fix(tui): bound the primary turn so a silent stall can't freeze it (#1080)

* fix(tui): bound the primary turn so a silent stall can't freeze it

* fix(tui): answer CL-8016 critic nits without changing stall-bound behavior

Summary: document turnMarkers as diagnostic-only; drive the stop test through production cancelWorkersForStop; import prod ASK_DEADLINE_MS and pin its value and 2x stall-bound sizing; coalesce expireStaleAsks to one notify per batch; drop dead ?. on FleetMailbox.sessions.

Verification: bun run typecheck (exit 0); oxfmt --check and oxlint clean on all five files; bun test --randomize green on wiring.stall-bound (4 pass) plus session-store, agent-fleet, wiring.stall-poll, wiring.ask-wake, ask-director (207 pass, 0 fail).

* fix(tui): hang stalled ask-wake resurface on shouldAbortForStall

After the silent-turn abort, a second wake-only predicate would duplicate
that bound. Un-dedupe armed wakes on interrupt instead.

* fix(tui): let occupancy win after a stalled ask-wake abort

A stalled armed wake was re-surfacing before mailbox mail, so
occupancy lost the next turn. Share one interrupt path: interrupt
the hung inference, then mail, then wake only if still idle.
Expiring asks must abort that wake, not merely disarm it.

Author: TheGreatAxios

src/subagent/agent-fleet.ts

@@ -243,6 +243,20 @@ class FleetMailbox {
     );
   }
 
+  /**
+   * Stop teardown (CL-8016): drop every mailbox record alongside the store
+   * wipe, so no stale lane outlives the sessions it pins. The records held
+   * `pinHeld` refs into the store's refcounts; the store teardown clears
+   * `pinCounts` wholesale, so dropping the records here keeps both sides in
+   * agreement with nothing left to unpin. Also resets the parked-ask wake
+   * fingerprint so a later session reusing an id re-surfaces cleanly.
+   */
+  clear(): void {
+    this.records.clear();
+    this.lastSurfacedParkedAsks = undefined;
+    this.sessions.wake();
+  }
+
   markProviderFailure(id: string): void {
     const existing = this.records.get(id);
     if (existing === undefined) return;

src/subagent/fleet-report.ask-wake.test.ts

@@ -84,4 +84,20 @@ describe("pendingAskWakeText", () => {
     expect(text).toContain("using target a1");
     expect(text.toLowerCase()).toContain("worker");
   });
+
+  test("a re-surface count restates that the earlier wake stalled", () => {
+    const text = pendingAskWakeText(
+      {
+        sessionId: "a1",
+        agentId: "builder",
+        description: "Build the thing",
+        question: "Which port?",
+        questionId: "q1",
+      },
+      { resurface: 1 },
+    );
+    expect(text).toContain("Re-surface 1");
+    expect(text).toContain("stalled");
+    expect(text).toContain("send_input");
+  });
 });

src/subagent/fleet-report.ts

@@ -174,14 +174,30 @@ export const ASK_DIRECTOR_WAKE_PREFIX = "ask_director wake";
  * parent, not as the operator being asked — the parent answers via
  * send_input itself and only escalates when it genuinely cannot.
  */
-export function pendingAskWakeText(wake: PendingAskWake): string {
-  return [
+export function pendingAskWakeText(
+  wake: PendingAskWake,
+  options?: { resurface?: number },
+): string {
+  const lines = [
     `${ASK_DIRECTOR_WAKE_PREFIX} — worker ${wake.agentId} (${wake.description}) parked question ${wake.questionId} while this session was not collecting:`,
     "",
     wake.question,
     "",
+  ];
+  // Escalation for a re-surfaced question (CL-8016): the earlier wake turn
+  // stalled past the bound and was aborted without an answer, so say so and
+  // restate the routing — otherwise a second identical wake reads as a
+  // duplicate rather than as proof the first one never landed.
+  if (options?.resurface !== undefined && options.resurface > 0) {
+    lines.push(
+      `Re-surface ${options.resurface}: the earlier wake turn stalled and was aborted without an answer — reconcile against the live question before replying.`,
+      "",
+    );
+  }
+  lines.push(
     `The worker — not the operator — raised this. Answer it with send_input (soft) using target ${wake.sessionId}; do not relay to the operator unless it genuinely needs them.`,
-  ].join("\n");
+  );
+  return lines.join("\n");
 }
 
