"Never open that useless panel, whatever happens. Why open a panel that can do nothing? Leave an ordinary shell open at least — then I can do something." — Dad, 2026-09-17
The Dead Panel
On 2026-09-17 the session owner on the office Mac was restarted to move it onto a new input contract. That restart ended the live jobs, as Dad had approved. What he did not approve was what three Anvil seats looked like afterwards: a pane that said the session was no longer owned by this daemon and told him to use a menu item to restart it. The pane could not take a keystroke. It could not start a shell. It was honest about the loss and useless about everything else.
The previous lesson's rule — rematerialize, never resurrect — was being followed. Native workflow reservations had been kept on an explicit-restart path on purpose, so a seat would never be relaunched behind the operator's back. The rule was right. The resting state it left behind was a dead end, and a dead end in a terminal is a reach for another terminal.
Every Path Ends at a Prompt
The repair walks every way a pane can lose its process and gives each one a live shell at the end:
- A lost identity (daemon gone, logout, a tombstone) rematerializes the pane's declaration.
- A restored command that ends within five seconds opens a shell in its folder.
- A folder that no longer exists opens a shell at home and says so.
- A create the owner refuses opens a shell at home and says so.
- A dropped connection to the owner reconnects by itself, with backoff.
- An owner that never comes back, or was never there, leaves the pane running an app-owned shell, labeled as one.
Each of those prints one line saying why this is the shell it is. Only an explicit close, or the user's own command exiting, leaves a pane sitting at an exit status. A regression test walks the whole list — a seat, a command that ends at once, a missing folder, an owner replaced under a live pane, no service at all — and fails if any path leaves a pane that cannot type.
Reboot Brings Back More Than Shells
The same day widened what a reboot restores. When the kernel's boot identity has changed, or a saved session identity turns out to be only a tombstone, the app now rematerializes every ordinary declaration: local shells, declared profile and fleet commands, and SSH or mosh sessions, each with a fresh session identity, the layout kept, and any foreground program re-checked against the restore list. Before that change only local shells came back after a reboot.
Workflow reservations are the deliberate exception. An Anvil seat or a Firebrand resume comes back as a plain login shell in its folder, wearing its badge and color, and its CLI is never restarted on its own. A seat belongs to Anvil's run; starting a fresh CLI there would invent a seat the run never asked for. The shell is there so the operator can act; the seat is not faked so the run stays true.
Honest and Usable Are Not Opposites
None of this bends the earlier rule. No fallback claims a process survived. Every fallback says what it is in its first line. What changed is the resting state: from a truthful pane that can do nothing to a truthful pane that can do something. Both halves were Dad's bar from the first day — sturdy, and no reason to open the other app.