Some(template.to_string());
+        }
+        let id = agent_session.filter(|s| !s.is_empty())?;
+        Some(template.replace(AGENT_SESSION_PLACEHOLDER, id))
+    }
 }
 
 /// Build provenance of the running daemon: the commit it was compiled
@@ -742,6 +808,47 @@ pub enum ClientControl {
 mod tests {
     use super::*;
 
+    fn preset(resume: Option<&str>) -> SpawnPreset {
+        SpawnPreset {
+            id: "claude".into(),
+            label: "Claude".into(),
+            command: "claude".into(),
+            resume_command: resume.map(str::to_string),
+        }
+    }
+
+    #[test]
+    fn resume_command_substitutes_the_agent_session() {
+        let p = preset(Some("claude --resume {agent_session}"));
+        assert_eq!(
+            p.resume_command_for(Some("abc-123")).as_deref(),
+            Some("claude --resume abc-123")
+        );
+    }
+
+    #[test]
+    fn resume_command_without_a_placeholder_ignores_the_agent_session() {
+        let p = preset(Some("opencode --continue"));
+        assert_eq!(
+            p.resume_command_for(None).as_deref(),
+            Some("opencode --continue")
+        );
+    }
+
+    /// A template that wants an id the session never reported would run
+    /// `claude --resume` against nothing; the caller respawns instead.
+    #[test]
+    fn resume_command_is_none_without_the_id_it_asks_for() {
+        let p = preset(Some("claude --resume {agent_session}"));
+        assert!(p.resume_command_for(None).is_none());
+        assert!(p.resume_command_for(Some("")).is_none());
+    }
+
+    #[test]
+    fn a_preset_without_a_resume_command_has_none() {
+        assert!(preset(None).resume_command_for(Some("abc")).is_none());
+    }
+
     #[test]
     fn version_compatibility_is_major_only() {
         assert!(is_compatible(PROTOCOL_VERSION));
@@ -862,6 +969,7 @@ mod tests {
             current_cwd: Some(PathBuf::from("/home/naps62/projects/maestro/crates")),
             blocked_work: None,
             last_focused_at: None,
+            agent_session_id: None,
         }
     }
 
@@ -1031,6 +1139,7 @@ mod tests {
         let full = ReportActivityRequest {
             state: ActivityState::AwaitingInput,
             detail: Some("waiting on permission".into()),
+            session_id: Some("conv-abc123".into()),
         };
         assert_eq!(full, round_trip(&full));
 
@@ -1059,6 +1168,33 @@ mod tests {
             serde_json::to_value(SessionStatus::Dead).unwrap(),
             serde_json::json!("Dead")
         );
+        assert_eq!(
+            serde_json::to_value(SessionStatus::Dormant).unwrap(),
+            serde_json::json!("Dormant")
+        );
+    }
+
+    // #162: a session with no tmux behind it still rides the wire whole.
+    #[test]
+    fn dormant_session_round_trips() {
+        let mut s = sample_session();
+        s.status = SessionStatus::Dormant;
+        assert_eq!(s, round_trip(&s));
+    }
+
+    // #162: a `SessionStatus` this client does not know must degrade to the
+    // inert variant, not fail the whole `Session` the way a derived
+    // `Deserialize` would.
+    #[test]
+    fn unknown_session_status_degrades_to_dead() {
+        assert_eq!(
+            serde_json::from_value::<SessionStatus>(serde_json::json!("Hibernating")).unwrap(),
+            SessionStatus::Dead
+        );
+        let mut value = serde_json::to_value(sample_session()).unwrap();
+        value["status"] = serde_json::json!("Hibernating");
+        let s: Session = serde_json::from_value(value).expect("session survives unknown status");
+        assert_eq!(s.status, SessionStatus::Dead);
     }
 
     #[test]

crates/maestro-protocol/src/routes.rs

@@ -66,6 +66,12 @@ pub fn session_focus(id: Uuid) -> String {
     format!("{SESSIONS}/{id}/focus")
 }
 
+/// `POST /api/sessions/:id/resume` (#166): respawn a dormant session under its
+/// own id, keeping its sidecar, name, worktree and `created_at`.
+pub fn session_resume(id: Uuid) -> String {
+    format!("{SESSIONS}/{id}/resume")
+}
+
 /// `WS /api/attach/:id` — raw PTY bytes.
 pub fn attach(id: Uuid) -> String {
     format!("{API_PREFIX}/attach/{id}")
@@ -79,6 +85,7 @@ pub mod patterns {
     pub const SESSION_INPUT: &str = "/api/sessions/:id/input";
     pub const SESSION_PROMPT: &str = "/api/sessions/:id/prompt";
     pub const SESSION_FOCUS: &str = "/api/sessions/:id/focus";
+    pub const SESSION_RESUME: &str = "/api/sessions/:id/resume";
     pub const ATTACH: &str = "/api/attach/:id";
 }
 
@@ -202,6 +209,10 @@ mod tests {
             session_focus(id()),
             "/api/sessions/6f1a7c0e-0f5e-4a2b-9a3d-6b1c2d3e4f50/focus"
         );
+        assert_eq!(
+            session_resume(id()),
+            "/api/sessions/6f1a7c0e-0f5e-4a2b-9a3d-6b1c2d3e4f50/resume"
+        );
         assert_eq!(
             attach(id()),
             "/api/attach/6f1a7c0e-0f5e-4a2b-9a3d-6b1c2d3e4f50"
@@ -236,6 +247,10 @@ mod tests {
             patterns::SESSION_FOCUS.trim_end_matches(":id/focus"),
             session(id()).trim_end_matches(&id().to_string())
         );
+        assert_eq!(
+            patterns::SESSION_RESUME.trim_end_matches(":id/resume"),
+            session(id()).trim_end_matches(&id().to_string())
+        );
         assert_eq!(
             patterns::ATTACH.trim_end_matches(":id"),
             attach(id()).trim_end_matches(&id().to_string())

crates/maestro-testing/src/lib.rs

@@ -47,6 +47,7 @@ pub fn session(id: Uuid, cwd: &str, command: &str) -> Session {
         current_cwd: None,
         blocked_work: None,
         last_focused_at: None,
+        agent_session_id: None,
     }
 }
 

crates/maestro-tui/src/app.rs

@@ -1898,6 +1898,7 @@ mod tests {
                     current_cwd: None,
                     blocked_work: None,
                     last_focused_at: None,
+                    agent_session_id: None,
                 })
                 .collect(),
         });
@@ -2079,6 +2080,7 @@ mod tests {
                 current_cwd: None,
                 blocked_work: None,
                 last_focused_at: None,
+                agent_session_id: None,
             }],
         });
         app.dispatch(Action::SidebarNext);
@@ -2106,6 +2108,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
+            agent_session_id: None,
         }
     }
 
