fix: don't pin dashboard to a non-orchestrator session (#12)

jgnagy · claude · web-flow · commit d1f62b0bce24 · 2026-06-18T18:46:56.000-04:00
* fix: don't pin dashboard to a non-orchestrator session

The dashboard discovers delegates by scanning the *parent* (orchestrator)
session's messages for "Task &lt;id&gt; started in background" and never re-resolves
that parent once pinned. Two paths could pin the wrong session, leaving the UI
stuck on "Spawning delegates..." with 0 delegates forever — even while delegate
messages stream onto the wall (the wall is keyed off GOOSE_GTWALL_FILE, so it
keeps working independently):

1. dashboard `resolve_session()` trusted `AGENT_SESSION_ID` unconditionally and
   passed it as `--session`, bypassing goosetown-ui's own discovery. goose
   exports a *terminal* session id into shell subprocesses, so launching the
   dashboard from a goose shell pinned that terminal session — which has no
   delegates.
2. `sessions_tree_watcher()` reads `parent_id` once and never re-resolves, so any
   wrong/early pin is permanent.

Fix:
- resolve_session(): only trust AGENT_SESSION_ID when it actually has delegate
  activity; otherwise prefer SQL discovery of a delegate-bearing session, and
  fall back to AGENT_SESSION_ID / most-recent user session only as a last resort.
  Adds a `session_has_delegates()` helper.
- sessions_tree_watcher(): when the pinned parent yields 0 children, re-resolve
  via find_parent_session() and adopt a candidate only if it actually has
  children — self-healing without thrashing between empty sessions.

Verified against a real sessions.db that exhibited the bug: with
AGENT_SESSION_ID set to a terminal session, resolve_session now returns the
orchestrator session, and the watcher re-resolves a wrongly-pinned parent to the
orchestrator (6 delegates) while leaving a correct parent untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;

* fix: scope dashboard session resolution to the instance's wall

All goosetowns on a machine share one sessions.db, and sessions carry no
instance/wall identifier. The previous resolution ("most recent delegate-bearing
user session") and the self-heal added in the prior commit would, with multiple
concurrent instances, resolve or re-pin to *another* instance's orchestrator —
e.g. instance A's dashboard adopting instance B's delegates whenever A's
orchestrator momentarily had 0 children.

Use the wall as the per-instance anchor. An instance's wall lists its delegates'
gtwall IDs (senders), and the orchestrator's delegate-spawn messages declare those
same IDs (already parsed by build_sender_session_map). Matching the two uniquely
identifies the orchestrator for this instance:

- goosetown-ui: add scoped_parent_session(cur, senders) — pick the candidate whose
  spawned delegates overlap most with this wall's senders (ties → most recent),
  else None. find_parent_session() now prefers it; main() lets a positive
  wall-scoped match override an explicit --session (the launcher may pass a
  terminal/other-instance id); the self-heal re-resolves on 0 children OR when the
  current parent's delegates don't match the wall's senders (wrong instance), using
  only the scoped lookup — so it can adopt this instance's orchestrator and never
  another's.
- dashboard: resolve_session() prefers a delegate-bearing user session that
  references this wall (WALL_ID, already sanitized to [A-Za-z0-9_-]) before the
  generic most-recent query. Best-effort hint; goosetown-ui is authoritative.

Verified with a synthetic two-instance sessions.db: wall-A senders resolve to
orchestrator A and wall-B senders to orchestrator B even though B is more recently
updated; a wall with no delegate senders resolves to None (never a cross-instance
guess); and bash resolve_session honors WALL_ID over a conflicting AGENT_SESSION_ID.
Single-instance behavior and tests/test_dashboard.sh (4/4) unchanged.

Known limitation: if two concurrent instances spawn delegates with identical gtwall
IDs, the most-overlap-then-most-recent tiebreak may still pick the wrong one.

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;

---------

Co-authored-by: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/dashboard b/dashboard
@@ -31,22 +31,77 @@ SCREEN_NAME="goosetown-ui-${WALL_ID}"
 PORTFILE="${WALLS_DIR}/dashboard-${WALL_ID}.port"
 
 # ── Session resolution ──────────────────────────────────────────────────────
+# True if the given session has delegate activity (a "started in background"
+# message), i.e. it looks like an orchestrator rather than a bare terminal/chat
+# session. Returns non-zero on empty input, no DB, or no delegate activity.
+session_has_delegates() {
+  local sid="$1"
+  [[ -n "$sid" ]] || return 1
+  command -v sqlite3 &>/dev/null && [[ -f "$DB_PATH" ]] || return 1
+  # Escape single quotes to keep the literal safe (session ids are YYYYMMDD_N).
+  local esc="${sid//\'/\'\'}"
+  local n
+  n=$(sqlite3 "$DB_PATH" "
+    SELECT COUNT(*) FROM messages
+    WHERE session_id = '$esc'
+      AND content_json LIKE '%started in background%';
+  " 2>/dev/null || echo 0)
+  [[ "$n" =~ ^[0-9]+$ && "$n" -gt 0 ]]
+}
+
 resolve_session() {
   local sid="${AGENT_SESSION_ID:-}"
 
