From 9f3e477a205d48c4d0a16b0b24c486b4fa94698f Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Tue, 31 Mar 2026 00:22:24 -0500
Subject: [PATCH 01/21] fix: model selection for 1M context variant + mobile
 model list sync
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Root causes:
1. FetchAvailableModelsAsync used SDK Model.Name (display name) instead of
   Model.Id (slug). When user selected 'Claude Opus 4.6 (1M Context)(Internal
   Only)', NormalizeToSlug stripped the parenthetical to 'claude-opus-4.6' —
   the wrong model.

2. NormalizeToSlug only handled single parenthetical groups. Multiple parens
   like '(1M Context)(Internal Only)' were parsed incorrectly.

3. Bridge protocol never sent ModelDisplayNames to mobile clients.

Fixes:
- FetchAvailableModelsAsync now stores Model.Id (slug) and builds a
  ModelDisplayNames dictionary mapping Id→Name for rich display
- NormalizeToSlug properly parses multiple parenthetical groups and
  recognizes '1m' as a known suffix
- Added ModelDisplayNames to SessionsListPayload bridge protocol
- WsBridgeClient/Server sync AvailableModels + ModelDisplayNames
- Bridge.cs OnStateChanged syncs model list to CopilotService in remote mode
- Added PrettifyModel to ModelHelper (centralized from 3 Razor files)
- Added claude-opus-4.6-1m to FallbackModels
- ModelSelector/ExpandedSessionView/CreateSessionForm accept DisplayNames param
- SessionListItem renders display names via ModelHelper.PrettifyModel
- 8 new tests for 1M model handling, display name lookup, bridge payload

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot.Tests/ModelSelectionTests.cs        | 77 ++++++++++++++++++-
 PolyPilot.Tests/TestStubs.cs                  |  1 +
 .../Components/ExpandedSessionView.razor      | 15 +---
 .../Components/Layout/CreateSessionForm.razor |  3 +-
 .../Components/Layout/SessionListItem.razor   |  3 +-
 .../Components/Layout/SessionSidebar.razor    |  2 +
 PolyPilot/Components/ModelSelector.razor      | 14 +---
 PolyPilot/Components/Pages/Dashboard.razor    |  1 +
 PolyPilot/Models/BridgeMessages.cs            |  4 +-
 PolyPilot/Models/ModelHelper.cs               | 25 ++++++
 PolyPilot/Services/CopilotService.Bridge.cs   |  5 ++
 .../Services/CopilotService.Utilities.cs      | 28 +++++--
 PolyPilot/Services/CopilotService.cs          | 11 +--
 PolyPilot/Services/IWsBridgeClient.cs         |  1 +
 PolyPilot/Services/WsBridgeClient.cs          |  7 +-
 PolyPilot/Services/WsBridgeServer.cs          |  1 +
 16 files changed, 154 insertions(+), 44 deletions(-)

diff --git a/PolyPilot.Tests/ModelSelectionTests.cs b/PolyPilot.Tests/ModelSelectionTests.cs
index 4f4a8d00e5..038c086b92 100644
--- a/PolyPilot.Tests/ModelSelectionTests.cs
+++ b/PolyPilot.Tests/ModelSelectionTests.cs
@@ -494,11 +494,10 @@ public void ChangeModel_DisplayNameFromDropdown_NormalizesToSlug()
     }
 
     // --- PrettifyModel tests ---
-    // The prettifier is duplicated in ExpandedSessionView.razor and ModelSelector.razor.
-    // We test the logic inline here to catch regressions like the "Opus-4.5" bug.
+    // Now centralized in ModelHelper.PrettifyModel. Tests use the real method.
 
