fix(maestro): focus the kill button in kill dialogs

Enter now confirms the kill the operator just asked for; Escape and the scrim still cancel.
Merge remote-tracking branch 'origin/main' into sarabande
2026-09-04 08:24:32 +01:00 · 2026-09-04 08:18:02 +01:00 · 2026-09-04 08:17:14 +01:00 · 2026-09-04 08:15:35 +01:00
22 changed files with 163 additions and 470 deletions
@@ -188,7 +188,6 @@ fn print_session_table(out: &mut impl Write, sessions: &[Session], info: &Daemon
        let status = match s.status {
            SessionStatus::Running => "running",
            SessionStatus::Dead => "dead",
-            SessionStatus::Dormant => "dormant",
        };
        let activity = match s.activity {
            ActivityState::Active => "active",
@@ -62,10 +62,7 @@ pub struct SessionRecord {
    /// `base_repo` from the original `WorktreeSpec`. Needed because `git
    /// worktree remove` is invoked from the base repo.
    pub worktree_base_repo: Option<PathBuf>,
-    /// The PTY bridge feeding this session's attach stream. `None` for a
-    /// `Dormant` session (#162): there is no pane behind it, so there is
-    /// nothing to pipe and nothing to attach to.
-    pub bridge: Option<PtyBridge>,
+    pub bridge: PtyBridge,
    /// Agent-reported activity (#105) still within its TTL. While in force it
    /// outranks the activity pass's own inference; when it lapses, inference
    /// resumes and [`Session::activity_detail`] is cleared with it. This
@@ -294,10 +291,7 @@ impl SessionManager {
    /// unknown to this daemon.
    pub async fn subscribe_pty(&self, id: Uuid) -> Option<broadcast::Receiver<Vec<u8>>> {
        let sessions = self.inner.sessions.lock().await;
-        sessions
-            .get(&id)
-            .and_then(|r| r.bridge.as_ref())
-            .map(|b| b.subscribe())
+        sessions.get(&id).map(|r| r.bridge.subscribe())
    }

    /// Subscribe to a session's PTY broadcast and return the replay buffer
@@ -316,26 +310,19 @@ impl SessionManager {
        let (result, updated) = {
            let mut sessions = self.inner.sessions.lock().await;
            let rec = sessions.get_mut(&id)?;
-            let SessionRecord {
-                session, bridge, ..
-            } = &mut *rec;
-            // #162: a dormant session has no bridge and no pane — nothing was
-            // ever piped for it, so there is no stream to hand back and the
-            // attach reads as unknown. Checked before anything is stamped.
-            let bridge = bridge.as_ref()?;
-            session.last_focused_at = Some(Utc::now());
-            let updated = session.clone();
+            rec.session.last_focused_at = Some(Utc::now());
+            let updated = rec.session.clone();
            // For a live session, tmux's own screen beats the byte tail: the
            // tail starts mid-stream, so a full-screen program (an agent TUI)
            // replayed from it renders as garbage until something forces a
            // repaint. A dead session has no pane left to capture, so it
            // keeps the byte tail.
-            let alive = session.status == SessionStatus::Running;
+            let alive = rec.session.status == SessionStatus::Running;
            // The capture shells out to tmux while the replay lock is held,
            // which parks the reader for the length of one tmux round-trip.
            // That only happens on attach, and the alternative is a seam in
            // the stream.
-            let result = bridge.subscribe_with_snapshot(|| {
+            let result = rec.bridge.subscribe_with_snapshot(|| {
                if !alive {
                    return None;
                }
@@ -512,7 +499,7 @@ impl SessionManager {
                    fifo_path,
                    worktree_path,
                    worktree_base_repo,
-                    bridge: Some(bridge),
+                    bridge,
                    reported_activity: None,
                    settled: false,
                    #[cfg(feature = "haiku-autoname")]
@@ -720,7 +707,7 @@ impl SessionManager {
                    // directory blocks that branch forever (#54 review).
                    worktree_path: session.worktree.as_ref().map(|w| w.path.clone()),
                    worktree_base_repo: session.worktree.as_ref().map(|w| w.base_repo.clone()),
-                    bridge: Some(bridge),
+                    bridge,
                    reported_activity: None,
                    settled: false,
                    #[cfg(feature = "haiku-autoname")]
@@ -735,89 +722,16 @@ impl SessionManager {
                .send(CatalogEvent::SessionAdded { session });
            adopted += 1;
        }
-        self.register_dormant().await;
        Ok(adopted)
    }

