Merge pull request #442 from irisitymichaelgrundberg/feat/restore-sessions-after-reboot

feat(sessions): offer to rebuild the sessions a host reboot destroyed

test/discard-partially-built-session.test.ts

@@ -0,0 +1,131 @@
+/**
+ * `WebServer.discardPartiallyBuiltSession()` against the real server object.
+ *
+ * The reboot-restore route calls this when a rebuild registers a session and
+ * then fails to start its pane. It has to be the exact inverse of
+ * `registerSessionWithLayout()` plus `setupSessionListeners()`, and it must NOT
+ * be the user-initiated delete: banking the session's token totals, demoting a
+ * pinned record or deleting the workspace's files would all be wrong for a
+ * session that never ran.
+ *
+ * These tests drive the real method rather than the route, because the route
+ * tests run against a mock context whose `discardPartiallyBuiltSession` is a
+ * one-line stub — an earlier version of this function left four registrations
+ * behind and every route test still passed.
+ *
+ * The retry assertion is the important one. `setupSessionListeners()` returns
+ * early when `sessionListenerRefs` still holds the session id, so a discard that
+ * leaves that entry makes the next attempt wire nothing at all, and the user
+ * gets a tab that never shows output.
+ */
+import { mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
+import { safeRmHomeTree } from './mocks/test-helpers.js';
+
+import { WebServer } from '../src/web/server.js';
+import { Session } from '../src/session.js';
+import { TmuxManager } from '../src/tmux-manager.js';
+
+/** Reach the private collections the discard is responsible for emptying. */
+interface ServerInternals {
+  sessions: Map<string, Session>;
+  sessionListenerRefs: Map<string, unknown>;
+  runSummaryTrackers: Map<string, unknown>;
+  registerSessionWithLayout(session: Session): Promise<void>;
+  setupSessionListeners(session: Session): Promise<void>;
+  discardPartiallyBuiltSession(sessionId: string): Promise<void>;
+}
+
+const WORKSPACE = join(homedir(), '.codeman-test-discard');
+const SESSION_ID = 'a1b2c3d4e5f60718';
+
+let server: WebServer;
+let internals: ServerInternals;
+let mux: TmuxManager;
+
+function buildSession(): Session {
+  return new Session({
+    id: SESSION_ID,
+    workingDir: WORKSPACE,
+    mode: 'claude',
+    name: 'rebuilt session',
+    mux,
+    useMux: true,
+  });
+}
+
+beforeAll(() => {
+  mkdirSync(WORKSPACE, { recursive: true });
+  // Test mode: no port is opened and no CLI is launched. One server for the file,
+  // stopped at the end: the constructor registers handlers on the module-level
+  // image, subagent, team and workflow watchers, and only stop() removes them.
+  server = new WebServer(0, false, true);
+  internals = server as unknown as ServerInternals;
+  mux = new TmuxManager();
+});
+
+afterEach(async () => {
+  await internals.discardPartiallyBuiltSession(SESSION_ID).catch(() => {});
+});
+
+afterAll(async () => {
+  await server.stop().catch(() => {});
+  safeRmHomeTree(WORKSPACE);
+});
+
+describe('discarding a session whose pane never started', () => {
+  it('takes the session back out of the server', async () => {
+    const session = buildSession();
+    await internals.registerSessionWithLayout(session);
+    await internals.setupSessionListeners(session);
+    expect(internals.sessions.has(SESSION_ID)).toBe(true);
+
+    await internals.discardPartiallyBuiltSession(SESSION_ID);
+    expect(internals.sessions.has(SESSION_ID)).toBe(false);
+  });
+
+  it('releases the listener registration, so a retry can wire itself again', async () => {
+    const first = buildSession();
+    await internals.registerSessionWithLayout(first);
+    await internals.setupSessionListeners(first);
+    expect(internals.sessionListenerRefs.has(SESSION_ID)).toBe(true);
+
+    const firstRefs = internals.sessionListenerRefs.get(SESSION_ID);
+    await internals.discardPartiallyBuiltSession(SESSION_ID);
+    expect(internals.sessionListenerRefs.has(SESSION_ID)).toBe(false);
+
+    // The retry reuses the id by design. `setupSessionListeners()` returns early
+    // while the refs are still there, so a session built now would run blind: no
+    // terminal output, no status updates, no exit broadcast. Asserting a DIFFERENT
+    // refs object is what distinguishes wiring the retry from finding the corpse
+    // of the first attempt still in place.
+    const retry = buildSession();
+    await internals.registerSessionWithLayout(retry);
+    await internals.setupSessionListeners(retry);
+    const retryRefs = internals.sessionListenerRefs.get(SESSION_ID);
+    expect(retryRefs).toBeDefined();
+    expect(retryRefs).not.toBe(firstRefs);
+  });
+
+  it('stops the run-summary tracker, whose interval would otherwise keep firing', async () => {
+    const session = buildSession();
+    await internals.registerSessionWithLayout(session);
+    await internals.setupSessionListeners(session);
+    const tracker = internals.runSummaryTrackers.get(SESSION_ID) as { stop: () => void };
+    expect(tracker).toBeDefined();
+    // Dropping the map entry is not enough: the tracker arms a setInterval in its
+    // constructor, and only stop() clears it, so a discard that merely forgot the
+    // entry would leave the timer running for the life of the process.
+    const stopped = vi.spyOn(tracker, 'stop');
+
+    await internals.discardPartiallyBuiltSession(SESSION_ID);
+    expect(stopped).toHaveBeenCalled();
+    expect(internals.runSummaryTrackers.has(SESSION_ID)).toBe(false);
+  });
+
+  it('does nothing at all for a session it never registered', async () => {
+    await expect(internals.discardPartiallyBuiltSession('never-existed')).resolves.toBeUndefined();
+  });
+});

test/mocks/mock-route-context-completeness.test.ts

@@ -0,0 +1,28 @@
+/**
+ * The mock route context must offer everything the real one does.
+ *
+ * Route tests pass their context as `ctx as never`, and `tsconfig.json` includes
+ * only `src/**`, so no type check ever compares the mock against the ports. A
+ * port that gained a method left this mock missing it twice; both times the
+ * route under test threw a TypeError inside its own catch, and the suite
+ * reported a plausible-looking failure for an unrelated reason.
