fix(workspace): stop a metadata-less tile leaf from freezing autosave forever

[Juliusolsson05]

The failure

A single tile leaf whose session id had no row in sessions permanently disabled autosave on a real workspace. ~/.config/agent-code/workspace.json stopped being written on 2026-07-28 22:23 and stayed frozen for three weeks, with the Autosave off banner on every launch.

Every retained boot journal shows the same signature:

rehydrate.complete  {"expectedCount":4,"resolvedCount":3,"ok":false}

Exactly one visible pane, every time. Reading the per-session ladders, only three sessions ever received a recover.claim — the fourth was never attempted.

The cause was tab agent-code, holding a vertical split whose b leaf pointed at a session id with no entry in sessions. The tab's focusedSessionId pointed at the same dead id.

Why it could never recover

1. collectLiveProcessIds walked tile leaves and counted every one, so the orphan entered expectedSessions.
2. rehydrate's respawn loop iterates Object.entries(persisted.sessions). The orphan is not in there, so it was never claimed, never spawned, never given an outcome.
3. projectSessionRecovery likewise iterates persistedSessions, so the orphan never entered resolvedIds.
4. complete = resolvedIds.size === expectedSessions was therefore unsatisfiable, latching partial-restore and holding autosave off.
5. useAutoSave is the only writer of workspace.json, so the corrupt tree could never be rewritten.

Restarting could not help — which is exactly what the banner told the user to do.

I dated the corruption using the leftover atomic-write temp files, which are full content snapshots: every one through 2026-07-28 22:20 is clean, and the file written at 22:23 is the first containing the orphan. The last autosave before the gate closed serialized a tile leaf whose metadata had already been removed from state.sessions.

The fix

Both sides of the persistence boundary, matching the philosophy pruneSessionOwnership already states — "A corrupted workspace can fail both directions."

Read side (collectLiveProcessIds) — a leaf with no SessionMeta has no cwd and no kind, so there is nothing to spawn for it. It no longer counts toward the restore gate. This is what makes an already-corrupt file self-heal: the gate becomes satisfiable, autosave unlocks, and the write-side guard then persists a repaired tree. Deliberately not "spawn a fresh session for the orphan" — we do not know its cwd or provider, and inventing one would resurrect a pane the user never asked for, pointed at the wrong directory.

Write side (pruneOrphanTileLeaves) — collapses orphaned leaves out of the tree using the same closeLeaf primitive a normal pane close uses, so a repaired tree has exactly the shape it would have had if the pane were closed normally. Repoints focusedSessionId when it pointed at the dead id, and drops a tab that loses every leaf (its root would be empty, which TileNode cannot represent).

There is a self-reference that makes the write side the only place this repair can happen: ownership is derived from tile leaves, so an orphan leaf is an owner. Pruning sessions against owners can never remove it — the tree itself has to be rewritten. That is the gap that let the torn state become durable, because useAutoSave serialized state.tabs verbatim while scrubbing every other pointer.

Diagnostics — rehydrate.complete now names the unresolved ids. It previously said one pane was missing but never which, so diagnosing this meant diffing tile leaves against the sessions map by hand. The key is added to the lifecycle allowlist and joined into a string, since payload values must stay flat for the sanitizer to be total. No new category of data: ids are already first-class in this stream.

Tests

Regression tests reproduce the shape recorded on disk — a vertical split whose b leaf is orphaned and whose tab focus points at it — and cover the gate denominator, the collapse, focus repointing, whole-tab drop, the healthy-tree no-op (asserted by identity, so a healthy save does not churn the tree), and the end-to-end invariant that a pruned tree makes restore completion satisfiable again.

Verification

• npx tsc -b --pretty false — clean
• vitest run --project unit --project renderer — 1762 passed, 1 failed

The single failure is imageAttachment.test.ts, which asserts a local Claude transcript JSONL still exists on this machine. It fails identically on unmodified main (verified by stashing) — environment-dependent, unrelated to this change.

Scope

This is a targeted slice of #545, which already lists the invariant "Autosave resumes after every pane has a resolved outcome, including retained failures." This PR does not attempt the atomic main-owned recovery that issue describes; it fixes the specific case where a pane can never have an outcome at all.

Refs #545

🤖 Generated with Claude Code