feat(maestro): register dormant sessions on recovery

A host reboot kills the tmux server, so `SessionManager::recover` iterated an
empty list and every session vanished from the API while its sidecar sat
untouched on disk. A second recovery pass now reads the sidecars tmux had
nothing to adopt and registers each as `SessionStatus::Dormant` — a record of
what was running, with no pane and no PTY bridge behind it.

`SessionStatus` deserializes leniently now, like `ActivityState`: an unknown
spelling reads as `Dead` rather than failing the whole `Session`.

Refs #162

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

crates/maestro-cli/src/dispatch.rs

@@ -96,32 +96,20 @@ pub async fn dispatch(
 }
 
 /// `maestro hooks install` (#106): write the shipped hook script under the
-/// user's data dir and register it in every agent's hook file. Idempotent and
-/// foreign-hook-preserving — the guarantees live in [`maestro_hooks`]. One
-/// agent failing is reported and does not stop the others.
+/// user's data dir and register it in their Claude Code settings. Idempotent
+/// and foreign-hook-preserving — the guarantees live in [`maestro_hooks`].
 #[allow(clippy::result_large_err)]
 fn run_hooks_install() -> Result<(), CliError> {
     let home = dirs::home_dir().ok_or(CliError::NoHome)?;
-    let script = maestro_hooks::script_path(&home);
-    for (target, result) in maestro_hooks::install_for_home(&home) {
-        let agent = target.label();
-        let settings = target.settings_path(&home);
-        match result {
-            Ok(true) => {
-                println!(
-                    "installed {agent} activity hook: {} → {}",
-                    script.display(),
-                    settings.display()
-                );
-                if target == maestro_hooks::Target::Codex {
-                    // Codex will not run a hook it has not been told to
-                    // trust, and that approval is the operator's to give.
-                    println!("  codex will ask you to trust this hook the next time it starts");
-                }
-            }
-            Ok(false) => println!("{agent} activity hook already up to date"),
-            Err(e) => eprintln!("{agent} activity hook not installed: {e}"),
-        }
+    let changed = maestro_hooks::install_for_home(&home)?;
+    if changed {
+        println!(
+            "installed claude-code activity hook: {} → {}",
+            maestro_hooks::script_path(&home).display(),
+            maestro_hooks::settings_path(&home).display()
+        );
+    } else {
+        println!("claude-code activity hook already up to date");
     }
     Ok(())
 }

crates/maestro-cli/src/sessions.rs

@@ -188,6 +188,7 @@ fn print_session_table(out: &mut impl Write, sessions: &[Session], info: &Daemon
         let status = match s.status {
             SessionStatus::Running => "running",
             SessionStatus::Dead => "dead",
+            SessionStatus::Dormant => "dormant",
         };
         let activity = match s.activity {
             ActivityState::Active => "active",

crates/maestro-daemon/src/cli.rs

@@ -51,23 +51,17 @@ async fn run(config_override: Option<PathBuf>) -> Result<(), Box<dyn Error>> {
     // First-start hook auto-install (#106). Best-effort, before serving: a
     // session spawned right away should already carry the hook.
     if config.hooks_auto_install {
-        for (target, outcome) in crate::hooks::auto_install(&config.home_dir) {
-            let agent = target.label();
-            match outcome {
-                crate::hooks::AutoInstallOutcome::Installed => {
-                    tracing::info!(agent, "installed activity hook (#106)");
-                }
-                crate::hooks::AutoInstallOutcome::Upgraded => {
-                    tracing::info!(agent, "updated activity hook to this build (#106)");
-                }
-                crate::hooks::AutoInstallOutcome::Failed => {
-                    tracing::warn!(
-                        agent,
-                        "hooks auto-install failed; run `maestro hooks install` manually"
-                    );
-                }
-                _ => {}
+        match crate::hooks::auto_install(&config.home_dir) {
+            crate::hooks::AutoInstallOutcome::Installed => {
+                tracing::info!("installed claude-code activity hook (#106)");
             }
+            crate::hooks::AutoInstallOutcome::Upgraded => {
+                tracing::info!("updated claude-code activity hook to this build (#106)");
+            }
+            crate::hooks::AutoInstallOutcome::Failed => {
+                tracing::warn!("hooks auto-install failed; run `maestro hooks install` manually");
+            }
+            _ => {}
         }
     }
     // No worktree dir to pre-create: without an override the worktrees live

crates/maestro-daemon/src/hooks.rs

@@ -1,53 +1,37 @@
 //! First-start hook auto-install (#106).
 //!
-//! The daemon runs [`auto_install`] once at startup: for every agent maestro
-//! knows how to hook ([`maestro_hooks::Target`]), unless that agent's hook
-//! file already carries exactly what this build ships (and `[hooks]
-//! .auto_install` hasn't opted out — checked by the caller), the same
-//! installer `maestro hooks install` uses writes it. That covers upgrades as
-//! well as first starts: an install from a maestro that had fewer events —
-//! #131 added `UserPromptSubmit` to a hook #106 had already put in everyone's
-//! settings — is rewritten rather than left half-wired. Best-effort: a
-//! failure is warned about and never blocks startup, and one target failing
-//! does not stop the others. The same global hook serves every session on the
-//! machine, so nothing here targets repositories or worktrees.
+//! The daemon runs [`auto_install`] once at startup: unless the user's
+//! `~/.claude/settings.json` already carries exactly what this build ships
+//! (and `[hooks].auto_install` hasn't opted out — checked by the caller), the
+//! same installer `maestro hooks install` uses writes it. That covers
+//! upgrades as well as first starts: an install from a maestro that had fewer
+//! events — #131 added `UserPromptSubmit` to a hook #106 had already put in
+//! everyone's settings — is rewritten rather than left half-wired. Best-effort:
+//! a failure is warned about and never blocks startup. The same global hook
+//! serves every Claude Code session on the machine, so nothing here targets
+//! repositories or worktrees.
 
 use std::path::Path;
 
-use maestro_hooks::Target;
-
-/// Install the activity hook for every [`Target`] under `home_dir`, skipping
-/// any whose install is already current. Returns what happened per target —
-/// an older install being brought up to date is
-/// [`AutoInstallOutcome::Upgraded`], so the log can say so. An unresolvable
-/// home dir (`""`) reports every target as [`AutoInstallOutcome::Skipped`].
-pub fn auto_install(home_dir: &str) -> Vec<(Target, AutoInstallOutcome)> {
-    Target::ALL
-        .iter()
-        .map(|&target| (target, auto_install_target(target, home_dir)))
-        .collect()
-}
-
-fn auto_install_target(target: Target, home_dir: &str) -> AutoInstallOutcome {
+/// Install the Claude Code activity hook for `home_dir` unless the current
+/// one is already there or the home dir is unresolvable (`""`). Returns what
+/// happened; an older install being brought up to date is
+/// [`AutoInstallOutcome::Upgraded`], so the log can say so.
+pub fn auto_install(home_dir: &str) -> AutoInstallOutcome {
     if home_dir.is_empty() {
         return AutoInstallOutcome::Skipped;
     }
-    let home = Path::new(home_dir);
-    let settings = target.settings_path(home);
-    let script = maestro_hooks::script_path(home);
-    if maestro_hooks::is_current(target, &settings, &script) {
+    let settings = maestro_hooks::settings_path(Path::new(home_dir));
+    let script = maestro_hooks::script_path(Path::new(home_dir));
+    if maestro_hooks::is_current(&settings, &script) {
         return AutoInstallOutcome::AlreadyPresent;
     }
     let stale = maestro_hooks::is_installed(&settings);
-    match maestro_hooks::install_target(target, home) {
+    match maestro_hooks::install_for_home(Path::new(home_dir)) {
         Ok(_) if stale => AutoInstallOutcome::Upgraded,
         Ok(_) => AutoInstallOutcome::Installed,
         Err(e) => {
-            tracing::warn!(
-                target = target.label(),
-                error = %e,
-                "hooks auto-install failed (non-fatal)"
-            );
+            tracing::warn!(error = %e, "hooks auto-install failed (non-fatal)");
             AutoInstallOutcome::Failed
         }
     }
@@ -68,50 +52,15 @@ pub enum AutoInstallOutcome {
 mod tests {
     use super::*;
 
-    /// The outcome recorded for one target.
-    fn outcome(outcomes: &[(Target, AutoInstallOutcome)], target: Target) -> AutoInstallOutcome {
-        outcomes
-            .iter()
-            .find(|(t, _)| *t == target)
-            .map(|(_, o)| *o)
-            .expect("every target is reported")
-    }
-
     /// Everything happens under a temp `$HOME`; the developer's own
-    /// `~/.claude/settings.json` and `~/.codex/hooks.json` are never read or
-    /// written.
+    /// `~/.claude/settings.json` is never read or written.
     #[test]
     fn installs_when_settings_carry_no_maestro_hook() {
         let dir = tempfile::tempdir().unwrap();
-        let outcomes = auto_install(dir.path().to_str().unwrap());
-        for target in Target::ALL {
-            assert_eq!(
-                outcome(&outcomes, target),
-                AutoInstallOutcome::Installed,
-                "{}",
-                target.label()
-            );
-            assert!(maestro_hooks::is_installed(
-                &target.settings_path(dir.path())
-            ));
-        }
-    }
-
-    /// Every agent maestro knows about is hooked, not just Claude Code: a
-    /// codex session reports activity and its first prompt the same way.
-    #[test]
-    fn codex_gets_its_own_hook_file() {
-        let dir = tempfile::tempdir().unwrap();
-        auto_install(dir.path().to_str().unwrap());
-        let hooks = dir.path().join(".codex/hooks.json");
-        let root: serde_json::Value =
-            serde_json::from_str(&std::fs::read_to_string(&hooks).unwrap()).unwrap();
-        let events = root["hooks"].as_object().unwrap();
-        assert!(events.contains_key("PermissionRequest"));
-        assert!(
-            !events.contains_key("Notification"),
-            "codex has no Notification"
-        );
+        let outcome = auto_install(dir.path().to_str().unwrap());
+        assert_eq!(outcome, AutoInstallOutcome::Installed);
+        let settings = dir.path().join(".claude/settings.json");
+        assert!(maestro_hooks::is_installed(&settings));
     }
 
     #[test]
@@ -120,22 +69,14 @@ mod tests {
         let home = dir.path().to_str().unwrap();
         auto_install(home);
         // A current install is left exactly as it is.
-        let before: Vec<String> = Target::ALL
-            .iter()
-            .map(|t| std::fs::read_to_string(t.settings_path(dir.path())).unwrap())
-            .collect();
-        let outcomes = auto_install(home);
-        for (i, target) in Target::ALL.iter().enumerate() {
-            assert_eq!(
-                outcome(&outcomes, *target),
-                AutoInstallOutcome::AlreadyPresent
-            );
-            assert_eq!(
-                before[i],
-                std::fs::read_to_string(target.settings_path(dir.path())).unwrap(),
-                "already-installed settings must not be rewritten"
-            );
-        }
+        let settings = dir.path().join(".claude/settings.json");
+        let before = std::fs::read_to_string(&settings).unwrap();
+        assert_eq!(auto_install(home), AutoInstallOutcome::AlreadyPresent);
+        assert_eq!(
+            before,
+            std::fs::read_to_string(&settings).unwrap(),
+            "already-installed settings must not be rewritten"
+        );
     }
 
     /// An install from an older maestro — present, but missing an event this
@@ -146,7 +87,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let home = dir.path().to_str().unwrap();
         auto_install(home);
-        let settings = Target::ClaudeCode.settings_path(dir.path());
+        let settings = dir.path().join(".claude/settings.json");
         let script = maestro_hooks::script_path(dir.path());
 
         let mut root: serde_json::Value =
@@ -155,23 +96,12 @@ mod tests {
         std::fs::write(&settings, serde_json::to_string_pretty(&root).unwrap()).unwrap();
         std::fs::write(&script, "#!/bin/sh\nexit 0\n").unwrap();
 