+ *
+ * So the comparison is made at runtime, against `WebServer.createRouteContext()`
+ * rather than against the port types, which is what keeps it from drifting: the
+ * server's own context object is the thing route modules are really given.
+ */
+import { describe, expect, it } from 'vitest';
+
+import { WebServer } from '../../src/web/server.js';
+import { createMockRouteContext } from './mock-route-context.js';
+
+describe('the mock route context', () => {
+  it('offers every member the real route context does', () => {
+    const server = new WebServer(0, false, true);
+    const real = (server as unknown as { createRouteContext(): Record<string, unknown> }).createRouteContext();
+    const mock = createMockRouteContext() as unknown as Record<string, unknown>;
+
+    const missing = Object.keys(real).filter((key) => !(key in mock));
+    expect(missing, `mock-route-context.ts is missing: ${missing.join(', ')}`).toEqual([]);
+  });
+});

test/mocks/mock-route-context.ts

@@ -61,6 +61,10 @@ export function createMockRouteContext(options?: {
     setupSessionListeners: vi.fn(async () => {}),
     persistSessionState: vi.fn(),
     persistSessionStateNow: vi.fn(),
+    reapplyPersistedSessionState: vi.fn(async () => {}),
+    discardPartiallyBuiltSession: vi.fn(async (id: string) => {
+      sessions.delete(id);
+    }),
     getSessionStateWithRespawn: vi.fn((s: MockSession) => s.toState()),
 
     // -- EventPort --
@@ -149,6 +153,7 @@ export function createMockRouteContext(options?: {
       clearRespawnConfig: vi.fn(),
       updateRespawnConfig: vi.fn(),
       setHistoryLimit: vi.fn(async () => {}),
+      startStatsCollection: vi.fn(),
     },
     runSummaryTrackers: new Map(),
     activePlanOrchestrators: new Map(),

test/reboot-restore.test.ts

@@ -0,0 +1,395 @@
+/**
+ * @fileoverview The decision half of reboot restore, and proof that the existing
+ * recovery construction path can CREATE a resumed pane.
+ *
+ * Three things are under test. `src/reboot-restore.ts` decides whether the
+ * machine rebooted and which dead sessions may be offered back. The plan
+ * registry in `src/web/reboot-restore-registry.ts` holds that offer between the
+ * boot that builds it and the click that spends it. The third is the claim the
+ * whole feature rests on: a `Session` built the way `restoreMuxSessions()`
+ * already builds one, but given no `muxSession` and a `resumeSessionId`, creates
+ * a fresh pane that resumes the old conversation. If that holds, the restore
+ * needs no new session-creation service.
+ *
+ * `reconcileSessions()` reports every session ALIVE under vitest, so the
+ * server's own boot pass cannot be reached from here. The decision logic is
+ * therefore driven directly, and the construction claim is driven through a real
+ * `Session` against the in-memory tmux layer vitest substitutes.
+ */
+import { mkdirSync, rmSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { Session } from '../src/session.js';
+import { TmuxManager } from '../src/tmux-manager.js';
+import type { SessionState } from '../src/types.js';
+import {
+  looksLikeHostReboot,
+  newestPersistedActivity,
+  planRebootRestore,
+  rejectAlreadyLive,
+  resolveResumeConversationId,
+  type RebootRestoreEntry,
+} from '../src/reboot-restore.js';
+import { RebootRestoreRegistry } from '../src/web/reboot-restore-registry.js';
+
+const HOUR = 60 * 60 * 1000;
+const NOW = 1_760_000_000_000;
+
+function persistedSession(overrides: Partial<SessionState> & { id: string }): SessionState {
+  return {
+    // A live agent's record carries its process id; `/exit` persists null instead.
+    pid: 99999,
+    status: 'idle',
+    workingDir: '/tmp/spike',
+    currentTaskId: null,
+    createdAt: NOW - 4 * HOUR,
+    lastActivityAt: NOW - 2 * HOUR,
+    mode: 'claude',
+    ...overrides,
+  } as SessionState;
+}
+
+describe('reboot detection', () => {
+  const base = {
+    livePaneCount: 0,
+    deadSessionCount: 2,
+    // The host came up 10 minutes ago, well after the sessions were last active.
+    uptimeSeconds: 600,
+    newestPersistedActivityAt: NOW - 2 * HOUR,
+    now: NOW,
+  };
+
+  it('calls it a reboot when the socket is empty and the host booted after the last activity', () => {
+    expect(looksLikeHostReboot(base)).toBe(true);
+  });
+
+  it('refuses when some panes survived, which is an ordinary server restart', () => {
+    expect(looksLikeHostReboot({ ...base, livePaneCount: 3 })).toBe(false);
+  });
+
+  it('refuses on a long-uptime host, where someone wiped the tmux socket by hand', () => {
+    // Up for 30 days: the sessions were active long AFTER this boot, so the panes
+    // went away for some reason other than the machine restarting.
