fix(tui): keep the held queue on stay-alive worker stop

Stay-alive second Ctrl+C cancelled workers through the quit teardown,
which wiped held follow-ups. Quit still wipes; stay-alive does not.

Author: TheGreatAxios

src/tui/prompt-slash-exit.test.ts

@@ -581,6 +581,26 @@ describe("Ctrl+C exit", () => {
       });
     });
 
+    test("rejecting onStopWorkers stays STOPPED without quitting", async () => {
+      await withShell(async ({ shell }) => {
+        count = 1;
+        stops = 0;
+        exits = 0;
+        setShellStopAffordance(shell, {
+          liveWorkerCount: () => count,
+          onStopWorkers: () => Promise.reject(new Error("cancelAll failed")),
+        });
+        setShellExitHandler(shell, () => onExit());
+        handleCtrlC(shell, 0);
+        handleCtrlC(shell, 1);
+        await Promise.resolve();
+        await Promise.resolve();
+        expect(exits).toBe(0);
+        handleCtrlC(shell, 2);
+        expect(exits).toBe(1);
+      });
+    });
+
     test("single press pauses only: neither stops nor exits", async () => {
       await withShell(async ({ shell }) => {
         wireWorkers(shell, 2);

src/tui/runner/wiring.stop-affordance.test.ts

@@ -13,14 +13,20 @@ import {
 } from "../shell/internals.js";
 import { handleCtrlC } from "../shell/keys.js";
 import { withTestRenderer } from "../harness.js";
-import { buildShellStopAffordance } from "./wiring.js";
+import {
+  badgeCount,
+  createSessionQueue,
+  enqueue,
+  isPaused,
+} from "../delivery-queue.js";
+import { buildShellStopAffordance, cancelWorkersForStop } from "./wiring.js";
 
 // CL-10149 Phase 4 -- the integration half of Phase 3 deferred here.
 //
 // The runner wires the REAL stop affordance into the shell inside
 // wirePostStartup via buildShellStopAffordance: the affordance's
 // liveWorkerCount reports the underlying session store's live fleet and its
-// onStopWorkers drives the production `cancelWorkersForStop` closure. This test
+// onStopWorkers drives the production `cancelLiveWorkers` closure. This test
 // proves that end-to-end against a harnessed store: a 2nd Ctrl+C press stops
 // the live workers and the app STAYS RUNNING (no exit), and liveWorkerCount
 // reports the harnessed store's live fleet before and after the stop.
@@ -58,14 +64,11 @@ describe("shell stop affordance wiring (CL-10149 Phase 4)", () => {
       });
 
       const store = harnessWithLiveWorkers(2);
-      const bridge = { clearQueuedDelivery: () => undefined };
-      // The production dep shapes feed cancelWorkersForStop; fleetRecords is
-      // cleared after a stop so the idle-with-fleet gauge drops.
       const fleetRecords = { clear: () => undefined };
-      const affordance = buildShellStopAffordance(
-        { bridge },
-        { subAgentSessions: store, toolset: { fleetRecords } },
-      );
+      const affordance = buildShellStopAffordance({
+        subAgentSessions: store,
+        toolset: { fleetRecords },
+      });
       // The runner's wirePostStartup registers the affordance on the shell;
       // mirror that so the key machine's readStopAffordance sees it.
       setShellStopAffordance(shell, affordance);
@@ -82,7 +85,7 @@ describe("shell stop affordance wiring (CL-10149 Phase 4)", () => {
         expect(liveStripCount(store)).toBe(2);
 
         // 2nd press inside the window stops the live workers via the real
-        // cancelWorkersForStop closure -- app STAYS RUNNING (no exit).
+        // cancelLiveWorkers closure -- app STAYS RUNNING (no exit).
         handleCtrlC(shell, 1);
         expect(liveStripCount(store)).toBe(0);
         expect(exits).toBe(0);
@@ -113,10 +116,10 @@ describe("shell stop affordance wiring (CL-10149 Phase 4)", () => {
       });
 