     /// <summary>
-    /// Mirror of the PrettifyModel logic from ExpandedSessionView.razor / ModelSelector.razor.
+    /// Mirror of the PrettifyModel logic for tests that don't pass a displayNames dictionary.
     /// </summary>
     private static string PrettifyModel(string modelId)
     {
@@ -578,4 +577,76 @@ public void RoundTrip_NormalizeAndPrettify_AreConsistent(string slug)
         var backToSlug = ModelHelper.NormalizeToSlug(pretty);
         Assert.Equal(slug, backToSlug);
     }
+
+    [Fact]
+    public void PrettifyModel_UsesDisplayNamesWhenAvailable()
+    {
+        var displayNames = new Dictionary<string, string>
+        {
+            ["claude-opus-4.6-1m"] = "Claude Opus 4.6 (1M Context)(Internal Only)",
+            ["claude-opus-4.6"] = "Claude Opus 4.6",
+        };
+        Assert.Equal("Claude Opus 4.6 (1M Context)(Internal Only)",
+            ModelHelper.PrettifyModel("claude-opus-4.6-1m", displayNames));
+        Assert.Equal("Claude Opus 4.6",
+            ModelHelper.PrettifyModel("claude-opus-4.6", displayNames));
+        // Falls back to algorithmic when not in dictionary
+        Assert.Equal("Claude Sonnet 4.5",
+            ModelHelper.PrettifyModel("claude-sonnet-4.5", displayNames));
+    }
+
+    // --- 1M Context model tests (regression for Issue: model doesn't stay selected) ---
+
+    [Fact]
+    public void NormalizeToSlug_1mContext_PreservesSuffix()
+    {
+        // The core bug: "Claude Opus 4.6 (1M Context)(Internal Only)" was
+        // being normalized to "claude-opus-4.6" instead of "claude-opus-4.6-1m"
+        var displayName = "Claude Opus 4.6 (1M Context)(Internal Only)";
+        var slug = ModelHelper.NormalizeToSlug(displayName);
+        Assert.Equal("claude-opus-4.6-1m", slug);
+    }
+
+    [Theory]
+    [InlineData("Claude Opus 4.6 (1M Context)", "claude-opus-4.6-1m")]
+    [InlineData("Claude Opus 4.6 (1M context)(Internal Only)", "claude-opus-4.6-1m")]
+    [InlineData("claude-opus-4.6-1m", "claude-opus-4.6-1m")]
+    public void NormalizeToSlug_1mVariants_AllResolveCorrectly(string input, string expected)
+    {
+        Assert.Equal(expected, ModelHelper.NormalizeToSlug(input));
+    }
+
+    [Fact]
+    public void NormalizeToSlug_MultipleParentheses_ParsedCorrectly()
+    {
+        // Handles multiple parenthetical groups independently
+        var input = "Claude Opus 4.6 (1M Context)(Internal Only)";
+        var slug = ModelHelper.NormalizeToSlug(input);
+        // "1M Context" → "-1m", "Internal Only" → ignored
+        Assert.Equal("claude-opus-4.6-1m", slug);
+        Assert.NotEqual("claude-opus-4.6", slug); // The old broken behavior
+    }
+
+    [Fact]
+    public void FallbackModels_Includes1mModel()
+    {
+        Assert.Contains("claude-opus-4.6-1m", ModelHelper.FallbackModels);
+    }
+
+    [Fact]
+    public void SessionsListPayload_IncludesModelFields()
+    {
+        var payload = new SessionsListPayload
+        {
+            AvailableModels = new List<string> { "claude-opus-4.6", "claude-opus-4.6-1m" },
+            ModelDisplayNames = new Dictionary<string, string>
+            {
+                ["claude-opus-4.6-1m"] = "Claude Opus 4.6 (1M Context)(Internal Only)"
+            }
+        };
+        Assert.NotNull(payload.AvailableModels);
+        Assert.Equal(2, payload.AvailableModels.Count);
+        Assert.Contains("claude-opus-4.6-1m", payload.AvailableModels);
+        Assert.True(payload.ModelDisplayNames!.ContainsKey("claude-opus-4.6-1m"));
+    }
 }
diff --git a/PolyPilot.Tests/TestStubs.cs b/PolyPilot.Tests/TestStubs.cs
index 7a24317f2e..1ec4443518 100644
--- a/PolyPilot.Tests/TestStubs.cs
+++ b/PolyPilot.Tests/TestStubs.cs
@@ -73,6 +73,7 @@ internal class StubWsBridgeClient : IWsBridgeClient
     public string? GitHubLogin { get; set; }
     public string? ServerMachineName { get; set; }
     public List<string> AvailableModels { get; set; } = new();
+    public Dictionary<string, string> ModelDisplayNames { get; set; } = new();
 