-        let outcomes = auto_install(home);
-        assert_eq!(
-            outcome(&outcomes, Target::ClaudeCode),
-            AutoInstallOutcome::Upgraded
-        );
-        assert!(maestro_hooks::is_current(
-            Target::ClaudeCode,
-            &settings,
-            &script
-        ));
+        assert_eq!(auto_install(home), AutoInstallOutcome::Upgraded);
+        assert!(maestro_hooks::is_current(&settings, &script));
     }
 
     #[test]
     fn unresolvable_home_is_skipped() {
-        let outcomes = auto_install("");
-        for target in Target::ALL {
-            assert_eq!(outcome(&outcomes, target), AutoInstallOutcome::Skipped);
-        }
+        assert_eq!(auto_install(""), AutoInstallOutcome::Skipped);
     }
 }

crates/maestro-daemon/src/session.rs

@@ -62,7 +62,10 @@ pub struct SessionRecord {
     /// `base_repo` from the original `WorktreeSpec`. Needed because `git
     /// worktree remove` is invoked from the base repo.
     pub worktree_base_repo: Option<PathBuf>,
-    pub bridge: PtyBridge,
+    /// The PTY bridge feeding this session's attach stream. `None` for a
+    /// `Dormant` session (#162): there is no pane behind it, so there is
+    /// nothing to pipe and nothing to attach to.
+    pub bridge: Option<PtyBridge>,
     /// Agent-reported activity (#105) still within its TTL. While in force it
     /// outranks the activity pass's own inference; when it lapses, inference
     /// resumes and [`Session::activity_detail`] is cleared with it. This
@@ -291,7 +294,10 @@ impl SessionManager {
     /// unknown to this daemon.
     pub async fn subscribe_pty(&self, id: Uuid) -> Option<broadcast::Receiver<Vec<u8>>> {
         let sessions = self.inner.sessions.lock().await;
-        sessions.get(&id).map(|r| r.bridge.subscribe())
+        sessions
+            .get(&id)
+            .and_then(|r| r.bridge.as_ref())
+            .map(|b| b.subscribe())
     }
 
     /// Subscribe to a session's PTY broadcast and return the replay buffer
@@ -310,19 +316,26 @@ impl SessionManager {
         let (result, updated) = {
             let mut sessions = self.inner.sessions.lock().await;
             let rec = sessions.get_mut(&id)?;
-            rec.session.last_focused_at = Some(Utc::now());
-            let updated = rec.session.clone();
+            let SessionRecord {
+                session, bridge, ..
+            } = &mut *rec;
+            // #162: a dormant session has no bridge and no pane — nothing was
+            // ever piped for it, so there is no stream to hand back and the
+            // attach reads as unknown. Checked before anything is stamped.
+            let bridge = bridge.as_ref()?;
+            session.last_focused_at = Some(Utc::now());
+            let updated = session.clone();
             // For a live session, tmux's own screen beats the byte tail: the
             // tail starts mid-stream, so a full-screen program (an agent TUI)
             // replayed from it renders as garbage until something forces a
             // repaint. A dead session has no pane left to capture, so it
             // keeps the byte tail.
-            let alive = rec.session.status == SessionStatus::Running;
+            let alive = session.status == SessionStatus::Running;
             // The capture shells out to tmux while the replay lock is held,
             // which parks the reader for the length of one tmux round-trip.
             // That only happens on attach, and the alternative is a seam in
             // the stream.
-            let result = rec.bridge.subscribe_with_snapshot(|| {
+            let result = bridge.subscribe_with_snapshot(|| {
                 if !alive {
                     return None;
                 }
@@ -499,7 +512,7 @@ impl SessionManager {
                     fifo_path,
                     worktree_path,
                     worktree_base_repo,
-                    bridge,
+                    bridge: Some(bridge),
                     reported_activity: None,
                     settled: false,
                     #[cfg(feature = "haiku-autoname")]
@@ -707,7 +720,7 @@ impl SessionManager {
                     // directory blocks that branch forever (#54 review).
                     worktree_path: session.worktree.as_ref().map(|w| w.path.clone()),
                     worktree_base_repo: session.worktree.as_ref().map(|w| w.base_repo.clone()),
-                    bridge,
+                    bridge: Some(bridge),
                     reported_activity: None,
                     settled: false,
                     #[cfg(feature = "haiku-autoname")]
@@ -722,16 +735,89 @@ impl SessionManager {
                 .send(CatalogEvent::SessionAdded { session });
             adopted += 1;
         }
+        self.register_dormant().await;
         Ok(adopted)
     }
 
-    /// Forward keystrokes to a session's pane. A dead session is read-only —
-    /// its pane is gone, so this is a no-op rather than a tmux failure the
-    /// client would have to interpret.
+    /// Second recovery pass (#162): register every sidecar tmux had nothing to
+    /// adopt as a [`SessionStatus::Dormant`] session.
+    ///
+    /// A host reboot kills the tmux server, so the first pass runs over an
+    /// empty list and every session would otherwise disappear from the API
+    /// while its sidecar sat untouched on disk. A dormant record keeps the id,
+    /// name, cwd, command, worktree and `created_at` — everything the sidecar
+    /// holds — so the operator still has a record of what was running. It has
+    /// no tmux session and no [`PtyBridge`] behind it: it cannot be attached
+    /// to, cannot be typed into, and is skipped by both watcher passes. The
+    /// only thing left to do with one is dismiss it, which removes the sidecar
+    /// so the next recovery does not bring it back.
+    ///
+    /// Activity is not carried over: whatever the session was doing, it is not
+    /// doing it now. The rest of the sidecar is left as written.
+    async fn register_dormant(&self) {
+        let stored = match self.inner.sidecar.load_all() {
+            Ok(stored) => stored,
+            Err(e) => {
+                tracing::warn!(error = ?e, "recover: reading sidecars for dormant sessions failed");
+                return;
+            }
+        };
+        let mut registered = Vec::new();
+        {
+            let mut sessions = self.inner.sessions.lock().await;
+            for mut session in stored {
+                if sessions.contains_key(&session.id) {
+                    // Adopted live by the first pass; its sidecar is on disk too.
+                    continue;
+                }
+                let id = session.id;
+                session.status = SessionStatus::Dormant;
+                session.foreground = None;
+                session.activity = ActivityState::Idle;
+                session.activity_detail = None;
+                sessions.insert(
+                    id,
+                    SessionRecord {
+                        session: session.clone(),
+                        fifo_path: self.inner.fifo_dir.join(format!("{id}.fifo")),
+                        // Still known, so a dismissal cleans the worktree up —
+                        // the same reason recovery restores it for a live
+                        // session (#54 review).
+                        worktree_path: session.worktree.as_ref().map(|w| w.path.clone()),
+                        worktree_base_repo: session.worktree.as_ref().map(|w| w.base_repo.clone()),
+                        bridge: None,
+                        reported_activity: None,
+                        settled: false,
+                        #[cfg(feature = "haiku-autoname")]
+                        naming: false,
+                        focused_since: None,
+                        awaiting_suppressed: false,
+                    },
+                );
+                registered.push(session);
+            }
+        }
+        if !registered.is_empty() {
+            tracing::info!(
+                dormant = registered.len(),
+                "registered sessions with no live tmux as dormant"
+            );
+        }
+        for session in registered {
+            let _ = self
+                .inner
+                .events
+                .send(CatalogEvent::SessionAdded { session });
+        }
+    }
+
+    /// Forward keystrokes to a session's pane. A dead or dormant session is
+    /// read-only — its pane is gone, so this is a no-op rather than a tmux
+    /// failure the client would have to interpret.
     pub async fn send_keys(&self, id: Uuid, bytes: &[u8]) -> Result<(), SessionError> {
         match self.status(id).await {
             None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead) => return Ok(()),
+            Some(SessionStatus::Dead | SessionStatus::Dormant) => return Ok(()),
             Some(SessionStatus::Running) => {}
         }
         let tmux = self.inner.tmux.clone();
@@ -744,13 +830,15 @@ impl SessionManager {
     /// Type `text` into a session's pane, with an Enter after it when
     /// `submit` is set.
     ///
-    /// Unlike [`Self::send_keys`], a dead session is an error: the caller
-    /// asked for text to land somewhere, and a silent success would let a
-    /// script believe an agent had been told something it never heard.
+    /// Unlike [`Self::send_keys`], a dead or dormant session is an error: the
+    /// caller asked for text to land somewhere, and a silent success would let
+    /// a script believe an agent had been told something it never heard.
     pub async fn send_input(&self, id: Uuid, text: &str, submit: bool) -> Result<(), SessionError> {
         match self.status(id).await {
             None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead) => return Err(SessionError::NotRunning(id)),
+            Some(SessionStatus::Dead | SessionStatus::Dormant) => {
+                return Err(SessionError::NotRunning(id))
+            }
             Some(SessionStatus::Running) => {}
         }
         let tmux = self.inner.tmux.clone();
@@ -768,12 +856,12 @@ impl SessionManager {
         Ok(())
     }
 
-    /// Resize a session's window. No-op for a dead session, as with
+    /// Resize a session's window. No-op for a dead or dormant session, as with
     /// [`Self::send_keys`].
     pub async fn resize(&self, id: Uuid, cols: u16, rows: u16) -> Result<(), SessionError> {
         match self.status(id).await {
             None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead) => return Ok(()),
+            Some(SessionStatus::Dead | SessionStatus::Dormant) => return Ok(()),
             Some(SessionStatus::Running) => {}
         }
         let tmux = self.inner.tmux.clone();
@@ -1174,7 +1262,11 @@ async fn run_activity_pass(inner: &Arc<Inner>) {
                     rec.session.activity_detail = None;
                 }
             }
-            let idle = rec.bridge.idle_for();
+            // Only `Running` sessions reach this pass, and every one of them
+            // has a bridge; a dormant session has neither pane nor bridge.
+            let Some(idle) = rec.bridge.as_ref().map(|b| b.idle_for()) else {
+                continue;
+            };
             // #105: while a report is in force it supplies the state and
             // nothing here may overwrite it; only an unreported session is
             // decided by inference.
@@ -1292,8 +1384,10 @@ async fn run_blocked_work_pass(inner: &Arc<Inner>) {
 /// alone and stays attached to the dead record for a later forced dismissal
 /// (#81), which leaves it on disk too.
 ///
-/// Dead sessions do not survive a daemon restart: [`SessionManager::recover`]
-/// adopts only what tmux still holds.
+/// A dead session does not come back as dead across a daemon restart: its
+/// sidecar survives, so [`SessionManager::recover`]'s second pass registers it
+/// as [`SessionStatus::Dormant`] (#162) — accurate either way, since neither
+/// has a pane behind it.
 async fn mark_session_dead(inner: &Arc<Inner>, id: Uuid) {
     let flipped = {
         let mut sessions = inner.sessions.lock().await;
@@ -1302,7 +1396,9 @@ async fn mark_session_dead(inner: &Arc<Inner>, id: Uuid) {
                 record.session.status = SessionStatus::Dead;
                 // Release anyone attached; the scrollback survives for a later
                 // attach.
-                record.bridge.seal();
+                if let Some(bridge) = record.bridge.as_mut() {
+                    bridge.seal();
+                }
                 let session = record.session.clone();
                 let worktree = record
                     .worktree_base_repo

crates/maestro-daemon/tests/session_manager.rs

@@ -140,6 +140,140 @@ async fn recover_adopts_existing_tmux_sessions() {
     assert_eq!(snap[0].command, "sleep 30");
 }
 