+    expect(looksLikeHostReboot({ ...base, uptimeSeconds: 30 * 24 * 60 * 60 })).toBe(false);
+  });
+
+  it('refuses when nothing died', () => {
+    expect(looksLikeHostReboot({ ...base, deadSessionCount: 0 })).toBe(false);
+  });
+
+  it('reads the newest activity stamp across the persisted records', () => {
+    const persisted = {
+      a: persistedSession({ id: 'a', lastActivityAt: NOW - 5 * HOUR }),
+      b: persistedSession({ id: 'b', lastActivityAt: NOW - 1 * HOUR }),
+    };
+    expect(newestPersistedActivity(persisted)).toBe(NOW - 1 * HOUR);
+  });
+});
+
+describe('which dead sessions may be rebuilt', () => {
+  it('rebuilds a session that was simply running when the power went out', () => {
+    const persisted = { live: persistedSession({ id: 'live', status: 'busy' }) };
+    const plan = planRebootRestore(['live'], persisted, () => true);
+    expect(plan.restore.map((s) => s.sessionId)).toEqual(['live']);
+  });
+
+  it('never revives a session the user killed while pinned (COD-142 demotes it to stopped)', () => {
+    const persisted = { killed: persistedSession({ id: 'killed', status: 'stopped', pinned: true }) };
+    const plan = planRebootRestore(['killed'], persisted, () => true);
+    expect(plan.restore).toEqual([]);
+    expect(plan.skipped).toEqual([{ sessionId: 'killed', reason: 'intentionally-ended' }]);
+  });
+
+  it('never revives a session whose record an unpinned kill already deleted', () => {
+    const plan = planRebootRestore(['gone'], {}, () => true);
+    expect(plan.restore).toEqual([]);
+    expect(plan.skipped).toEqual([{ sessionId: 'gone', reason: 'no-persisted-record' }]);
+  });
+
+  it('never revives a pane whose PTY-exit breaker had tripped', () => {
+    const persisted = { crashy: persistedSession({ id: 'crashy', respawnBlocked: true }) };
+    expect(planRebootRestore(['crashy'], persisted, () => true).skipped[0].reason).toBe('respawn-blocked');
+  });
+
+  it('leaves remote sessions to the COD-108 reconnect watcher', () => {
+    const persisted = {
+      r: persistedSession({
+        id: 'r',
+        remote: { hostId: 'h', host: 'example.test', username: 'u', sessionName: 'n', owned: true },
+      } as Partial<SessionState> & { id: string }),
+    };
+    expect(planRebootRestore(['r'], persisted, () => true).skipped[0].reason).toBe('remote-or-docker');
+  });
+
+  it('leaves docker sessions alone, since the container may not be up', () => {
+    const persisted = {
+      d: persistedSession({ id: 'd', docker: { containerId: 'abc', caseId: 'c' } } as Partial<SessionState> & {
+        id: string;
+      }),
+    };
+    expect(planRebootRestore(['d'], persisted, () => true).skipped[0].reason).toBe('remote-or-docker');
+  });
+
+  it('skips a CLI whose history the claude transcript reader does not understand', () => {
+    const persisted = { c: persistedSession({ id: 'c', mode: 'codex' }) };
+    expect(planRebootRestore(['c'], persisted, () => true).skipped[0].reason).toBe('unsupported-mode');
+  });
+});
+
+describe('a session with no attach process in its record', () => {
+  it('is refused, because there was nothing running to bring back', () => {
+    // A session that never started, or whose pane died outright. NOT a session
+    // the user ended with `/exit`: that keeps its pid, because the pid is the
+    // tmux attach process and `remain-on-exit` keeps the pane alive.
+    const persisted = { exited: persistedSession({ id: 'exited', status: 'idle', pid: null }) };
+    const plan = planRebootRestore(['exited'], persisted, () => true);
+    expect(plan.restore).toEqual([]);
+    expect(plan.skipped).toEqual([{ sessionId: 'exited', reason: 'not-running' }]);
+  });
+
+  it('still restores the session beside it that was attached when the power went', () => {
+    const persisted = {
+      exited: persistedSession({ id: 'exited', pid: null }),
+      running: persistedSession({ id: 'running', pid: 4242 }),
+    };
+    const plan = planRebootRestore(['exited', 'running'], persisted, () => true);
+    expect(plan.restore.map((entry) => entry.sessionId)).toEqual(['running']);
+    expect(plan.skipped.map((s) => s.reason)).toEqual(['not-running']);
+  });
+
+  it('refuses a record with no pid field at all', () => {
+    const persisted = { odd: persistedSession({ id: 'odd', pid: undefined as unknown as null }) };
+    expect(planRebootRestore(['odd'], persisted, () => true).skipped[0].reason).toBe('not-running');
+  });
+});
+
+describe('a workspace that is no longer on disk', () => {
+  it('is kept out of the offer, so a click cannot scaffold a deleted repo', () => {
+    const persisted = { gone: persistedSession({ id: 'gone', workingDir: '/tmp/deleted-repo' }) };
+    const plan = planRebootRestore(['gone'], persisted, () => false);
+    expect(plan.restore).toEqual([]);
+    expect(plan.skipped).toEqual([{ sessionId: 'gone', reason: 'workspace-missing' }]);
+  });
+
+  it('is judged per session, not for the batch', () => {
+    const persisted = {
+      kept: persistedSession({ id: 'kept', workingDir: '/tmp/still-here' }),
+      gone: persistedSession({ id: 'gone', workingDir: '/tmp/deleted-repo' }),
+    };
+    const plan = planRebootRestore(['kept', 'gone'], persisted, (dir) => dir === '/tmp/still-here');
+    expect(plan.restore.map((entry) => entry.sessionId)).toEqual(['kept']);
+    expect(plan.skipped.map((s) => s.reason)).toEqual(['workspace-missing']);
+  });
+});
+
+describe('a conversation that came back on its own before the click', () => {
+  const entry: RebootRestoreEntry = {
+    sessionId: 'abc',
+    workingDir: '/tmp/spike',
+    mode: 'claude',
+    resumeConversationId: 'conv-1',
+    state: persistedSession({ id: 'abc' }),
+  };
+
+  it('is skipped when the user resumed it by hand from the Resume list', () => {
+    // Same conversation, different session id: the Resume list creates a NEW id.
+    const result = rejectAlreadyLive([entry], new Set(['other']), new Set(['conv-1']));
+    expect(result.restore).toEqual([]);
+    expect(result.skipped).toEqual([{ sessionId: 'abc', reason: 'already-live' }]);
+  });
+
+  it('is skipped when a session with that id is already on the board', () => {
+    const result = rejectAlreadyLive([entry], new Set(['abc']), new Set());
+    expect(result.skipped).toEqual([{ sessionId: 'abc', reason: 'already-live' }]);
+  });
+
+  it('is rebuilt when neither its id nor its conversation is live', () => {
+    const result = rejectAlreadyLive([entry], new Set(['other']), new Set(['conv-other']));
+    expect(result.restore.map((e) => e.sessionId)).toEqual(['abc']);
+    expect(result.skipped).toEqual([]);
+  });
+});
+
+describe('the plan the banner spends', () => {
+  const all = () => true;
+  const entryFor = (sessionId: string, owner?: string): RebootRestoreEntry => ({
+    sessionId,
+    owner,
+    workingDir: '/tmp/spike',
+    mode: 'claude',
+    resumeConversationId: `conv-${sessionId}`,
+    state: persistedSession({ id: sessionId, owner }),
+  });
+
+  it('hands an entry to the first caller and nothing to the second', () => {
+    const registry = new RebootRestoreRegistry();
+    registry.set([entryFor('a'), entryFor('b')]);
+    expect(registry.take(all, undefined, undefined).map((e) => e.sessionId)).toEqual(['a', 'b']);
+    // The double-click: two panes on one conversation is what this prevents.