     public event Action? OnStateChanged;
     public event Action<string, string>? OnContentReceived;
diff --git a/PolyPilot/Components/ExpandedSessionView.razor b/PolyPilot/Components/ExpandedSessionView.razor
index 019330b80e..16e37bce69 100644
--- a/PolyPilot/Components/ExpandedSessionView.razor
+++ b/PolyPilot/Components/ExpandedSessionView.razor
@@ -339,6 +339,7 @@
     [Parameter] public string InputMode { get; set; } = "chat";
     [Parameter] public string CurrentModel { get; set; } = "";
     [Parameter] public IReadOnlyList<string> AvailableModels { get; set; } = Array.Empty<string>();
+    [Parameter] public IReadOnlyDictionary<string, string>? ModelDisplayNames { get; set; }
     [Parameter] public List<PendingImage>? PendingImages { get; set; }
     [Parameter] public string? UserAvatarUrl { get; set; }
     [Parameter] public string? RepoUrl { get; set; }
@@ -545,19 +546,9 @@
     private void LoadMore() => OnLoadMore.InvokeAsync(Session.Name);
     private void LoadFullHistory() => OnLoadFullHistory.InvokeAsync(Session.Name);
 
-    private static string PrettifyModel(string modelId)
+    private string PrettifyModel(string modelId)
     {
-        var display = modelId
-            .Replace("claude-", "Claude ")
-            .Replace("gpt-", "GPT-")
-            .Replace("gemini-", "Gemini ");
-        // Replace remaining hyphens with spaces (e.g. "opus-4.5" → "opus 4.5")
-        // but preserve hyphens within the GPT- prefix (already handled above)
-        display = display.Replace("-", " ");
-        // Re-insert hyphen for GPT prefix
-        display = display.Replace("GPT ", "GPT-");
-        return string.Join(' ', display.Split(' ', StringSplitOptions.RemoveEmptyEntries).Select(s =>
-            s.Length > 0 ? char.ToUpper(s[0]) + s[1..] : s));
+        return Models.ModelHelper.PrettifyModel(modelId, ModelDisplayNames);
     }
 
     private void OpenSessionFolder(string sessionId)
diff --git a/PolyPilot/Components/Layout/CreateSessionForm.razor b/PolyPilot/Components/Layout/CreateSessionForm.razor
index 2a58b4dcfc..0a4e3fc45e 100644
--- a/PolyPilot/Components/Layout/CreateSessionForm.razor
+++ b/PolyPilot/Components/Layout/CreateSessionForm.razor
@@ -164,7 +164,7 @@ else
                   class="ns-prompt" rows="2"></textarea>
 
         <div class="ns-footer">
-            <ModelSelector Value="@SelectedModel" ValueChanged="OnModelSelected" Models="AvailableModels" CssClass="ns-model" />
+            <ModelSelector Value="@SelectedModel" ValueChanged="OnModelSelected" Models="AvailableModels" DisplayNames="ModelDisplayNames" CssClass="ns-model" />
             <div class="ns-footer-actions">
                 <button class="ns-cancel" @onclick="Collapse">Cancel</button>
                 <button class="ns-create" @onclick="TriggerCreate"
@@ -195,6 +195,7 @@ else
     [Parameter] public bool IsCreating { get; set; }
     [Parameter] public string? CreateError { get; set; }
     [Parameter] public List<string> AvailableModels { get; set; } = new();
+    [Parameter] public IReadOnlyDictionary<string, string>? ModelDisplayNames { get; set; }
     [Parameter] public string SelectedModel { get; set; } = "claude-opus-4.6";
     [Parameter] public EventCallback<string> SelectedModelChanged { get; set; }
 
