Startup tmux reconciliation still reads the legacy single-window workspace envelope, while the current workspace store persists version 2 with windows[].workspace.
Expected: collect terminal tmuxName references from every persisted window before classifying managed tmux sessions as recoverable or orphaned.
Actual source behavior at 6a19e4eef9ce93a2691e08118d0637bf562dafc4: startApp reads parsed.workspace?.sessions ?? {}. A v2 workspace has no top-level workspace, so it supplies an empty reference list. reconcile considers every managed live session absent from that list an orphan and calls killSession on it. This can destroy shell continuity on restart despite valid saved terminal references.
Evidence:
Deterministic regression case: supply a v2 workspace containing a terminal with tmuxName, and a fake registry listing that exact managed session. The startup reference extraction plus reconciliation should return it as recoverable and make no kill call. Include references from more than one window and retain legacy migration coverage.
Discovered through source tracing during #897; no live terminal processes were launched or killed to reproduce it. Runtime behavior should be confirmed with the fixture above before a fix. Environment inspected: macOS checkout, Agent Code 0.0.2-beta.1, bundled tmux path. This is a separate runtime follow-up; the architecture PR only documents the limitation. Related broader recovery work: #545.
Implementation verification (2026-09-12)
Revalidated the defect at 552914f5610518458f944fa1bdaf63f243685bd1. PR #933 implements canonical v1/v2 decoding and complete/incomplete/unknown inventory before cleanup. Regression coverage exercises the actual startup helper through the real decoder and reconciliation, with only file/registry boundaries supplied by fixtures.
The initial extracted legacy reader failed 21 of the first 25 cases; the v2 fixture returned zero recoverable references. The completed fix passes 58 focused tests (36 new recovery cases), type checking, the test contract, all seven package-pin checks, and app build-output verification. The original implementation passed both CI gates. A plan-conformance follow-up adds a digest identifying the inspected workspace byte snapshot; its updated 58-test suite and typecheck pass locally, and the latest CI/review state lives in #933. No live user tmux session was launched, attached, or killed.
Acceptance also protects partial/corrupt/future/read-failure inventory: unknown must not become empty at destructive cleanup admission. This PR's preservation is scoped to the startup snapshot, not durable quarantine across later workspace repair/saves; broader repair provenance remains tracked in #918.
Startup tmux reconciliation still reads the legacy single-window workspace envelope, while the current workspace store persists version 2 with
windows[].workspace.Expected: collect terminal
tmuxNamereferences from every persisted window before classifying managed tmux sessions as recoverable or orphaned.Actual source behavior at
6a19e4eef9ce93a2691e08118d0637bf562dafc4:startAppreadsparsed.workspace?.sessions ?? {}. A v2 workspace has no top-levelworkspace, so it supplies an empty reference list.reconcileconsiders every managed live session absent from that list an orphan and callskillSessionon it. This can destroy shell continuity on restart despite valid saved terminal references.Evidence:
Deterministic regression case: supply a v2 workspace containing a terminal with
tmuxName, and a fake registry listing that exact managed session. The startup reference extraction plus reconciliation should return it as recoverable and make no kill call. Include references from more than one window and retain legacy migration coverage.Discovered through source tracing during #897; no live terminal processes were launched or killed to reproduce it. Runtime behavior should be confirmed with the fixture above before a fix. Environment inspected: macOS checkout, Agent Code
0.0.2-beta.1, bundled tmux path. This is a separate runtime follow-up; the architecture PR only documents the limitation. Related broader recovery work: #545.Implementation verification (2026-09-12)
Revalidated the defect at
552914f5610518458f944fa1bdaf63f243685bd1. PR #933 implements canonical v1/v2 decoding and complete/incomplete/unknown inventory before cleanup. Regression coverage exercises the actual startup helper through the real decoder and reconciliation, with only file/registry boundaries supplied by fixtures.The initial extracted legacy reader failed 21 of the first 25 cases; the v2 fixture returned zero recoverable references. The completed fix passes 58 focused tests (36 new recovery cases), type checking, the test contract, all seven package-pin checks, and app build-output verification. The original implementation passed both CI gates. A plan-conformance follow-up adds a digest identifying the inspected workspace byte snapshot; its updated 58-test suite and typecheck pass locally, and the latest CI/review state lives in #933. No live user tmux session was launched, attached, or killed.
Acceptance also protects partial/corrupt/future/read-failure inventory: unknown must not become empty at destructive cleanup admission. This PR's preservation is scoped to the startup snapshot, not durable quarantine across later workspace repair/saves; broader repair provenance remains tracked in #918.