+    expect(registry.take(all, undefined, undefined)).toEqual([]);
+  });
+
+  it('spends only the ids a caller asked for', () => {
+    const registry = new RebootRestoreRegistry();
+    registry.set([entryFor('a'), entryFor('b')]);
+    expect(registry.take(all, ['b'], undefined).map((e) => e.sessionId)).toEqual(['b']);
+    expect(registry.list(all).map((e) => e.sessionId)).toEqual(['a']);
+  });
+
+  it("shows a user their own sessions and leaves another owner's alone", () => {
+    const registry = new RebootRestoreRegistry();
+    registry.set([entryFor('mine', 'alice'), entryFor('theirs', 'bob')]);
+    const asAlice = (owner: string | undefined) => owner === 'alice';
+    expect(registry.list(asAlice).map((e) => e.sessionId)).toEqual(['mine']);
+    expect(registry.take(asAlice, undefined, 'alice').map((e) => e.sessionId)).toEqual(['mine']);
+    // Bob's entry is still on offer for Bob.
+    expect(registry.list(() => true).map((e) => e.sessionId)).toEqual(['theirs']);
+  });
+
+  it('puts back an entry that no pane was created for', () => {
+    const registry = new RebootRestoreRegistry();
+    registry.set([entryFor('a')]);
+    const taken = registry.take(all, undefined, undefined);
+    registry.releaseFlight(undefined, taken);
+    expect(registry.list(all).map((e) => e.sessionId)).toEqual(['a']);
+  });
+
+  it('runs one restore at a time', () => {
+    const registry = new RebootRestoreRegistry();
+    expect(registry.beginSpending()).toBe(true);
+    expect(registry.beginSpending()).toBe(false);
+    registry.endSpending();
+    expect(registry.beginSpending()).toBe(true);
+  });
+
+  it('drops what a dismiss cleared', () => {
+    const registry = new RebootRestoreRegistry();
+    registry.set([entryFor('a'), entryFor('b')]);
+    expect(registry.clear(all)).toBe(2);
+    expect(registry.list(all)).toEqual([]);
+  });
+
+  it('forgets a plan nobody took for a day', () => {
+    const registry = new RebootRestoreRegistry();
+    registry.set([entryFor('a')]);
+    const dayLater = Date.now() + 25 * HOUR;
+    const realNow = Date.now;
+    Date.now = () => dayLater;
+    try {
+      expect(registry.list(all)).toEqual([]);
+    } finally {
+      Date.now = realNow;
+    }
+  });
+});
+
+describe('which conversation a rebuilt pane resumes', () => {
+  it('prefers the chain tail, the conversation the CLI reported last', () => {
+    const state = persistedSession({
+      id: 'sess-1',
+      resumeSessionId: 'launch-id',
+      claudeSessionChain: ['launch-id', 'after-clear'],
+    });
+    expect(resolveResumeConversationId(state)).toBe('after-clear');
+  });
+
+  it('falls back to the id the session originally resumed', () => {
+    const state = persistedSession({ id: 'sess-1', resumeSessionId: 'resumed-id' });
+    expect(resolveResumeConversationId(state)).toBe('resumed-id');
+  });
+
+  it('falls back to the session id, which is what Claude was launched with', () => {
+    expect(resolveResumeConversationId(persistedSession({ id: 'sess-1' }))).toBe('sess-1');
+  });
+});
+
+describe('the recovery construction path can create a resumed pane', () => {
+  const workingDir = join(homedir(), 'codeman-cases', 'reboot-restore-spike');
+  const sessions: Session[] = [];
+
+  afterEach(() => {
+    for (const s of sessions.splice(0)) s.stop();
+    rmSync(workingDir, { recursive: true, force: true });
+  });
+
+  /** Built exactly as the reboot pass builds one: no `muxSession`, plus a resume id. */
+  function rebuildFromPersistedState(state: SessionState, mux: TmuxManager): Session {
+    mkdirSync(workingDir, { recursive: true });
+    const session = new Session({
+      id: state.id,
+      workingDir,
+      mode: state.mode,
+      name: state.name,
+      createdAt: state.createdAt,
+      mux,
+      useMux: true,
+      resumeSessionId: resolveResumeConversationId(state),
+      owner: state.owner,
+      lastActivityAt: state.lastActivityAt,
+      claudeSessionChain: state.claudeSessionChain,
+    });
+    sessions.push(session);
+    return session;
+  }
+
+  it('creates a NEW mux session rather than needing one to attach to', async () => {
+    const mux = new TmuxManager();
+    const state = persistedSession({ id: 'aaaaaaa1-1111-4111-8111-111111111111', name: 'w1-spike' });
+    const session = rebuildFromPersistedState(state, mux);
+
+    expect(mux.getSessions()).toHaveLength(0);
+    await session.startInteractive();
+
+    const created = mux.getSessions();
+    expect(created).toHaveLength(1);
+    expect(created[0].sessionId).toBe('aaaaaaa1-1111-4111-8111-111111111111');
+    expect(created[0].workingDir).toBe(workingDir);
+  });
+
+  it('comes back pointed at the conversation the pane was holding', async () => {
+    const mux = new TmuxManager();
+    const state = persistedSession({
+      id: 'aaaaaaa2-2222-4222-8222-222222222222',
+      resumeSessionId: 'launch-id',
+      claudeSessionChain: ['launch-id', 'after-clear'],
+    });
+    const session = rebuildFromPersistedState(state, mux);
+
+    await session.startInteractive();
+
+    // The chain tail wins: a `/clear` before the reboot moved the CLI off the launch id.
+    expect(session.claudeSessionId).toBe('after-clear');
+  });
+
+  it('comes back idle, with no prompt sent and no autonomous loop armed', async () => {
+    const mux = new TmuxManager();
+    const state = persistedSession({
+      id: 'aaaaaaa3-3333-4333-8333-333333333333',
+      ralphEnabled: true,
+      respawnEnabled: true,
+    });
+    const session = rebuildFromPersistedState(state, mux);
+
+    await session.startInteractive();
+
+    // No prompt was queued: nothing is waiting on a task. The status itself is not
+    // assertable here, because the test PTY echoes and the activity detector reads
+    // that echo as work; in production the pane settles once the CLI finishes booting.