diff --git a/PolyPilot/Components/Layout/SessionListItem.razor b/PolyPilot/Components/Layout/SessionListItem.razor
index 15389c6f4e..858728c9b0 100644
--- a/PolyPilot/Components/Layout/SessionListItem.razor
+++ b/PolyPilot/Components/Layout/SessionListItem.razor
@@ -194,7 +194,8 @@
                             @foreach (var model in CopilotService.AvailableModels)
                             {
                                 var strengths = ModelCapabilities.GetStrengths(model);
-                                <option value="@model" title="@strengths">@model</option>
+                                var displayName = PolyPilot.Models.ModelHelper.PrettifyModel(model, CopilotService.ModelDisplayNames);
+                                <option value="@model" title="@strengths">@displayName</option>
                             }
                         </select>
                         @{
diff --git a/PolyPilot/Components/Layout/SessionSidebar.razor b/PolyPilot/Components/Layout/SessionSidebar.razor
index 0b7dae6327..ace71019b7 100644
--- a/PolyPilot/Components/Layout/SessionSidebar.razor
+++ b/PolyPilot/Components/Layout/SessionSidebar.razor
@@ -35,6 +35,7 @@ else if (IsFlyoutPanel)
             <CreateSessionForm @ref="createSessionFormRef" @bind-SessionName="newSessionName"
                                @bind-SelectedModel="selectedModel"
                                AvailableModels="availableModels.ToList()"
+                               ModelDisplayNames="CopilotService.ModelDisplayNames"
                                IsCreating="isCreating"
                                CreateError="@createError"
                                OnCreate="HandleCreateSession"
@@ -98,6 +99,7 @@ else
             <CreateSessionForm @ref="createSessionFormRef" @bind-SessionName="newSessionName"
                                @bind-SelectedModel="selectedModel"
                                AvailableModels="availableModels.ToList()"
+                               ModelDisplayNames="CopilotService.ModelDisplayNames"
                                IsCreating="isCreating"
                                CreateError="@createError"
                                OnCreate="HandleCreateSession"
diff --git a/PolyPilot/Components/ModelSelector.razor b/PolyPilot/Components/ModelSelector.razor
index 8b2a83f0f6..644411cd42 100644
--- a/PolyPilot/Components/ModelSelector.razor
+++ b/PolyPilot/Components/ModelSelector.razor
@@ -32,6 +32,7 @@
     [Parameter] public string Value { get; set; } = "";
     [Parameter] public EventCallback<string> ValueChanged { get; set; }
     [Parameter] public IReadOnlyList<string> Models { get; set; } = Array.Empty<string>();
+    [Parameter] public IReadOnlyDictionary<string, string>? DisplayNames { get; set; }
     [Parameter] public string CssClass { get; set; } = "";
 
     private bool isOpen;
@@ -69,18 +70,7 @@
             icon = @"<svg xmlns=""http://www.w3.org/2000/svg"" width=""14"" height=""14"" viewBox=""0 0 24 24"" fill=""none""><circle cx=""12"" cy=""12"" r=""10"" stroke=""currentColor"" stroke-width=""2""/></svg>";
 
         // Prettify display name
-        var display = modelId
-            .Replace("claude-", "Claude ")
-            .Replace("gpt-", "GPT-")
-            .Replace("gemini-", "Gemini ");
-        // Replace remaining hyphens with spaces (e.g. "opus-4.5" → "opus 4.5")
-        display = display.Replace("-", " ");
-        // Re-insert hyphen for GPT prefix
-        display = display.Replace("GPT ", "GPT-");
-
-        // Capitalize segments
-        display = string.Join(' ', display.Split(' ', StringSplitOptions.RemoveEmptyEntries).Select(s =>
-            s.Length > 0 ? char.ToUpper(s[0]) + s[1..] : s));
+        var display = PolyPilot.Models.ModelHelper.PrettifyModel(modelId, DisplayNames);
 
         return new ModelDisplayInfo(display, icon);
     }
diff --git a/PolyPilot/Components/Pages/Dashboard.razor b/PolyPilot/Components/Pages/Dashboard.razor
index 62e0b46095..b2ca91565c 100644
--- a/PolyPilot/Components/Pages/Dashboard.razor
+++ b/PolyPilot/Components/Pages/Dashboard.razor
@@ -169,6 +169,7 @@
                                      InputMode="@GetInputMode(session.Name)"
                                      CurrentModel="@GetExpandedModel(session)"
                                      AvailableModels="availableModels"
+                                     ModelDisplayNames="CopilotService.ModelDisplayNames"
                                      PendingImages="@(pendingImagesBySession.TryGetValue(session.Name, out var pi2) ? pi2 : null)"
                                      UserAvatarUrl="@CopilotService.GitHubAvatarUrl"
                                      RepoUrl="@CopilotService.GetRepoUrlForSession(session.Name)"
diff --git a/PolyPilot/Models/BridgeMessages.cs b/PolyPilot/Models/BridgeMessages.cs
index 06f2436d7f..42c5bdca7b 100644
--- a/PolyPilot/Models/BridgeMessages.cs
+++ b/PolyPilot/Models/BridgeMessages.cs
@@ -139,8 +139,10 @@ public class SessionsListPayload
     public string? GitHubLogin { get; set; }
     /// <summary>Server's machine name, used by remote clients to open VS Code via Remote - Tunnels.</summary>
     public string? ServerMachineName { get; set; }
-    /// <summary>Available model display names fetched from the SDK on the desktop. Null means not yet fetched.</summary>
+    /// <summary>Available model slugs from the SDK's ListModelsAsync.</summary>
     public List<string>? AvailableModels { get; set; }
+    /// <summary>Maps model slug → display name (e.g., "claude-opus-4.6-1m" → "Claude Opus 4.6 (1M Context)(Internal Only)").</summary>
+    public Dictionary<string, string>? ModelDisplayNames { get; set; }
 }
 