       const store = createSubAgentSessionStore();
-      const affordance = buildShellStopAffordance(
-        { bridge: { clearQueuedDelivery: () => undefined } },
-        { subAgentSessions: store, toolset: { fleetRecords: undefined } },
-      );
+      const affordance = buildShellStopAffordance({
+        subAgentSessions: store,
+        toolset: { fleetRecords: undefined },
+      });
       setShellStopAffordance(shell, affordance);
       try {
         expect(affordance.liveWorkerCount()).toBe(0);
@@ -130,4 +133,68 @@ describe("shell stop affordance wiring (CL-10149 Phase 4)", () => {
       }
     });
   });
+
+  test("stay-alive stop keeps a held follow-up paused; quit still wipes", async () => {
+    await withTestRenderer(async (h) => {
+      const shell = createAppShell(h.renderer, {
+        terminal: { columns: 80, rows: 24 },
+        wireKeys: false,
+        run: "busy",
+      });
+      let exits = 0;
+      setShellExitHandler(shell, () => {
+        exits += 1;
+      });
+
+      const store = harnessWithLiveWorkers(2);
+      let cleared = 0;
+      const bridge = {
+        clearQueuedDelivery: () => {
+          cleared += 1;
+          shell.session = createSessionQueue("idle");
+        },
+      };
+      const fleetRecords = { clear: () => undefined };
+      const inner = buildShellStopAffordance({
+        subAgentSessions: store,
+        toolset: { fleetRecords },
+      });
+      let stopDone: Promise<void> = Promise.resolve();
+      const affordance = {
+        liveWorkerCount: inner.liveWorkerCount,
+        onStopWorkers: () => {
+          stopDone = Promise.resolve(inner.onStopWorkers());
+          return stopDone;
+        },
+      };
+      setShellStopAffordance(shell, affordance);
+      try {
+        shell.session = enqueue(shell.session, "follow up later");
+        expect(badgeCount(shell.session)).toBe(1);
+
+        handleCtrlC(shell, 0);
+        expect(isPaused(shell.session)).toBe(true);
+        expect(badgeCount(shell.session)).toBe(1);
+        expect(liveStripCount(store)).toBe(2);
+
+        handleCtrlC(shell, 1);
+        await stopDone;
+        expect(exits).toBe(0);
+        expect(liveStripCount(store)).toBe(0);
+        expect(cleared).toBe(0);
+        expect(badgeCount(shell.session)).toBe(1);
+        expect(isPaused(shell.session)).toBe(true);
+
+        await cancelWorkersForStop({
+          subAgentSessions: store,
+          fleetRecords,
+          bridge,
+        });
+        expect(cleared).toBe(1);
+        expect(badgeCount(shell.session)).toBe(0);
+      } finally {
+        shell.dispose();
+      }
+    });
+  });
 });

src/tui/runner/wiring.stop-idempotent.test.ts

@@ -5,18 +5,24 @@ import {
   type SubAgentSessionStore,
 } from "../../subagent/session-store.js";
 import { isLiveStrip } from "../../subagent/lifecycle.js";
-import { cancelWorkersForStop } from "./wiring.js";
+import { createAppShell } from "../shell/index.js";
+import {
+  setShellExitHandler,
+  setShellStopAffordance,
+} from "../shell/internals.js";
+import { handleCtrlC } from "../shell/keys.js";
+import { withTestRenderer } from "../harness.js";
+import { buildShellStopAffordance, cancelWorkersForStop } from "./wiring.js";
 
 // CL-10149 Phase 3 — idempotent stop-then-quit (three-press Ctrl+C).
 //
-// The 2nd-press stop and the 3rd-press quit both drive `cancelWorkersForStop`
-// (the affordance's onStopWorkers in Phase 4 wires the stop; the quit path
-// runs it again through shutdownRuntime). Because `cancelAll` snapshots live
-// sessions and leaves tombstones, a stop followed by a quit must cancel twice
-// total, with the second call finding nothing live — no double cancel. The
-// single-press pause (the interrupt path) must never call cancelAll at all.
-// These assertions pin that idempotency at the `cancelWorkersForStop` unit
-// boundary, before the affordance is wired into production (Phase 4).
+// The 2nd-press stay-alive stop drives `cancelLiveWorkers`; the 3rd-press
+// quit runs `cancelWorkersForStop` through shutdownRuntime. Both cancel
+// via `cancelAll`, which snapshots live sessions and leaves tombstones, so
+// a stop followed by a quit must cancel twice total, with the second call
+// finding nothing live — no double cancel. The single-press pause (the
+// interrupt path) must never call cancelAll at all. These assertions pin
+// that idempotency at the cancel unit boundary.
 