-    /// Second recovery pass (#162): register every sidecar tmux had nothing to
-    /// adopt as a [`SessionStatus::Dormant`] session.
-    ///
-    /// A host reboot kills the tmux server, so the first pass runs over an
-    /// empty list and every session would otherwise disappear from the API
-    /// while its sidecar sat untouched on disk. A dormant record keeps the id,
-    /// name, cwd, command, worktree and `created_at` — everything the sidecar
-    /// holds — so the operator still has a record of what was running. It has
-    /// no tmux session and no [`PtyBridge`] behind it: it cannot be attached
-    /// to, cannot be typed into, and is skipped by both watcher passes. The
-    /// only thing left to do with one is dismiss it, which removes the sidecar
-    /// so the next recovery does not bring it back.
-    ///
-    /// Activity is not carried over: whatever the session was doing, it is not
-    /// doing it now. The rest of the sidecar is left as written.
-    async fn register_dormant(&self) {
-        let stored = match self.inner.sidecar.load_all() {
-            Ok(stored) => stored,
-            Err(e) => {
-                tracing::warn!(error = ?e, "recover: reading sidecars for dormant sessions failed");
-                return;
-            }
-        };
-        let mut registered = Vec::new();
-        {
-            let mut sessions = self.inner.sessions.lock().await;
-            for mut session in stored {
-                if sessions.contains_key(&session.id) {
-                    // Adopted live by the first pass; its sidecar is on disk too.
-                    continue;
-                }
-                let id = session.id;
-                session.status = SessionStatus::Dormant;
-                session.foreground = None;
-                session.activity = ActivityState::Idle;
-                session.activity_detail = None;
-                sessions.insert(
-                    id,
-                    SessionRecord {
-                        session: session.clone(),
-                        fifo_path: self.inner.fifo_dir.join(format!("{id}.fifo")),
-                        // Still known, so a dismissal cleans the worktree up —
-                        // the same reason recovery restores it for a live
-                        // session (#54 review).
-                        worktree_path: session.worktree.as_ref().map(|w| w.path.clone()),
-                        worktree_base_repo: session.worktree.as_ref().map(|w| w.base_repo.clone()),
-                        bridge: None,
-                        reported_activity: None,
-                        settled: false,
-                        #[cfg(feature = "haiku-autoname")]
-                        naming: false,
-                        focused_since: None,
-                        awaiting_suppressed: false,
-                    },
-                );
-                registered.push(session);
-            }
-        }
-        if !registered.is_empty() {
-            tracing::info!(
-                dormant = registered.len(),
-                "registered sessions with no live tmux as dormant"
-            );
-        }
-        for session in registered {
-            let _ = self
-                .inner
-                .events
-                .send(CatalogEvent::SessionAdded { session });
-        }
-    }
-
-    /// Forward keystrokes to a session's pane. A dead or dormant session is
-    /// read-only — its pane is gone, so this is a no-op rather than a tmux
-    /// failure the client would have to interpret.
+    /// Forward keystrokes to a session's pane. A dead session is read-only —
+    /// its pane is gone, so this is a no-op rather than a tmux failure the
+    /// client would have to interpret.
    pub async fn send_keys(&self, id: Uuid, bytes: &[u8]) -> Result<(), SessionError> {
        match self.status(id).await {
            None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead | SessionStatus::Dormant) => return Ok(()),
+            Some(SessionStatus::Dead) => return Ok(()),
            Some(SessionStatus::Running) => {}
        }
        let tmux = self.inner.tmux.clone();
@@ -830,15 +744,13 @@ impl SessionManager {
    /// Type `text` into a session's pane, with an Enter after it when
    /// `submit` is set.
    ///
-    /// Unlike [`Self::send_keys`], a dead or dormant session is an error: the
-    /// caller asked for text to land somewhere, and a silent success would let
-    /// a script believe an agent had been told something it never heard.
+    /// Unlike [`Self::send_keys`], a dead session is an error: the caller
+    /// asked for text to land somewhere, and a silent success would let a
+    /// script believe an agent had been told something it never heard.
    pub async fn send_input(&self, id: Uuid, text: &str, submit: bool) -> Result<(), SessionError> {
        match self.status(id).await {
            None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead | SessionStatus::Dormant) => {
-                return Err(SessionError::NotRunning(id))
-            }
+            Some(SessionStatus::Dead) => return Err(SessionError::NotRunning(id)),
            Some(SessionStatus::Running) => {}
        }
        let tmux = self.inner.tmux.clone();
@@ -856,12 +768,12 @@ impl SessionManager {
        Ok(())
    }

-    /// Resize a session's window. No-op for a dead or dormant session, as with
+    /// Resize a session's window. No-op for a dead session, as with
    /// [`Self::send_keys`].
    pub async fn resize(&self, id: Uuid, cols: u16, rows: u16) -> Result<(), SessionError> {
        match self.status(id).await {
            None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead | SessionStatus::Dormant) => return Ok(()),
+            Some(SessionStatus::Dead) => return Ok(()),
            Some(SessionStatus::Running) => {}
        }
        let tmux = self.inner.tmux.clone();
@@ -1262,11 +1174,7 @@ async fn run_activity_pass(inner: &Arc<Inner>) {
                    rec.session.activity_detail = None;
                }
            }
-            // Only `Running` sessions reach this pass, and every one of them
-            // has a bridge; a dormant session has neither pane nor bridge.
-            let Some(idle) = rec.bridge.as_ref().map(|b| b.idle_for()) else {
-                continue;
-            };
+            let idle = rec.bridge.idle_for();
            // #105: while a report is in force it supplies the state and
            // nothing here may overwrite it; only an unreported session is
            // decided by inference.
@@ -1384,10 +1292,8 @@ async fn run_blocked_work_pass(inner: &Arc<Inner>) {
 /// alone and stays attached to the dead record for a later forced dismissal
 /// (#81), which leaves it on disk too.
 ///
-/// A dead session does not come back as dead across a daemon restart: its
-/// sidecar survives, so [`SessionManager::recover`]'s second pass registers it
-/// as [`SessionStatus::Dormant`] (#162) — accurate either way, since neither
-/// has a pane behind it.
+/// Dead sessions do not survive a daemon restart: [`SessionManager::recover`]
+/// adopts only what tmux still holds.
 async fn mark_session_dead(inner: &Arc<Inner>, id: Uuid) {
    let flipped = {
        let mut sessions = inner.sessions.lock().await;
@@ -1396,9 +1302,7 @@ async fn mark_session_dead(inner: &Arc<Inner>, id: Uuid) {
                record.session.status = SessionStatus::Dead;
                // Release anyone attached; the scrollback survives for a later
                // attach.
-                if let Some(bridge) = record.bridge.as_mut() {
-                    bridge.seal();
-                }
+                record.bridge.seal();
                let session = record.session.clone();
                let worktree = record
                    .worktree_base_repo
@@ -140,140 +140,6 @@ async fn recover_adopts_existing_tmux_sessions() {
    assert_eq!(snap[0].command, "sleep 30");
 }