 public class SessionSummary
diff --git a/PolyPilot/Models/ModelHelper.cs b/PolyPilot/Models/ModelHelper.cs
index 0734ce893a..30b3b65a1f 100644
--- a/PolyPilot/Models/ModelHelper.cs
+++ b/PolyPilot/Models/ModelHelper.cs
@@ -13,6 +13,7 @@ public static class ModelHelper
     public static IReadOnlyList<string> FallbackModels { get; } = new[]
     {
         "claude-opus-4.6",
+        "claude-opus-4.6-1m",
         "claude-opus-4.6-fast",
         "claude-opus-4.5",
         "claude-sonnet-4.5",
@@ -89,6 +90,30 @@ public static bool IsDisplayName(string? model)
         return model.Any(char.IsUpper) || model.Contains(' ');
     }
 
+    /// <summary>
+    /// Converts a model slug to a human-friendly display name.
+    /// If displayNames dictionary is provided and contains the slug, uses the SDK's display name.
+    /// Otherwise falls back to algorithmic prettification.
+    /// </summary>
+    public static string PrettifyModel(string modelId, IReadOnlyDictionary<string, string>? displayNames = null)
+    {
+        if (string.IsNullOrEmpty(modelId)) return modelId;
+
+        // If we have an SDK-provided display name, prefer it
+        if (displayNames != null && displayNames.TryGetValue(modelId, out var sdkName))
+            return sdkName;
+
+        // Algorithmic fallback
+        var display = modelId
+            .Replace("claude-", "Claude ")
+            .Replace("gpt-", "GPT-")
+            .Replace("gemini-", "Gemini ");
+        display = display.Replace("-", " ");
+        display = display.Replace("GPT ", "GPT-");
+        return string.Join(' ', display.Split(' ', StringSplitOptions.RemoveEmptyEntries).Select(s =>
+            s.Length > 0 ? char.ToUpper(s[0]) + s[1..] : s));
+    }
+
     internal static string? ExtractLatestModelFromEvents(IEnumerable<string> lines)
     {
         string? latestModel = null;
diff --git a/PolyPilot/Services/CopilotService.Bridge.cs b/PolyPilot/Services/CopilotService.Bridge.cs
index 068b01f8c9..6f925cdbb8 100644
--- a/PolyPilot/Services/CopilotService.Bridge.cs
+++ b/PolyPilot/Services/CopilotService.Bridge.cs
@@ -48,6 +48,11 @@ private async Task InitializeRemoteAsync(ConnectionSettings settings, Cancellati
         // Wire WsBridgeClient events to our events
         _bridgeClient.OnStateChanged += () =>
         {
+            // Sync model list from bridge when in remote mode
+            if (_bridgeClient.AvailableModels.Count > 0)
+                AvailableModels = _bridgeClient.AvailableModels;
+            if (_bridgeClient.ModelDisplayNames.Count > 0)
+                ModelDisplayNames = _bridgeClient.ModelDisplayNames;
             SyncRemoteSessions();
             NotifyStateChangedCoalesced();
         };
diff --git a/PolyPilot/Services/CopilotService.Utilities.cs b/PolyPilot/Services/CopilotService.Utilities.cs
index 61d0eabcd2..db39c68997 100644
--- a/PolyPilot/Services/CopilotService.Utilities.cs
+++ b/PolyPilot/Services/CopilotService.Utilities.cs
@@ -794,15 +794,29 @@ private async Task FetchAvailableModelsAsync()
             var modelList = await _client.ListModelsAsync();
             if (modelList != null && modelList.Count > 0)
             {
-                var models = modelList
-                    .Where(m => !string.IsNullOrEmpty(m.Id))
-                    .Select(m => m.Id!)
-                    .OrderBy(m => m)
-                    .ToList();
+                // Use Id (slug) as the canonical model identifier, not Name (display name).
+                // Name is a display string like "Claude Opus 4.6 (1M Context)(Internal Only)"