 interface StopHarness {
   store: SubAgentSessionStore;
@@ -80,13 +86,29 @@ describe("cancelWorkersForStop idempotency (CL-10149 Phase 3)", () => {
   });
 
   test("single-press pause never calls cancelAll", async () => {
-    // The pause press must not drive the stop/quit path, so a worker that is
-    // only paused stays live and cancelAll is never invoked (guards the
-    // interrupt path, R4/R5).
-    const h = harnessWithLiveWorkers(1);
-    expect(liveStripCount(h.store)).toBe(1);
-    expect(h.cancelCalls).toHaveLength(0);
-    expect(liveStripCount(h.store)).toBe(1);
+    await withTestRenderer(async (h) => {
+      const shell = createAppShell(h.renderer, {
+        terminal: { columns: 80, rows: 24 },
+        wireKeys: false,
+        run: "busy",
+      });
+      setShellExitHandler(shell, () => undefined);
+      const harn = harnessWithLiveWorkers(1);
+      setShellStopAffordance(
+        shell,
+        buildShellStopAffordance({
+          subAgentSessions: harn.store,
+          toolset: { fleetRecords: { clear: () => undefined } },
+        }),
+      );
+      try {
+        handleCtrlC(shell, 0);
+        expect(harn.cancelCalls).toHaveLength(0);
+        expect(liveStripCount(harn.store)).toBe(1);
+      } finally {
+        shell.dispose();
+      }
+    });
   });
 
   test("a lone stop on many live workers still cancels exactly once", async () => {

src/tui/runner/wiring.ts

@@ -157,50 +157,58 @@ export interface StopTeardownDeps {
   bridge: { clearQueuedDelivery: () => void };
 }
 
+/**
+ * Cancel live workers and drop fleet records, leaving tombstones so a later
+ * quit-path cancelAll is a no-op. Does not wipe the held delivery queue —
+ * stay-alive 2nd-press stop uses this so follow-ups stay pending.
+ */
+export async function cancelLiveWorkers(
+  deps: Omit<StopTeardownDeps, "bridge">,
+): Promise<void> {
+  await deps.subAgentSessions.cancelAll("Session closed");
+  deps.subAgentSessions.teardown("Session closed");
+  deps.fleetRecords?.clear();
+}
+
 /**
  * Stop teardown (CL-8016): cancel the workers, wipe the sessions (leaving
  * tombstones so a late send_input names the teardown), drop the mailbox
  * lanes that pin them, and clear the bridge queue so no wake-turn bound
  * outlives the sessions it was owed to. Exported so the stall-bound
  * regression test drives this exact production path instead of re-wiring
- * the three clears by hand.
+ * the three clears by hand. Quit / shutdown keep this wipe; stay-alive
+ * stop uses `cancelLiveWorkers` instead.
  */
 export async function cancelWorkersForStop(
   deps: StopTeardownDeps,
 ): Promise<void> {
-  await deps.subAgentSessions.cancelAll("Session closed");
-  deps.subAgentSessions.teardown("Session closed");
-  deps.fleetRecords?.clear();
+  await cancelLiveWorkers(deps);
   deps.bridge.clearQueuedDelivery();
 }
 
