Fix /sessions resume: keep the pane and un-suppress the status fallback (#713)

* Keep a resumed pane bound to the session the user resumed

`/sessions` resume creates the pane and binds it through
`ResumePaneAssigned` before the agent CLI starts, so that pane belongs to
exactly one session id. Copilot's `--resume` boots a throwaway bootstrap
session first and only switches to the requested one seconds later, so its
deferred SessionStart hook reports the bootstrap id together with the resumed
pane's GUID. Master's `active_by_pane` handoff took that at face value and
demoted the resumed row to Ended; terminal-state rows refuse resurrection, so
the row stayed Ended for the rest of the CLI's life while the hookless watcher's
status events were silently dropped.

Mark a WTA-established pane binding `born_bound_pane` and refuse the handoff
when the pane's current owner is a live born-bound row with a different key. The
incoming session is still recorded, it just gets no pane binding. The flag
clears itself when the row gives up the pane (SessionStopped, PaneClosed,
end_entry) or once a SessionStarted for the same key claims it, so a genuinely
new session typed into that pane still takes over and no timer is involved.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cd1be30e-1a90-4c72-af2e-1b138a6cc866

* Drop a stale hook_owned claim when a session is born-bound again

`hook_owned` was sticky: once a session id landed there it stayed for the
lifetime of the master process. Resuming a session that had already run once in
the same process therefore added `born_bound` while the old claim remained, and
because `apply_watcher_event` checks `hook_owned` first, every watcher status
event for the resumed row was dropped. The row sat at Idle for its whole life
even though the CLI was working and its transcript kept growing.

That combination is easy to hit now that Copilot's `--resume` bootstrap session
consumes the SessionStart hook: the resumed id itself never emits another hook,
so the watcher is the only remaining status producer -- and it was suppressed.

Observed: cd195d64 got real hooks at 04:05, was resumed at 06:05 in the same
master process (started 03:01), and master then broadcast zero sessions/changed
while events.jsonl grew to 209 KB.

Restore the documented disjointness by removing the id from `hook_owned` on the
binding-only path. A born-bound event means WTA has just relaunched that id, so
the previous generation's claim is over, and a real hook re-claims ownership on
its very next event.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cd1be30e-1a90-4c72-af2e-1b138a6cc866

* Name the pane's current owner `owner` in the born-bound guard

The three closures in the guard's chain bound the same name to three different
things: two `&SessionId` for the pane's current owner, then `&SessionInfo`
for that owner's row. `prev` also read as "the previous value of sid", which is
the opposite of what it holds -- `sid` is the incoming event's session id, the
one attempting to claim the pane, while the chain resolves whoever already owns
it. `owner_sid` / `owner` matches the comment right above, which already
calls it "the pane's born-bound owner".

Rename only; no behavior change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cd1be30e-1a90-4c72-af2e-1b138a6cc866

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cd1be30e-1a90-4c72-af2e-1b138a6cc866

Author: DDKinger

doc/specs/hybrid-agent-session-tracking.md

@@ -153,9 +153,19 @@ The master keeps **two disjoint** ownership sets (`master/mod.rs`):
 
 `handle_session_hook` routes each inbound event: a binding-only event (the
 dedicated `intellterm.wta/session_born_bound` method, or a
-`ResumeDispatched`/`ResumePaneAssigned` resume-binding event) → `born_bound`;
-anything else (a real hook / ACP event) → `hook_owned` (and, if the session was
-born-bound, drops it from `born_bound` — a real hook **takes over**).
+`ResumeDispatched`/`ResumePaneAssigned` resume-binding event) → `born_bound`
+(and drops any stale `hook_owned` claim — see below); anything else (a real
+hook / ACP event) → `hook_owned` (and, if the session was born-bound, drops it
+from `born_bound` — a real hook **takes over**).
+
+The two sets are disjoint **in both directions**. A born-bound event means WTA
+has just (re)launched that session id, so an ownership claim left by an earlier
+generation of the same id is over. Without the reverse removal, resuming a
+session that had already run once in the same master process left it in
+`hook_owned` forever; since `apply_watcher_event` checks `hook_owned` first,
+every watcher status event for the resumed row was dropped and the row sat at
+`Idle` for its whole life. A real hook re-claims ownership on its very next
+event, so nothing is lost when hooks are working.
 
 `apply_watcher_event` then, in order:
 
@@ -195,6 +205,21 @@ the hook-free resume binding, so `handle_session_hook` records them in
 treated as hook-owned and its row would sit at `Idle` forever even as the watcher
 saw activity.
 