+                // which NormalizeToSlug can't reliably round-trip. Id is the SDK slug.
+                var displayNames = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+                var models = new List<string>();
+                foreach (var m in modelList)
+                {
+                    var id = m.Id;
+                    var name = m.Name;
+                    // Prefer Id (slug); fall back to Name if Id is missing
+                    var key = !string.IsNullOrEmpty(id) ? id : name;
+                    if (string.IsNullOrEmpty(key)) continue;
+                    if (!models.Contains(key))
+                        models.Add(key);
+                    if (!string.IsNullOrEmpty(name) && !string.IsNullOrEmpty(id))
+                        displayNames[id] = name;
+                }
+                models.Sort(StringComparer.OrdinalIgnoreCase);
                 if (models.Count > 0)
                 {
-                    _localAvailableModels = models;
-                    Debug($"Loaded {models.Count} models from SDK");
+                    AvailableModels = models;
+                    ModelDisplayNames = displayNames;
+                    Debug($"Loaded {models.Count} models from SDK (ids)");
                     OnStateChanged?.Invoke();
                 }
             }
diff --git a/PolyPilot/Services/CopilotService.cs b/PolyPilot/Services/CopilotService.cs
index 8015a065ed..b05e23372b 100644
--- a/PolyPilot/Services/CopilotService.cs
+++ b/PolyPilot/Services/CopilotService.cs
@@ -259,11 +259,12 @@ private static string FindProjectDir()
     public string? ActiveSessionName => _activeSessionName;
     public IChatDatabase ChatDb => _chatDb;
     public ConnectionMode CurrentMode { get; private set; } = ConnectionMode.Embedded;
-    public List<string> AvailableModels =>
-        IsRemoteMode && _bridgeClient.AvailableModels.Count > 0
-            ? _bridgeClient.AvailableModels
-            : _localAvailableModels;
-    private List<string> _localAvailableModels = new();
+    public List<string> AvailableModels { get; private set; } = new();
+    /// <summary>
+    /// Maps model slug (Id) → display name from the SDK's ListModelsAsync.
+    /// Used for richer display when the algorithmic prettification isn't sufficient.
+    /// </summary>
+    public Dictionary<string, string> ModelDisplayNames { get; private set; } = new();
 
     private readonly RepoManager _repoManager;
     private readonly CodespaceService _codespaceService;
diff --git a/PolyPilot/Services/IWsBridgeClient.cs b/PolyPilot/Services/IWsBridgeClient.cs
index cc7c555e1a..6fffda9bb8 100644
--- a/PolyPilot/Services/IWsBridgeClient.cs
+++ b/PolyPilot/Services/IWsBridgeClient.cs
@@ -18,6 +18,7 @@ public interface IWsBridgeClient
     string? GitHubLogin { get; }
     string? ServerMachineName { get; }
     List<string> AvailableModels { get; }
+    Dictionary<string, string> ModelDisplayNames { get; }
 
     // Events
     event Action? OnStateChanged;
diff --git a/PolyPilot/Services/WsBridgeClient.cs b/PolyPilot/Services/WsBridgeClient.cs
index fec92c0d7f..54b81d9d60 100644
--- a/PolyPilot/Services/WsBridgeClient.cs
+++ b/PolyPilot/Services/WsBridgeClient.cs
@@ -42,6 +42,7 @@ public class WsBridgeClient : IWsBridgeClient, IDisposable
     public string? GitHubLogin { get; private set; }
     public string? ServerMachineName { get; private set; }
     public List<string> AvailableModels { get; private set; } = new();
+    public Dictionary<string, string> ModelDisplayNames { get; private set; } = new();
 