@@ -3214,6 +3217,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: focused,
+            agent_session_id: None,
         };
         let older = Utc::now() - chrono::Duration::seconds(60);
         app.catalog.apply_event(CatalogEvent::Snapshot {
@@ -3492,6 +3496,7 @@ mod tests {
                 current_cwd: None,
                 blocked_work: None,
                 last_focused_at: None,
+                agent_session_id: None,
             }],
         });
         app.dispatch(Action::KillHighlighted);
@@ -3527,6 +3532,7 @@ mod tests {
                 current_cwd: None,
                 blocked_work: None,
                 last_focused_at: None,
+                agent_session_id: None,
             }],
         });
     }

crates/maestro-tui/src/catalog.rs

@@ -223,6 +223,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
+            agent_session_id: None,
         }
     }
 

crates/maestro-tui/src/command_bar.rs

@@ -194,7 +194,9 @@ pub enum BarOutcome {
 pub fn order_sessions_for_bar(sessions: &[Session]) -> Vec<&Session> {
     let mut ordered: Vec<&Session> = sessions.iter().collect();
     ordered.sort_by(|a, b| {
-        let dead = |s: &Session| u8::from(s.status == SessionStatus::Dead);
+        // docs/COMMAND-BAR.md: anything with no live pane — dead or dormant
+        // (#162) — sorts after the sessions you could actually attach to.
+        let dead = |s: &Session| u8::from(s.status != SessionStatus::Running);
         dead(a)
             .cmp(&dead(b))
             .then_with(|| {
@@ -319,7 +321,7 @@ impl CommandBar {
             .map(|s| BarEntry {
                 candidate: MatchCandidate::Session(session_candidate(s, home_dir)),
                 target: BarTarget::Session(s.id),
-                dead: s.status == SessionStatus::Dead,
+                dead: s.status != SessionStatus::Running,
                 chords: Vec::new(),
             })
             .collect();
@@ -809,6 +811,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
+            agent_session_id: None,
         }
     }
 
@@ -889,6 +892,23 @@ mod tests {
         assert!(bar.rows()[1].dead);
     }
 
+    /// #162: docs/COMMAND-BAR.md ranks by whether you could attach, not by
+    /// which way the pane went away — a dormant session sorts with the dead.
+    #[test]
+    fn dormant_sessions_sort_after_live_ones_however_recent() {
+        let mut dormant = named(1, "dormant");
+        dormant.status = SessionStatus::Dormant;
+        dormant.last_focused_at = Some(at(99));
+        let live = named(2, "live");
+
+        let bar = CommandBar::new(&[dormant, live], &[], "/home/me");
+        assert_eq!(
+            ids(bar.rows()),
+            vec![Uuid::from_u128(2), Uuid::from_u128(1)]
+        );
+        assert!(bar.rows()[1].dead);
+    }
+
     #[test]
     fn typing_ranks_through_the_matcher_and_returns_ranges() {
         let mut bar = CommandBar::new(

crates/maestro-tui/src/draft.rs

@@ -1705,6 +1705,7 @@ mod tests {
             id: "aider".into(),
             label: "Aider".into(),
             command: "aider".into(),
+            resume_command: None,
         }]);
         assert_eq!(
             draft.command(),
@@ -1727,11 +1728,13 @@ mod tests {
                 id: "claude".into(),
                 label: "Claude".into(),
                 command: "claude".into(),
+                resume_command: None,
             },
             SpawnPreset {
                 id: "aider".into(),
                 label: "Aider".into(),
                 command: "aider".into(),
+                resume_command: None,
             },
         ]);
         assert_eq!(draft.command(), "aider");
@@ -1751,6 +1754,7 @@ mod tests {
             id: "claude".into(),
             label: "Claude".into(),
             command: "claude".into(),
+            resume_command: None,
         }]);
         assert!(draft.is_custom());
         assert_eq!(draft.command(), "bash -l");

crates/maestro-tui/src/fast_forward.rs

@@ -183,6 +183,7 @@ mod tests {
             id: id.into(),
             label: id.into(),
             command: command.into(),
+            resume_command: None,
         }
     }
 

crates/maestro-tui/src/sidebar.rs

@@ -268,6 +268,8 @@ impl Sidebar {
     fn name_row(&self, s: &Session, width: usize, focused: bool) -> Vec<Span<'static>> {
         let glyph = match (s.status, self.attached.contains(&s.id)) {
             (SessionStatus::Dead, _) => "✗",
+            // #162: known from its sidecar, nothing running behind it.
+            (SessionStatus::Dormant, _) => "◌",
             (SessionStatus::Running, true) => "●",
             (SessionStatus::Running, false) => "○",
         };
@@ -322,6 +324,7 @@ impl Sidebar {
         // on line 1; the kill confirm names the specifics.
         let blocked = s.blocked_work.filter(|b| !b.is_clear());
         let dead = s.status == SessionStatus::Dead;
+        let dormant = s.status == SessionStatus::Dormant;
         let highlighted = self.highlight == Some(SidebarItem::Session(s.id));
         let fill = self.card_fill(s, focused);
         let base = card_base(fill, focused);
@@ -361,6 +364,9 @@ impl Sidebar {
         if dead {
             tail.push(Span::styled(" exited", muted));
         }
+        if dormant {
+            tail.push(Span::styled(" dormant", muted));
+        }
         // docs/SIDEBAR.md: the card names the program, never its arguments.
         let command = Span::styled(format!(" {}", command_program(&s.command)), muted);
 
@@ -500,6 +506,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
+            agent_session_id: None,
         }
     }
 
@@ -1068,6 +1075,39 @@ mod tests {
         );
     }
 
+    /// #162, docs/SIDEBAR.md: a dormant session is known but not running —
+    /// its own glyph on line 1 and the muted `dormant` fragment on line 2, so
+    /// it never reads as something that exited.
+    #[test]
+    fn dormant_session_reads_as_known_but_not_running() {
+        let mut s = session_named(1, "claude");
+        s.status = SessionStatus::Dormant;
+        s.activity_since = Utc::now() - Duration::seconds(5);
+        let sb = Sidebar {
+            sessions: vec![s],
+            highlight: None,
+            attached: Default::default(),
+            pane_session: None,
+        };
+        let all = rows(&draw(&sb, 28, 8));
+        let idx = all.iter().position(|l| l.contains("claude")).unwrap();
+        assert!(
+            all[idx].contains('\u{25cc}'),
+            "expected the dormant glyph in: {:?}",
+            all[idx]
+        );
+        assert!(
+            all[idx + 1].contains("dormant"),
+            "expected dormant fragment in: {:?}",
+            all[idx + 1]
+        );
+        assert!(
+            !all[idx + 1].contains("exited"),
+            "a dormant session never reads as exited: {:?}",
+            all[idx + 1]
+        );
+    }
+
     /// docs/SIDEBAR.md: line 2 names the program, never its arguments.
     #[test]
     fn meta_line_drops_the_commands_arguments() {
@@ -1266,6 +1306,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
+            agent_session_id: None,
         };
         let sb = Sidebar {
             sessions: vec![s],

docs/COMMAND-BAR.md

@@ -123,9 +123,9 @@ client opening `/api/attach/:id`, and a client reporting focus explicitly at
 `POST /api/sessions/:id/focus` when it refocuses a pane that is already open.
 
 **A session that has never been focused sorts after every session that has**,
-and among those, most recently created first. Dead sessions sort after live
-ones regardless of recency: a session you cannot attach to is not where you
-just were.
+and among those, most recently created first. Sessions with no live pane —
+`Dead`, and `Dormant` (#162) — sort after live ones regardless of recency: a
+session you cannot attach to is not where you just were.
 