-/// #162: a host reboot kills the tmux server, so recovery finds nothing to
-/// adopt while every sidecar is still on disk. Those sessions come back as
-/// `Dormant` — a record of what was running — rather than vanishing from the
-/// API and leaving the operator with nothing.
-#[tokio::test]
-async fn recover_registers_orphaned_sidecars_as_dormant() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-    let mut metadata = HashMap::new();
-    metadata.insert(
-        maestro_protocol::NAME_KEY.to_string(),
-        serde_json::Value::String("after-reboot".into()),
-    );
-
-    let s = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata,
-            worktree: None,
-        })
-        .await
-        .expect("create");
-
-    // The reboot: the tmux server is gone, the sidecar is untouched.
-    fx.tmux.tmux.kill_server().expect("kill tmux server");
-
-    let revived = revive(&fx);
-    let adopted = revived.recover().await.expect("recover");
-    assert_eq!(adopted, 0, "no live tmux session left to adopt");
-
-    let snap = revived.snapshot().await;
-    assert_eq!(snap.len(), 1, "the sidecar's session is still listed");
-    assert_eq!(snap[0].id, s.id);
-    assert_eq!(snap[0].status, SessionStatus::Dormant);
-    assert_eq!(snap[0].command, "sleep 30");
-    assert_eq!(snap[0].cwd, s.cwd);
-    assert_eq!(snap[0].created_at, s.created_at);
-    assert_eq!(
-        snap[0]
-            .metadata
-            .get(maestro_protocol::NAME_KEY)
-            .and_then(|v| v.as_str()),
-        Some("after-reboot"),
-    );
-}
-
-/// #162: a session tmux still holds is adopted `Running` by the first pass and
-/// must not be re-registered as dormant by the second — the sidecar is on disk
-/// for both.
-#[tokio::test]
-async fn recover_does_not_mark_adopted_sessions_dormant() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-
-    let live = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create live");
-    let orphan = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 31".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create orphan");
-    // Only the second session loses its pane.
-    fx.tmux.tmux.kill_session(orphan.id).expect("kill session");
-
-    let revived = revive(&fx);
-    assert_eq!(revived.recover().await.expect("recover"), 1);
-
-    let mut snap = revived.snapshot().await;
-    snap.sort_by_key(|s| s.command.clone());
-    assert_eq!(snap.len(), 2);
-    assert_eq!(snap[0].id, live.id);
-    assert_eq!(snap[0].status, SessionStatus::Running);
-    assert_eq!(snap[1].id, orphan.id);
-    assert_eq!(snap[1].status, SessionStatus::Dormant);
-}
-
-/// #162: dismissing a dormant session is the one thing that can be done to it
-/// — no tmux call to fail, and the sidecar goes with it so the next recovery
-/// does not resurrect it.
-#[tokio::test]
-async fn dormant_session_can_be_dismissed() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-
-    let s = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create");
-    fx.tmux.tmux.kill_server().expect("kill tmux server");
-
-    let revived = revive(&fx);
-    revived.recover().await.expect("recover");
-    revived.kill(s.id, false).await.expect("dismiss");
-
-    assert!(!revived.has(s.id).await);
-    assert!(!fx.sidecar_dir().join(format!("{}.json", s.id)).exists());
-}
-
-/// A second `SessionManager` over the same dirs and the same tmux server —
-/// what a daemon restart looks like from inside a test.
-fn revive(fx: &DaemonFixture) -> maestro_daemon::SessionManager {
-    maestro_daemon::SessionManager::new(
-        Arc::new(fx.tmux.tmux.clone()),
-        maestro_daemon::sidecar::SidecarStore::new(fx.sidecar_dir()),
-        maestro_daemon::worktree::WorktreeManager::new(None),
-        fx.fifo_dir(),
-    )
-}
-
 /// Regression for NAP-253: the very first bytes a freshly-spawned command
 /// writes must reach the replay buffer. Before the fix, `pipe-pane` was a
 /// separate tmux invocation that ran after `new-session` + an async FIFO
@@ -123,38 +123,10 @@ fn epoch() -> DateTime<Utc> {
    DateTime::from_timestamp(0, 0).expect("unix epoch is a valid timestamp")
 }

-/// Lifecycle of a session as the daemon knows it.
-///
-/// Deserializes leniently, like [`ActivityState`] (#162): an unknown spelling
-/// from a newer daemon reads as [`SessionStatus::Dead`] instead of failing the
-/// whole `Session`. `Dead` is the safe degrade — an unrecognised session is
-/// one this client must not treat as having a live pane to type into.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub enum SessionStatus {
    Running,
    Dead,
-    /// Known from its sidecar, with no tmux session behind it (#162). The
-    /// daemon registers these at recovery time for every sidecar tmux had
-    /// nothing to adopt — after a host reboot, that is every session there
-    /// was. There is no pane and no PTY bridge: a dormant session is a record
-    /// of what was running, listed so the operator still has it, and the only
-    /// thing that can be done to it is dismissing it.
-    Dormant,
-}
-
-impl<'de> Deserialize<'de> for SessionStatus {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        let s = String::deserialize(deserializer)?;
-        Ok(match s.as_str() {
-            "Running" => Self::Running,
-            "Dormant" => Self::Dormant,
-            // Known or not, any other spelling degrades to the inert variant.
-            _ => Self::Dead,
-        })
-    }
 }