+    expect(session.currentTaskId).toBeNull();
+    // The pass never touches the tracker, so a persisted Ralph loop stays cold.
+    expect(session.ralphTracker.enabled).toBe(false);
+  });
+
+  it('keeps the owner it was persisted with, there being no request to read one from', async () => {
+    const mux = new TmuxManager();
+    const state = persistedSession({ id: 'aaaaaaa4-4444-4444-8444-444444444444', owner: 'alice' });
+    const session = rebuildFromPersistedState(state, mux);
+
+    await session.startInteractive();
+
+    expect(session.owner).toBe('alice');
+    expect(mux.getSessions()[0].owner).toBe('alice');
+  });
+});

test/routes/reboot-restore-rebuild-failure.test.ts

@@ -0,0 +1,377 @@
+/**
+ * Reboot-restore route: what happens when a rebuild gets part-way and then fails.
+ *
+ * The other route test file deliberately uses workspaces that do not exist, so it
+ * never reaches `new Session()`. This one mocks the `Session` module so the route
+ * runs its whole construction path — `addSession`, `setupSessionListeners`,
+ * `reapplyPersistedSessionState`, `startInteractive` — and then throws.
+ *
+ * The mock is the only way in. Driven against a real server, `startInteractive()`
+ * does not throw for either obvious cause: the CLI resolver finds its binary by
+ * absolute path rather than through PATH, and tmux falls back to another
+ * directory rather than failing when it cannot enter the workspace. A mux-layer
+ * failure is what is left, and it cannot be provoked from a test. Without the
+ * mock this path would go unexercised, which is how the original version of this
+ * route shipped a session leak the tests could not see.
+ *
+ * It also covers the session caps, because those too are only reachable once the
+ * route is actually willing to build something.
+ */
+import { describe, it, expect, afterEach, vi, beforeEach } from 'vitest';
+import Fastify, { type FastifyInstance } from 'fastify';
+import fastifyCookie from '@fastify/cookie';
+
+/** Set per test: whether the mocked `startInteractive()` rejects. */
+let startShouldThrow = false;
+/** Ordering log, so a test can assert what ran before the pane spawned. */
+const callOrder: string[] = [];
+
+vi.mock('../../src/session.js', () => ({
+  Session: class {
+    id: string;
+    mode: string;
+    name?: string;
+    workingDir: string;
+    owner?: string;
+    claudeSessionId: string | null = null;
+    constructor(config: { id: string; mode?: string; name?: string; workingDir: string; owner?: string }) {
+      this.id = config.id;
+      this.mode = config.mode ?? 'claude';
+      this.name = config.name;
+      this.workingDir = config.workingDir;
+      this.owner = config.owner;
+    }
+    async startInteractive() {
+      callOrder.push('startInteractive');
+      if (startShouldThrow) throw new Error('spawn claude ENOENT');
+    }
+    /** The mock route context projects a session through this on broadcast. */
+    toState() {
+      return { id: this.id, mode: this.mode, name: this.name, workingDir: this.workingDir, owner: this.owner };
+    }
+  },
+}));
+
+const { registerRebootRestoreRoutes } = await import('../../src/web/routes/reboot-restore-routes.js');
+const { rebootRestoreRegistry } = await import('../../src/web/reboot-restore-registry.js');
+const { installRouteErrorHandler } = await import('../../src/web/route-error-handler.js');
+const { httpStatusForErrorCode } = await import('../../src/types.js');
+const { createMockRouteContext } = await import('../mocks/index.js');
+type ApiErrorCode = import('../../src/types.js').ApiErrorCode;
+type RebootRestoreEntry = import('../../src/reboot-restore.js').RebootRestoreEntry;
+type SessionState = import('../../src/types.js').SessionState;
+
+/** A real directory, so the route's workspace checks pass and it reaches the build. */
+const WORKSPACE = process.cwd();
+
+function offerEntry(sessionId: string, owner?: string): RebootRestoreEntry {
+  return {
+    sessionId,
+    name: `session ${sessionId}`,
+    workingDir: WORKSPACE,
+    owner,
+    mode: 'claude',
+    resumeConversationId: `conv-${sessionId}`,
+    state: {
+      id: sessionId,
+      pid: null,
+      status: 'idle',
+      workingDir: WORKSPACE,
+      currentTaskId: null,
+      createdAt: 1_760_000_000_000,
+      mode: 'claude',
+      owner,
+    } as SessionState,
+  };
+}
+
+async function createHarness(ctx: ReturnType<typeof createMockRouteContext>): Promise<FastifyInstance> {
+  const app = Fastify({ logger: false });
+  await app.register(fastifyCookie);
+  registerRebootRestoreRoutes(app, ctx as never);
+  app.addHook('preSerialization', (req, reply, payload: unknown, done) => {
+    if (!req.url.startsWith('/api')) return done(null, payload);
+    if (payload === null || typeof payload !== 'object') return done(null, payload);
+    const p = payload as { success?: unknown; errorCode?: unknown };
+    if (p.success === false) {
+      if (reply.statusCode === 200 && typeof p.errorCode === 'string') {
+        reply.code(httpStatusForErrorCode(p.errorCode as ApiErrorCode));
+      }
+      return done(null, payload);
+    }
+    if (p.success === true) return done(null, payload);
+    return done(null, { success: true, data: payload });
+  });
+  installRouteErrorHandler(app);
+  await app.ready();
+  return app;
+}
+
+beforeEach(() => {
+  startShouldThrow = false;
+  callOrder.length = 0;
+});
+
+afterEach(() => {
+  rebootRestoreRegistry.reset();
+  vi.clearAllMocks();
+});
+
+describe('a rebuild that fails after the session is registered', () => {
+  it('reports why it failed rather than blaming the workspace', async () => {
+    startShouldThrow = true;
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    const app = await createHarness(ctx);
+
+    const res = (await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} })).json().data;
+    expect(res.restored).toEqual([]);
+    // Not `workspace-missing`: the directory is there, the agent would not start.