+/// #162: a host reboot kills the tmux server, so recovery finds nothing to
+/// adopt while every sidecar is still on disk. Those sessions come back as
+/// `Dormant` — a record of what was running — rather than vanishing from the
+/// API and leaving the operator with nothing.
+#[tokio::test]
+async fn recover_registers_orphaned_sidecars_as_dormant() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let mut metadata = HashMap::new();
+    metadata.insert(
+        maestro_protocol::NAME_KEY.to_string(),
+        serde_json::Value::String("after-reboot".into()),
+    );
+
+    let s = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata,
+            worktree: None,
+        })
+        .await
+        .expect("create");
+
+    // The reboot: the tmux server is gone, the sidecar is untouched.
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+
+    let revived = revive(&fx);
+    let adopted = revived.recover().await.expect("recover");
+    assert_eq!(adopted, 0, "no live tmux session left to adopt");
+
+    let snap = revived.snapshot().await;
+    assert_eq!(snap.len(), 1, "the sidecar's session is still listed");
+    assert_eq!(snap[0].id, s.id);
+    assert_eq!(snap[0].status, SessionStatus::Dormant);
+    assert_eq!(snap[0].command, "sleep 30");
+    assert_eq!(snap[0].cwd, s.cwd);
+    assert_eq!(snap[0].created_at, s.created_at);
+    assert_eq!(
+        snap[0]
+            .metadata
+            .get(maestro_protocol::NAME_KEY)
+            .and_then(|v| v.as_str()),
+        Some("after-reboot"),
+    );
+}
+
+/// #162: a session tmux still holds is adopted `Running` by the first pass and
+/// must not be re-registered as dormant by the second — the sidecar is on disk
+/// for both.
+#[tokio::test]
+async fn recover_does_not_mark_adopted_sessions_dormant() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+
+    let live = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create live");
+    let orphan = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 31".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create orphan");
+    // Only the second session loses its pane.
+    fx.tmux.tmux.kill_session(orphan.id).expect("kill session");
+
+    let revived = revive(&fx);
+    assert_eq!(revived.recover().await.expect("recover"), 1);
+
+    let mut snap = revived.snapshot().await;
+    snap.sort_by_key(|s| s.command.clone());
+    assert_eq!(snap.len(), 2);
+    assert_eq!(snap[0].id, live.id);
+    assert_eq!(snap[0].status, SessionStatus::Running);
+    assert_eq!(snap[1].id, orphan.id);
+    assert_eq!(snap[1].status, SessionStatus::Dormant);
+}
+
+/// #162: dismissing a dormant session is the one thing that can be done to it
+/// — no tmux call to fail, and the sidecar goes with it so the next recovery
+/// does not resurrect it.
+#[tokio::test]
+async fn dormant_session_can_be_dismissed() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+
+    let s = fx
+        .manager
+        .create(CreateSessionRequest {
+            cwd: cwd.path().to_path_buf(),
+            command: "sleep 30".into(),
+            env: HashMap::new(),
+            metadata: HashMap::new(),
+            worktree: None,
+        })
+        .await
+        .expect("create");
+    fx.tmux.tmux.kill_server().expect("kill tmux server");
+
+    let revived = revive(&fx);
+    revived.recover().await.expect("recover");
+    revived.kill(s.id, false).await.expect("dismiss");
+
+    assert!(!revived.has(s.id).await);
+    assert!(!fx.sidecar_dir().join(format!("{}.json", s.id)).exists());
+}
+
+/// A second `SessionManager` over the same dirs and the same tmux server —
+/// what a daemon restart looks like from inside a test.
+fn revive(fx: &DaemonFixture) -> maestro_daemon::SessionManager {
+    maestro_daemon::SessionManager::new(
+        Arc::new(fx.tmux.tmux.clone()),
+        maestro_daemon::sidecar::SidecarStore::new(fx.sidecar_dir()),
+        maestro_daemon::worktree::WorktreeManager::new(None),
+        fx.fifo_dir(),
+    )
+}
+
 /// Regression for NAP-253: the very first bytes a freshly-spawned command
 /// writes must reach the replay buffer. Before the fix, `pipe-pane` was a
 /// separate tmux invocation that ran after `new-session` + an async FIFO

crates/maestro-hooks/src/lib.rs

@@ -1,4 +1,4 @@
-//! Agent activity hook (#106).
+//! Claude Code activity hook (#106).
 //!
 //! Two halves, both shared by the `maestro hooks install` CLI subcommand and
 //! the daemon's first-start auto-install:
@@ -6,40 +6,28 @@
 //! * [`HOOK_SCRIPT`] — the hook itself, written to disk at install time. It
 //!   posts an [`ActivityState`](maestro-protocol) to
 //!   `$MAESTRO_URL/api/sessions/$MAESTRO_SESSION_ID/activity` (#105). The same
-//!   global hook runs in every agent session on the machine, so it exits
+//!   global hook runs in every Claude Code session on the machine, so it exits
 //!   0 and silently when either #103 env var is unset, and it never lets a
 //!   daemon failure escape (short curl timeout, status ignored).
-//! * [`install`] — idempotent registration of that script in one [`Target`]'s
-//!   hook file. Only entries maestro itself wrote (identified by
-//!   [`HOOK_MARKER`]) are touched; every other hook and every other field in
-//!   the file is preserved verbatim.
-//!
-//! One script serves every [`Target`]: Claude Code and Codex read the same
-//! `{"hooks": {Event: [{"hooks": [{"type": "command", "command": …}]}]}}`
-//! shape and hand the hook the same JSON on stdin. Only the file's location
-//! and the event set differ.
+//! * [`install`] — idempotent registration of that script in
+//!   `~/.claude/settings.json`. Only entries maestro itself wrote (identified
+//!   by [`HOOK_MARKER`]) are touched; every other hook and every other field
+//!   in the file is preserved verbatim.
 
 use std::path::Path;
 
 /// Marker substring every maestro-installed hook command carries. The
 /// installer rewrites or removes exactly these entries — nothing else in the
 /// user's settings file.
-///
-/// It still says `claude` although the script now serves every [`Target`]:
-/// the marker is how an install from an older maestro is recognised, and
-/// renaming it would orphan every entry already on disk.
 pub const HOOK_MARKER: &str = "maestro-claude-hook";
 
-/// File name of the installed script (carries [`HOOK_MARKER`]). One script
-/// for every [`Target`] — see the note on [`HOOK_MARKER`] for the name.
+/// File name of the installed script (carries [`HOOK_MARKER`]).
 pub const SCRIPT_FILE_NAME: &str = "maestro-claude-hook.sh";
 
-/// Hook events installed only with the `haiku-autoname` feature (#131), for
-/// every [`Target`] — Claude Code and Codex both spell the event
-/// `UserPromptSubmit` and both put the submitted text in the payload's
-/// `prompt`. The script forwards the whole payload to
-/// `/api/sessions/:id/prompt`, which names a still-provisionally-named
-/// session after its first one.
+/// Hook events installed only with the `haiku-autoname` feature (#131).
+/// `UserPromptSubmit` carries the prompt the user just submitted; the script
+/// forwards the whole payload to `/api/sessions/:id/prompt`, which names a
+/// still-provisionally-named session after its first one.
 #[cfg(feature = "haiku-autoname")]
 pub const PROMPT_EVENTS: [(&str, &str); 1] = [("UserPromptSubmit", "Prompt")];
 
@@ -55,7 +43,7 @@ pub const PROMPT_EVENTS: [(&str, &str); 0] = [];
 /// Claude Code's own name for "the turn ended on an API error"; there is no
 /// failure signal in `Stop` or `SessionEnd` payloads, so those never report
 /// `Error`.
-pub const CLAUDE_EVENTS: [(&str, &str); 5] = [
+pub const HOOK_EVENTS: [(&str, &str); 5] = [
     // Tool starting: the agent is demonstrably producing work, even if the
     // tool itself runs for minutes.
     ("PreToolUse", "Active"),
@@ -70,86 +58,17 @@ pub const CLAUDE_EVENTS: [(&str, &str); 5] = [
     ("StopFailure", "Error"),
 ];
 
-/// Codex hook event → `ActivityState` spelling posted to the daemon.
-///
-/// Codex's event set is close to Claude Code's but not identical: a pending
-/// approval arrives as `PermissionRequest` rather than `Notification`, and
-/// there is no `StopFailure`, so a codex session never reports `Error`.
-pub const CODEX_EVENTS: [(&str, &str); 4] = [
-    ("PreToolUse", "Active"),
-    ("PostToolUse", "Active"),
-    // Codex is blocked on the operator approving a tool call.
-    ("PermissionRequest", "AwaitingInput"),
-    ("Stop", "AwaitingInput"),
-];
-
-/// An agent whose hook file maestro writes into.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Target {
-    /// `~/.claude/settings.json`.
-    ClaudeCode,
-    /// `~/.codex/hooks.json`. Codex asks the operator to trust a hook it has
-    /// not seen before, so an install here does nothing until they approve it
-    /// once inside codex — maestro never writes that approval itself.
-    Codex,
-}
-
-impl Target {
-    /// Every target an install covers. Both files are written whether or not
-    /// the agent is on the machine: an unused hook file costs nothing, and
-    /// the alternative is a session spawned after the daemon started missing
-    /// the hook because its agent arrived later.
-    pub const ALL: [Target; 2] = [Target::ClaudeCode, Target::Codex];
-
-    /// How the target is named in logs and CLI output.
-    pub fn label(self) -> &'static str {
-        match self {
-            Target::ClaudeCode => "claude-code",
-            Target::Codex => "codex",
-        }
-    }
-
-    /// The file this target's hook entries are registered in, under `home`.
-    pub fn settings_path(self, home: &Path) -> std::path::PathBuf {
-        match self {
-            Target::ClaudeCode => home.join(".claude/settings.json"),
-            Target::Codex => home.join(".codex/hooks.json"),
-        }
-    }
-
-    /// The activity events this target emits.
-    pub fn activity_events(self) -> &'static [(&'static str, &'static str)] {
-        match self {
-            Target::ClaudeCode => &CLAUDE_EVENTS,
-            Target::Codex => &CODEX_EVENTS,
-        }
-    }
-
-    /// Every event installed for this target: its activity events plus, with
-    /// `haiku-autoname` on, the prompt event both agents spell the same way.
-    pub fn events(self) -> impl Iterator<Item = (&'static str, &'static str)> {
-        self.activity_events()
-            .iter()
-            .chain(PROMPT_EVENTS.iter())
-            .copied()
-    }
-}
-
 /// The shipped hook script. POSIX sh so any `/bin/sh` works.
 pub const HOOK_SCRIPT: &str = r#"#!/bin/sh
-# Installed by maestro (#106): report agent activity to its daemon.
-# One script for every agent maestro installs hooks into; the state to post
-# is chosen by the caller, so the two event sets differ only in what is
-# registered where. Exits silently unless running inside a session maestro
-# spawned (#103 env).
+# Installed by maestro (#106): report Claude Code activity to its daemon.
+# Exits silently unless running inside a session maestro spawned (#103 env).
 # Event -> ActivityState mapping:
-#   PreToolUse         -> Active         (tool started; agent is working)
-#   PostToolUse        -> Active         (tool finished)
-#   Notification       -> AwaitingInput  (claude code: permission / idle)
-#   PermissionRequest  -> AwaitingInput  (codex: waiting on an approval)
-#   Stop               -> AwaitingInput  (turn ended; waiting on the user)
-#   StopFailure        -> Error          (claude code: turn ended on an error)
-#   Prompt             -> the payload is forwarded to the prompt route (#131)
+#   PreToolUse    -> Active         (tool started; agent is working)
+#   PostToolUse   -> Active         (tool finished)
+#   Notification  -> AwaitingInput  (permission / idle notice)
+#   Stop          -> AwaitingInput  (turn ended; waiting on the user)
+#   StopFailure   -> Error          (turn ended on an API error)
+#   Prompt        -> the payload is forwarded to the prompt route (#131)
 state="$1"
 [ -n "$MAESTRO_SESSION_ID" ] || exit 0
 [ -n "$MAESTRO_URL" ] || exit 0
@@ -196,29 +115,34 @@ pub fn script_path(home: &Path) -> std::path::PathBuf {
     home.join(".local/share/maestro").join(SCRIPT_FILE_NAME)
 }
 
-/// Whether the file at `settings_path` already carries a maestro hook
-/// (#106). Presence only: an install from an older release answers `true`
-/// even when it is missing events this build ships — see [`is_current`].
+/// The user-level Claude Code settings file for a given home directory.
+pub fn settings_path(home: &Path) -> std::path::PathBuf {
+    home.join(".claude/settings.json")
+}
+
+/// Whether `settings_path` already carries a maestro hook (#106). Presence
+/// only: an install from an older release answers `true` even when it is
+/// missing events this build ships — see [`is_current`].
 pub fn is_installed(settings_path: &Path) -> bool {
     settings_json(settings_path)
         .map(|root| find_maestro_commands(&root).next().is_some())
         .unwrap_or(false)
 }
 