 /// Inferred session activity, orthogonal to [`SessionStatus`] (NAP-340). The
@@ -1087,33 +1059,6 @@ mod tests {
            serde_json::to_value(SessionStatus::Dead).unwrap(),
            serde_json::json!("Dead")
        );
-        assert_eq!(
-            serde_json::to_value(SessionStatus::Dormant).unwrap(),
-            serde_json::json!("Dormant")
-        );
-    }
-
-    // #162: a session with no tmux behind it still rides the wire whole.
-    #[test]
-    fn dormant_session_round_trips() {
-        let mut s = sample_session();
-        s.status = SessionStatus::Dormant;
-        assert_eq!(s, round_trip(&s));
-    }
-
-    // #162: a `SessionStatus` this client does not know must degrade to the
-    // inert variant, not fail the whole `Session` the way a derived
-    // `Deserialize` would.
-    #[test]
-    fn unknown_session_status_degrades_to_dead() {
-        assert_eq!(
-            serde_json::from_value::<SessionStatus>(serde_json::json!("Hibernating")).unwrap(),
-            SessionStatus::Dead
-        );
-        let mut value = serde_json::to_value(sample_session()).unwrap();
-        value["status"] = serde_json::json!("Hibernating");
-        let s: Session = serde_json::from_value(value).expect("session survives unknown status");
-        assert_eq!(s.status, SessionStatus::Dead);
    }

    #[test]
@@ -194,9 +194,7 @@ pub enum BarOutcome {
 pub fn order_sessions_for_bar(sessions: &[Session]) -> Vec<&Session> {
    let mut ordered: Vec<&Session> = sessions.iter().collect();
    ordered.sort_by(|a, b| {
-        // docs/COMMAND-BAR.md: anything with no live pane — dead or dormant
-        // (#162) — sorts after the sessions you could actually attach to.
-        let dead = |s: &Session| u8::from(s.status != SessionStatus::Running);
+        let dead = |s: &Session| u8::from(s.status == SessionStatus::Dead);
        dead(a)
            .cmp(&dead(b))
            .then_with(|| {
@@ -321,7 +319,7 @@ impl CommandBar {
            .map(|s| BarEntry {
                candidate: MatchCandidate::Session(session_candidate(s, home_dir)),
                target: BarTarget::Session(s.id),
-                dead: s.status != SessionStatus::Running,
+                dead: s.status == SessionStatus::Dead,
                chords: Vec::new(),
            })
            .collect();
@@ -891,23 +889,6 @@ mod tests {
        assert!(bar.rows()[1].dead);
    }

-    /// #162: docs/COMMAND-BAR.md ranks by whether you could attach, not by
-    /// which way the pane went away — a dormant session sorts with the dead.
-    #[test]
-    fn dormant_sessions_sort_after_live_ones_however_recent() {
-        let mut dormant = named(1, "dormant");
-        dormant.status = SessionStatus::Dormant;
-        dormant.last_focused_at = Some(at(99));
-        let live = named(2, "live");
-
-        let bar = CommandBar::new(&[dormant, live], &[], "/home/me");
-        assert_eq!(
-            ids(bar.rows()),
-            vec![Uuid::from_u128(2), Uuid::from_u128(1)]
-        );
-        assert!(bar.rows()[1].dead);
-    }
-
    #[test]
    fn typing_ranks_through_the_matcher_and_returns_ranges() {
        let mut bar = CommandBar::new(
@@ -268,8 +268,6 @@ impl Sidebar {
    fn name_row(&self, s: &Session, width: usize, focused: bool) -> Vec<Span<'static>> {
        let glyph = match (s.status, self.attached.contains(&s.id)) {
            (SessionStatus::Dead, _) => "✗",
-            // #162: known from its sidecar, nothing running behind it.
-            (SessionStatus::Dormant, _) => "◌",
            (SessionStatus::Running, true) => "●",
            (SessionStatus::Running, false) => "○",
        };
@@ -324,7 +322,6 @@ impl Sidebar {
        // on line 1; the kill confirm names the specifics.
        let blocked = s.blocked_work.filter(|b| !b.is_clear());
        let dead = s.status == SessionStatus::Dead;
-        let dormant = s.status == SessionStatus::Dormant;
        let highlighted = self.highlight == Some(SidebarItem::Session(s.id));
        let fill = self.card_fill(s, focused);
        let base = card_base(fill, focused);
@@ -364,9 +361,6 @@ impl Sidebar {
        if dead {
            tail.push(Span::styled(" exited", muted));
        }
-        if dormant {
-            tail.push(Span::styled(" dormant", muted));
-        }
        // docs/SIDEBAR.md: the card names the program, never its arguments.
        let command = Span::styled(format!(" {}", command_program(&s.command)), muted);

@@ -1074,39 +1068,6 @@ mod tests {
        );
    }

-    /// #162, docs/SIDEBAR.md: a dormant session is known but not running —
-    /// its own glyph on line 1 and the muted `dormant` fragment on line 2, so
-    /// it never reads as something that exited.
-    #[test]
-    fn dormant_session_reads_as_known_but_not_running() {
-        let mut s = session_named(1, "claude");
-        s.status = SessionStatus::Dormant;
-        s.activity_since = Utc::now() - Duration::seconds(5);
-        let sb = Sidebar {
-            sessions: vec![s],
-            highlight: None,
-            attached: Default::default(),
-            pane_session: None,
-        };
-        let all = rows(&draw(&sb, 28, 8));
-        let idx = all.iter().position(|l| l.contains("claude")).unwrap();
-        assert!(
-            all[idx].contains('\u{25cc}'),
-            "expected the dormant glyph in: {:?}",
-            all[idx]
-        );
-        assert!(
-            all[idx + 1].contains("dormant"),
-            "expected dormant fragment in: {:?}",
-            all[idx + 1]
-        );
-        assert!(
-            !all[idx + 1].contains("exited"),
-            "a dormant session never reads as exited: {:?}",
-            all[idx + 1]
-        );
-    }
-
    /// docs/SIDEBAR.md: line 2 names the program, never its arguments.
    #[test]
    fn meta_line_drops_the_commands_arguments() {
@@ -123,9 +123,9 @@ client opening `/api/attach/:id`, and a client reporting focus explicitly at
 `POST /api/sessions/:id/focus` when it refocuses a pane that is already open.