 /**
  * Stop-teardown sources for the shell stop affordance (CL-10149 Phase 4).
  * Live-worker count is the authoritative `liveFleetCount` over the session
- * store (not the bridge-local mirror); the stop callback is the exact
- * production `cancelWorkersForStop` closure, so a 2nd-press stop and the
- * 3rd-press quit share the same teardown deps as `shutdownRuntime`
- * (wiring.ts:295-301) and stay idempotent. Extracted so the Phase 4 wiring
- * test can drive the real closure against a harnessed store without a full
- * runner harness.
+ * store (not the bridge-local mirror); the stop callback cancels workers
+ * and fleet records without wiping the held queue, so a 2nd-press stay-alive
+ * stop keeps pending follow-ups. Quit still goes through
+ * `cancelWorkersForStop` (wiring.ts shutdown path) and wipes. Extracted so
+ * the Phase 4 wiring test can drive the real closure against a harnessed
+ * store without a full runner harness.
  */
-export function buildShellStopAffordance(
-  host: { bridge: { clearQueuedDelivery: () => void } },
-  deps: {
-    subAgentSessions: Pick<
-      RunnerServices["subAgentSessions"],
-      "list" | "cancelAll" | "teardown"
-    >;
-    toolset: { fleetRecords?: { clear: () => void } | undefined };
-  },
-): ShellStopAffordance {
+export function buildShellStopAffordance(deps: {
+  subAgentSessions: Pick<
+    RunnerServices["subAgentSessions"],
+    "list" | "cancelAll" | "teardown"
+  >;
+  toolset: { fleetRecords?: { clear: () => void } | undefined };
+}): ShellStopAffordance {
   return {
     liveWorkerCount: () => liveFleetCount(deps.subAgentSessions.list()),
     onStopWorkers: () =>
-      cancelWorkersForStop({
+      cancelLiveWorkers({
         subAgentSessions: deps.subAgentSessions,
         fleetRecords: deps.toolset.fleetRecords,
-        bridge: host.bridge,
       }),
   };
 }
@@ -340,14 +348,14 @@ export function wirePostStartup(
   setActiveDisposeHost(() => services.crashGuard.invokeDisposeHost());
 
   // CL-10149 three-press: register the shell stop affordance so the 2nd Ctrl+C
-  // (with live sub-agents) drives the same faithful stop-teardown closure the
-  // quit path uses — the runner owns the source of truth, the shell stays
-  // service-free (SOLUTION_SCOPE D1/D2). liveWorkerCount reports the live fleet
-  // from the session store; onStopWorkers stops the workers while the app stays
-  // running, and is idempotent so a later quit finds nothing live.
+  // (with live sub-agents) stops workers while the app stays running. The
+  // runner owns the source of truth; the shell stays service-free. Stay-alive
+  // stop cancels workers without wiping the held queue; quit still wipes
+  // through cancelWorkersForStop. Tombstones keep a later quit-path cancelAll
+  // a no-op.
   setShellStopAffordance(
     hostOf(state).shell,
-    buildShellStopAffordance({ bridge: hostOf(state).bridge }, services),
+    buildShellStopAffordance(services),
   );
 
   // Harness inference.error events omit providerId; stamp the live catalog id

src/tui/shell/keys.ts

@@ -1,12 +1,14 @@
 /**
  * Key routing: paste guard, kill-ring chords, the onKey dispatcher body, Ctrl+C arming.
  */
+import { getLogger } from "@intx/log";
 import {
   ScrollBoxRenderable,
   type BaseRenderable,
   type KeyEvent,
   type MouseEvent,
 } from "@opentui/core";
+import { LOG_NAMESPACE_ROOT } from "../../branding.js";
 import { badgeCount, pause } from "../delivery-queue.js";
 
 import {
@@ -91,6 +93,14 @@ import {
 } from "../sent-message-history.js";
 import { EXPAND_KEY } from "../stream.js";
 
+const tuiLogger = getLogger([LOG_NAMESPACE_ROOT, "tui"]);
+
+function logStopWorkersFailure(error: unknown): void {
+  tuiLogger.warn("stop workers failed: {error}", {
+    error: error instanceof Error ? error.message : String(error),
+  });
+}
+
 // Human keystrokes land tens of milliseconds apart at the fastest; a paste
 // replayed onto stdin without bracketed-paste framing lands effectively all
 // at once. 15ms is an empirical guess at a gap comfortably under normal
@@ -206,7 +216,11 @@ export function handleCtrlC(
             ? { schedule: options.schedule }
             : {}),
         });
-        void onStop();
+        try {
+          void Promise.resolve(onStop()).catch(logStopWorkersFailure);
+        } catch (error: unknown) {
+          logStopWorkersFailure(error);
+        }
         return;
       }
       // Real quit (2nd press with no live workers, or 3rd press after stop).