 Under `>` an empty query lists every command in registry order. Under `~` it
 lists recent dirs, most recent first, then the project list.
@@ -158,12 +158,12 @@ searchable — the query line keeps working, now over those actions.
   ambiguous.
 - Escape, or backspace at an empty query, returns to the result list **with the
   previous query intact**. Drilling in and backing out is free.
-- Each action raises the flow it already has: kill goes through the existing
-  confirm-and-blockers dialog (`docs/WORKTREES.md`), rename through the
-  existing prompt pre-filled with the session's own name
-  (`docs/SIDEBAR.md`), spawn similar through the spawn form seeded from the
-  session's directory and command. The bar picks the action; it never
-  reimplements one.
+- Each action raises the flow it already has: kill through the confirmation
+  both clients ask for (`docs/SIDEBAR.md`) and the blockers dialog behind it
+  (`docs/WORKTREES.md`), rename through the existing prompt pre-filled with the
+  session's own name (`docs/SIDEBAR.md`), spawn similar through the spawn form
+  seeded from the session's directory and command. The bar picks the action; it
+  never reimplements one.
 
 No actions beyond those three, and no action across more than one session.
 

docs/INSTALL.md

@@ -243,6 +243,26 @@ Pick `/tmp` if the daemon must outlive your login session and you can't run
 tmux sockets with it). The env var `MAESTRO_DAEMON_TMUX_TMPDIR` takes
 precedence over the file.
 
+## What happens to sessions after a reboot
+
+A host reboot kills the tmux server, so every session the daemon knew is dead
+while its record on disk survives. What recovery does with those is
+`[daemon].resume_on_boot`:
+
+```toml
+[daemon]
+resume_on_boot = "dormant"   # "dormant" (default) | "auto" | "never"
+```
+
+- `dormant` — the sessions are listed but not running, and you resume the ones
+  you want from the web UI or the TUI.
+- `auto` — the daemon resumes them all itself during startup. Only pick this
+  on a host where restarting every agent unattended is safe: they come back on
+  the flags they were spawned with, with nobody watching.
+- `never` — the records are deleted and a reboot is a clean slate.
+
+See `docs/RESTART.md` for the full contract.
+
 ## What the systemd unit looks like
 
 The wizard writes a *user* unit (`systemctl --user`), since `maestro daemon`

docs/PREVIEW.md

@@ -47,6 +47,7 @@ Web client (`--preview` and friends in `web/src/styles.css`):
 | The canvas | A `preview` chip, top right, and a dashed inset ring. |
 | A throwaway tab | Dashed border, italic label. |
 | The sidebar row being previewed | Filled with the preview hue, over whatever open state the row already had — but the row of the session already showing in the pane keeps its accent fill, since previewing it changes nothing on screen. |
+| The sidebar row of the session the operator picked | Keeps its accent fill for the whole preview. A preview never moves the accent; only opening another session does. |
 | A hovered sidebar row, and the keyboard cursor on a session | A lighter wash of the same hue, because both are what previews a row. |
 
 Rows say it with fill, not with an edge — see the tier ladder in

docs/RESTART.md

@@ -68,6 +68,84 @@ resolves, so a blocked client is never a trapped one. It clears itself the
 moment a probe succeeds — there is no "retry" button, because the client is
 already retrying.
 
+## What survives, and what comes back dormant
+
+A daemon restart leaves tmux alone, so recovery re-adopts every
+`maestro-<uuid>` session tmux still holds and the operator sees no change
+beyond the reconnect above.
+
+A **host reboot** is different: it kills the tmux server, so there is nothing
+to adopt while every session's sidecar is still on disk. Recovery always asks
+tmux — `tmux list-sessions` is the single source of truth for liveness, and the
+kernel's `boot_id` only tells a reboot from a restart in the log (#164, #174).
+A boot id changes without the tmux server dying whenever the state directory is
+restored, a VM or container snapshot is rolled back, or the `boot_id` file is
+truncated; a session tmux still holds is adopted `Running` in every one of
+those cases. Recovery makes a
+second pass over those sidecars and registers each as a `Dormant` session
+(#162) — id, name, cwd, command, worktree and `created_at` intact. A dormant
+session has no pane and no PTY bridge: it cannot be attached to, typed into or
+resized, and neither watcher pass touches it.
+
+A dormant session is brought back with `POST /api/sessions/:id/resume` (#166),
+which respawns tmux under the **same** uuid and sidecar — `metadata.name`,
+`created_at`, `env` and worktree ownership all survive, and only the tmux
+session and the PTY bridge are new. The command is the matching spawn preset's
+`resume_command` with `{agent_session}` filled in from the session's own
+`agent_session_id`, so an agent comes back inside its old conversation; a
+session with no matching preset, no `resume_command`, or no reported
+conversation id is respawned on the command it was created with. `Session::command`
+always keeps that original command, so a second resume resolves the same preset.
+Resume is refused with `409` for a session that is already running
+(`already_running`) and for one whose `cwd` has disappeared (`cwd_missing`) —
+neither is something a respawn could fix. The other thing to do with a dormant
+session is dismiss it, which removes the sidecar so the next recovery does not
+bring it back.
+
+## What recovery does with them: `resume_on_boot`
+
+Whether a recovered-but-dead session is left dormant at all is the operator's
+call, per host, via `[daemon].resume_on_boot` (#167):
+
+| value       | what recovery does                                                    |
+| ----------- | --------------------------------------------------------------------- |
+| `"dormant"` | **Default.** Register each one dormant and wait for the operator.      |
+| `"auto"`    | Resume each one during recovery, itself.                               |
+| `"never"`   | Prune the sidecars instead — a reboot is a clean slate.                |
+
+`dormant` is the default because resuming agents unattended is a foot-gun:
+they come back on whatever flags they were spawned with, seconds after a
+reboot, with nobody watching. `auto` exists for hosts where that is known to
+be safe, and it is opted into rather than inherited.
+
+`auto` calls the same `resume` the client's `POST /api/sessions/:id/resume`
+does — same uuid, same sidecar, the preset's `resume_command` — so there is
+one resume path and not two. A session that fails to resume is logged and
+stays dormant; the rest still come back.
+
+`never` prunes the same way #163 does for a missing `cwd`: the sidecar is
+deleted and nothing is registered, so the session is not listed and the next
+recovery does not find it. Whatever worktree it owned is left on disk.
+
+The policy only decides the fate of sessions with no live pane. A session
+tmux still holds is adopted `Running` by the first pass under every policy,
+including `never`.
+
+Recovery logs the policy that ran and the number of sessions it acted on, so
+a host that resumes agents unattended says so in its own journal.
+
+Attaching to a session that has no bridge answers `409 not_attachable`, not
+`404 unknown_session`: the session exists, and a client that cannot tell "gone"
+from "not running" cannot offer the resume.
+
+`SessionStatus` is a wire type, so from this build forward it deserializes
+leniently on both clients: a spelling the client does not know reads as `Dead`
+rather than failing the whole session. That leniency lives in the client's own
+binary, so it covers spellings added *after* this build, not this one — a CLI
+or TUI still running an older build fails to parse a `Dormant` session, and
+with it the whole session list, until it is upgraded. Clients render a dormant session as known-but-not-running —
+see `docs/SIDEBAR.md` for the card and `docs/COMMAND-BAR.md` for how it ranks.
+
 ## Timing
 