 **A session that has never been focused sorts after every session that has**,
-and among those, most recently created first. Sessions with no live pane —
-`Dead`, and `Dormant` (#162) — sort after live ones regardless of recency: a
-session you cannot attach to is not where you just were.
+and among those, most recently created first. Dead sessions sort after live
+ones regardless of recency: a session you cannot attach to is not where you
+just were.

 Under `>` an empty query lists every command in registry order. Under `~` it
 lists recent dirs, most recent first, then the project list.
@@ -47,6 +47,7 @@ Web client (`--preview` and friends in `web/src/styles.css`):
 | The canvas | A `preview` chip, top right, and a dashed inset ring. |
 | A throwaway tab | Dashed border, italic label. |
 | The sidebar row being previewed | Filled with the preview hue, over whatever open state the row already had — but the row of the session already showing in the pane keeps its accent fill, since previewing it changes nothing on screen. |
+| The sidebar row of the session the operator picked | Keeps its accent fill for the whole preview. A preview never moves the accent; only opening another session does. |
 | A hovered sidebar row, and the keyboard cursor on a session | A lighter wash of the same hue, because both are what previews a row. |

 Rows say it with fill, not with an edge — see the tier ladder in
@@ -68,26 +68,6 @@ resolves, so a blocked client is never a trapped one. It clears itself the
 moment a probe succeeds — there is no "retry" button, because the client is
 already retrying.

-## What survives, and what comes back dormant
-
-A daemon restart leaves tmux alone, so recovery re-adopts every
-`maestro-<uuid>` session tmux still holds and the operator sees no change
-beyond the reconnect above.
-
-A **host reboot** is different: it kills the tmux server, so there is nothing
-to adopt while every session's sidecar is still on disk. Recovery makes a
-second pass over those sidecars and registers each as a `Dormant` session
-(#162) — id, name, cwd, command, worktree and `created_at` intact. A dormant
-session has no pane and no PTY bridge: it cannot be attached to, typed into or
-resized, and neither watcher pass touches it. It is a record of what was
-running, and the only thing left to do with one is dismiss it, which removes
-the sidecar so the next recovery does not bring it back.
-
-`SessionStatus` is a wire type, so it deserializes leniently on both clients:
-a spelling this build does not know reads as `Dead` rather than failing the
-whole session. Clients render a dormant session as known-but-not-running —
-see `docs/SIDEBAR.md` for the card and `docs/COMMAND-BAR.md` for how it ranks.
-
 ## Timing

 - **Grace window** — 1200 ms between the socket dropping and the overlay
@@ -56,7 +56,7 @@ itself is not.
 Line 2 reads left to right:

 ```
-[<duration>] [<detail>] <command> [<diff stat> | exited | dormant]
+[<duration>] [<detail>] <command> [<diff stat> | exited]
 ```

 Its minimum content is therefore just the command.
@@ -104,14 +104,8 @@ fragment; it no longer decides whether line 2 exists.
 while an agent-reported state is in force (see Precedence): when the report
 lapses at its TTL or is replaced, the detail goes with it. The detail
 truncates with `…` ahead of the trailing fragments — a long detail never
-pushes `<command>`, `<blocked work>`, `exited` or `dormant` off the line, and
-neither client ever lets it wrap.
-
-`dormant` (#162) is the counterpart of `exited` for a session the daemon knows
-only from its sidecar: recovery found no tmux session behind it, so it has no
-pane, no scrollback, and nothing to attach to. It is not an exit — nothing was
-observed ending — so the two fragments never both show. The TUI marks the same
-state on line 1 with `◌`, next to `✗` for exited and `●`/`○` for running.
+pushes `<command>`, `<blocked work>`, or `exited` off the line, and neither
+client ever lets it wrap.

 `<diff stat>` is the blocked-work breakdown (#83) in diff notation, replacing
 the spelled-out `⚠ 3 uncommitted files, 2 unpushed commits`. It renders only
@@ -215,7 +209,7 @@ the cursor's fill while the pane holds the keyboard, and the web's ring on a
 highlighted **folder** row — a folder previews nothing, so it has no fill to
 step up to.

-The duration text inherits its state's colour; the exited, dormant and command
+The duration text inherits its state's colour; the exited and command
 fragments use the surface's `muted` role, as do the diff stat's `~`, `?` and
 `↑` fragments. Only `+` and `-` step outside the surface's muted role, and they
 take the `active` and `error` roles of the same surface.
@@ -414,19 +414,6 @@ describe("session cards (#107)", () => {
    expect(line2?.textContent).toContain("exited");
  });

-  // #162: a session recovered with no tmux behind it is known but not running,
-  // and never reads as something that exited.
-  it("shows dormant on line 2 for dormant sessions", () => {
-    const s = session({
-      id: "aaaaaaaa-0000-0000-0000-000000000118",
-      status: "Dormant",
-    });
-    const el = renderSidebar(storeWith([s])).el;
-    const line2 = rowFor(el, s.id)?.querySelector<HTMLElement>(".card-line2");
-    expect(line2?.textContent).toContain("dormant");
-    expect(line2?.textContent).not.toContain("exited");
-  });
-
  it("carries the state word only in tooltips and aria labels, never as text", () => {
    const s = session({
      id: "aaaaaaaa-0000-0000-0000-000000000019",
@@ -113,9 +113,6 @@ function activityRailMarkup(slug: string, stateWord: string): string {

 function metaLine(s: Session, now: number): string {
  const dead = s.status === "Dead";
-  // #162: known from its sidecar with nothing running behind it — a distinct
-  // fragment, since it never exited.
-  const dormant = s.status === "Dormant";
  const blockers = sessionBlockers(s);
  const slug = activityColorSlug(s.activity ?? "Idle");
  const held = activityHeldMs(s.activity_since, now);
@@ -130,7 +127,6 @@ function metaLine(s: Session, now: number): string {
    commandFragment(s.command),
    blockers ? blockedFragment(blockers) : "",
    dead ? `<span class="card-flag">exited</span>` : "",
-    dormant ? `<span class="card-flag">dormant</span>` : "",
  ];
  return `<span class="card-line2" data-activity="${slug}">${fragments.join("")}</span>`;
 }
@@ -99,20 +99,6 @@ describe("empty-query ordering", () => {
    ]);
  });