+    expect(res.skipped).toEqual([{ sessionId: 'a', reason: 'rebuild-failed' }]);
+    await app.close();
+  });
+
+  it('does not leave a registered session with no pane behind it', async () => {
+    startShouldThrow = true;
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    const app = await createHarness(ctx);
+
+    await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} });
+    // The session reached ctx.sessions via addSession; the route has to take it
+    // back out, or the board shows a tab whose pane never existed.
+    expect(ctx.discardPartiallyBuiltSession).toHaveBeenCalledWith('a');
+    expect(ctx.sessions.has('a')).toBe(false);
+    // NOT the user-initiated delete: that would bank this session's historical
+    // tokens into the lifetime totals, demote a pinned record to `stopped`, and
+    // delete the workspace's .claude-images.
+    expect(ctx.cleanupSession).not.toHaveBeenCalled();
+    await app.close();
+  });
+
+  it('keeps the entry on offer, so the user can fix the PATH and click again', async () => {
+    startShouldThrow = true;
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    const app = await createHarness(ctx);
+
+    await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} });
+    const left = (await app.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(left.sessions.map((s: { id: string }) => s.id)).toEqual(['a']);
+    await app.close();
+  });
+});
+
+describe('a rebuild that succeeds', () => {
+  it('re-applies the persisted state before the record is written again', async () => {
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    const app = await createHarness(ctx);
+
+    const res = (await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} })).json().data;
+    expect(res.restored.map((s: { id: string }) => s.id)).toEqual(['a']);
+    // A session built from a record carries none of the pin, token totals or
+    // custom-model selection, so persisting it first would replace the fuller
+    // record with the reduced one.
+    expect(ctx.reapplyPersistedSessionState).toHaveBeenCalled();
+    const reapplyOrder = (ctx.reapplyPersistedSessionState as ReturnType<typeof vi.fn>).mock.invocationCallOrder[0];
+    const persistOrder = (ctx.persistSessionState as ReturnType<typeof vi.fn>).mock.invocationCallOrder[0];
+    expect(reapplyOrder).toBeLessThan(persistOrder);
+    await app.close();
+  });
+
+  it('shapes the pane before it spawns, and restores the history after', async () => {
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    (ctx.reapplyPersistedSessionState as ReturnType<typeof vi.fn>).mockImplementation(
+      async (_s: unknown, _saved: unknown, phase: string) => {
+        callOrder.push(`reapply:${phase}`);
+      }
+    );
+    (ctx.setupSessionListeners as ReturnType<typeof vi.fn>).mockImplementation(async () => {
+      callOrder.push('setupSessionListeners');
+    });
+    const app = await createHarness(ctx);
+
+    await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} });
+    // `setupSessionListeners()` READS the image-watcher flag that `before-spawn`
+    // restores, so the phase has to precede it or the session comes back
+    // reporting the watcher as on with nothing watching. The custom-model
+    // environment has to reach the process, and the token totals must not land
+    // on a session whose pane never started.
+    expect(callOrder).toEqual([
+      'reapply:before-spawn',
+      'setupSessionListeners',
+      'startInteractive',
+      'reapply:after-spawn',
+    ]);
+    await app.close();
+  });
+
+  it('tells every other board about the rebuilt session', async () => {
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    const app = await createHarness(ctx);
+
+    await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} });
+    expect(ctx.broadcast).toHaveBeenCalledWith('session:created', expect.anything());
+    await app.close();
+  });
+
+  it('spends the entry, so it is no longer on offer', async () => {
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    const app = await createHarness(ctx);
+
+    await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} });
+    const left = (await app.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(left.sessions).toEqual([]);
+    await app.close();
+  });
+});
+
+describe('the session caps', () => {
+  it('counts the sessions it is itself creating, not just the ones it started with', async () => {
+    rebootRestoreRegistry.set([offerEntry('a'), offerEntry('b')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    // One seat short of the documented maximum of 50, counting the session the
+    // mock context seeds. A check that ran once before the loop would restore
+    // BOTH entries; only a per-iteration check refuses the second.
+    for (let i = 0; i < 48; i += 1) {
+      ctx.sessions.set(`filler-${i}`, { id: `filler-${i}`, owner: undefined } as never);
+    }
+    const app = await createHarness(ctx);
+
+    const res = (await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} })).json().data;
+    expect(res.restored.map((s: { id: string }) => s.id)).toEqual(['a']);
+    expect(res.skipped).toEqual([{ sessionId: 'b', reason: 'capacity-reached' }]);
+
+    // Refused rather than lost: closing a session and clicking again works.
+    const left = (await app.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(left.sessions.map((s: { id: string }) => s.id)).toEqual(['b']);
+    await app.close();
+  });
+
+  it('refuses every entry when the board is already at the cap', async () => {
+    rebootRestoreRegistry.set([offerEntry('a'), offerEntry('b')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    for (let i = 0; i < 50; i += 1) {
+      ctx.sessions.set(`filler-${i}`, { id: `filler-${i}`, owner: undefined } as never);
+    }
+    const app = await createHarness(ctx);
+
+    const res = (await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} })).json().data;
+    expect(res.restored).toEqual([]);
+    expect(res.skipped.map((s: { reason: string }) => s.reason)).toEqual(['capacity-reached', 'capacity-reached']);
+    await app.close();
+  });
+});
+
+describe('a failure before any entry is considered', () => {
+  it('returns the whole plan rather than spending it', async () => {
+    rebootRestoreRegistry.set([offerEntry('a'), offerEntry('b')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    (ctx.getWorkspaceHooksEnabled as ReturnType<typeof vi.fn>).mockRejectedValue(new Error('settings unreadable'));
+    const app = await createHarness(ctx);
+
+    const res = await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} });
+    expect(res.statusCode).toBeGreaterThanOrEqual(500);
+
+    // The plan cannot be rebuilt once boot has pruned the records, so a throw
+    // anywhere in the route has to hand the entries back.