-  if [[ -z "$sid" ]] && command -v sqlite3 &>/dev/null && [[ -f "$DB_PATH" ]]; then
-    # Prefer orchestrator session (has delegates)
-    sid=$(sqlite3 "$DB_PATH" "
-      SELECT DISTINCT s.id FROM sessions s
-      JOIN messages m ON m.session_id = s.id
-      WHERE s.session_type = 'user'
-        AND m.role = 'user'
-        AND m.content_json LIKE '%started in background%'
-        AND s.updated_at > datetime('now', '-24 hours')
-      ORDER BY s.updated_at DESC LIMIT 1;
-    " 2>/dev/null || true)
-
-    # Fallback: any recent user session
+  if command -v sqlite3 &>/dev/null && [[ -f "$DB_PATH" ]]; then
+    # Prefer the orchestrator bound to THIS instance's wall. Every goosetown on the
+    # machine shares one sessions.db with no instance/wall column, so without scoping
+    # we'd risk pinning a *different* instance's orchestrator. The wall is the per-
+    # instance anchor; an orchestrator launched with this wall records its path in its
+    # messages. WALL_ID is already sanitized to [A-Za-z0-9_-], so it's injection-safe.
+    # (goosetown-ui does the authoritative wall-scoped match; this is a best-effort hint.)
+    if [[ -n "${WALL_ID:-}" ]]; then
+      local wall_scoped
+      wall_scoped=$(sqlite3 "$DB_PATH" "
+        SELECT DISTINCT s.id FROM sessions s
+        JOIN messages m ON m.session_id = s.id
+        WHERE s.session_type = 'user'
+          AND m.role = 'user'
+          AND m.content_json LIKE '%started in background%'
+          AND s.updated_at > datetime('now', '-24 hours')
+          AND EXISTS (SELECT 1 FROM messages w
+                      WHERE w.session_id = s.id AND w.content_json LIKE '%${WALL_ID}%')
+        ORDER BY s.updated_at DESC LIMIT 1;
+      " 2>/dev/null || true)
+      [[ -n "$wall_scoped" ]] && sid="$wall_scoped"
+    fi
+
+    # Otherwise don't trust AGENT_SESSION_ID if it points at a session with no delegates
+    # (e.g. goose exports a *terminal* session id into shell subprocesses). Pinning such
+    # a session leaves the dashboard stuck on "Spawning delegates..." forever because
+    # find_children() never matches. Fall through to discovery instead.
+    if [[ -z "${wall_scoped:-}" && -n "$sid" ]] && ! session_has_delegates "$sid"; then
+      sid=""
+    fi
+
+    # Prefer the most recent orchestrator session (one that has delegates).
+    if [[ -z "$sid" ]]; then
+      sid=$(sqlite3 "$DB_PATH" "
+        SELECT DISTINCT s.id FROM sessions s
+        JOIN messages m ON m.session_id = s.id
+        WHERE s.session_type = 'user'
+          AND m.role = 'user'
+          AND m.content_json LIKE '%started in background%'
+          AND s.updated_at > datetime('now', '-24 hours')
+        ORDER BY s.updated_at DESC LIMIT 1;
+      " 2>/dev/null || true)
+    fi
+
+    # Fall back to AGENT_SESSION_ID even without delegate activity — covers a fresh
+    # orchestrator that hasn't spawned delegates yet (goosetown-ui self-heals the
+    # pin once delegates appear). Then to any recent user session.
+    if [[ -z "$sid" ]]; then
+      sid="${AGENT_SESSION_ID:-}"
+    fi
     if [[ -z "$sid" ]]; then
       sid=$(sqlite3 "$DB_PATH" "
         SELECT id FROM sessions WHERE session_type = 'user'
diff --git a/scripts/goosetown-ui b/scripts/goosetown-ui
@@ -94,18 +94,64 @@ def normalize_epoch(ts) -> float:
 