-  // #162: docs/COMMAND-BAR.md ranks by whether you could attach, not by which
-  // way the pane went away.
-  it("sorts dormant sessions after live ones, like dead ones", () => {
-    const dormantRecent = session("dormant", {
-      status: "Dormant",
-      last_focused_at: "2026-06-01T00:00:00Z",
-    });
-    const liveStale = session("live", { last_focused_at: "2020-01-01T00:00:00Z" });
-    expect(orderSessionsForBar([dormantRecent, liveStale]).map((s) => s.id)).toEqual([
-      "live",
-      "dormant",
-    ]);
-  });
-
  it("treats a null last_focused_at as never focused", () => {
    const nulled = session("nulled", { last_focused_at: null });
    const stamped = session("stamped", { last_focused_at: "2020-01-01T00:00:00Z" });
@@ -142,10 +142,8 @@ function createdAt(s: Session): number {
 *  matcher's last tie-break preserves. */
 export function orderSessionsForBar(sessions: readonly Session[]): Session[] {
  return [...sessions].sort((a, b) => {
-    // docs/COMMAND-BAR.md: anything with no live pane — dead or dormant (#162)
-    // — sorts after the sessions you could actually attach to.
-    const deadA = a.status === "Running" ? 0 : 1;
-    const deadB = b.status === "Running" ? 0 : 1;
+    const deadA = a.status === "Dead" ? 1 : 0;
+    const deadB = b.status === "Dead" ? 1 : 0;
    if (deadA !== deadB) return deadA - deadB;

    const focusA = focusedAt(a);
@@ -352,7 +350,7 @@ function renderRow(result: BarResult, index: number): HTMLElement {
  row.dataset.kind = candidate.kind;
  if (candidate.kind === "session") {
    row.dataset.sessionId = candidate.session.id;
-    if (candidate.session.status !== "Running") row.classList.add("is-dead");
+    if (candidate.session.status === "Dead") row.classList.add("is-dead");
  } else if (isActionCandidate(candidate)) {
    row.dataset.actionId = candidate.action.id;
  } else if (candidate.kind === "command") {
@@ -34,12 +34,14 @@ describe("resolveFastForward (#67)", () => {
    const res = resolveFastForward(projects, presets, "amber-falcon");
    expect(res.project?.path).toBe("/repos/fresh");
    expect(res.command).toBe("aider");
-    expect(res.name).toBe("amber-falcon");
+    expect(res.handle).toBe("amber-falcon");

    const req = buildFastForwardRequest(res)!;
    expect(req.cwd).toBe("/repos/fresh");
    expect(req.command).toBe("aider");
-    expect(req.metadata).toEqual({ name: "amber-falcon" });
+    // No name (#131): the daemon names the session after its first prompt,
+    // and a name here would collide with the branch handle.
+    expect(req.metadata).toBeUndefined();
    expect(req.worktree).toEqual({
      base_repo: "/repos/fresh",
      branch: "amber-falcon",
@@ -88,9 +90,9 @@ describe("resolveFastForward (#67)", () => {
    expect(buildFastForwardRequest(res)).toBeNull();
  });

-  it("downgrades to a draft when the generated name is missing", () => {
+  it("downgrades to a draft when the generated handle is missing", () => {
    const res = resolveFastForward([project({ last_command: "claude" })], presets);
-    expect(res.name).toBeUndefined();
+    expect(res.handle).toBeUndefined();
    expect(buildFastForwardRequest(res)).toBeNull();
  });

@@ -108,6 +110,17 @@ describe("resolveFastForward (#67)", () => {
    });
  });

+  it("seeds the handle as the branch and leaves the name field empty (#131)", () => {
+    const res = resolveFastForward(
+      [project({ path: "/repos/p", base_repo: "/repos/p", last_command: "aider" })],
+      presets,
+      "amber-falcon",
+    );
+    const seed = fastForwardSeed(res);
+    expect(seed.name).toBe("");
+    expect(seed.worktreeBranch).toBe("amber-falcon");
+  });
+
  it("leaves the worktree default alone when not even a project resolved", () => {
    // Not `false`: the form defaults the toggle on and a false would stick,
    // so the fallback draft would disagree with a normally-opened draft and
@@ -10,19 +10,21 @@ import { sortProjects } from "./projectList.js";
 export interface FastForwardResolution {
  project?: Project;
  command?: string;
-  name?: string;
+  /** A generated handle for the worktree branch (#131). Not a session name:
+   *  the fast path names no session. */
+  handle?: string;
 }

 /** The defaults: the currently focused session's project when it's still a
 *  known project, else the most recent one (fresh-first, same ordering the
 *  picker shows) — so `N` lands where the operator currently is, matching
 *  what plain `n` seeds from `spawnSimilarProjectSeed`. Its last command
- *  falls back to the first non-custom preset, and the name is freshly
- *  generated when the daemon supplied one. */
+ *  falls back to the first non-custom preset, and the branch handle is
+ *  freshly generated when the daemon supplied one. */
 export function resolveFastForward(
  projects: Project[],
  presets: SpawnPreset[],
-  name?: string,
+  handle?: string,
  focusedCwd?: string,
 ): FastForwardResolution {
  const project =
@@ -30,41 +32,45 @@ export function resolveFastForward(
  const lastCommand = project?.last_command?.trim();
  const command =
    lastCommand || presets.find((p) => p.command !== "")?.command || undefined;
-  return { project, command, name: name || undefined };
+  return { project, command, handle: handle || undefined };
 }