-/// Whether what is on disk is what this build ships for `target`: the script
-/// at `script_path` byte-for-byte, and exactly one settings entry per one of
-/// the target's [`Target::events`], pointing at that script.
+/// Whether what is on disk is what this build ships: the script at
+/// `script_path` byte-for-byte, and exactly one settings entry per event in
+/// [`HOOK_EVENTS`] and [`PROMPT_EVENTS`], pointing at that script.
 ///
-/// This is the upgrade question, asked per [`Target`]. A maestro that gains
-/// an event — #131 added `UserPromptSubmit` long after #106 had installed
-/// itself — leaves every existing user with a present but incomplete
-/// install, which [`is_installed`] cannot tell apart from a current one.
-pub fn is_current(target: Target, settings_path: &Path, script_path: &Path) -> bool {
+/// This is the upgrade question. A maestro that gains an event — #131 added
+/// `UserPromptSubmit` long after #106 had installed itself — leaves every
+/// existing user with a present but incomplete install, which
+/// [`is_installed`] cannot tell apart from a current one.
+pub fn is_current(settings_path: &Path, script_path: &Path) -> bool {
     if std::fs::read_to_string(script_path).ok().as_deref() != Some(HOOK_SCRIPT) {
         return false;
     }
     settings_json(settings_path)
-        .map(|root| maestro_entries(&root) == expected_entries(target, script_path))
+        .map(|root| maestro_entries(&root) == expected_entries(script_path))
         .unwrap_or(false)
 }
 
@@ -249,13 +173,14 @@ fn maestro_entries(root: &serde_json::Value) -> Vec<(String, String)> {
     found
 }
 
-/// What [`install`] writes for `target` and `script_path`, in the same shape.
-fn expected_entries(target: Target, script_path: &Path) -> Vec<(String, String)> {
-    let mut want: Vec<(String, String)> = target
-        .events()
+/// What [`install`] writes for `script_path`, in the same shape.
+fn expected_entries(script_path: &Path) -> Vec<(String, String)> {
+    let mut want: Vec<(String, String)> = HOOK_EVENTS
+        .iter()
+        .chain(PROMPT_EVENTS.iter())
         .map(|(event, state)| {
             (
-                event.to_string(),
+                (*event).to_string(),
                 format!("{} {state}", script_path.display()),
             )
         })
@@ -282,40 +207,28 @@ pub fn write_script(path: &Path) -> Result<(), HooksError> {
     Ok(())
 }
 
-/// Install the full hook setup for one target under `home`: write the script
-/// under `.local/share/maestro/` and register it in the target's hook file.
+/// Install the full hook setup for `home`: write the script under
+/// `.local/share/maestro/` and register it in `.claude/settings.json`.
 /// Idempotent; returns whether anything changed on disk.
-pub fn install_target(target: Target, home: &Path) -> Result<bool, HooksError> {
+pub fn install_for_home(home: &Path) -> Result<bool, HooksError> {
     let script = script_path(home);
-    let settings = target.settings_path(home);
+    let settings = settings_path(home);
     // A script left over from an older release counts as a change even when
     // the settings entries pointing at it are already right.
-    let changed = !is_current(target, &settings, &script);
+    let changed = !is_current(&settings, &script);
     write_script(&script)?;
-    install(target, &settings, &script)?;
+    install(&settings, &script)?;
     Ok(changed)
 }
 
-/// Install for every [`Target::ALL`], reporting each one separately. One
-/// target failing — an unwritable file, unparseable JSON — never stops the
-/// others: an agent whose hook could not be written is one agent without
-/// activity reporting, not a failed install.
-pub fn install_for_home(home: &Path) -> Vec<(Target, Result<bool, HooksError>)> {
-    Target::ALL
-        .iter()
-        .map(|&target| (target, install_target(target, home)))
-        .collect()
-}
-
-/// Register the hook command for every one of `target`'s [`Target::events`]
-/// in the settings file at `settings_path`. Idempotent: existing maestro
-/// entries are updated in place wherever they sit, stale ones removed,
-/// duplicates folded; every non-maestro entry and every unrelated top-level
-/// field survives.
+/// Register the hook command for every event in [`HOOK_EVENTS`] in the
+/// settings file at `settings_path`. Idempotent: existing maestro entries are
+/// updated in place wherever they sit, stale ones removed, duplicates folded;
+/// every non-maestro entry and every unrelated top-level field survives.
 ///
 /// Never inspects or writes anywhere but `settings_path` — callers pass the
 /// user's real home or a temp one in tests, never a repository.
-pub fn install(target: Target, settings_path: &Path, script_path: &Path) -> Result<(), HooksError> {
+pub fn install(settings_path: &Path, script_path: &Path) -> Result<(), HooksError> {
     let mut root = settings_json(settings_path)?;
 
     // Strip every maestro entry wherever it currently sits, so an older
@@ -323,7 +236,7 @@ pub fn install(target: Target, settings_path: &Path, script_path: &Path) -> Resu
     strip_maestro_entries(&mut root);
 
     let hooks = ensure_object(&mut root, "hooks");
-    for (event, state) in target.events() {
+    for (event, state) in HOOK_EVENTS.iter().chain(PROMPT_EVENTS.iter()).copied() {
         let groups = ensure_array(hooks, event);
         let mut group = serde_json::Map::new();
         group.insert(

crates/maestro-hooks/src/tests.rs

@@ -1,24 +1,15 @@
 //! Tests for the shipped hook script (run as a real `/bin/sh` subprocess)
 //! and the settings-file installer. Everything happens under a temp `$HOME`;
-//! the developer's own `~/.claude/settings.json` and `~/.codex/hooks.json`
-//! are never touched.
+//! the developer's own `~/.claude/settings.json` is never touched.
 
 use std::io::{Read, Write};
 use std::process::{Command, Stdio};
 
 use super::*;
 
-/// How many commands one install writes for a target: its activity events,
-/// plus the prompt event when `haiku-autoname` is on (#131).
-fn installed_events(target: Target) -> usize {
-    target.events().count()
-}
-
-/// The Claude Code hook file under a temp home. Most installer tests only
-/// need one target, and this is the one they were written against.
-fn settings_path(home: &Path) -> std::path::PathBuf {
-    Target::ClaudeCode.settings_path(home)
-}
+/// How many commands one install writes: every activity event, plus the
+/// prompt event when `haiku-autoname` is on (#131).
+const INSTALLED_EVENTS: usize = HOOK_EVENTS.len() + PROMPT_EVENTS.len();
 
 fn sh(script: &str, args: &[&str], envs: &[(&str, &str)], payload: &[u8]) -> std::process::Output {
     let mut cmd = Command::new("/bin/sh");
@@ -79,7 +70,7 @@ fn owned_envs<'a>(envs: &'a [(&'static str, String)]) -> Vec<(&'static str, &'a
 /// exit 0, no output, stdin drained.
 #[test]
 fn script_exits_silently_without_maestro_env() {
-    for (event, _) in CLAUDE_EVENTS {
+    for (event, _) in HOOK_EVENTS {
         let out = sh(HOOK_SCRIPT, &[event], &[], br#"{"session_id":"x"}"#);
         assert!(out.status.success(), "{event:?}: {:?}", out.stderr);
         assert!(out.stdout.is_empty(), "{event:?}: {:?}", out.stdout);
@@ -112,7 +103,7 @@ fn script_posts_mapped_state_to_the_activity_endpoint() {
 /// Every event maps to the state the contract specifies.
 #[test]
 fn event_state_mapping_matches_the_contract() {
-    let map: std::collections::HashMap<&str, &str> = CLAUDE_EVENTS.into_iter().collect();
+    let map: std::collections::HashMap<&str, &str> = HOOK_EVENTS.into_iter().collect();
     assert_eq!(map["PreToolUse"], "Active");
     assert_eq!(map["PostToolUse"], "Active");
     assert_eq!(map["Notification"], "AwaitingInput");
@@ -212,10 +203,10 @@ fn fresh_install_registers_every_event() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
     write_script(&script_path(home)).unwrap();
-    install(Target::ClaudeCode, &settings_path(home), &script_path(home)).unwrap();
+    install(&settings_path(home), &script_path(home)).unwrap();
 
     let cmds = installed_commands(&settings_path(home));
-    assert_eq!(cmds.len(), installed_events(Target::ClaudeCode));
+    assert_eq!(cmds.len(), INSTALLED_EVENTS);
     let joined = cmds.join("\n");
     assert_eq!(joined.matches("Active").count(), 2);
     assert!(joined.contains("Error"));
@@ -230,15 +221,15 @@ fn fresh_install_registers_every_event() {
 fn install_is_idempotent() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install(Target::ClaudeCode, &settings_path(home), &script_path(home)).unwrap();
+    install(&settings_path(home), &script_path(home)).unwrap();
     let once = std::fs::read_to_string(settings_path(home)).unwrap();
 
-    install(Target::ClaudeCode, &settings_path(home), &script_path(home)).unwrap();
+    install(&settings_path(home), &script_path(home)).unwrap();
     let twice = std::fs::read_to_string(settings_path(home)).unwrap();
     assert_eq!(once, twice);
     assert_eq!(
         installed_commands(&settings_path(home)).len(),
-        installed_events(Target::ClaudeCode)
+        INSTALLED_EVENTS
     );
 }
 
@@ -266,12 +257,12 @@ fn install_updates_an_older_maestro_hook_in_place() {
         .path()
         .join(".local/share/maestro")
         .join(SCRIPT_FILE_NAME);
-    install(Target::ClaudeCode, &settings, &new_script).unwrap();
+    install(&settings, &new_script).unwrap();
 
     let cmds = installed_commands(&settings);
     assert_eq!(
         cmds.len(),
-        installed_events(Target::ClaudeCode),
+        INSTALLED_EVENTS,
         "old entry replaced, not kept: {cmds:?}"
     );
     assert!(!cmds.iter().any(|c| c == old_script));
@@ -307,7 +298,7 @@ fn install_preserves_foreign_hooks_and_removes_stale_maestro_ones() {
         .path()
         .join(".local/share/maestro")
         .join(SCRIPT_FILE_NAME);
-    install(Target::ClaudeCode, &settings, &new_script).unwrap();
+    install(&settings, &new_script).unwrap();
 
     let root: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(&settings).unwrap()).unwrap();
@@ -320,7 +311,7 @@ fn install_preserves_foreign_hooks_and_removes_stale_maestro_ones() {
     let cmds = installed_commands(&settings);
     assert_eq!(
         cmds.iter().filter(|c| c.contains(HOOK_MARKER)).count(),
-        installed_events(Target::ClaudeCode),
+        INSTALLED_EVENTS,
         "{cmds:?}"
     );
 }
@@ -330,15 +321,9 @@ fn install_preserves_foreign_hooks_and_removes_stale_maestro_ones() {
 fn is_installed_tracks_reality() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    for target in Target::ALL {
-        assert!(!is_installed(&target.settings_path(home)));
-    }
-    for (_, result) in install_for_home(home) {
-        result.unwrap();
-    }
-    for target in Target::ALL {
-        assert!(is_installed(&target.settings_path(home)));
-    }
+    assert!(!is_installed(&settings_path(home)));
+    install_for_home(home).unwrap();
+    assert!(is_installed(&settings_path(home)));
 }
 
