ELI5

You park a remote terminal tab, come back to it, and it looks fine — the old output is there, it says it's connected — but typing does nothing and it never paints again. The client was writing keystrokes to a stream the host had already thrown away, and nobody noticed because the write kept reporting success.

What Changed

src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts

sendFrame gates only on socket readiness (matchesCurrentEnvironmentRevision() && ready && subscription) and never checks that the stream id is still registered. A handle whose record had been dropped — close() on park, or handleClose() clearing the stream table on reconnect — kept returning true from sendInput, claimViewport, and resize, while the host discarded those frames for an unknown stream id.

Guard those three senders on stream membership via a new isRegisteredStream. This is the same check close() and setOutputPaused already perform; these three were simply missing it.

src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts

Drain input queued behind a viewport claim on every stream install, not only a still-pending claim. Previously a claim that was pending with no known viewport left its queued bytes orphaned. Extracted as flushPendingClaimInput, called from both the live-claim path and the install path.

Also drops a previously merged test whose fake host answered Subscribe with an immediate snapshot — it was green by construction and could not fail for the reason it was written.

Why

A revealed cold-parked remote terminal lost PTY input and live painting. The diagnostics from the failing CI run line up field for field with the stale-handle theory:

• restoredBuffer: true — the snapshot arrived from the earlier, still-valid subscription
• hostReceivedInput: false, paintedLive: false — frames discarded host-side for an unknown stream id
• recoveryState: "connected" — the client had no signal anything was wrong

It is a race: whether the stale handle is still the transport's current stream when the socket regains readiness. That is why it reproduces intermittently on CI and never on macOS.

The failure was silent rather than degraded because the transport already has a recovery path — when a stream refuses input it re-sends over the terminal.send RPC. The stale stream's false success is precisely what kept that fallback from running. Making the senders honest restores it.

Membership-gating is the minimal fix and the one consistent with the surrounding code, rather than adding new reconnect bookkeeping.

Linked Issue

Tracked in the internal issue tracker; no public GitHub issue.

Visual Proof

N/A — no UI change. The behavioral change is covered by the E2E specs below, which assert on pane content and host-side input rather than appearance.

Testing

Platform tested: macOS. CI covers Linux.

• src/renderer/src/runtime/remote-runtime-terminal-stale-stream-frames.test.ts (new) drives the real multiplexer — not a fake host — and asserts a closed stream refuses input/claim/resize while a sibling stream keeps the socket live. Verified failing without the fix (expected true to be false), passing with it.
• Full unit suite: 498 files / 4584 tests pass.
• tsc --noEmit -p config/tsconfig.tc.web.json clean; oxlint clean on changed files.
• E2E, 2x each, both pass: tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts and tests/e2e/host-parked-pane-remote-viewer.spec.ts. The cold-parked scenario now reports hostReceivedInput: true, paintedLive: true.

Reviewer-relevant limits, stated plainly:

• The local E2E pass is a non-regression check, not proof. That spec has never failed on macOS across repeated runs; only CI can confirm the fix.

• The transport-side drain has no regression test of its own. I could not construct a deterministic repro for it — it is hardening on a reachable leak, not the proven root cause.

• I wrote and then deleted a second unit case for the reconnect-orphan path: it passed without the fix, because handleClose releases the multiplexer instance so that handle's socket is already dead. It could not fail for the right reason, so it is not included.

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

AI Disclosure

Review

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

Ensure no issues in: Security, Cross-platoform support (Linux, Windows, Mac), Remote SSH, Mobile, general backwards compatibility, performance

• Remote wire compatibility: no protocol change. No new opcode, no changed payload, no change to what the host publishes. The client now stops emitting frames the host already discarded, so old hosts and old clients are unaffected in either pairing direction.
• Remote SSH: the change is client-side within the multiplex transport and is agnostic to the execution host; it does not alter liveness reporting or the execution boundary.
• Cross-platform: no platform-dependent code paths touched; no path, shortcut, or process handling involved.
• Backwards compatibility: the guard can only turn a previously-true return into false, and only for a stream that was already unusable. Callers already handle false — that is the existing fallback path.
• Performance: one Map.get identity comparison per frame send.
• Mobile / Security: not touched.

Checklist

• This PR is small and focused
• I explained what changed and why (including ELI5)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

Ran locally: full vitest suite, typecheck:web, and oxlint on changed files — all clean. Did not run the full pnpm lint / pnpm typecheck / pnpm build matrix; leaving that to CI.