 /** The immediate spawn request — worktree on, new branch named after the
- *  generated session name — or `null` when any default is missing. */
+ *  generated handle — or `null` when any default is missing.
+ *
+ *  The request carries no name (#131): the daemon assigns a provisional one
+ *  and replaces it once the session sees its first prompt. A name here would
+ *  also collide with the branch handle's own session. */
 export function buildFastForwardRequest(
  res: FastForwardResolution,
 ): CreateSessionRequest | null {
-  const { project, command, name } = res;
-  if (!project || !command?.trim() || !name) return null;
+  const { project, command, handle } = res;
+  if (!project || !command?.trim() || !handle) return null;
  return {
    cwd: project.path,
    command,
-    metadata: { name },
    worktree: {
      base_repo: project.base_repo ?? project.path,
-      branch: name,
+      branch: handle,
      create_branch: true,
    },
  };
 }

 /** Seed for the fallback spawn form: whatever did resolve goes into the
- *  form; the rest stays with its own defaults. */
+ *  form; the rest stays with its own defaults. The name field stays empty
+ *  (#131) — the handle seeds the branch, not the session name. */
 export function fastForwardSeed(res: FastForwardResolution) {
  return {
    cwd: res.project?.path ?? "",
    command: res.command ?? "",
-    name: res.name ?? "",
+    name: "",
    // Left undefined rather than false when nothing resolved: the form
    // defaults the toggle on, and `false` would stick, so the fallback form
    // would disagree with both a normally-opened form and the TUI's fast path
    // (#67 review).
    worktreeEnabled: res.project ? true : undefined,
    worktreeBranch:
-      res.project && res.name ? res.name : undefined,
+      res.project && res.handle ? res.handle : undefined,
  };
 }
@@ -0,0 +1,33 @@
+// @vitest-environment happy-dom
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  closeForceKillDialog,
+  openForceKillDialog,
+  openKillConfirmDialog,
+} from "./killDialog.js";
+
+describe("kill dialogs", () => {
+  beforeEach(() => {
+    closeForceKillDialog();
+    document.body.innerHTML = "";
+  });
+
+  it("focuses the kill button, so Enter confirms", () => {
+    const el = openKillConfirmDialog({
+      name: "alpha",
+      blockers: null,
+      onKill: () => Promise.resolve(),
+    });
+    expect(document.activeElement).toBe(el.querySelector(".kill-dialog-kill"));
+  });
+
+  it("focuses the force button too", () => {
+    const el = openForceKillDialog({
+      name: "alpha",
+      blockers: null,
+      reason: "worktree is dirty.",
+      onForce: () => Promise.resolve(),
+    });
+    expect(document.activeElement).toBe(el.querySelector(".kill-dialog-force"));
+  });
+});
@@ -132,9 +132,9 @@ function mount(p: KillDialogSpec): HTMLElement {
  };
  window.addEventListener("keydown", onKeydown, true);
  open = { el, onKeydown };
-  // Cancel takes the focus in both prompts: a kill is never one keystroke
-  // away from whatever asked for the dialog.
-  cancel.focus();
+  // The acting button takes the focus in both prompts: the operator already
+  // asked for the kill, so Enter confirms it. Escape and the scrim cancel.
+  confirm.focus();
  return el;
 }

@@ -356,14 +356,14 @@ async function spawnPresets(): Promise<SpawnPreset[]> {
 }

 async function requestFastForward(): Promise<void> {
-  const [discovered, name] = await Promise.all([
+  const [discovered, handle] = await Promise.all([
    fetchProjects().catch(() => [] as Project[]),
    fetchNames(1)
      .then((batch) => batch.names[0])
      .catch(() => undefined),
  ]);
  const presets = await spawnPresets();
-  const resolved = resolveFastForward(discovered, presets, name, focusedProjectCwd());
+  const resolved = resolveFastForward(discovered, presets, handle, focusedProjectCwd());
  const req = buildFastForwardRequest(resolved);
  if (req) {
    try {
@@ -390,7 +390,7 @@ async function requestFastForward(): Promise<void> {
 // one outside any repo spawns without a worktree, since there is no repo to cut
 // a branch from. Anything still unresolved opens the pre-filled form.
 async function requestSpawnInDirectory(path: string): Promise<void> {
-  const [discovered, name] = await Promise.all([
+  const [discovered, handle] = await Promise.all([
    fetchProjects().catch(() => [] as Project[]),
    fetchNames(1)
      .then((batch) => batch.names[0])
@@ -399,7 +399,7 @@ async function requestSpawnInDirectory(path: string): Promise<void> {
  const presets = await spawnPresets();
  const known = discovered.find((p) => p.path === path);
  const project: Project = known ?? { path, name: path.split("/").filter(Boolean).pop() ?? path };
-  const resolved = resolveFastForward([project], presets, name, path);
+  const resolved = resolveFastForward([project], presets, handle, path);
  const req = buildFastForwardRequest(resolved);
  if (req) {
    const inRepo =
@@ -215,6 +215,20 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
    return fl?.sessionId ?? null;
  }