     // --- Events matching CopilotService signatures ---
     public event Action? OnStateChanged;
@@ -677,8 +678,10 @@ private void HandleServerMessage(string json)
                     GitHubAvatarUrl = sessions.GitHubAvatarUrl;
                     GitHubLogin = sessions.GitHubLogin;
                     ServerMachineName = sessions.ServerMachineName;
-                    if (sessions.AvailableModels is { Count: > 0 } models)
-                        AvailableModels = models;
+                    if (sessions.AvailableModels is { Count: > 0 })
+                        AvailableModels = sessions.AvailableModels;
+                    if (sessions.ModelDisplayNames is { Count: > 0 })
+                        ModelDisplayNames = sessions.ModelDisplayNames;
                     HasReceivedSessionsList = true;
                     Console.WriteLine($"[WsBridgeClient] Got {Sessions.Count} sessions, active={ActiveSessionName}");
                     OnStateChanged?.Invoke();
diff --git a/PolyPilot/Services/WsBridgeServer.cs b/PolyPilot/Services/WsBridgeServer.cs
index 808b6f77fa..e5b6566602 100644
--- a/PolyPilot/Services/WsBridgeServer.cs
+++ b/PolyPilot/Services/WsBridgeServer.cs
@@ -1193,6 +1193,7 @@ private SessionsListPayload BuildSessionsListPayload()
             GitHubLogin = _copilot.GitHubLogin,
             ServerMachineName = Environment.MachineName,
             AvailableModels = _copilot.AvailableModels.Count > 0 ? _copilot.AvailableModels : null,
+            ModelDisplayNames = _copilot.ModelDisplayNames.Count > 0 ? _copilot.ModelDisplayNames : null,
         };
     }
 

From 9a9d4213c069ec31204ecce60cfe6151f0877443 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Tue, 31 Mar 2026 08:20:01 -0500
Subject: [PATCH 02/21] feat: add all sessions to @ mention autocomplete

Extends the @ mention autocomplete in the chat input to include all
active PolyPilot sessions, not just Fiesta linked workers. This lets
users reference and send messages to any session via @mention.

- Add AllSessionNames parameter to ExpandedSessionView
- Merge session names into FiestaAutocompleteWorkers (excluding current session)
- Pass all session names from Dashboard via CopilotService.GetAllSessionNames()

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot/Components/ExpandedSessionView.razor | 11 +++++++++--
 PolyPilot/Components/Pages/Dashboard.razor     |  4 ++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/PolyPilot/Components/ExpandedSessionView.razor b/PolyPilot/Components/ExpandedSessionView.razor
index 16e37bce69..1d3b9c2c17 100644
--- a/PolyPilot/Components/ExpandedSessionView.razor
+++ b/PolyPilot/Components/ExpandedSessionView.razor
@@ -351,6 +351,7 @@
     [Parameter] public int MessageWindowSize { get; set; } = 25;
     [Parameter] public bool FiestaActive { get; set; }
     [Parameter] public IReadOnlyList<FiestaLinkedWorker> FiestaWorkers { get; set; } = Array.Empty<FiestaLinkedWorker>();
+    [Parameter] public IReadOnlyList<string> AllSessionNames { get; set; } = Array.Empty<string>();
 