 /// The full home-level install leaves the script executable.
@@ -346,9 +331,7 @@ fn is_installed_tracks_reality() {
 fn install_for_home_writes_an_executable_script() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    for (_, result) in install_for_home(home) {
-        result.unwrap();
-    }
+    install_for_home(home).unwrap();
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
@@ -367,7 +350,7 @@ fn install_for_home_writes_an_executable_script() {
 fn install_registers_the_prompt_event() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install(Target::ClaudeCode, &settings_path(home), &script_path(home)).unwrap();
+    install(&settings_path(home), &script_path(home)).unwrap();
 
     let root: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(settings_path(home)).unwrap()).unwrap();
@@ -384,7 +367,7 @@ fn install_registers_the_prompt_event() {
 fn install_registers_no_prompt_event_without_the_feature() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install(Target::ClaudeCode, &settings_path(home), &script_path(home)).unwrap();
+    install(&settings_path(home), &script_path(home)).unwrap();
 
     let root: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(settings_path(home)).unwrap()).unwrap();
@@ -453,12 +436,8 @@ fn the_script_posts_a_prompt_payload_unchanged() {
 fn is_current_rejects_an_install_missing_an_event() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install_target(Target::ClaudeCode, home).unwrap();
-    assert!(is_current(
-        Target::ClaudeCode,
-        &settings_path(home),
-        &script_path(home)
-    ));
+    install_for_home(home).unwrap();
+    assert!(is_current(&settings_path(home), &script_path(home)));
 
     // Drop one event, as an older install would have left the file.
     let mut root: serde_json::Value =
@@ -471,11 +450,7 @@ fn is_current_rejects_an_install_missing_an_event() {
     .unwrap();
 
     assert!(is_installed(&settings_path(home)));
-    assert!(!is_current(
-        Target::ClaudeCode,
-        &settings_path(home),
-        &script_path(home)
-    ));
+    assert!(!is_current(&settings_path(home), &script_path(home)));
 }
 
 /// A settings file that is complete but points at a script from an older
@@ -484,13 +459,9 @@ fn is_current_rejects_an_install_missing_an_event() {
 fn is_current_rejects_a_stale_script() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install_target(Target::ClaudeCode, home).unwrap();
+    install_for_home(home).unwrap();
     std::fs::write(script_path(home), "#!/bin/sh\nexit 0\n").unwrap();
-    assert!(!is_current(
-        Target::ClaudeCode,
-        &settings_path(home),
-        &script_path(home)
-    ));
+    assert!(!is_current(&settings_path(home), &script_path(home)));
 }
 
 /// Nothing installed at all is not current.
@@ -498,93 +469,18 @@ fn is_current_rejects_a_stale_script() {
 fn is_current_rejects_a_missing_install() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    assert!(!is_current(
-        Target::ClaudeCode,
-        &settings_path(home),
-        &script_path(home)
-    ));
+    assert!(!is_current(&settings_path(home), &script_path(home)));
 }
 
-/// `install_target` reports a stale script as a change, even when the
+/// `install_for_home` reports a stale script as a change, even when the
 /// settings entries pointing at it already read correctly.
 #[test]
-fn install_target_reports_a_stale_script_as_a_change() {
+fn install_for_home_reports_a_stale_script_as_a_change() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    assert!(install_target(Target::ClaudeCode, home).unwrap());
-    assert!(!install_target(Target::ClaudeCode, home).unwrap());
+    assert!(install_for_home(home).unwrap());
+    assert!(!install_for_home(home).unwrap());
 
     std::fs::write(script_path(home), "#!/bin/sh\nexit 0\n").unwrap();
-    assert!(install_target(Target::ClaudeCode, home).unwrap());
-}
-
-/// Codex is hooked in its own file, with its own event set: the two agents
-/// share the script but not the events, so neither file carries the other's
-/// spellings (#131 follow-up — a codex session was never named because
-/// nothing installed its `UserPromptSubmit` hook).
-#[test]
-fn each_target_gets_its_own_file_and_events() {
-    let dir = tempfile::tempdir().unwrap();
-    let home = dir.path();
-    for (_, result) in install_for_home(home) {
-        result.unwrap();
-    }
-
-    let claude = events_in(&Target::ClaudeCode.settings_path(home));
-    let codex = events_in(&Target::Codex.settings_path(home));
-    assert_eq!(
-        Target::Codex.settings_path(home),
-        home.join(".codex/hooks.json")
-    );
-
-    // Claude Code's failure signal has no codex equivalent, and codex's
-    // approval notice is spelled differently.
-    assert!(claude.contains(&"StopFailure".to_string()));
-    assert!(claude.contains(&"Notification".to_string()));
-    assert!(!codex.contains(&"StopFailure".to_string()));
-    assert!(!codex.contains(&"Notification".to_string()));
-    assert!(codex.contains(&"PermissionRequest".to_string()));
-
-    // Both report work and both report a finished turn.
-    for event in ["PreToolUse", "PostToolUse", "Stop"] {
-        assert!(claude.contains(&event.to_string()), "claude {event}");
-        assert!(codex.contains(&event.to_string()), "codex {event}");
-    }
-
-    assert_eq!(
-        installed_commands(&Target::Codex.settings_path(home)).len(),
-        installed_events(Target::Codex)
-    );
-}
-
-/// #131: a codex session names itself the same way a Claude Code one does —
-/// same event spelling, same script, same `Prompt` argument.
-#[cfg(feature = "haiku-autoname")]
-#[test]
-fn codex_reports_its_first_prompt_too() {
-    let dir = tempfile::tempdir().unwrap();
-    let home = dir.path();
-    install_target(Target::Codex, home).unwrap();
-
-    let root: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(Target::Codex.settings_path(home)).unwrap())
-            .unwrap();
-    let cmd = root["hooks"]["UserPromptSubmit"][0]["hooks"][0]["command"]
-        .as_str()
-        .unwrap()
-        .to_string();
-    assert!(cmd.ends_with(" Prompt"), "{cmd}");
-    assert!(cmd.contains(SCRIPT_FILE_NAME));
-}
-
-/// Every event name a settings file registers a maestro hook under.
-fn events_in(settings: &Path) -> Vec<String> {
-    serde_json::from_str::<serde_json::Value>(&std::fs::read_to_string(settings).unwrap())
-        .unwrap()
-        .get("hooks")
-        .and_then(|h| h.as_object())
-        .into_iter()
-        .flatten()
-        .map(|(event, _)| event.clone())
-        .collect()
+    assert!(install_for_home(home).unwrap());
 }

crates/maestro-protocol/src/lib.rs

@@ -123,10 +123,38 @@ fn epoch() -> DateTime<Utc> {
     DateTime::from_timestamp(0, 0).expect("unix epoch is a valid timestamp")
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+/// Lifecycle of a session as the daemon knows it.
+///
+/// Deserializes leniently, like [`ActivityState`] (#162): an unknown spelling
+/// from a newer daemon reads as [`SessionStatus::Dead`] instead of failing the
+/// whole `Session`. `Dead` is the safe degrade — an unrecognised session is
+/// one this client must not treat as having a live pane to type into.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 pub enum SessionStatus {
     Running,
     Dead,
+    /// Known from its sidecar, with no tmux session behind it (#162). The
+    /// daemon registers these at recovery time for every sidecar tmux had
+    /// nothing to adopt — after a host reboot, that is every session there
+    /// was. There is no pane and no PTY bridge: a dormant session is a record
+    /// of what was running, listed so the operator still has it, and the only
+    /// thing that can be done to it is dismissing it.
+    Dormant,
+}
+
+impl<'de> Deserialize<'de> for SessionStatus {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let s = String::deserialize(deserializer)?;
+        Ok(match s.as_str() {
+            "Running" => Self::Running,
+            "Dormant" => Self::Dormant,
+            // Known or not, any other spelling degrades to the inert variant.
+            _ => Self::Dead,
+        })
+    }
 }
 
 /// Inferred session activity, orthogonal to [`SessionStatus`] (NAP-340). The
@@ -1059,6 +1087,33 @@ mod tests {
             serde_json::to_value(SessionStatus::Dead).unwrap(),
             serde_json::json!("Dead")
         );
+        assert_eq!(
+            serde_json::to_value(SessionStatus::Dormant).unwrap(),
+            serde_json::json!("Dormant")
+        );
+    }
+
+    // #162: a session with no tmux behind it still rides the wire whole.
+    #[test]
+    fn dormant_session_round_trips() {
+        let mut s = sample_session();
+        s.status = SessionStatus::Dormant;
+        assert_eq!(s, round_trip(&s));
+    }
+
+    // #162: a `SessionStatus` this client does not know must degrade to the
+    // inert variant, not fail the whole `Session` the way a derived
+    // `Deserialize` would.
+    #[test]
+    fn unknown_session_status_degrades_to_dead() {
+        assert_eq!(
+            serde_json::from_value::<SessionStatus>(serde_json::json!("Hibernating")).unwrap(),
+            SessionStatus::Dead
+        );
+        let mut value = serde_json::to_value(sample_session()).unwrap();
+        value["status"] = serde_json::json!("Hibernating");
+        let s: Session = serde_json::from_value(value).expect("session survives unknown status");
+        assert_eq!(s.status, SessionStatus::Dead);
     }
 
     #[test]

crates/maestro-tui/src/command_bar.rs

@@ -194,7 +194,9 @@ pub enum BarOutcome {
 pub fn order_sessions_for_bar(sessions: &[Session]) -> Vec<&Session> {
     let mut ordered: Vec<&Session> = sessions.iter().collect();
     ordered.sort_by(|a, b| {
-        let dead = |s: &Session| u8::from(s.status == SessionStatus::Dead);
+        // docs/COMMAND-BAR.md: anything with no live pane — dead or dormant
+        // (#162) — sorts after the sessions you could actually attach to.
+        let dead = |s: &Session| u8::from(s.status != SessionStatus::Running);
         dead(a)
             .cmp(&dead(b))
             .then_with(|| {
@@ -319,7 +321,7 @@ impl CommandBar {
             .map(|s| BarEntry {
                 candidate: MatchCandidate::Session(session_candidate(s, home_dir)),
                 target: BarTarget::Session(s.id),
-                dead: s.status == SessionStatus::Dead,
+                dead: s.status != SessionStatus::Running,
                 chords: Vec::new(),
             })
             .collect();
@@ -889,6 +891,23 @@ mod tests {
         assert!(bar.rows()[1].dead);
     }
 
+    /// #162: docs/COMMAND-BAR.md ranks by whether you could attach, not by
+    /// which way the pane went away — a dormant session sorts with the dead.
+    #[test]
+    fn dormant_sessions_sort_after_live_ones_however_recent() {
+        let mut dormant = named(1, "dormant");
+        dormant.status = SessionStatus::Dormant;
+        dormant.last_focused_at = Some(at(99));
+        let live = named(2, "live");
+
+        let bar = CommandBar::new(&[dormant, live], &[], "/home/me");
+        assert_eq!(
+            ids(bar.rows()),
+            vec![Uuid::from_u128(2), Uuid::from_u128(1)]
+        );
+        assert!(bar.rows()[1].dead);
+    }
+
     #[test]
     fn typing_ranks_through_the_matcher_and_returns_ranges() {
         let mut bar = CommandBar::new(

crates/maestro-tui/src/sidebar.rs

@@ -268,6 +268,8 @@ impl Sidebar {
     fn name_row(&self, s: &Session, width: usize, focused: bool) -> Vec<Span<'static>> {
         let glyph = match (s.status, self.attached.contains(&s.id)) {
             (SessionStatus::Dead, _) => "✗",
+            // #162: known from its sidecar, nothing running behind it.
+            (SessionStatus::Dormant, _) => "◌",
             (SessionStatus::Running, true) => "●",
             (SessionStatus::Running, false) => "○",
         };
@@ -322,6 +324,7 @@ impl Sidebar {
         // on line 1; the kill confirm names the specifics.
         let blocked = s.blocked_work.filter(|b| !b.is_clear());
         let dead = s.status == SessionStatus::Dead;
+        let dormant = s.status == SessionStatus::Dormant;
         let highlighted = self.highlight == Some(SidebarItem::Session(s.id));
         let fill = self.card_fill(s, focused);
         let base = card_base(fill, focused);
@@ -361,6 +364,9 @@ impl Sidebar {
         if dead {
             tail.push(Span::styled(" exited", muted));
         }
+        if dormant {
+            tail.push(Span::styled(" dormant", muted));
+        }
         // docs/SIDEBAR.md: the card names the program, never its arguments.
         let command = Span::styled(format!(" {}", command_program(&s.command)), muted);
 
@@ -1068,6 +1074,39 @@ mod tests {
         );
     }
 
+    /// #162, docs/SIDEBAR.md: a dormant session is known but not running —
+    /// its own glyph on line 1 and the muted `dormant` fragment on line 2, so
+    /// it never reads as something that exited.
+    #[test]
+    fn dormant_session_reads_as_known_but_not_running() {
+        let mut s = session_named(1, "claude");
+        s.status = SessionStatus::Dormant;
+        s.activity_since = Utc::now() - Duration::seconds(5);
+        let sb = Sidebar {
+            sessions: vec![s],
+            highlight: None,
+            attached: Default::default(),
+            pane_session: None,
+        };
+        let all = rows(&draw(&sb, 28, 8));
+        let idx = all.iter().position(|l| l.contains("claude")).unwrap();
+        assert!(
+            all[idx].contains('\u{25cc}'),
+            "expected the dormant glyph in: {:?}",
+            all[idx]
+        );
+        assert!(
+            all[idx + 1].contains("dormant"),
+            "expected dormant fragment in: {:?}",
+            all[idx + 1]
+        );
+        assert!(
+            !all[idx + 1].contains("exited"),
+            "a dormant session never reads as exited: {:?}",
+            all[idx + 1]
+        );
+    }
+
     /// docs/SIDEBAR.md: line 2 names the program, never its arguments.
     #[test]
     fn meta_line_drops_the_commands_arguments() {

docs/COMMAND-BAR.md

@@ -123,9 +123,9 @@ client opening `/api/attach/:id`, and a client reporting focus explicitly at
 `POST /api/sessions/:id/focus` when it refocuses a pane that is already open.
 
