Amplifier integration fixes: bundle stamping, server detach, idle-reap cap, session backfill - #600

…nvironmentFile option, single-owner note

…/ 8 falsified)

Validated against the installed amplifier_app_cli 0.1.1 (1873aa9), the real
~/.amplifier corpus (12,469 sessions), live sessions, pinned saphyr/yaml@2
runs, setsid/WSL experiments, and green test baselines. Plan changes:

- Item 4 safety model redesigned (ledger A15/A16): --apply refuses while any
  amplifier process is visible; pre-rename re-read-compare; byte-fidelity
  verify (skipped-unfaithful); per-session guards kept as defense in depth.
- Item 3 (ledger A14): unconditional agent idle-reap exemption replaced by a
  24h hard cap - Running is not a loss-proof live-child signal and the sweep
  is the only cleanup for wedged rows.
- Item 2 (ledger A13): setsid verified against shell-death cascades; WSL2
  VM-teardown caveat documented; systemd unit promoted to recommended.
- Item 1 (ledger A5/A6/A9/A10): bare-stamp nuance (CLI normalizes to
  bundle:<name> on first save), loud exit-1 failure for unloadable bundles,
  multi-doc = Surprise in both resolvers, uniqueKeys:false in the TS twin,
  mirrored matrices extended; CLI ground-truth bullet added (resume default
  is 'anchors'; /home/dan/code/amplifier is not the CLI source).

Full ledger: .the-usual-logs/amplifier-integration-fixes/load-bearing-ledger.md

…te, correct reaper test counts

Fresh-eyes review found two blocking defects in the plan:

1. Task 9's applyBlockedByLiveAmplifier tested /amplifier/ against the
   whole ps snapshot, which always contains the backfill script's own
   process (the filename contains 'amplifier'), so --apply could never
   run. The gate now filters out ps lines mentioning the script filename
   (amplifier-backfill-bundle, present in every node/npx/tsx wrapper's
   argv) before matching; unit test gains self-exclusion + real-process
   assertions (same test count); header comment and Item 4 summary
   updated to match.

2. Task 7's red/green gates claimed 6 existing enforce_idle_kills_*
   tests; the crate has 9 (verified via cargo test -- --list). Red gate
   now expects 12 run / 10 pass / 2 fail, green gate expects all 12.

…(saphyr)

… stubs

… test

… shell death cannot cascade-kill agent terminals

…ument detached lifecycle

…iet agents, keep the cleanup backstop)

…seam at shell mode

…ive-session guards)

… cap

Fresh-eyes review (iteration 1) found the ITEM-3 is_agent_mode closed
list omitted the gemini and kimi agent CLI modes, both shipped under
extensions/ (category "cli", picker group "agents"). A busy-but-quiet
gemini/kimi terminal was still reaped at the configured idle threshold
(default 15 min) — the exact kill-while-busy bug the hard cap fixes —
and neither mode has resumeArgs, so a reaped session was unrecoverable.

- registry.rs: add "gemini" | "kimi" to is_agent_mode; doc comment now
  states the membership rule (mirrors shipped agent-CLI extensions)
- registry.rs tests: the spares-agent-modes test now drives all 6 modes
  and asserts inventory len 6
- plan doc: correct the Task 7 mode inventory (the false premise that
  s.mode is only shell|claude|codex|opencode|amplifier) and its two
  code blocks

Verified: cargo fmt clean, clippy -D warnings clean,
cargo test -p freshell-terminal enforce_idle_kills => 12 passed.

…undle stamping, server detach, idle-reap cap, session backfill)

Generated with Amplifier

Co-Authored-By: Amplifier <[email protected]>