+**Resume pane ownership.** `ResumePaneAssigned` marks the row's pane binding
+`born_bound_pane` (`session_registry.rs`). WTA creates the resume pane and binds
+it *before* the agent CLI starts, so that pane belongs to exactly one session
+id. Copilot's `--resume` boots a throwaway bootstrap session and only switches
+to the requested one seconds later, so its deferred `SessionStart` hook reports
+the **bootstrap** id against the resumed pane's GUID. Master's `SessionStarted`
+reducer therefore refuses the `active_by_pane` handoff when the pane's current
+owner is a live born-bound row with a different key: the incoming session is
+still recorded, it just gets no pane binding. Without the guard the resumed row
+was demoted to `Ended`, and because terminal-state rows refuse resurrection it
+stayed there for the rest of the CLI's life — the watcher's status fallback
+silently dropped every event. The flag clears itself whenever the row gives up
+the pane (`SessionStopped`, `PaneClosed`, `end_entry`) or once a `SessionStarted`
+for the *same* key claims it, so the protection needs no timer.
+
 ### Liveness gate: scoping to this IT window
 
 The four CLIs write their session state to **per-user** roots, so the watcher

tools/wta/src/master/mod.rs

@@ -6149,14 +6149,23 @@ async fn handle_session_hook(
     //
     //  * binding-only (#266 delegate born-bound + resume binding events): record
     //    in `born_bound` so the watcher may still supply STATUS when no real hook
-    //    is installed — without re-binding the pane.
+    //    is installed — without re-binding the pane. Also drop any **stale**
+    //    `hook_owned` claim: the two sets are disjoint by contract, and a
+    //    born-bound event means WTA has just (re)launched this session id, so an
+    //    ownership claim left by a previous generation of the same session is
+    //    over. Without this a `/sessions` resume of a session that ran earlier
+    //    in the same master process stayed `hook_owned` forever, and because
+    //    `apply_watcher_event` checks `hook_owned` first, every watcher status
+    //    event for the resumed row was dropped — the row sat at Idle for the
+    //    whole session. A real hook re-claims ownership on its very next event.
     //  * real hook / ACP agent-pane event: authoritative for binding AND
     //    activity. Record in `hook_owned` (full watcher suppression) and, if the
     //    session was previously born-bound, drop it from `born_bound` — the real
     //    hook now owns it.
     if let Some(key) = &refresh_key {
         let sid = acp::schema::v1::SessionId::new(key.clone());
         if binding_only {
+            state.hook_owned.lock().await.remove(&sid);
             state.born_bound.lock().await.insert(sid);
         } else {
             state.hook_owned.lock().await.insert(sid.clone());

tools/wta/src/master/tests.rs

@@ -10395,3 +10395,76 @@ async fn resume_binding_events_are_born_bound_not_hook_owned() {
     );
     assert!(!state.hook_owned.lock().await.contains(&sid));
 }
+
+#[tokio::test]
+async fn resume_binding_events_clear_a_stale_hook_ownership_claim() {
+    // Regression: resuming a session that already ran once in THIS master
+    // process. The earlier run's hooks put the id in `hook_owned`, and
+    // `hook_owned` used to be sticky — the resume added `born_bound` but left
+    // the stale claim in place, so `apply_watcher_event`'s first check dropped
+    // every watcher status event and the resumed row sat at Idle for its whole
+    // life. The two sets are disjoint by contract; a born-bound event means WTA
+    // just relaunched the id, so the previous generation's claim is over.
+    let state = make_state();
+    let sid = acp::schema::v1::SessionId::new("sid-rerun".to_string());
+
+    let first_run = crate::agent_sessions::SessionEvent::SessionStarted {
+        key: "sid-rerun".to_string(),
+        cli_source: crate::agent_sessions::CliSource::Copilot,
+        pane_session_id: "pane-old".to_string(),
+        cwd: std::path::PathBuf::from("C:\\repo"),
+        title: String::new(),
+    };
+    handle_session_hook(&state, first_run, false)
+        .await
+        .expect("real hook accepted");
+    assert!(state.hook_owned.lock().await.contains(&sid));
+
+    let dispatched = crate::agent_sessions::SessionEvent::ResumeDispatched {
+        key: "sid-rerun".to_string(),
+    };
+    handle_session_hook(&state, dispatched, false)
+        .await
+        .expect("resume dispatched accepted");
+
+    assert!(
+        !state.hook_owned.lock().await.contains(&sid),
+        "the resume must drop the previous run's hook_owned claim, or the \
+         watcher's status fallback stays suppressed for the whole session"
+    );
+    assert!(
+        state.born_bound.lock().await.contains(&sid),
+        "the resumed session is born-bound"
+    );
+}
+
+#[tokio::test]
+async fn born_bound_delegate_clears_a_stale_hook_ownership_claim() {
+    // Same invariant for the dedicated born-bound method (`?<prompt>`
+    // delegation), which reaches `handle_session_hook` with is_born_bound=true.
+    let state = make_state();
+    let sid = acp::schema::v1::SessionId::new("sid-delegate".to_string());
+
+    let earlier = crate::agent_sessions::SessionEvent::ToolStarting {
+        key: "sid-delegate".to_string(),
+        tool_name: "Bash".to_string(),
+    };
+    handle_session_hook(&state, earlier, false)
+        .await
+        .expect("real hook accepted");
+    assert!(state.hook_owned.lock().await.contains(&sid));
+
+    let born = crate::agent_sessions::SessionEvent::SessionStarted {
+        key: "sid-delegate".to_string(),
+        cli_source: crate::agent_sessions::CliSource::Copilot,
+        pane_session_id: "pane-new".to_string(),
+        cwd: std::path::PathBuf::from("C:\\repo"),
+        title: String::new(),
+    };
+    handle_session_hook(&state, born, true)
+        .await
+        .expect("born-bound accepted");
+
+    assert!(!state.hook_owned.lock().await.contains(&sid));
+    assert!(state.born_bound.lock().await.contains(&sid));
+}