Caller resolution can attribute a call to a dead record on a recycled surface_id

[EtanHey]

Follow-up from the review of #466 (lane F1), raised by the reviewer as recommended, not blocking. Investigated during the review round and deliberately not fixed — the obvious guard does not work. Filing so the reason is not lost.

The hazard

resolveCurrentCallerAgent (src/server.ts) resolves the calling agent in four tiers:

1. surface_uuid match, live
2. surface_id match, live
3. surface_uuid match (terminal records)
4. surface_id match (terminal records)

Tier 4 is the exposure. surface_id is a recyclable ref — this repo guards it explicitly elsewhere (the "surface recycled" refusal in deliverAgentInput, src/server.ts:10962). So a dead worker's record whose ref got reused by a new pane, with no live record bound to that ref, now claims to be the caller — and the #378 guard then forces the new pane's children to worker/right off a corpse.

Tiers 1 and 3 (UUID) are unaffected. Tier 4 exists because #408 flips live agents to done; removing it re-breaks U6 for records that carry no surface_uuid.

Why the obvious guard does not work

The natural fix is the same signal deliverAgentInput uses: if the live pane hosts a different, known CLI than the record's, the record is not the caller.

It cannot fire here. registry.listMerged rewrites record.cli from the live pane, so by the time caller resolution runs, a recycled record already claims the new occupant's CLI. Verified directly:

BEFORE  claude      // record as written
AFTER   codex       // after one list_agents call, pane is codex

Shipping that guard would have added protective-looking code that never triggers in the scenario it names.

What a real fix needs

A signal the registry merge does not overwrite. Candidates:

• surface_observer_id ownership plus record recency (the reviewer's suggestion) — needs a defensible recency window, and it drops caller attribution for records with no observer id, which are exactly the legacy/auto-discovered ones.
• Persisting the surface UUID at spawn for every managed seat, so tier 4 becomes unnecessary.
• Recording the CLI observed at registration separately from the merged/live one, so the comparison has an un-rewritten baseline.

An AIDEV-TODO at the call site points here.

[EtanHey]

Lane T1 — FIXED, using the signal the issue's own analysis pointed at

The guard shipped is the reviewer's first candidate — surface_observer_id ownership — applied
to the ref-only tier alone:

records.find((agent) => matchesUuid(agent) && live(agent)) ??
records.find((agent) => matchesSurfaceId(agent) && live(agent)) ??
records.find(matchesUuid) ??
records.find((agent) => matchesSurfaceId(agent) && ownsRefBinding(agent)) ?? null

ownsRefBinding is agent.surface_observer_id === <this observer's id>. This works where the CLI
comparison could not, for exactly the reason the issue states: listMerged rewrites record.cli
from the live pane, but it does not rewrite surface_observer_id — that field is stamped when
an observer binds the surface and only replaced by another binding. A ref stamped by a dead socket
generation, or never stamped, cannot say who occupies that ref now.

Recency was considered and rejected. updated_at is refreshed by merge-time metadata syncs, so
a recycled corpse's record can look freshly touched; a recency window would have been the same
class of protective-looking-but-inert code the issue was filed to avoid.

The cost, stated plainly (this is the drop the issue predicted): a caller whose record predates
observer identity gets no attribution at the ref-only tier, and sees an explicit refusal —
list_agents mine=true requires a managed calling agent identity — instead of a wrong parent. Every
cmuxlayer-spawned seat carries the stamp (createAgentSurface writes it, and ensureAutoRecord
stamps auto-discovered rows too), so the drop is limited to genuinely cross-generation records,
whose refs are meaningless anyway. Tiers 1 and 3 (UUID) are untouched, and a terminal record this
observer owns still resolves — U6 for #408-poisoned rows keeps working.

Tests (tests/f1-live-state-truth.test.ts): "#468: a terminal record from a prior observer cannot
claim a recycled ref" and "#468: a terminal record this observer owns still resolves as the
caller". Two existing F1 fixtures were given a surface_observer_id (they seeded managed leads
without one, which real spawns always write); that fixture edit is called out in the PR body.
The AIDEV-TODO at the call site is now an AIDEV-NOTE recording the reasoning.

— cmuxlayerClaude-72284e3f (worker) · claude-code/opus-5