 **A session that has never been focused sorts after every session that has**,
-and among those, most recently created first. Dead sessions sort after live
-ones regardless of recency: a session you cannot attach to is not where you
-just were.
+and among those, most recently created first. Sessions with no live pane —
+`Dead`, and `Dormant` (#162) — sort after live ones regardless of recency: a
+session you cannot attach to is not where you just were.
 
 Under `>` an empty query lists every command in registry order. Under `~` it
 lists recent dirs, most recent first, then the project list.

docs/PREVIEW.md

@@ -47,7 +47,6 @@ Web client (`--preview` and friends in `web/src/styles.css`):
 | The canvas | A `preview` chip, top right, and a dashed inset ring. |
 | A throwaway tab | Dashed border, italic label. |
 | The sidebar row being previewed | Filled with the preview hue, over whatever open state the row already had — but the row of the session already showing in the pane keeps its accent fill, since previewing it changes nothing on screen. |
-| The sidebar row of the session the operator picked | Keeps its accent fill for the whole preview. A preview never moves the accent; only opening another session does. |
 | A hovered sidebar row, and the keyboard cursor on a session | A lighter wash of the same hue, because both are what previews a row. |
 
 Rows say it with fill, not with an edge — see the tier ladder in

docs/RESTART.md

@@ -68,6 +68,26 @@ resolves, so a blocked client is never a trapped one. It clears itself the
 moment a probe succeeds — there is no "retry" button, because the client is
 already retrying.
 
+## What survives, and what comes back dormant
+
+A daemon restart leaves tmux alone, so recovery re-adopts every
+`maestro-<uuid>` session tmux still holds and the operator sees no change
+beyond the reconnect above.
+
+A **host reboot** is different: it kills the tmux server, so there is nothing
+to adopt while every session's sidecar is still on disk. Recovery makes a
+second pass over those sidecars and registers each as a `Dormant` session
+(#162) — id, name, cwd, command, worktree and `created_at` intact. A dormant
+session has no pane and no PTY bridge: it cannot be attached to, typed into or
+resized, and neither watcher pass touches it. It is a record of what was
+running, and the only thing left to do with one is dismiss it, which removes
+the sidecar so the next recovery does not bring it back.
+
+`SessionStatus` is a wire type, so it deserializes leniently on both clients:
+a spelling this build does not know reads as `Dead` rather than failing the
+whole session. Clients render a dormant session as known-but-not-running —
+see `docs/SIDEBAR.md` for the card and `docs/COMMAND-BAR.md` for how it ranks.
+
 ## Timing
 
 - **Grace window** — 1200 ms between the socket dropping and the overlay

docs/SIDEBAR.md

@@ -56,7 +56,7 @@ itself is not.
 Line 2 reads left to right:
 
 ```
-[<duration>] [<detail>] <command> [<diff stat> | exited]
+[<duration>] [<detail>] <command> [<diff stat> | exited | dormant]
 ```
 
 Its minimum content is therefore just the command.
@@ -104,8 +104,14 @@ fragment; it no longer decides whether line 2 exists.
 while an agent-reported state is in force (see Precedence): when the report
 lapses at its TTL or is replaced, the detail goes with it. The detail
 truncates with `…` ahead of the trailing fragments — a long detail never
-pushes `<command>`, `<blocked work>`, or `exited` off the line, and neither
-client ever lets it wrap.
+pushes `<command>`, `<blocked work>`, `exited` or `dormant` off the line, and
+neither client ever lets it wrap.
+
+`dormant` (#162) is the counterpart of `exited` for a session the daemon knows
+only from its sidecar: recovery found no tmux session behind it, so it has no
+pane, no scrollback, and nothing to attach to. It is not an exit — nothing was
+observed ending — so the two fragments never both show. The TUI marks the same
+state on line 1 with `◌`, next to `✗` for exited and `●`/`○` for running.
 
 `<diff stat>` is the blocked-work breakdown (#83) in diff notation, replacing
 the spelled-out `⚠ 3 uncommitted files, 2 unpushed commits`. It renders only
@@ -209,7 +215,7 @@ the cursor's fill while the pane holds the keyboard, and the web's ring on a
 highlighted **folder** row — a folder previews nothing, so it has no fill to
 step up to.
 
-The duration text inherits its state's colour; the exited and command
+The duration text inherits its state's colour; the exited, dormant and command
 fragments use the surface's `muted` role, as do the diff stat's `~`, `?` and
 `↑` fragments. Only `+` and `-` step outside the surface's muted role, and they
 take the `active` and `error` roles of the same surface.
@@ -250,10 +256,6 @@ Two rulings specific to a reported `Error` (#114):
   process changes do not clear it — only the agent itself may withdraw what
   the agent itself reported. Re-reporting `Error` extends the TTL rather than
   stacking reports.
-- **Only Claude Code reports `Error`.** Codex has no counterpart to
-  `StopFailure` in its hook event set, so a codex turn that ends on an API
-  error reports `AwaitingInput` and its card carries no error mark. A card
-  without the mark means "nothing reported a failure", not "nothing failed".
 
 If a client receives an `ActivityState` variant it does not know, it must not
 fail rendering: treat it as `Idle` (neutral/dim, line-2 rules apply as usual)
@@ -307,10 +309,9 @@ lands on the first row it was hiding. A highlight parked on a skipped row —
 reachable by clicking a folder header — still steps to its neighbour rather
 than jumping to the end of the list.
 
-The web client needs a chord to reach the list at all (leader-`h` — `Ctrl+A h`
-by default — and the same chord back): an attached terminal owns every plain
-keystroke, and Escape is left to reach the pane's shell/app instead. The TUI
-uses `ctrl-w h`.
+The web client needs a chord to reach the list at all (`Ctrl+Shift+H`, and the
+same chord back): an attached terminal owns every plain keystroke. The TUI uses
+`ctrl-w h`.
 
 Everything else is the same key on both clients:
 

web/src/attach.ts

@@ -4,6 +4,8 @@ import { Terminal } from "@xterm/xterm";
 import "@xterm/xterm/css/xterm.css";
 
 import { attachWsUrl } from "./routes.js";
+import { FOCUS_SIDEBAR_EVENT } from "./catalog.js";
+import { CommandSet, defineCommands } from "./commands.js";
 import { escapeHtml } from "./html.js";
 import { INITIAL_RECONNECT_MS, MAX_RECONNECT_MS } from "./reconnect.js";
 import { applyModsToChar, cursorSeq, tildeSeq } from "./keys.js";
@@ -12,6 +14,15 @@ import { splitCommand, toolIconSvg } from "./toolIcon.js";
 import type { ClientControl, Uuid } from "./types.js";
 import { WebglPolicy } from "./webglRenderer.js";
 
+// The pane's half of the command registry (#148): plain Escape hands the
+// keyboard back to the session list, the pair to the list's Tab.
+const paneKeys = new CommandSet(
+  defineCommands({
+    "pane.focusList": () => document.dispatchEvent(new CustomEvent(FOCUS_SIDEBAR_EVENT)),
+  }),
+  { preventDefault: false },
+);
+
 /** One budget for the whole page — see webglRenderer.ts for why contexts are
  *  rationed rather than handed to every connection. */
 const webglPolicy = new WebglPolicy();
@@ -210,6 +221,15 @@ export function createAttachConnection(
     }
   }
 
+  // Plain Escape hands the keyboard back to the session list instead of the
+  // shell/app. `false` tells xterm to skip its own handling of this event —
+  // which is also why the set doesn't `preventDefault`: swallowing here is
+  // xterm's return value, not the browser's.
+  term.attachCustomKeyEventHandler((e) => {
+    if (e.type !== "keydown") return true;
+    return !paneKeys.handle(e);
+  });
+
   // Touch scrolling: xterm's built-in touch handling is jittery (drags crawl a
   // line at a time and stall), so map finger drags ourselves. Two routes:
   //   • normal buffer  → term.scrollLines walks the scrollback.

web/src/catalog.test.ts

@@ -414,6 +414,19 @@ describe("session cards (#107)", () => {
     expect(line2?.textContent).toContain("exited");
   });
 
+  // #162: a session recovered with no tmux behind it is known but not running,
+  // and never reads as something that exited.
+  it("shows dormant on line 2 for dormant sessions", () => {
+    const s = session({
+      id: "aaaaaaaa-0000-0000-0000-000000000118",
+      status: "Dormant",
+    });
+    const el = renderSidebar(storeWith([s])).el;
+    const line2 = rowFor(el, s.id)?.querySelector<HTMLElement>(".card-line2");
+    expect(line2?.textContent).toContain("dormant");
+    expect(line2?.textContent).not.toContain("exited");
+  });
+
   it("carries the state word only in tooltips and aria labels, never as text", () => {
     const s = session({
       id: "aaaaaaaa-0000-0000-0000-000000000019",

web/src/catalog.ts

@@ -53,6 +53,10 @@ export function requestOpenCommandBar(): void {
  *  connection pool. */
 export const FOCUS_PANE_EVENT = "catalog-focus-pane";
 
+/** Ask the shell to hand the keyboard back to the session list — what Escape
+ *  does when the pane's terminal is focused. Handled in main.ts. */
+export const FOCUS_SIDEBAR_EVENT = "catalog-focus-sidebar";
+
 /** Ask the shell to open the spawn modal seeded from an existing session
  *  ("Spawn similar"). Detail is the session being cloned. */
 export const SPAWN_SIMILAR_EVENT = "catalog-spawn-similar";
@@ -109,6 +113,9 @@ function activityRailMarkup(slug: string, stateWord: string): string {
 
 function metaLine(s: Session, now: number): string {
   const dead = s.status === "Dead";
+  // #162: known from its sidecar with nothing running behind it — a distinct
+  // fragment, since it never exited.
+  const dormant = s.status === "Dormant";
   const blockers = sessionBlockers(s);
   const slug = activityColorSlug(s.activity ?? "Idle");
   const held = activityHeldMs(s.activity_since, now);
@@ -123,6 +130,7 @@ function metaLine(s: Session, now: number): string {
     commandFragment(s.command),
     blockers ? blockedFragment(blockers) : "",
     dead ? `<span class="card-flag">exited</span>` : "",
+    dormant ? `<span class="card-flag">dormant</span>` : "",
   ];
   return `<span class="card-line2" data-activity="${slug}">${fragments.join("")}</span>`;
 }

web/src/commandBar.test.ts

@@ -99,6 +99,20 @@ describe("empty-query ordering", () => {
     ]);
   });
 