 type Change =

src/subagent/lifecycle-tools.ts

@@ -460,9 +460,12 @@ export function createSendInputTool(deps: LifecycleToolDeps): AgentTool {
           : {}),
       });
       if (!outcome.ok) {
+        // CL-8016: name the teardown when one is recorded — after a stop the
+        // session is gone, and a bare status would read as "never existed".
+        const hint = outcome.hint !== undefined ? ` ${outcome.hint}` : "";
         return lifecycleResult(
           call.id,
-          `Error: cannot send_input to "${target}" (status: ${outcome.status}).`,
+          `Error: cannot send_input to "${target}" (status: ${outcome.status}).${hint}`,
         );
       }
       // CL-7331: an interrupt-with-followup is transitional, not terminal.

src/subagent/session-store.ts

@@ -290,7 +290,7 @@ export interface SubAgentSessionStore {
     },
   ):
     | { ok: true; status: AgentLifecycleStatus }
-    | { ok: false; status: AgentLifecycleStatus };
+    | { ok: false; status: AgentLifecycleStatus; hint?: string };
   /**
    * One pending ask_director per session. `sendInputOne` (soft) resolves it;
    * interrupt/settle/close cancel it. Wait JSON projects this, not lifecycle.
@@ -308,6 +308,16 @@ export interface SubAgentSessionStore {
   cancelAsk(id: string, reason?: string): boolean;
   hasPendingAsk(id: string): boolean;
   peekAsk(id: string): { question: string; questionId: string } | undefined;
+  /**
+   * Ask deadline (CL-8016): reject every pending ask older than `maxAgeMs`
+   * with an explicit timeout error naming its question and session, so a
+   * parked worker whose wake turn stalled can never wait forever. Returns the
+   * expired descriptors; settlement stays exactly-once through the same
+   * delete-then-settle path as `resolveAsk`/`cancelAsk`.
+   */
+  expireStaleAsks(
+    maxAgeMs: number,
+  ): readonly { sessionId: string; questionId: string }[];
   /**
    * Refcount so wait mailboxes can pin an uncollected result. pruneCompleted
    * will not delete a session while its pin count is greater than zero.
@@ -337,10 +347,26 @@ export interface SubAgentSessionStore {
   wake(): void;
   subscribe(listener: () => void): () => void;
   clear(): void;
+  /**
+   * Stop teardown (CL-8016): like `clear`, but leaves a tombstone per known
+   * session so a late `sendInputOne` fails closed naming the teardown instead
+   * of the bare `not_found` a wipe would give. New ids after teardown still
+   * report `not_found`; ids the teardown removed name it via `hint`.
+   */
+  teardown(reason?: string): void;
 }
 
 export const DEFAULT_CANCEL_REASON = "Cancelled by operator";
 
+/**
+ * Ask deadline (CL-8016): a parked `ask_director` question older than this
+ * settles via `expireStaleAsks` with an explicit timeout error, so a worker
+ * whose wake turn stalled can never wait forever. Twice the stall abort
+ * bound, so a re-surfaced wake turn gets a full bound cycle to prove the
+ * parent alive before its questions time out.
+ */
+export const ASK_DEADLINE_MS = 1_800_000;
+
 const DEFAULT_MAX_COMPLETED = 20;
 // CL-7007: sized for fan-out dispatch (dozens of spawn_agent workers), not a
 // sidebar list — see maxRetained doc above.
@@ -582,6 +608,10 @@ export function createSubAgentSessionStore(
       questionId: string;
       resolve: (answer: string) => void;
       reject: (reason: unknown) => void;
+      // Registration clock for the ask deadline (CL-8016): an ask parked
+      // longer than the bound settles via `expireStaleAsks` instead of
+      // waiting on a wake turn that may never land.
+      askedAt: number;
     }
   >();
   const listeners = new Set<() => void>();
@@ -656,7 +686,11 @@ export function createSubAgentSessionStore(
     return false;
   };
 
-  const cancelAskInternal = (id: string, reason: string): boolean => {
+  const cancelAskInternal = (
+    id: string,
+    reason: string,
+    silent = false,
+  ): boolean => {
     const pending = pendingAsks.get(id);
     if (pending === undefined) return false;
     pendingAsks.delete(id);
@@ -665,7 +699,7 @@ export function createSubAgentSessionStore(
     } catch {
       // Reject must not throw into settle/interrupt paths.
     }
-    notify();
+    if (!silent) notify();
     return true;
   };
 