 
 # ── Session Discovery ──────────────────────────────────────────────────────
-def find_parent_session(cur) -> str | None:
+def wall_sender_ids_from_file(wall_file: str | None) -> set[str]:
+    """IDs that have posted to a wall file (column 2 of each line)."""
+    if not wall_file or not os.path.isfile(wall_file):
+        return set()
+    senders: set[str] = set()
+    try:
+        with open(wall_file, "r", encoding="utf-8", errors="replace") as f:
+            for line in f:
+                parts = line.split("|", 2)
+                if len(parts) >= 2 and parts[1].strip():
+                    senders.add(parts[1].strip())
+    except OSError:
+        pass
+    return senders
+
+
+def _orchestrator_candidates(cur) -> list[str]:
+    """User sessions with delegate activity in the last 24h, most recent first."""
     cur.execute("""
         SELECT DISTINCT s.id FROM sessions s
         JOIN messages m ON m.session_id = s.id
         WHERE s.session_type = 'user'
           AND m.role = 'user'
           AND m.content_json LIKE '%started in background%'
           AND s.updated_at > datetime('now', '-24 hours')
-        ORDER BY s.updated_at DESC LIMIT 1
+        ORDER BY s.updated_at DESC
     """)
-    if row := cur.fetchone():
-        return row[0]
+    return [row[0] for row in cur.fetchall()]
+
+
+def scoped_parent_session(cur, senders: set[str]) -> str | None:
+    """The orchestrator bound to THIS instance, found by matching the gtwall IDs it
+    spawned against the IDs that have posted to this instance's wall.
+
+    All goosetowns on a machine share one sessions.db, and sessions carry no
+    instance/wall identifier. The wall file is the per-instance anchor: matching its
+    senders to a candidate's spawned delegates is what stops concurrent instances from
+    resolving to each other's orchestrator. Picks the candidate with the most overlap
+    (ties → most recent); returns None if nothing matches this wall's senders.
+    """
+    if not senders:
+        return None
+    best, best_score = None, 0
+    for cid in _orchestrator_candidates(cur):
+        spawned = set(build_sender_session_map(cur, cid).keys())
+        score = len(spawned & senders)
+        if score > best_score:
+            best, best_score = cid, score
+    return best
+
+
+def find_parent_session(cur, wall_file: str | None = None) -> str | None:
+    # Prefer the orchestrator bound to THIS instance's wall (multi-instance safe).
+    if scoped := scoped_parent_session(cur, wall_sender_ids_from_file(wall_file)):
+        return scoped
+    # Fall back: most recent delegate-bearing user session, then any recent user session.
+    if candidates := _orchestrator_candidates(cur):
+        return candidates[0]
     cur.execute("SELECT id FROM sessions WHERE session_type = 'user' ORDER BY updated_at DESC LIMIT 1")
     return row[0] if (row := cur.fetchone()) else None
 
@@ -362,6 +408,31 @@ async def sessions_tree_watcher():
                 # Tree
                 child_ids = find_children(cur, parent_id)
                 sender_map = build_sender_session_map(cur, parent_id)
+
+                # Self-heal (multi-instance safe). Re-pin when the current parent has no
+                # delegates (e.g. AGENT_SESSION_ID pointed at a terminal session, or the
+                # dashboard launched before the orchestrator existed), OR when the current
+                # parent's delegates don't match the IDs posting to our wall — meaning we're
+                # pinned to a *different* concurrent goosetown's orchestrator. Re-resolution
+                # is scoped to THIS wall's senders, so we can only ever adopt our own
+                # instance, and only a candidate that actually has children (no thrashing).
+                wall_senders = {ln.get("sender_id", "") for ln in latest_wall_lines if ln.get("sender_id")}
+                parent_gtwall_ids = set(sender_map.keys())
+                wrong_instance = bool(wall_senders) and bool(parent_gtwall_ids) and not (parent_gtwall_ids & wall_senders)
+                if not child_ids or wrong_instance:
+                    candidate = scoped_parent_session(cur, wall_senders)
+                    if candidate and candidate != parent_id:
+                        candidate_children = find_children(cur, candidate)
+                        if candidate_children:
+                            print(
+                                f"🔄 Re-resolved parent session {parent_id} → {candidate} "
+                                f"({len(candidate_children)} delegate(s), wall-scoped)",
+                                file=sys.stderr,
+                            )
+                            parent_id = candidate
+                            config["parent_session_id"] = parent_id
+                            child_ids = candidate_children
+                            sender_map = build_sender_session_map(cur, parent_id)
                 session_to_gtwall = {sid: gid for gid, sid in sender_map.items()}
                 now = time.time()
                 children = []
@@ -577,16 +648,6 @@ def main():
     parser.add_argument("--wall", help="Wall file path (auto-detect if omitted)")
     args = parser.parse_args()
 
-    parent_id = args.session
-    if not parent_id:
-        try:
-            with db() as cur:
-                parent_id = find_parent_session(cur)
-        except Exception as e:
-            print(f"⚠️  Could not auto-detect session: {e}", file=sys.stderr)
-
-    print(f"📋 Parent session: {parent_id}" if parent_id else "⚠️  No parent session found — will retry in background", file=sys.stderr)
-
     wall_file = args.wall or find_wall_file()
     wall_id = ""
     if wall_file:
@@ -595,6 +656,22 @@ def main():
     else:
         print("⚠️  No wall file found — will poll for it", file=sys.stderr)
 
+    # Resolve the parent (orchestrator) session. Prefer the one bound to THIS instance's
+    # wall — it overrides an explicit --session, since the launcher may have passed a
+    # terminal or another instance's session id. Keep --session only when the wall can't
+    # yet identify an orchestrator (no delegates have posted), then fall back to discovery.
+    parent_id = args.session
+    try:
+        with db() as cur:
+            if scoped := scoped_parent_session(cur, wall_sender_ids_from_file(wall_file)):
+                parent_id = scoped
+            elif not parent_id:
+                parent_id = find_parent_session(cur, wall_file)
+    except Exception as e:
+        print(f"⚠️  Could not auto-detect session: {e}", file=sys.stderr)
+
+    print(f"📋 Parent session: {parent_id}" if parent_id else "⚠️  No parent session found — will retry in background", file=sys.stderr)
+
     config.update({
         "parent_session_id": parent_id,
         "wall_file": wall_file,