+  // #162: docs/COMMAND-BAR.md ranks by whether you could attach, not by which
+  // way the pane went away.
+  it("sorts dormant sessions after live ones, like dead ones", () => {
+    const dormantRecent = session("dormant", {
+      status: "Dormant",
+      last_focused_at: "2026-06-01T00:00:00Z",
+    });
+    const liveStale = session("live", { last_focused_at: "2020-01-01T00:00:00Z" });
+    expect(orderSessionsForBar([dormantRecent, liveStale]).map((s) => s.id)).toEqual([
+      "live",
+      "dormant",
+    ]);
+  });
+
   it("treats a null last_focused_at as never focused", () => {
     const nulled = session("nulled", { last_focused_at: null });
     const stamped = session("stamped", { last_focused_at: "2020-01-01T00:00:00Z" });

web/src/commandBar.ts

@@ -142,8 +142,10 @@ function createdAt(s: Session): number {
  *  matcher's last tie-break preserves. */
 export function orderSessionsForBar(sessions: readonly Session[]): Session[] {
   return [...sessions].sort((a, b) => {
-    const deadA = a.status === "Dead" ? 1 : 0;
-    const deadB = b.status === "Dead" ? 1 : 0;
+    // docs/COMMAND-BAR.md: anything with no live pane — dead or dormant (#162)
+    // — sorts after the sessions you could actually attach to.
+    const deadA = a.status === "Running" ? 0 : 1;
+    const deadB = b.status === "Running" ? 0 : 1;
     if (deadA !== deadB) return deadA - deadB;
 
     const focusA = focusedAt(a);
@@ -350,7 +352,7 @@ function renderRow(result: BarResult, index: number): HTMLElement {
   row.dataset.kind = candidate.kind;
   if (candidate.kind === "session") {
     row.dataset.sessionId = candidate.session.id;
-    if (candidate.session.status === "Dead") row.classList.add("is-dead");
+    if (candidate.session.status !== "Running") row.classList.add("is-dead");
   } else if (isActionCandidate(candidate)) {
     row.dataset.actionId = candidate.action.id;
   } else if (candidate.kind === "command") {

web/src/commands.test.ts

@@ -133,28 +133,31 @@ describe("CommandSet", () => {
     expect(run).toHaveBeenCalledTimes(2);
   });
 
-  it("keeps plain keys deaf inside a form field, and leader chords live from the pane", () => {
+  it("keeps plain keys deaf inside a form field, and chorded ones live", () => {
     const plain = vi.fn();
     const chorded = vi.fn();
     const set = new CommandSet(
-      defineCommands({ "spawn.open": plain, "focus.toggle": chorded }, DEFAULT_LEADER),
-      { leader: DEFAULT_LEADER },
+      defineCommands({ "spawn.open": plain, "focus.toggle": chorded }),
     );
     const input = el("<input>");
     expect(pressOn(set, input, "n")).toBe(false);
     expect(plain).not.toHaveBeenCalled();
-    // focus.toggle hangs off the leader (#166): a plain, unmodified Escape is
-    // left for the pane's shell/app instead.
-    const terminal = el('<textarea class="xterm-helper-textarea"></textarea>');
-    pressOn(set, terminal, "a", { ctrlKey: true });
-    expect(pressOn(set, terminal, "h")).toBe(true);
+    expect(pressOn(set, input, "H", { ctrlKey: true, shiftKey: true })).toBe(true);
     expect(chorded).toHaveBeenCalledTimes(1);
   });
 
-  it("leaves a plain Escape for the pane instead of binding it", () => {
-    const set = new CommandSet(defineCommands({ "spawn.open": vi.fn() }));
+  it("keeps pane commands live inside the terminal's textarea", () => {
+    const run = vi.fn();
+    const set = new CommandSet(defineCommands({ "pane.focusList": run }), {
+      preventDefault: false,
+    });
     const textarea = el('<textarea class="xterm-helper-textarea"></textarea>');
-    expect(pressOn(set, textarea, "Escape")).toBe(false);
+    const e = key("Escape");
+    Object.defineProperty(e, "target", { value: textarea });
+    expect(set.handle(e)).toBe(true);
+    expect(run).toHaveBeenCalledTimes(1);
+    // xterm is told to swallow by the return value, not by the browser default.
+    expect(e.defaultPrevented).toBe(false);
   });
 });
 
@@ -170,7 +173,6 @@ describe("the leader", () => {
     const byId = new Map(commandSpecs("ctrl-b").map((s) => [s.id, s]));
     expect(byId.get("pane.literalCtrlK")?.keys).toEqual(["ctrl-b ctrl-k"]);
     expect(byId.get("pane.literalLeader")?.keys).toEqual(["ctrl-b ctrl-b"]);
-    expect(byId.get("focus.toggle")?.keys).toEqual(["ctrl-b h"]);
     // Commands that do not hang off the leader are untouched.
     expect(byId.get("bar.open")?.keys).toEqual(["ctrl-k"]);
   });

web/src/commands.ts

@@ -93,8 +93,7 @@ const SPECS: readonly SpecSource[] = [
     id: "focus.toggle",
     label: "Move the keyboard between the session list and the pane",
     group: "Session list",
-    keys: [`${DEFAULT_LEADER} h`],
-    leaderKeys: (leader) => [`${leader} h`],
+    keys: ["ctrl-shift-h"],
     scope: "global",
   },
   {
@@ -146,6 +145,13 @@ const SPECS: readonly SpecSource[] = [
     keys: ["tab"],
     scope: "list",
   },
+  {
+    id: "pane.focusList",
+    label: "Hand the keyboard back to the session list, from the pane",
+    group: "Session list",
+    keys: ["esc"],
+    scope: "pane",
+  },
   {
     id: "help.toggle",
     label: "Show or hide this help",

web/src/fastForward.test.ts

@@ -34,14 +34,12 @@ describe("resolveFastForward (#67)", () => {
     const res = resolveFastForward(projects, presets, "amber-falcon");
     expect(res.project?.path).toBe("/repos/fresh");
     expect(res.command).toBe("aider");
-    expect(res.handle).toBe("amber-falcon");
+    expect(res.name).toBe("amber-falcon");
 
     const req = buildFastForwardRequest(res)!;
     expect(req.cwd).toBe("/repos/fresh");
     expect(req.command).toBe("aider");
-    // No name (#131): the daemon names the session after its first prompt,
-    // and a name here would collide with the branch handle.
-    expect(req.metadata).toBeUndefined();
+    expect(req.metadata).toEqual({ name: "amber-falcon" });
     expect(req.worktree).toEqual({
       base_repo: "/repos/fresh",
       branch: "amber-falcon",
@@ -90,9 +88,9 @@ describe("resolveFastForward (#67)", () => {
     expect(buildFastForwardRequest(res)).toBeNull();
   });
 
-  it("downgrades to a draft when the generated handle is missing", () => {
+  it("downgrades to a draft when the generated name is missing", () => {
     const res = resolveFastForward([project({ last_command: "claude" })], presets);
-    expect(res.handle).toBeUndefined();
+    expect(res.name).toBeUndefined();
     expect(buildFastForwardRequest(res)).toBeNull();
   });
 
@@ -110,17 +108,6 @@ describe("resolveFastForward (#67)", () => {
     });
   });
 
-  it("seeds the handle as the branch and leaves the name field empty (#131)", () => {
-    const res = resolveFastForward(
-      [project({ path: "/repos/p", base_repo: "/repos/p", last_command: "aider" })],
-      presets,
-      "amber-falcon",
-    );
-    const seed = fastForwardSeed(res);
-    expect(seed.name).toBe("");
-    expect(seed.worktreeBranch).toBe("amber-falcon");
-  });
-
   it("leaves the worktree default alone when not even a project resolved", () => {
     // Not `false`: the form defaults the toggle on and a false would stick,
     // so the fallback draft would disagree with a normally-opened draft and

web/src/fastForward.ts

@@ -10,21 +10,19 @@ import { sortProjects } from "./projectList.js";
 export interface FastForwardResolution {
   project?: Project;
   command?: string;
-  /** A generated handle for the worktree branch (#131). Not a session name:
-   *  the fast path names no session. */
-  handle?: string;
+  name?: string;
 }
 
 /** The defaults: the currently focused session's project when it's still a
  *  known project, else the most recent one (fresh-first, same ordering the
  *  picker shows) — so `N` lands where the operator currently is, matching
  *  what plain `n` seeds from `spawnSimilarProjectSeed`. Its last command
- *  falls back to the first non-custom preset, and the branch handle is
- *  freshly generated when the daemon supplied one. */
+ *  falls back to the first non-custom preset, and the name is freshly
+ *  generated when the daemon supplied one. */
 export function resolveFastForward(
   projects: Project[],
   presets: SpawnPreset[],
-  handle?: string,
+  name?: string,
   focusedCwd?: string,
 ): FastForwardResolution {
   const project =
@@ -32,45 +30,41 @@ export function resolveFastForward(
   const lastCommand = project?.last_command?.trim();
   const command =
     lastCommand || presets.find((p) => p.command !== "")?.command || undefined;
-  return { project, command, handle: handle || undefined };
+  return { project, command, name: name || undefined };
 }
 
 /** The immediate spawn request — worktree on, new branch named after the
- *  generated handle — or `null` when any default is missing.
- *
- *  The request carries no name (#131): the daemon assigns a provisional one
- *  and replaces it once the session sees its first prompt. A name here would
- *  also collide with the branch handle's own session. */
+ *  generated session name — or `null` when any default is missing. */
 export function buildFastForwardRequest(
   res: FastForwardResolution,
 ): CreateSessionRequest | null {
-  const { project, command, handle } = res;
-  if (!project || !command?.trim() || !handle) return null;
+  const { project, command, name } = res;
+  if (!project || !command?.trim() || !name) return null;
   return {
     cwd: project.path,
     command,
+    metadata: { name },
     worktree: {
       base_repo: project.base_repo ?? project.path,
-      branch: handle,
+      branch: name,
       create_branch: true,
     },
   };
 }
 
 /** Seed for the fallback spawn form: whatever did resolve goes into the
- *  form; the rest stays with its own defaults. The name field stays empty
- *  (#131) — the handle seeds the branch, not the session name. */
+ *  form; the rest stays with its own defaults. */
 export function fastForwardSeed(res: FastForwardResolution) {
   return {
     cwd: res.project?.path ?? "",
     command: res.command ?? "",
-    name: "",
+    name: res.name ?? "",
     // Left undefined rather than false when nothing resolved: the form
     // defaults the toggle on, and `false` would stick, so the fallback form
     // would disagree with both a normally-opened form and the TUI's fast path
     // (#67 review).
     worktreeEnabled: res.project ? true : undefined,
     worktreeBranch:
-      res.project && res.handle ? res.handle : undefined,
+      res.project && res.name ? res.name : undefined,
   };
 }

web/src/killDialog.test.ts

@@ -1,33 +0,0 @@
-// @vitest-environment happy-dom
-import { beforeEach, describe, expect, it } from "vitest";
-import {
-  closeForceKillDialog,
-  openForceKillDialog,
-  openKillConfirmDialog,
-} from "./killDialog.js";
-
-describe("kill dialogs", () => {
-  beforeEach(() => {
-    closeForceKillDialog();
-    document.body.innerHTML = "";
-  });
-
-  it("focuses the kill button, so Enter confirms", () => {
-    const el = openKillConfirmDialog({
-      name: "alpha",
-      blockers: null,
-      onKill: () => Promise.resolve(),
-    });
-    expect(document.activeElement).toBe(el.querySelector(".kill-dialog-kill"));
-  });
-
-  it("focuses the force button too", () => {
-    const el = openForceKillDialog({
-      name: "alpha",
-      blockers: null,
-      reason: "worktree is dirty.",
-      onForce: () => Promise.resolve(),
-    });
-    expect(document.activeElement).toBe(el.querySelector(".kill-dialog-force"));
-  });
-});

web/src/killDialog.ts

@@ -132,9 +132,9 @@ function mount(p: KillDialogSpec): HTMLElement {
   };
   window.addEventListener("keydown", onKeydown, true);
   open = { el, onKeydown };
-  // The acting button takes the focus in both prompts: the operator already
-  // asked for the kill, so Enter confirms it. Escape and the scrim cancel.
-  confirm.focus();
+  // Cancel takes the focus in both prompts: a kill is never one keystroke
+  // away from whatever asked for the dialog.
+  cancel.focus();
   return el;
 }
 

web/src/layout.test.ts

@@ -2,7 +2,6 @@ import { describe, expect, it } from "vitest";
 
 import {
   emptyLayout,
-  equalizeRatios,
   leaves,
   locateSession,
   openSessions,
@@ -45,23 +44,6 @@ describe("splitLeaf", () => {
   });
 });
 