 - **Grace window** — 1200 ms between the socket dropping and the overlay

docs/SIDEBAR.md

@@ -56,7 +56,7 @@ itself is not.
 Line 2 reads left to right:
 
 ```
-[<duration>] [<detail>] <command> [<diff stat> | exited]
+[<duration>] [<detail>] <command> [<diff stat> | exited | dormant]
 ```
 
 Its minimum content is therefore just the command.
@@ -104,8 +104,14 @@ fragment; it no longer decides whether line 2 exists.
 while an agent-reported state is in force (see Precedence): when the report
 lapses at its TTL or is replaced, the detail goes with it. The detail
 truncates with `…` ahead of the trailing fragments — a long detail never
-pushes `<command>`, `<blocked work>`, or `exited` off the line, and neither
-client ever lets it wrap.
+pushes `<command>`, `<blocked work>`, `exited` or `dormant` off the line, and
+neither client ever lets it wrap.
+
+`dormant` (#162) is the counterpart of `exited` for a session the daemon knows
+only from its sidecar: recovery found no tmux session behind it, so it has no
+pane, no scrollback, and nothing to attach to. It is not an exit — nothing was
+observed ending — so the two fragments never both show. The TUI marks the same
+state on line 1 with `◌`, next to `✗` for exited and `●`/`○` for running.
 
 `<diff stat>` is the blocked-work breakdown (#83) in diff notation, replacing
 the spelled-out `⚠ 3 uncommitted files, 2 unpushed commits`. It renders only
@@ -209,7 +215,7 @@ the cursor's fill while the pane holds the keyboard, and the web's ring on a
 highlighted **folder** row — a folder previews nothing, so it has no fill to
 step up to.
 
-The duration text inherits its state's colour; the exited and command
+The duration text inherits its state's colour; the exited, dormant and command
 fragments use the surface's `muted` role, as do the diff stat's `~`, `?` and
 `↑` fragments. Only `+` and `-` step outside the surface's muted role, and they
 take the `active` and `error` roles of the same surface.
@@ -316,7 +322,7 @@ Everything else is the same key on both clients:
 | `Tab`   | hand the keyboard to the pane               |
 | `c`     | collapse or expand the highlighted folder   |
 | `r`     | rename the highlighted session              |
-| `x`     | kill the highlighted session                |
+| `x`     | kill the highlighted session (confirms)     |
 | `n`     | open the spawn form                         |
 | `N`     | spawn with every default resolved           |
 | `?`     | show the shortcut overlay                   |
@@ -324,3 +330,18 @@ Everything else is the same key on both clients:
 The TUI binds these through its keymap, so a user can rebind any of them; the
 web client's are fixed. A binding added to one client belongs in this table and
 in both help overlays.
+
+## Killing a session
+
+**Every kill confirms first, in both clients** (#160). A kill is destructive
+and unattended agents live in these sessions, so neither client sends
+`DELETE /api/sessions/:id` off a single press. The TUI raises
+`OverlayKind::KillConfirm` (`[y]`/`[n]`); the web raises the same dialog its
+`✕` button and the command bar's action page both use. Cancel holds the focus
+in the web's dialog, so nothing kills on a stray Enter.
+
+The confirmation names what the card last saw in the way, when anything was —
+the daemon will refuse an unforced kill over such a worktree, and saying so
+before the attempt is cheaper than a refusal. What comes back from that refusal
+is a second, separate prompt offering `force=true`; `docs/WORKTREES.md` owns
+what a forced kill leaves behind.

web/src/barActions.test.ts

@@ -65,7 +65,7 @@ async function flush(): Promise<void> {
 }
 
 describe("kill from the action page", () => {
-  it("goes through the daemon, without a first confirmation", async () => {
+  it("goes through the same confirmation the sidebar raises (#160)", async () => {
     const calls: string[] = [];
     window.fetch = ((url: string, init?: RequestInit) => {
       calls.push(`${init?.method ?? "GET"} ${url}`);
@@ -75,6 +75,12 @@ describe("kill from the action page", () => {
     mount(s);
     raise(KILL_SESSION_EVENT, s);
     await flush();
+    expect(document.querySelector(".kill-dialog")?.getAttribute("aria-label")).toBe(
+      "Kill amber-falcon",
+    );
+    expect(calls.filter((c) => c.startsWith("DELETE"))).toHaveLength(0);
+    document.querySelector<HTMLButtonElement>(".kill-dialog-kill")?.click();
+    await flush();
     expect(calls).toContain(`DELETE /api/sessions/${s.id}`);
     expect(document.querySelector(".kill-dialog")).toBeNull();
   });
@@ -101,6 +107,8 @@ describe("kill from the action page", () => {
     mount(s);
     raise(KILL_SESSION_EVENT, s);
     await flush();
+    document.querySelector<HTMLButtonElement>(".kill-dialog-kill")?.click();
+    await flush();
     const dialog = document.querySelector(".kill-dialog");
     expect(dialog?.getAttribute("aria-label")).toBe("Kill amber-falcon");
     expect(dialog?.textContent).toContain("1 untracked file");

web/src/catalog.test.ts

@@ -98,7 +98,7 @@ describe("blocked-work indicator (#83)", () => {
     expect(rowFor(el, unprobed.id)?.querySelector(".leaf-blocked")).toBeNull();
   });
 
-  it("kills straight away, without a first confirmation", async () => {
+  it("confirms before an unguarded kill (#160)", async () => {
     const calls: string[] = [];
     window.fetch = ((url: string, init?: RequestInit) => {
       calls.push(`${init?.method ?? "GET"} ${url}`);
@@ -108,10 +108,45 @@ describe("blocked-work indicator (#83)", () => {
     const el = renderSidebar(storeWith([plain])).el;
     rowFor(el, plain.id)?.querySelector<HTMLButtonElement>(".leaf-kill")?.click();
     await flush();
+    const dialog = document.querySelector(".kill-dialog");
+    expect(dialog?.getAttribute("aria-label")).toBe("Kill claude");
+    expect(calls.filter((c) => c.startsWith("DELETE"))).toHaveLength(0);
+    dialog?.querySelector<HTMLButtonElement>(".kill-dialog-kill")?.click();
+    await flush();
     expect(calls).toContain(`DELETE /api/sessions/${plain.id}`);
     expect(document.querySelector(".kill-dialog")).toBeNull();
   });
 