@@ -1763,9 +1797,22 @@ export function createSubAgentSessionStore(
       },
     ):
       | { ok: true; status: AgentLifecycleStatus }
-      | { ok: false; status: AgentLifecycleStatus } {
+      | { ok: false; status: AgentLifecycleStatus; hint?: string } {
       const session = sessions.get(id);
-      if (session === undefined) return { ok: false, status: "not_found" };
+      if (session === undefined) {
+        // CL-8016: after a stop teardown the id is gone but the teardown is
+        // named — a bare `not_found` would read as "never existed" when the
+        // real story is "existed, then the runtime shut down".
+        const tombstone = evicted.get(id);
+        if (tombstone !== undefined) {
+          return {
+            ok: false,
+            status: tombstone.lifecycleStatus,
+            hint: tombstone.hint,
+          };
+        }
+        return { ok: false, status: "not_found" };
+      }
       if (session.lifecycle.state !== "running") {
         return { ok: false, status: projectLifecycleStatus(session.lifecycle) };
       }
@@ -1851,7 +1898,7 @@ export function createSubAgentSessionStore(
       if (session === undefined) return false;
       if (session.lifecycle.state !== "running") return false;
       if (pendingAsks.has(id)) return false;
-      pendingAsks.set(id, ask);
+      pendingAsks.set(id, { ...ask, askedAt: now() });
       mutate(id, () => undefined);
       return true;
     },
@@ -1879,6 +1926,26 @@ export function createSubAgentSessionStore(
       return { question: pending.question, questionId: pending.questionId };
     },
 
+    expireStaleAsks(
+      maxAgeMs: number,
+    ): readonly { sessionId: string; questionId: string }[] {
+      const cutoff = now() - maxAgeMs;
+      const expired: { sessionId: string; questionId: string }[] = [];
+      for (const [id, pending] of pendingAsks) {
+        if (pending.askedAt > cutoff) continue;
+        expired.push({ sessionId: id, questionId: pending.questionId });
+        cancelAskInternal(
+          id,
+          `ask_director question ${pending.questionId} for session ${id} expired without an answer after ${maxAgeMs}ms — reply with send_input before the deadline, or not at all`,
+          true,
+        );
+      }
+      // One subscriber wake for the batch (none when nothing expired):
+      // per-ask notifies would wake N observers for one poll tick.
+      if (expired.length > 0) notify();
+      return expired;
+    },
+
     interruptOne(
       id: string,
     ): { ok: true } | { ok: false; status: AgentLifecycleStatus } {
@@ -2172,6 +2239,46 @@ export function createSubAgentSessionStore(
       evicted.clear();
       notify();
     },
+
+    teardown(reason = "Session closed"): void {
+      // CL-8016: stop teardown. Cancels the asks with the teardown named
+      // (single-resolve preserved through `cancelAskInternal`), releases the
+      // handles like `clear`, then leaves a tombstone per removed session so
+      // a late `sendInputOne` fails closed naming the teardown instead of a
+      // bare `not_found` that would read as "never existed".
+      for (const id of pendingAsks.keys())
+        cancelAskInternal(id, `ask_director cancelled: ${reason}`);
+      for (const id of closeHandles.keys()) releaseHandles(id);
+      cancelHandles.clear();
+      closeHandles.clear();
+      interruptHandles.clear();
+      followupHandles.clear();
+      deliverHandles.clear();
+      for (const id of stashedFollowups.keys())
+        dropStashedFollowups(id, reason);
+      stashedFollowups.clear();
+      for (const session of sessions.values()) {
+        evicted.set(session.id, {
+          lifecycleStatus: projectLifecycleStatus(session.lifecycle),
+          hint: reason,
+        });
+      }
+      if (evicted.size > MAX_EVICTED_TOMBSTONES) {
+        const overflow = evicted.size - MAX_EVICTED_TOMBSTONES;
+        const keys = evicted.keys();
+        for (let i = 0; i < overflow; i++) {
+          const oldest = keys.next().value;
+          if (oldest === undefined) break;
+          evicted.delete(oldest);
+        }
+      }
+      sessions.clear();
+      pinCounts.clear();
+      runInFlight.clear();
+      revisions.clear();
+      snapshotCache.clear();
+      notify();
+    },
   };
 }