+    const left = (await app.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(left.sessions.map((s: { id: string }) => s.id).sort()).toEqual(['a', 'b']);
+    await app.close();
+  });
+
+  it('releases the single flight, so the next click is not refused', async () => {
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    (ctx.getWorkspaceHooksEnabled as ReturnType<typeof vi.fn>).mockRejectedValue(new Error('settings unreadable'));
+    const app = await createHarness(ctx);
+
+    await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} });
+    expect(rebootRestoreRegistry.beginSpending(undefined)).toBe(true);
+    rebootRestoreRegistry.endSpending(undefined);
+    await app.close();
+  });
+});
+
+describe('a dismiss that lands while a restore is running', () => {
+  it('wins when an admin is restoring the entries and their owner dismisses', async () => {
+    const theirs = offerEntry('theirs', 'bob');
+    rebootRestoreRegistry.set([theirs]);
+    // An admin may spend another user's entries, so the caller doing the restore
+    // and the owner of what is being restored are different people.
+    const taken = rebootRestoreRegistry.take(() => true, undefined, 'admin');
+    expect(taken.map((e) => e.sessionId)).toEqual(['theirs']);
+
+    // Bob dismisses his own banner. Nothing of his is in the plan any more, and
+    // the restore is running under a different name than his.
+    rebootRestoreRegistry.clear((owner) => owner === 'bob');
+    rebootRestoreRegistry.releaseFlight('admin', taken);
+
+    expect(rebootRestoreRegistry.list(() => true)).toEqual([]);
+  });
+
+  it('wins when an admin dismisses everything mid-restore', async () => {
+    rebootRestoreRegistry.set([offerEntry('theirs', 'bob')]);
+    const taken = rebootRestoreRegistry.take(() => true, undefined, 'admin');
+
+    rebootRestoreRegistry.clear(() => true);
+    rebootRestoreRegistry.releaseFlight('admin', taken);
+
+    expect(rebootRestoreRegistry.list(() => true)).toEqual([]);
+  });
+
+  it('wins, rather than being undone when the route hands its entries back', async () => {
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    const ctx = createMockRouteContext({ workspaceHooksEnabled: false });
+    // The user clicks Dismiss while the restore is between its take and its
+    // return. Driven through the ROUTE, so removing the generation argument from
+    // the route would make this fail.
+    (ctx.getWorkspaceHooksEnabled as ReturnType<typeof vi.fn>).mockImplementation(async () => {
+      rebootRestoreRegistry.clear(() => true);
+      throw new Error('settings unreadable');
+    });
+    const app = await createHarness(ctx);
+
+    await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} });
+
+    const left = (await app.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(left.sessions).toEqual([]);
+    await app.close();
+  });
+
+  it('reaches an in-flight restore the dismisser can see, even once its entries are taken', async () => {
+    const mine = offerEntry('mine', 'alice');
+    rebootRestoreRegistry.set([mine]);
+    const taken = rebootRestoreRegistry.take((owner) => owner === 'alice', undefined, 'alice');
+    expect(taken).toHaveLength(1);
+
+    // The plan is empty now, so the dismiss has nothing of Alice's left in the
+    // plan; it has to reach the entry the restore is holding.
+    rebootRestoreRegistry.clear((owner) => owner === 'alice');
+    rebootRestoreRegistry.releaseFlight('alice', taken);
+
+    expect(rebootRestoreRegistry.list(() => true)).toEqual([]);
+  });
+
+  it('does not reach another owner, whose unspent entries still come back', async () => {
+    const mine = offerEntry('mine', 'alice');
+    const theirs = offerEntry('theirs', 'bob');
+    rebootRestoreRegistry.set([mine, theirs]);
+
+    // Bob is mid-restore, holding his own entry.
+    const bobsTaken = rebootRestoreRegistry.take((owner) => owner === 'bob', undefined, 'bob');
+    expect(bobsTaken.map((e) => e.sessionId)).toEqual(['theirs']);
+
+    // Alice dismisses her own banner meanwhile.
+    rebootRestoreRegistry.clear((owner) => owner === 'alice');
+
+    // Bob's restore finishes and hands his entry back. Alice's dismiss covered
+    // her entries, not his, so his offer survives.
+    rebootRestoreRegistry.releaseFlight('bob', bobsTaken);
+    expect(rebootRestoreRegistry.list(() => true).map((e) => e.sessionId)).toEqual(['theirs']);
+  });
+});

test/routes/reboot-restore-routes.test.ts

@@ -0,0 +1,202 @@
+/**
+ * Reboot-restore route tests (src/web/routes/reboot-restore-routes.ts) via
+ * app.inject(), no live port.
+ *
+ * Every entry these tests put on offer names a workspace that does not exist, so
+ * the route's click-time workspace check rejects it before any `Session` is
+ * constructed. That keeps the tests on the route's own guards — taking, scoping,
+ * single-flighting and re-checking — and leaves pane creation to
+ * test/reboot-restore.test.ts, which drives a real `Session` for it.
+ *
+ * The routes read the process-wide `rebootRestoreRegistry` singleton, so every
+ * test resets it; a leaked entry would bleed into the next one.