+  it("kills nothing when the confirmation is cancelled (#160)", async () => {
+    const calls: string[] = [];
+    window.fetch = ((url: string, init?: RequestInit) => {
+      calls.push(`${init?.method ?? "GET"} ${url}`);
+      return Promise.resolve(new Response(null, { status: 204 }));
+    }) as typeof fetch;
+    const plain = session({ id: "aaaaaaaa-0000-0000-0000-000000000007" });
+    const el = renderSidebar(storeWith([plain])).el;
+    rowFor(el, plain.id)?.querySelector<HTMLButtonElement>(".leaf-kill")?.click();
+    await flush();
+    document.querySelector<HTMLButtonElement>(".kill-dialog-cancel")?.click();
+    await flush();
+    expect(document.querySelector(".kill-dialog")).toBeNull();
+    expect(calls.filter((c) => c.startsWith("DELETE"))).toHaveLength(0);
+  });
+
+  it("names the blockers in the confirmation, before the daemon refuses (#160)", async () => {
+    window.fetch = (() => Promise.reject(new Error("never called"))) as typeof fetch;
+    const blocked = session({
+      id: "aaaaaaaa-0000-0000-0000-000000000008",
+      blocked_work: { untracked_files: 1 },
+    });
+    const el = renderSidebar(storeWith([blocked])).el;
+    rowFor(el, blocked.id)?.querySelector<HTMLButtonElement>(".leaf-kill")?.click();
+    await flush();
+    const dialog = document.querySelector(".kill-dialog");
+    expect(dialog?.textContent).toContain("1 untracked file");
+    expect(dialog?.textContent).toContain("refused unless it is forced");
+  });
+
   it("offers the override when the daemon refuses a guarded kill", async () => {
     const calls: string[] = [];
     window.fetch = ((url: string, init?: RequestInit) => {
@@ -138,6 +173,8 @@ describe("blocked-work indicator (#83)", () => {
     const el = renderSidebar(storeWith([blocked])).el;
     rowFor(el, blocked.id)?.querySelector<HTMLButtonElement>(".leaf-kill")?.click();
     await flush();
+    document.querySelector<HTMLButtonElement>(".kill-dialog-kill")?.click();
+    await flush();
     const dialog = document.querySelector(".kill-dialog");
     expect(dialog?.textContent).toContain("1 untracked file");
     dialog?.querySelector<HTMLButtonElement>(".kill-dialog-force")?.click();
@@ -166,6 +203,8 @@ describe("blocked-work indicator (#83)", () => {
     const el = renderSidebar(storeWith([blocked])).el;
     rowFor(el, blocked.id)?.querySelector<HTMLButtonElement>(".leaf-kill")?.click();
     await flush();
+    document.querySelector<HTMLButtonElement>(".kill-dialog-kill")?.click();
+    await flush();
     document.querySelector<HTMLButtonElement>(".kill-dialog-cancel")?.click();
     expect(document.querySelector(".kill-dialog")).toBeNull();
     expect(calls.filter((c) => c.includes("force=true"))).toHaveLength(0);
@@ -375,6 +414,19 @@ describe("session cards (#107)", () => {
     expect(line2?.textContent).toContain("exited");
   });
 
+  // #162: a session recovered with no tmux behind it is known but not running,
+  // and never reads as something that exited.
+  it("shows dormant on line 2 for dormant sessions", () => {
+    const s = session({
+      id: "aaaaaaaa-0000-0000-0000-000000000118",
+      status: "Dormant",
+    });
+    const el = renderSidebar(storeWith([s])).el;
+    const line2 = rowFor(el, s.id)?.querySelector<HTMLElement>(".card-line2");
+    expect(line2?.textContent).toContain("dormant");
+    expect(line2?.textContent).not.toContain("exited");
+  });
+
   it("carries the state word only in tooltips and aria labels, never as text", () => {
     const s = session({
       id: "aaaaaaaa-0000-0000-0000-000000000019",

web/src/catalog.ts

@@ -1,6 +1,6 @@
 import { escapeHtml } from "./html.js";
 import { ApiRequestError, getDaemonInfo, killSession, renameSession } from "./api.js";
-import { openForceKillDialog } from "./killDialog.js";
+import { openForceKillDialog, openKillConfirmDialog } from "./killDialog.js";
 import { openContextMenu } from "./contextMenu.js";
 import { toggleHelp } from "./help.js";
 import { CommandSet, defineCommands } from "./commands.js";
@@ -113,6 +113,9 @@ function activityRailMarkup(slug: string, stateWord: string): string {
 
 function metaLine(s: Session, now: number): string {
   const dead = s.status === "Dead";
+  // #162: known from its sidecar with nothing running behind it — a distinct
+  // fragment, since it never exited.
+  const dormant = s.status === "Dormant";
   const blockers = sessionBlockers(s);
   const slug = activityColorSlug(s.activity ?? "Idle");
   const held = activityHeldMs(s.activity_since, now);
@@ -127,6 +130,7 @@ function metaLine(s: Session, now: number): string {
     commandFragment(s.command),
     blockers ? blockedFragment(blockers) : "",
     dead ? `<span class="card-flag">exited</span>` : "",
+    dormant ? `<span class="card-flag">dormant</span>` : "",
   ];
   return `<span class="card-line2" data-activity="${slug}">${fragments.join("")}</span>`;
 }
@@ -230,7 +234,7 @@ function renderNode(node: TreeNode, depth: number): HTMLElement {
   killBtn.addEventListener("click", (ev) => {
     ev.preventDefault();
     ev.stopPropagation();
-    void requestKill(cur, sessionName(cur));
+    requestKill(cur, sessionName(cur));
   });
   row.addEventListener("click", () => {
     document.dispatchEvent(new CustomEvent(SESSION_SELECT_EVENT, { detail: cur.id }));
@@ -248,7 +252,7 @@ function renderNode(node: TreeNode, depth: number): HTMLElement {
       {
         label: "Kill session",
         danger: true,
-        onSelect: () => void requestKill(cur, sessionName(cur)),
+        onSelect: () => requestKill(cur, sessionName(cur)),
       },
     ]);
   });
@@ -293,26 +297,33 @@ function treeSignature(node: TreeNode): string {
 }
 
 /**
- * Kill on the first click (#81): the daemon is the one that decides whether a
- * session may go, and it refuses over a worktree holding unsaved work. Only
- * that refusal is worth a prompt, and it needs one `confirm()` cannot give —
- * a forced kill. Anything else surfaces as an alert.
+ * Kill behind a confirmation (#160): a kill is destructive and unattended
+ * agents live in these sessions, so the web asks first, the way the TUI always
+ * has. The daemon decides the rest — it refuses a kill over a worktree holding
+ * unsaved work, and that refusal needs a prompt the confirmation cannot give,
+ * a forced kill. Anything else surfaces in the dialog that asked.
  */
-async function requestKill(s: Session, name: string): Promise<void> {
-  try {
-    await killSession(s.id);
-  } catch (e) {
-    if (e instanceof ApiRequestError && e.code === "kill_guarded") {
-      openForceKillDialog({
-        name,
-        blockers: e.unsavedWork ?? sessionBlockers(s),
-        reason: e.detail,
-        onForce: () => killSession(s.id, true),
-      });
-      return;
-    }
-    alert(`Failed to kill: ${(e as Error).message}`);
-  }
+function requestKill(s: Session, name: string): void {
+  openKillConfirmDialog({
+    name,
+    blockers: sessionBlockers(s),
+    onKill: async () => {
+      try {
+        await killSession(s.id);
+      } catch (e) {
+        if (e instanceof ApiRequestError && e.code === "kill_guarded") {
+          openForceKillDialog({
+            name,
+            blockers: e.unsavedWork ?? sessionBlockers(s),
+            reason: e.detail,
+            onForce: () => killSession(s.id, true),
+          });
+          return;
+        }
+        throw e;
+      }
+    },
+  });
 }
 