+  /** The session the operator actually picked — what `focusedLeafSession()`
+   *  would return with the preview undone. A preview moves the active tab and
+   *  its focus, but it is a view: the accent stays on the row the operator
+   *  chose until they choose another (docs/PREVIEW.md). */
+  function realFocusedSession(): string | null {
+    const p = preview;
+    if (!p) return focusedLeafSession();
+    const tab = layout.tabs.find((t) => t.id === p.prevActiveTabId) ?? activeTab(layout);
+    const leafId =
+      p.prevFocus && p.prevFocus.tabId === tab.id ? p.prevFocus.leafId : tab.focusedLeafId;
+    const fl = leafId ? findLeaf(tab.root, leafId) : null;
+    return fl?.sessionId ?? null;
+  }
+
  /** Update focus styling + pool focus + sidebar highlights without rebuilding
   *  the DOM (cheap path for click-to-focus). */
  function syncFocus(): void {
@@ -233,7 +247,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
    if (!preview) pool.setFocus(focusedLeafSession());
    sidebar.setHighlights({
      open: realOpenSessions(),
-      focused: focusedLeafSession(),
+      focused: realFocusedSession(),
    });
    // The row the preview came from wears the same colour, so the sidebar and
    // the pane read as one thing rather than two unrelated highlights.
@@ -608,7 +622,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
      { focus: !preview && !quietRender },
    );
    if (!preview) pool.setFocus(focused.sessionId ?? null);
-    sidebar.setHighlights({ open: realOpenSessions(), focused: focused.sessionId ?? null });
+    sidebar.setHighlights({ open: realOpenSessions(), focused: realFocusedSession() });
    sidebar.setPreview(preview?.sessionId ?? null);
  }

@@ -817,7 +831,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
    openSessions: realOpenSessions,
    beginSessionDrag,
    render,
-    focusedSessionId: focusedLeafSession,
+    focusedSessionId: realFocusedSession,
    previewSession,
    previewedSessionId: () => preview?.sessionId ?? null,
  };
@@ -47,12 +47,20 @@ function fakePool(): Spy {

 /** Last value the controller pushed to `SidebarHandle.setPreview`. */
 const previewRow: { id: string | null } = { id: null };
+/** Last highlights the controller pushed to `SidebarHandle.setHighlights`. */
+const rowHighlights: { open: Set<string>; focused: string | null } = {
+  open: new Set(),
+  focused: null,
+};

 function fakeSidebar(): SidebarHandle {
  return {
    el: document.createElement("aside"),
    setActive() {},
-    setHighlights() {},
+    setHighlights(h) {
+      rowHighlights.open = h.open;
+      rowHighlights.focused = h.focused;
+    },
    setPreview(id: string | null) {
      previewRow.id = id;
    },
@@ -95,6 +103,8 @@ describe("sidebar preview", () => {
    stubFetch();
    document.body.replaceChildren();
    previewRow.id = null;
+    rowHighlights.open = new Set();
+    rowHighlights.focused = null;
  });

  afterEach(() => {
@@ -134,6 +144,28 @@ describe("sidebar preview", () => {
    expect(mv.el.querySelectorAll(".mv-pane.is-preview")).toHaveLength(0);
  });

+  it("leaves the accent on the session the pane actually holds", () => {
+    const layout = twoTabs();
+    const spy = fakePool();
+    const mv = makeMv(layout, spy.pool);
+    expect(rowHighlights.focused).toBe("s2");
+
+    // Walking past other rows never moves the accent off what the operator
+    // picked: only a real open does (docs/PREVIEW.md).
+    mv.previewSession("s1");
+    expect(rowHighlights.focused).toBe("s2");
+    expect(mv.focusedSessionId()).toBe("s2");
+
+    mv.previewSession("s9");
+    expect(rowHighlights.focused).toBe("s2");
+
+    mv.previewSession(null);
+    expect(rowHighlights.focused).toBe("s2");
+
+    mv.openSession("s1");
+    expect(rowHighlights.focused).toBe("s1");
+  });
+
  it("shows a session no pane holds in a throwaway tab that leaves no trace", () => {
    const layout = twoTabs();
    const before = serializeLayout(layout);
@@ -6,10 +6,7 @@ import { escapeHtml } from "./html.js";
 export type Uuid = string;
 export type IsoTimestamp = string;

-/** `Dormant` (#162) is a session the daemon knows only from its sidecar —
- * recovered after the tmux server died under it, so there is no pane behind it
- * and nothing to attach to. Listed, never live. */
-export type SessionStatus = "Running" | "Dead" | "Dormant";
+export type SessionStatus = "Running" | "Dead";

 /** Daemon-inferred activity dimension, orthogonal to `SessionStatus` (NAP-340).
 * Absent on payloads from daemons that predate the field. `Error` is only set
Author	SHA1	Message	Date
Miguel Palhas	52877abe29	fix(maestro): focus the kill button in kill dialogs ci / web (push) Successful in 37s Details ci / flake (push) Successful in 2m50s Details ci / rust (push) Successful in 5m46s Details Enter now confirms the kill the operator just asked for; Escape and the scrim still cancel.	2026-09-04 08:24:32 +01:00
Miguel Palhas	43fc3a3735	Merge remote-tracking branch 'origin/main' into sarabande ci / web (push) Successful in 41s Details ci / flake (push) Successful in 4m45s Details ci / rust (push) Successful in 8m58s Details	2026-09-04 08:18:02 +01:00
Miguel Palhas	ff1ffb377c	fix(maestro): leave fast-forward spawns unnamed in the web client The web N path sent the generated handle as the session name as well as the worktree branch, so the session was born named and never got its Haiku name from its first prompt. The TUI already spawns unnamed (#131); the handle now only seeds the branch.	2026-09-04 08:17:14 +01:00
Miguel Palhas	ba74d3515b	fix(maestro): keep sidebar accent on the picked session while previewing ci / rust (push) Successful in 10m9s Details ci / web (push) Failing after 7s Details ci / flake (push) Successful in 2m56s Details A preview moved the active tab's focus, and the sidebar took that as the focused session, so hovering another row dropped the accent from the row the operator had actually opened. Report the pre-preview focus instead.	2026-09-04 08:15:35 +01:00