+ */
+import { describe, it, expect, afterEach } from 'vitest';
+import Fastify, { type FastifyInstance } from 'fastify';
+import fastifyCookie from '@fastify/cookie';
+import { registerRebootRestoreRoutes } from '../../src/web/routes/reboot-restore-routes.js';
+import { rebootRestoreRegistry } from '../../src/web/reboot-restore-registry.js';
+import { installRouteErrorHandler } from '../../src/web/route-error-handler.js';
+import { httpStatusForErrorCode, type ApiErrorCode } from '../../src/types.js';
+import { createMockRouteContext } from '../mocks/index.js';
+import type { RebootRestoreEntry } from '../../src/reboot-restore.js';
+import type { SessionState } from '../../src/types.js';
+
+async function createHarness(authUser?: { username: string; role: 'admin' | 'user' }): Promise<FastifyInstance> {
+  return createHarnessWithCtx(createMockRouteContext(), authUser);
+}
+
+async function createHarnessWithCtx(
+  ctx: ReturnType<typeof createMockRouteContext>,
+  authUser?: { username: string; role: 'admin' | 'user' }
+): Promise<FastifyInstance> {
+  const app = Fastify({ logger: false });
+  await app.register(fastifyCookie);
+  if (authUser) {
+    app.addHook('onRequest', async (req) => {
+      (req as unknown as { authUser: typeof authUser }).authUser = authUser;
+    });
+  }
+  registerRebootRestoreRoutes(app, ctx as never);
+
+  app.addHook('preSerialization', (req, reply, payload: unknown, done) => {
+    if (!req.url.startsWith('/api')) return done(null, payload);
+    if (payload === null || typeof payload !== 'object') return done(null, payload);
+    const p = payload as { success?: unknown; errorCode?: unknown };
+    if (p.success === false) {
+      if (reply.statusCode === 200 && typeof p.errorCode === 'string') {
+        reply.code(httpStatusForErrorCode(p.errorCode as ApiErrorCode));
+      }
+      return done(null, payload);
+    }
+    if (p.success === true) return done(null, payload);
+    return done(null, { success: true, data: payload });
+  });
+
+  installRouteErrorHandler(app);
+  await app.ready();
+  return app;
+}
+
+/** An entry whose workspace is deliberately absent, so no pane is ever created. */
+function offerEntry(sessionId: string, owner?: string): RebootRestoreEntry {
+  return {
+    sessionId,
+    name: `session ${sessionId}`,
+    workingDir: `/tmp/codeman-reboot-restore-missing/${sessionId}`,
+    owner,
+    mode: 'claude',
+    resumeConversationId: `conv-${sessionId}`,
+    state: {
+      id: sessionId,
+      pid: null,
+      status: 'idle',
+      workingDir: `/tmp/codeman-reboot-restore-missing/${sessionId}`,
+      currentTaskId: null,
+      createdAt: 1_760_000_000_000,
+      mode: 'claude',
+      owner,
+    } as SessionState,
+  };
+}
+
+afterEach(() => {
+  rebootRestoreRegistry.reset();
+});
+
+describe('GET /api/reboot-restore', () => {
+  it('reports nothing when no reboot left anything behind', async () => {
+    const app = await createHarness();
+    const res = await app.inject({ method: 'GET', url: '/api/reboot-restore' });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.sessions).toEqual([]);
+    await app.close();
+  });
+
+  it('names what is on offer, and says the scrollback is not coming back', async () => {
+    rebootRestoreRegistry.set([offerEntry('a'), offerEntry('b')]);
+    const app = await createHarness();
+    const body = (await app.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(body.sessions.map((s: { id: string }) => s.id)).toEqual(['a', 'b']);
+    expect(body.scrollbackRestored).toBe(false);
+    await app.close();
+  });
+
+  it('never carries the persisted record itself to the browser', async () => {
+    rebootRestoreRegistry.set([offerEntry('a', 'alice')]);
+    const app = await createHarness({ username: 'alice', role: 'admin' });
+    const body = (await app.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(Object.keys(body.sessions[0]).sort()).toEqual(['id', 'mode', 'name', 'owner', 'workingDir']);
+    expect(body.sessions[0].state).toBeUndefined();
+    await app.close();
+  });
+});
+
+describe('POST /api/reboot-restore/restore', () => {
+  it('reports a workspace that is gone, and keeps offering it in case it comes back', async () => {
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    const app = await createHarness();
+
+    const first = (await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} })).json().data;
+    expect(first.restored).toEqual([]);
+    expect(first.skipped).toEqual([{ sessionId: 'a', reason: 'workspace-missing' }]);
+
+    // Nothing was built, so the entry goes back: a repo can be restored from a
+    // backup between two clicks, and losing the offer would be unrecoverable.
+    const left = (await app.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(left.sessions.map((s: { id: string }) => s.id)).toEqual(['a']);
+    await app.close();
+  });
+
+  it('never re-offers a conversation that is already open', async () => {
+    const entry = offerEntry('a');
+    rebootRestoreRegistry.set([entry]);
+    const app = await createHarness();
+    const ctx = createMockRouteContext({ sessionId: entry.sessionId });
+    // A session with that id is live, which is what the Resume list would produce.
+    const liveApp = await createHarnessWithCtx(ctx);
+
+    const res = (await liveApp.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} })).json().data;
+    expect(res.skipped).toEqual([{ sessionId: 'a', reason: 'already-live' }]);
+
+    // Unlike a missing workspace, this one is dropped: it cannot stop being true.
+    const left = (await liveApp.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(left.sessions).toEqual([]);
+    await liveApp.close();
+    await app.close();
+  });
+
+  it('spends only the sessions the click named', async () => {
+    rebootRestoreRegistry.set([offerEntry('a'), offerEntry('b')]);
+    const app = await createHarness();
+
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/reboot-restore/restore',
+      payload: { sessionIds: ['b'] },
+    });
+    expect(res.json().data.skipped).toEqual([{ sessionId: 'b', reason: 'workspace-missing' }]);
+
+    // 'a' was never taken, and 'b' came back because no pane was built for it.
+    const left = (await app.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(left.sessions.map((s: { id: string }) => s.id).sort()).toEqual(['a', 'b']);
+    await app.close();
+  });
+
+  it('refuses a body it does not recognise rather than guessing', async () => {
+    const app = await createHarness();
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/reboot-restore/restore',
+      payload: { sessionIds: 'not-an-array' },
+    });
+    expect(res.statusCode).toBeGreaterThanOrEqual(400);
+    await app.close();
+  });
+
+  it('turns a second concurrent restore away rather than interleaving it', async () => {
+    rebootRestoreRegistry.set([offerEntry('a')]);
+    // Claimed by a restore already in flight for this same owner (undefined in
+    // single-user mode, which is what the harness runs as).
+    expect(rebootRestoreRegistry.beginSpending(undefined)).toBe(true);
+    const app = await createHarness();
+    const res = await app.inject({ method: 'POST', url: '/api/reboot-restore/restore', payload: {} });
+    expect(res.statusCode).toBe(409);
+    rebootRestoreRegistry.endSpending(undefined);
+    await app.close();
+  });
+});
+
+describe('POST /api/reboot-restore/dismiss', () => {
+  it('drops the offer and leaves the banner with nothing to show', async () => {
+    rebootRestoreRegistry.set([offerEntry('a'), offerEntry('b')]);
+    const app = await createHarness();
+
+    const res = await app.inject({ method: 'POST', url: '/api/reboot-restore/dismiss', payload: {} });
+    expect(res.json().data.dismissed).toBe(2);
+
+    const after = (await app.inject({ method: 'GET', url: '/api/reboot-restore' })).json().data;
+    expect(after.sessions).toEqual([]);
+    await app.close();
+  });
+});