 /**
@@ -719,7 +730,7 @@ export function renderSidebar(store: CatalogStore, opts: SidebarOptions = {}): S
       },
       "list.kill": () => {
         const hit = highlightedSession();
-        if (hit) void requestKill(hit.session, sessionName(hit.session));
+        if (hit) requestKill(hit.session, sessionName(hit.session));
       },
       "list.focusPane": () => document.dispatchEvent(new CustomEvent(FOCUS_PANE_EVENT)),
     }),
@@ -782,7 +793,7 @@ export function renderSidebar(store: CatalogStore, opts: SidebarOptions = {}): S
   // than by row.
   const killHandler = (ev: Event) => {
     const s = (ev as CustomEvent<Session>).detail;
-    void requestKill(s, sessionName(s));
+    requestKill(s, sessionName(s));
   };
   const renameHandler = (ev: Event) => {
     const s = (ev as CustomEvent<Session>).detail;

web/src/commandBar.test.ts

@@ -99,6 +99,20 @@ describe("empty-query ordering", () => {
     ]);
   });
 
+  // #162: docs/COMMAND-BAR.md ranks by whether you could attach, not by which
+  // way the pane went away.
+  it("sorts dormant sessions after live ones, like dead ones", () => {
+    const dormantRecent = session("dormant", {
+      status: "Dormant",
+      last_focused_at: "2026-06-01T00:00:00Z",
+    });
+    const liveStale = session("live", { last_focused_at: "2020-01-01T00:00:00Z" });
+    expect(orderSessionsForBar([dormantRecent, liveStale]).map((s) => s.id)).toEqual([
+      "live",
+      "dormant",
+    ]);
+  });
+
   it("treats a null last_focused_at as never focused", () => {
     const nulled = session("nulled", { last_focused_at: null });
     const stamped = session("stamped", { last_focused_at: "2020-01-01T00:00:00Z" });

web/src/commandBar.ts

@@ -142,8 +142,10 @@ function createdAt(s: Session): number {
  *  matcher's last tie-break preserves. */
 export function orderSessionsForBar(sessions: readonly Session[]): Session[] {
   return [...sessions].sort((a, b) => {
-    const deadA = a.status === "Dead" ? 1 : 0;
-    const deadB = b.status === "Dead" ? 1 : 0;
+    // docs/COMMAND-BAR.md: anything with no live pane — dead or dormant (#162)
+    // — sorts after the sessions you could actually attach to.
+    const deadA = a.status === "Running" ? 0 : 1;
+    const deadB = b.status === "Running" ? 0 : 1;
     if (deadA !== deadB) return deadA - deadB;
 
     const focusA = focusedAt(a);
@@ -350,7 +352,7 @@ function renderRow(result: BarResult, index: number): HTMLElement {
   row.dataset.kind = candidate.kind;
   if (candidate.kind === "session") {
     row.dataset.sessionId = candidate.session.id;
-    if (candidate.session.status === "Dead") row.classList.add("is-dead");
+    if (candidate.session.status !== "Running") row.classList.add("is-dead");
   } else if (isActionCandidate(candidate)) {
     row.dataset.actionId = candidate.action.id;
   } else if (candidate.kind === "command") {

web/src/fastForward.test.ts

@@ -34,12 +34,14 @@ describe("resolveFastForward (#67)", () => {
     const res = resolveFastForward(projects, presets, "amber-falcon");
     expect(res.project?.path).toBe("/repos/fresh");
     expect(res.command).toBe("aider");
-    expect(res.name).toBe("amber-falcon");
+    expect(res.handle).toBe("amber-falcon");
 
     const req = buildFastForwardRequest(res)!;
     expect(req.cwd).toBe("/repos/fresh");
     expect(req.command).toBe("aider");
-    expect(req.metadata).toEqual({ name: "amber-falcon" });
+    // No name (#131): the daemon names the session after its first prompt,
+    // and a name here would collide with the branch handle.
+    expect(req.metadata).toBeUndefined();
     expect(req.worktree).toEqual({
       base_repo: "/repos/fresh",
       branch: "amber-falcon",
@@ -88,9 +90,9 @@ describe("resolveFastForward (#67)", () => {
     expect(buildFastForwardRequest(res)).toBeNull();
   });
 
-  it("downgrades to a draft when the generated name is missing", () => {
+  it("downgrades to a draft when the generated handle is missing", () => {
     const res = resolveFastForward([project({ last_command: "claude" })], presets);
-    expect(res.name).toBeUndefined();
+    expect(res.handle).toBeUndefined();
     expect(buildFastForwardRequest(res)).toBeNull();
   });
 
@@ -108,6 +110,17 @@ describe("resolveFastForward (#67)", () => {
     });
   });
 
+  it("seeds the handle as the branch and leaves the name field empty (#131)", () => {
+    const res = resolveFastForward(
+      [project({ path: "/repos/p", base_repo: "/repos/p", last_command: "aider" })],
+      presets,
+      "amber-falcon",
+    );
+    const seed = fastForwardSeed(res);
+    expect(seed.name).toBe("");
+    expect(seed.worktreeBranch).toBe("amber-falcon");
+  });
+
   it("leaves the worktree default alone when not even a project resolved", () => {
     // Not `false`: the form defaults the toggle on and a false would stick,
     // so the fallback draft would disagree with a normally-opened draft and

web/src/fastForward.ts

@@ -10,19 +10,21 @@ import { sortProjects } from "./projectList.js";
 export interface FastForwardResolution {
   project?: Project;
   command?: string;
-  name?: string;
+  /** A generated handle for the worktree branch (#131). Not a session name:
+   *  the fast path names no session. */
+  handle?: string;
 }
 
 /** The defaults: the currently focused session's project when it's still a
  *  known project, else the most recent one (fresh-first, same ordering the
  *  picker shows) — so `N` lands where the operator currently is, matching
  *  what plain `n` seeds from `spawnSimilarProjectSeed`. Its last command
- *  falls back to the first non-custom preset, and the name is freshly
- *  generated when the daemon supplied one. */
+ *  falls back to the first non-custom preset, and the branch handle is
+ *  freshly generated when the daemon supplied one. */
 export function resolveFastForward(
   projects: Project[],
   presets: SpawnPreset[],
-  name?: string,
+  handle?: string,
   focusedCwd?: string,
 ): FastForwardResolution {
   const project =
@@ -30,41 +32,45 @@ export function resolveFastForward(
   const lastCommand = project?.last_command?.trim();
   const command =
     lastCommand || presets.find((p) => p.command !== "")?.command || undefined;
-  return { project, command, name: name || undefined };
+  return { project, command, handle: handle || undefined };
 }
 
 /** The immediate spawn request — worktree on, new branch named after the
- *  generated session name — or `null` when any default is missing. */
+ *  generated handle — or `null` when any default is missing.
+ *
+ *  The request carries no name (#131): the daemon assigns a provisional one
+ *  and replaces it once the session sees its first prompt. A name here would
+ *  also collide with the branch handle's own session. */
 export function buildFastForwardRequest(
   res: FastForwardResolution,
 ): CreateSessionRequest | null {
-  const { project, command, name } = res;
-  if (!project || !command?.trim() || !name) return null;
+  const { project, command, handle } = res;
+  if (!project || !command?.trim() || !handle) return null;
   return {
     cwd: project.path,
     command,
-    metadata: { name },
     worktree: {
       base_repo: project.base_repo ?? project.path,
-      branch: name,
+      branch: handle,
       create_branch: true,
     },
   };
 }
 