-describe("equalizeRatios", () => {
-  it("resets nested splits to equal width, not just the newest one", () => {
-    const tab = tabWithOneLeaf("s1");
-    const first = leaves(tab.root)[0].id;
-    splitLeaf(tab, first, "s2", "row", true); // A|B, 0.5/0.5
-    const second = leaves(tab.root)[1].id;
-    splitLeaf(tab, second, "s3", "row", true); // A(0.5) | (B|C, 0.5/0.5) -> B,C at 0.25 each
-
-    equalizeRatios(tab.root);
-
-    const root = tab.root as Extract<typeof tab.root, { kind: "split" }>;
-    expect(root.ratio).toBeCloseTo(1 / 3);
-    const inner = root.b as Extract<typeof root.b, { kind: "split" }>;
-    expect(inner.ratio).toBeCloseTo(1 / 2);
-  });
-});
-
 describe("removeLeaf", () => {
   it("collapses the parent split into the surviving sibling", () => {
     const tab = tabWithOneLeaf("s1");

web/src/layout.ts

@@ -118,17 +118,6 @@ export function removeLeaf(tab: Tab, leafId: string): void {
   tab.root = tab.root ? rec(tab.root) : null;
 }
 
-/** Reset every split ratio under `node` so all leaves get equal width,
- *  regardless of split direction or nesting order. Returns the leaf count. */
-export function equalizeRatios(node: Node | null): number {
-  if (!node) return 0;
-  if (node.kind === "leaf") return 1;
-  const na = equalizeRatios(node.a);
-  const nb = equalizeRatios(node.b);
-  node.ratio = na / (na + nb);
-  return na + nb;
-}
-
 export function addTab(layout: Layout): Tab {
   const tab: Tab = {
     id: freshId("t"),

web/src/main.ts

@@ -35,6 +35,7 @@ import { loadLayout, saveLayout } from "./persistence.js";
 import { createPreviewSchedule } from "./previewSchedule.js";
 import {
   FOCUS_PANE_EVENT,
+  FOCUS_SIDEBAR_EVENT,
   OPEN_COMMAND_BAR_EVENT,
   OPEN_SPAWN_EVENT,
   SESSION_SELECT_EVENT,
@@ -355,14 +356,14 @@ async function spawnPresets(): Promise<SpawnPreset[]> {
 }
 
 async function requestFastForward(): Promise<void> {
-  const [discovered, handle] = await Promise.all([
+  const [discovered, name] = await Promise.all([
     fetchProjects().catch(() => [] as Project[]),
     fetchNames(1)
       .then((batch) => batch.names[0])
       .catch(() => undefined),
   ]);
   const presets = await spawnPresets();
-  const resolved = resolveFastForward(discovered, presets, handle, focusedProjectCwd());
+  const resolved = resolveFastForward(discovered, presets, name, focusedProjectCwd());
   const req = buildFastForwardRequest(resolved);
   if (req) {
     try {
@@ -389,7 +390,7 @@ async function requestFastForward(): Promise<void> {
 // one outside any repo spawns without a worktree, since there is no repo to cut
 // a branch from. Anything still unresolved opens the pre-filled form.
 async function requestSpawnInDirectory(path: string): Promise<void> {
-  const [discovered, handle] = await Promise.all([
+  const [discovered, name] = await Promise.all([
     fetchProjects().catch(() => [] as Project[]),
     fetchNames(1)
       .then((batch) => batch.names[0])
@@ -398,7 +399,7 @@ async function requestSpawnInDirectory(path: string): Promise<void> {
   const presets = await spawnPresets();
   const known = discovered.find((p) => p.path === path);
   const project: Project = known ?? { path, name: path.split("/").filter(Boolean).pop() ?? path };
-  const resolved = resolveFastForward([project], presets, handle, path);
+  const resolved = resolveFastForward([project], presets, name, path);
   const req = buildFastForwardRequest(resolved);
   if (req) {
     const inRepo =
@@ -439,11 +440,10 @@ const spawnKeys = new CommandSet(
   }),
 );
 
-// Leader-h moves the keyboard between the session list and the pane, the web
-// counterpart of the TUI's `ctrl-w h`. It has to be a chord behind the
-// leader: an attached terminal owns every plain keystroke, and Ctrl+Shift+H
-// is already claimed by the browser (history), so nothing unmodified — or
-// modified with a common browser chord — could get the focus back out of it.
+// Ctrl+Shift+H moves the keyboard between the session list and the pane, the
+// web counterpart of the TUI's `ctrl-w h`. It has to be a chord: an attached
+// terminal owns every plain keystroke, so nothing unmodified could ever get
+// the focus back out of it.
 //
 // This set also owns the leader (`[tui].leader`, `ctrl-a` by default, served
 // on `/api/info`): it holds the key as a partial chord and takes select-all off
@@ -528,8 +528,8 @@ window.addEventListener(
 );
 
 
-// Tab in the session list hands the keyboard to the pane; leader-h (focus.toggle,
-// above) hands it back the other way.
+// Tab in the session list hands the keyboard to the pane; Escape in the pane
+// hands it back — the pair the TUI gets from `tab` and `esc`.
 document.addEventListener(FOCUS_PANE_EVENT, () => {
   // Handing the keyboard to a previewed pane is choosing it: the preview stops
   // being provisional rather than snapping back the moment the list blurs.
@@ -537,6 +537,10 @@ document.addEventListener(FOCUS_PANE_EVENT, () => {
   if (previewed) focusSession(previewed);
   pool.focusTerminal();
 });
+document.addEventListener(FOCUS_SIDEBAR_EVENT, () => {
+  drawer.open(); // no-op on desktop; on mobile the list is off-canvas
+  sidebar.focusList();
+});
 
 /** Open/focus a session and reflect it in the shell chrome. Shared by the
  *  hash router and the sidebar's click-driven path (#133), which can't rely

web/src/multiview.ts

@@ -10,7 +10,6 @@ import {
   activeTab,
   addTab,
   closeTab,
-  equalizeRatios,
   findLeaf,
   freshId,
   type Dir,
@@ -216,20 +215,6 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
     return fl?.sessionId ?? null;
   }
 
-  /** The session the operator actually picked — what `focusedLeafSession()`
-   *  would return with the preview undone. A preview moves the active tab and
-   *  its focus, but it is a view: the accent stays on the row the operator
-   *  chose until they choose another (docs/PREVIEW.md). */
-  function realFocusedSession(): string | null {
-    const p = preview;
-    if (!p) return focusedLeafSession();
-    const tab = layout.tabs.find((t) => t.id === p.prevActiveTabId) ?? activeTab(layout);
-    const leafId =
-      p.prevFocus && p.prevFocus.tabId === tab.id ? p.prevFocus.leafId : tab.focusedLeafId;
-    const fl = leafId ? findLeaf(tab.root, leafId) : null;
-    return fl?.sessionId ?? null;
-  }
-
   /** Update focus styling + pool focus + sidebar highlights without rebuilding
    *  the DOM (cheap path for click-to-focus). */
   function syncFocus(): void {
@@ -248,7 +233,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
     if (!preview) pool.setFocus(focusedLeafSession());
     sidebar.setHighlights({
       open: realOpenSessions(),
-      focused: realFocusedSession(),
+      focused: focusedLeafSession(),
     });
     // The row the preview came from wears the same colour, so the sidebar and
     // the pane read as one thing rather than two unrelated highlights.
@@ -458,7 +443,6 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
     dropPreview();
     const tab = activeTab(layout);
     tab.focusedLeafId = splitLeaf(tab, leafId, null, dir, true);
-    equalizeRatios(tab.root);
     render();
   }
 
@@ -544,7 +528,6 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
       target.sessionId = sessionId;
     } else {
       tab.focusedLeafId = splitLeaf(tab, target.id, sessionId, "row", true);
-      equalizeRatios(tab.root);
     }
     render();
     opts.onOpenSessionsChange?.();
@@ -625,7 +608,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
       { focus: !preview && !quietRender },
     );
     if (!preview) pool.setFocus(focused.sessionId ?? null);
-    sidebar.setHighlights({ open: realOpenSessions(), focused: realFocusedSession() });
+    sidebar.setHighlights({ open: realOpenSessions(), focused: focused.sessionId ?? null });
     sidebar.setPreview(preview?.sessionId ?? null);
   }
 
@@ -818,7 +801,6 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
     if (source.kind === "pane" && self) removeLeaf(tab, self);
     else if (loc) removeLeaf(loc.tab, loc.leaf.id);
     tab.focusedLeafId = splitLeaf(tab, targetLeafId, sessionId, dir, after);
-    equalizeRatios(tab.root);
     render();
   }
 
@@ -835,7 +817,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
     openSessions: realOpenSessions,
     beginSessionDrag,
     render,
-    focusedSessionId: realFocusedSession,
+    focusedSessionId: focusedLeafSession,
     previewSession,
     previewedSessionId: () => preview?.sessionId ?? null,
   };

web/src/preview.test.ts

@@ -47,20 +47,12 @@ function fakePool(): Spy {
 
 /** Last value the controller pushed to `SidebarHandle.setPreview`. */
 const previewRow: { id: string | null } = { id: null };
-/** Last highlights the controller pushed to `SidebarHandle.setHighlights`. */
-const rowHighlights: { open: Set<string>; focused: string | null } = {
-  open: new Set(),
-  focused: null,
-};
 
 function fakeSidebar(): SidebarHandle {
   return {
     el: document.createElement("aside"),
     setActive() {},
-    setHighlights(h) {
-      rowHighlights.open = h.open;
-      rowHighlights.focused = h.focused;
-    },
+    setHighlights() {},
     setPreview(id: string | null) {
       previewRow.id = id;
     },
@@ -103,8 +95,6 @@ describe("sidebar preview", () => {
     stubFetch();
     document.body.replaceChildren();
     previewRow.id = null;
-    rowHighlights.open = new Set();
-    rowHighlights.focused = null;
   });
 
   afterEach(() => {
@@ -144,28 +134,6 @@ describe("sidebar preview", () => {
     expect(mv.el.querySelectorAll(".mv-pane.is-preview")).toHaveLength(0);
   });
 
-  it("leaves the accent on the session the pane actually holds", () => {
-    const layout = twoTabs();
-    const spy = fakePool();
-    const mv = makeMv(layout, spy.pool);
-    expect(rowHighlights.focused).toBe("s2");
-
-    // Walking past other rows never moves the accent off what the operator
-    // picked: only a real open does (docs/PREVIEW.md).
-    mv.previewSession("s1");
-    expect(rowHighlights.focused).toBe("s2");
-    expect(mv.focusedSessionId()).toBe("s2");
-
-    mv.previewSession("s9");
-    expect(rowHighlights.focused).toBe("s2");
-
-    mv.previewSession(null);
-    expect(rowHighlights.focused).toBe("s2");
-
-    mv.openSession("s1");
-    expect(rowHighlights.focused).toBe("s1");
-  });
-
   it("shows a session no pane holds in a throwaway tab that leaves no trace", () => {
     const layout = twoTabs();
     const before = serializeLayout(layout);

web/src/types.ts

@@ -6,7 +6,10 @@ import { escapeHtml } from "./html.js";
 export type Uuid = string;
 export type IsoTimestamp = string;
 
-export type SessionStatus = "Running" | "Dead";
+/** `Dormant` (#162) is a session the daemon knows only from its sidecar —
+ * recovered after the tmux server died under it, so there is no pane behind it
+ * and nothing to attach to. Listed, never live. */
+export type SessionStatus = "Running" | "Dead" | "Dormant";
 
 /** Daemon-inferred activity dimension, orthogonal to `SessionStatus` (NAP-340).
  * Absent on payloads from daemons that predate the field. `Error` is only set