 /** Seed for the fallback spawn form: whatever did resolve goes into the
- *  form; the rest stays with its own defaults. */
+ *  form; the rest stays with its own defaults. The name field stays empty
+ *  (#131) — the handle seeds the branch, not the session name. */
 export function fastForwardSeed(res: FastForwardResolution) {
   return {
     cwd: res.project?.path ?? "",
     command: res.command ?? "",
-    name: res.name ?? "",
+    name: "",
     // Left undefined rather than false when nothing resolved: the form
     // defaults the toggle on, and `false` would stick, so the fallback form
     // would disagree with both a normally-opened form and the TUI's fast path
     // (#67 review).
     worktreeEnabled: res.project ? true : undefined,
     worktreeBranch:
-      res.project && res.name ? res.name : undefined,
+      res.project && res.handle ? res.handle : undefined,
   };
 }

web/src/killDialog.ts

@@ -1,14 +1,44 @@
 /**
- * Forced-kill prompt (#81).
+ * The two kill prompts (#81, #160).
  *
- * The daemon refuses to kill a session whose worktree still holds uncommitted
- * or unpushed work. `confirm()` can only ask the same question twice, so the
- * refusal gets its own dialog: it names what is in the way and offers the
- * override the daemon's `force=true` already implements. A kill the daemon
- * accepts never reaches here — there is nothing to warn about.
+ * A kill is destructive and unattended agents live in these sessions, so both
+ * clients ask before one goes through — the TUI's `KillConfirm`, and
+ * `openKillConfirmDialog` here (#160). Where the session's worktree still
+ * holds uncommitted or unpushed work, the confirmation says so up front, the
+ * same way the TUI's does.
+ *
+ * The daemon decides the rest: it refuses a kill over such a worktree, and
+ * that refusal needs an answer the confirmation cannot give — a forced kill.
+ * `openForceKillDialog` is that second prompt. A kill the daemon accepts never
+ * reaches it.
  */
 import { formatInTheWay, type InTheWay } from "./types.js";
 
+/** What both prompts need: a target to name and a button that acts on it. */
+interface KillDialogSpec {
+  /** Session name, as the sidebar shows it. */
+  name: string;
+  /** Sentence under the title. */
+  body: string;
+  /** Label on the acting button. */
+  confirmLabel: string;
+  /** Extra class on the acting button, so tests and styles can find it. */
+  confirmClass: string;
+  /** Run it. A rejection is rendered in the dialog, which stays open so the
+   *  press can be retried. */
+  onConfirm: () => Promise<void>;
+}
+
+export interface KillConfirmPrompt {
+  name: string;
+  /** What the card last saw in the way, when anything was. Shown before the
+   *  attempt, so "this will be refused" is not a surprise. */
+  blockers: InTheWay | null;
+  /** Run the plain kill. Opening a further dialog from here is allowed: the
+   *  confirmation only closes itself if it is still the one on screen. */
+  onKill: () => Promise<void>;
+}
+
 export interface ForceKillPrompt {
   /** Session name, as the sidebar shows it. */
   name: string;
@@ -30,9 +60,9 @@ export function closeForceKillDialog(): void {
   open = null;
 }
 
-/** Mount the prompt. Opening while one is up replaces it, so a second refusal
- *  can never stack two dialogs. */
-export function openForceKillDialog(p: ForceKillPrompt): HTMLElement {
+/** Mount one of the prompts. Opening while one is up replaces it, so the
+ *  confirmation and a refusal that follows it can never stack. */
+function mount(p: KillDialogSpec): HTMLElement {
   closeForceKillDialog();
 
   const el = document.createElement("div");
@@ -50,9 +80,7 @@ export function openForceKillDialog(p: ForceKillPrompt): HTMLElement {
 
   const body = document.createElement("p");
   body.className = "kill-dialog-body";
-  body.textContent = p.blockers
-    ? `Its worktree still has ${formatInTheWay(p.blockers)}. Forcing the kill removes the session and leaves the worktree on disk.`
-    : `${p.reason} Forcing the kill removes the session and leaves the worktree on disk.`;
+  body.textContent = p.body;
 
   const error = document.createElement("p");
   error.className = "kill-dialog-error";
@@ -65,22 +93,27 @@ export function openForceKillDialog(p: ForceKillPrompt): HTMLElement {
   cancel.className = "btn btn-ghost kill-dialog-cancel";
   cancel.textContent = "Cancel";
   cancel.addEventListener("click", closeForceKillDialog);
-  const force = document.createElement("button");
-  force.type = "button";
-  force.className = "btn btn-danger kill-dialog-force";
-  force.textContent = "Force kill";
-  force.addEventListener("click", () => {
-    force.disabled = true;
+  const confirm = document.createElement("button");
+  confirm.type = "button";
+  confirm.className = `btn btn-danger ${p.confirmClass}`;
+  confirm.textContent = p.confirmLabel;
+  confirm.addEventListener("click", () => {
+    confirm.disabled = true;
     void p
-      .onForce()
-      .then(closeForceKillDialog)
+      .onConfirm()
+      .then(() => {
+        // A handler that opened the refusal prompt has already replaced this
+        // dialog; closing here would take that one down with it.
+        if (open?.el === el) closeForceKillDialog();
+      })
       .catch((e: unknown) => {
-        force.disabled = false;
+        if (open?.el !== el) return;
+        confirm.disabled = false;
         error.hidden = false;
         error.textContent = `Failed to kill: ${(e as Error).message}`;
       });
   });
-  actions.append(cancel, force);
+  actions.append(cancel, confirm);
 
   panel.append(title, body, error, actions);
 
@@ -99,6 +132,34 @@ export function openForceKillDialog(p: ForceKillPrompt): HTMLElement {
   };
   window.addEventListener("keydown", onKeydown, true);
   open = { el, onKeydown };
+  // Cancel takes the focus in both prompts: a kill is never one keystroke
+  // away from whatever asked for the dialog.
   cancel.focus();
   return el;
 }
+
+/** Ask before a kill the daemon has not seen yet (#160). */
+export function openKillConfirmDialog(p: KillConfirmPrompt): HTMLElement {
+  return mount({
+    name: p.name,
+    body: p.blockers
+      ? `Its worktree still has ${formatInTheWay(p.blockers)}. The kill will be refused unless it is forced.`
+      : "The session and everything running in it go away. Its worktree stays on disk.",
+    confirmLabel: "Kill",
+    confirmClass: "kill-dialog-kill",
+    onConfirm: p.onKill,
+  });
+}
+
+/** Offer the override after the daemon refuses a guarded kill (#81). */
+export function openForceKillDialog(p: ForceKillPrompt): HTMLElement {
+  return mount({
+    name: p.name,
+    body: p.blockers
+      ? `Its worktree still has ${formatInTheWay(p.blockers)}. Forcing the kill removes the session and leaves the worktree on disk.`
+      : `${p.reason} Forcing the kill removes the session and leaves the worktree on disk.`,
+    confirmLabel: "Force kill",
+    confirmClass: "kill-dialog-force",
+    onConfirm: p.onForce,
+  });
+}

web/src/main.ts

@@ -356,14 +356,14 @@ async function spawnPresets(): Promise<SpawnPreset[]> {
 }
 
 async function requestFastForward(): Promise<void> {
-  const [discovered, name] = await Promise.all([
+  const [discovered, handle] = await Promise.all([
     fetchProjects().catch(() => [] as Project[]),
     fetchNames(1)
       .then((batch) => batch.names[0])
       .catch(() => undefined),
   ]);
   const presets = await spawnPresets();
-  const resolved = resolveFastForward(discovered, presets, name, focusedProjectCwd());
+  const resolved = resolveFastForward(discovered, presets, handle, focusedProjectCwd());
   const req = buildFastForwardRequest(resolved);
   if (req) {
     try {
@@ -390,7 +390,7 @@ async function requestFastForward(): Promise<void> {
 // one outside any repo spawns without a worktree, since there is no repo to cut
 // a branch from. Anything still unresolved opens the pre-filled form.
 async function requestSpawnInDirectory(path: string): Promise<void> {
-  const [discovered, name] = await Promise.all([
+  const [discovered, handle] = await Promise.all([
     fetchProjects().catch(() => [] as Project[]),
     fetchNames(1)
       .then((batch) => batch.names[0])
@@ -399,7 +399,7 @@ async function requestSpawnInDirectory(path: string): Promise<void> {
   const presets = await spawnPresets();
   const known = discovered.find((p) => p.path === path);
   const project: Project = known ?? { path, name: path.split("/").filter(Boolean).pop() ?? path };
-  const resolved = resolveFastForward([project], presets, name, path);
+  const resolved = resolveFastForward([project], presets, handle, path);
   const req = buildFastForwardRequest(resolved);
   if (req) {
     const inRepo =

web/src/multiview.ts

@@ -215,6 +215,20 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
     return fl?.sessionId ?? null;
   }
 
+  /** The session the operator actually picked — what `focusedLeafSession()`
+   *  would return with the preview undone. A preview moves the active tab and
+   *  its focus, but it is a view: the accent stays on the row the operator
+   *  chose until they choose another (docs/PREVIEW.md). */
+  function realFocusedSession(): string | null {
+    const p = preview;
+    if (!p) return focusedLeafSession();
+    const tab = layout.tabs.find((t) => t.id === p.prevActiveTabId) ?? activeTab(layout);
+    const leafId =
+      p.prevFocus && p.prevFocus.tabId === tab.id ? p.prevFocus.leafId : tab.focusedLeafId;
+    const fl = leafId ? findLeaf(tab.root, leafId) : null;
+    return fl?.sessionId ?? null;
+  }
+
   /** Update focus styling + pool focus + sidebar highlights without rebuilding
    *  the DOM (cheap path for click-to-focus). */
   function syncFocus(): void {
@@ -233,7 +247,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
     if (!preview) pool.setFocus(focusedLeafSession());
     sidebar.setHighlights({
       open: realOpenSessions(),
-      focused: focusedLeafSession(),
+      focused: realFocusedSession(),
     });
     // The row the preview came from wears the same colour, so the sidebar and
     // the pane read as one thing rather than two unrelated highlights.
@@ -608,7 +622,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
       { focus: !preview && !quietRender },
     );
     if (!preview) pool.setFocus(focused.sessionId ?? null);
-    sidebar.setHighlights({ open: realOpenSessions(), focused: focused.sessionId ?? null });
+    sidebar.setHighlights({ open: realOpenSessions(), focused: realFocusedSession() });
     sidebar.setPreview(preview?.sessionId ?? null);
   }
 
@@ -817,7 +831,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
     openSessions: realOpenSessions,
     beginSessionDrag,
     render,
-    focusedSessionId: focusedLeafSession,
+    focusedSessionId: realFocusedSession,
     previewSession,
     previewedSessionId: () => preview?.sessionId ?? null,
   };

web/src/preview.test.ts

@@ -47,12 +47,20 @@ function fakePool(): Spy {
 
 /** Last value the controller pushed to `SidebarHandle.setPreview`. */
 const previewRow: { id: string | null } = { id: null };
+/** Last highlights the controller pushed to `SidebarHandle.setHighlights`. */
+const rowHighlights: { open: Set<string>; focused: string | null } = {
+  open: new Set(),
+  focused: null,
+};
 
 function fakeSidebar(): SidebarHandle {
   return {
     el: document.createElement("aside"),
     setActive() {},
-    setHighlights() {},
+    setHighlights(h) {
+      rowHighlights.open = h.open;
+      rowHighlights.focused = h.focused;
+    },
     setPreview(id: string | null) {
       previewRow.id = id;
     },
@@ -95,6 +103,8 @@ describe("sidebar preview", () => {
     stubFetch();
     document.body.replaceChildren();
     previewRow.id = null;
+    rowHighlights.open = new Set();
+    rowHighlights.focused = null;
   });
 
   afterEach(() => {
@@ -134,6 +144,28 @@ describe("sidebar preview", () => {
     expect(mv.el.querySelectorAll(".mv-pane.is-preview")).toHaveLength(0);
   });
 
+  it("leaves the accent on the session the pane actually holds", () => {
+    const layout = twoTabs();
+    const spy = fakePool();
+    const mv = makeMv(layout, spy.pool);
+    expect(rowHighlights.focused).toBe("s2");
+
+    // Walking past other rows never moves the accent off what the operator
+    // picked: only a real open does (docs/PREVIEW.md).
+    mv.previewSession("s1");
+    expect(rowHighlights.focused).toBe("s2");
+    expect(mv.focusedSessionId()).toBe("s2");
+
+    mv.previewSession("s9");
+    expect(rowHighlights.focused).toBe("s2");
+
+    mv.previewSession(null);
+    expect(rowHighlights.focused).toBe("s2");
+
+    mv.openSession("s1");
+    expect(rowHighlights.focused).toBe("s1");
+  });
+
   it("shows a session no pane holds in a throwaway tab that leaves no trace", () => {
     const layout = twoTabs();
     const before = serializeLayout(layout);

web/src/sidebarNav.test.ts

@@ -143,7 +143,7 @@ describe("sidebar keyboard navigation", () => {
     field!.dispatchEvent(new KeyboardEvent("keydown", { key: "Escape", bubbles: true }));
   });
 
-  it("x kills the highlighted session", async () => {
+  it("x kills the highlighted session, once confirmed (#160)", async () => {
     const { el } = twoFolders();
     const killed: string[] = [];
     window.fetch = ((input: RequestInfo | URL, init?: RequestInit) => {
@@ -153,6 +153,8 @@ describe("sidebar keyboard navigation", () => {
 
     press(tree(el), "j");
     press(tree(el), "x");
+    expect(killed.some((r) => r.startsWith("DELETE"))).toBe(false);
+    document.querySelector<HTMLButtonElement>(".kill-dialog-kill")?.click();
     await Promise.resolve();
     expect(killed.some((r) => r.startsWith("DELETE") && r.includes(A))).toBe(true);
   });

web/src/types.ts

@@ -6,7 +6,10 @@ import { escapeHtml } from "./html.js";
 export type Uuid = string;
 export type IsoTimestamp = string;
 
-export type SessionStatus = "Running" | "Dead";
+/** `Dormant` (#162) is a session the daemon knows only from its sidecar —
+ * recovered after the tmux server died under it, so there is no pane behind it
+ * and nothing to attach to. Listed, never live. */
+export type SessionStatus = "Running" | "Dead" | "Dormant";
 
 /** Daemon-inferred activity dimension, orthogonal to `SessionStatus` (NAP-340).
  * Absent on payloads from daemons that predate the field. `Error` is only set