     [Parameter] public EventCallback<string> OnSend { get; set; }
     [Parameter] public EventCallback<string> OnStop { get; set; }
@@ -732,12 +733,18 @@
     {
         get
         {
-            var tokens = FiestaWorkers
+            var fiestaTokens = FiestaWorkers
                 .SelectMany(w => new[]
                 {
                     NormalizeMentionToken(w.Hostname),
                     NormalizeMentionToken(w.Name)
-                })
+                });
+
+            var sessionTokens = AllSessionNames
+                .Where(n => !string.Equals(n, Session.Name, StringComparison.OrdinalIgnoreCase))
+                .Select(NormalizeMentionToken);
+
+            var tokens = fiestaTokens.Concat(sessionTokens)
                 .Where(t => !string.IsNullOrWhiteSpace(t))
                 .Distinct(StringComparer.OrdinalIgnoreCase)
                 .OrderBy(t => t, StringComparer.OrdinalIgnoreCase);
diff --git a/PolyPilot/Components/Pages/Dashboard.razor b/PolyPilot/Components/Pages/Dashboard.razor
index b2ca91565c..0f905a2820 100644
--- a/PolyPilot/Components/Pages/Dashboard.razor
+++ b/PolyPilot/Components/Pages/Dashboard.razor
@@ -179,6 +179,7 @@
                                      MessageWindowSize="@(expandedMessageCounts.TryGetValue(session.Name, out var emc) ? emc : 25)"
                                      FiestaActive="@FiestaService.IsFiestaActive(session.Name)"
                                      FiestaWorkers="@GetFiestaWorkersForSession(session.Name)"
+                                     AllSessionNames="@allSessionNames"
                                      OnSend="HandleSend"
                                      OnStop="StopSession"
                                      OnCollapse="CollapseExpanded"
@@ -3356,6 +3357,9 @@
     private IReadOnlyList<string> availableModels =>
         CopilotService.AvailableModels.Count > 0 ? CopilotService.AvailableModels : ModelHelper.FallbackModels;
 
+    private IReadOnlyList<string> allSessionNames =>
+        CopilotService.GetAllSessionNames().ToList();
+
     private string GetSessionModel(AgentSessionInfo session)
     {
         // Priority: 1) Usage info (TRUTH) - what the backend is actually using

From 1af2b0f47d49549eb2805591674619f7359b4656 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Tue, 31 Mar 2026 13:54:35 -0500
Subject: [PATCH 03/21] feat: cross-session @mention routing in SendFromCard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When a user types @SessionName <message> in any chat input and the token
matches an active PolyPilot session name, the message is routed directly
to that session via CopilotService.SendPromptAsync instead of being sent
to the current session.

Behavior:
- Prompt must start with @<SessionName> (leading whitespace stripped)
- Multiple stacked mentions (@A @B message) route to all matched sessions
- The stripped message (without the @token) is sent to each target session
- A '📨 Forwarded to @<Name>: "..."' system message appears in the source
  session's chat as confirmation
- If SendPromptAsync fails, an error message appears in the source session
- Unknown @tokens (not a session name) fall through to normal send

RouteToMentionedSessions() builds a normalized-token lookup from
GetAllSessionNames() and parses the leading @mention chain. Token
normalization matches ExpandedSessionView.NormalizeMentionToken
(alphanumeric, dot, underscore, hyphen).

Does not conflict with Fiesta dispatch: Fiesta check runs first; cross-
session routing only activates when Fiesta returns MentionsFound=false.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot/Components/Pages/Dashboard.razor | 106 +++++++++++++++++++++
 1 file changed, 106 insertions(+)

diff --git a/PolyPilot/Components/Pages/Dashboard.razor b/PolyPilot/Components/Pages/Dashboard.razor
index 0f905a2820..ae41ab6c1f 100644
--- a/PolyPilot/Components/Pages/Dashboard.razor
+++ b/PolyPilot/Components/Pages/Dashboard.razor
@@ -1589,6 +1589,50 @@
             return;
         }
 
+        // Cross-session routing: check for @SessionName mentions matching other PolyPilot sessions.
+        // Build a lookup of normalized-token → session name for all sessions except the current one.
+        var crossSessionTargets = RouteToMentionedSessions(sessionName, finalPrompt);
+        if (crossSessionTargets.Count > 0)
+        {
+            // Add the user message to the current session's history
+            var sourceSession = sessions.FirstOrDefault(s => s.Name == sessionName);
+            sourceSession?.History.Add(ChatMessage.UserMessage(finalPrompt));
+
+            foreach (var (targetName, strippedMessage) in crossSessionTargets)
+            {
+                // Send to target session
+                _ = CopilotService.SendPromptAsync(targetName, strippedMessage).ContinueWith(t =>
+                {
+                    if (t.IsFaulted)
+                    {
+                        var err = t.Exception?.InnerException?.Message ?? t.Exception?.Message ?? "unknown error";
+                        InvokeAsync(() =>
+                        {
+                            var src = sessions.FirstOrDefault(s => s.Name == sessionName);
+                            if (src != null)
+                            {
+                                src.History.Add(ChatMessage.ErrorMessage($"Failed to forward to @{targetName}: {err}"));
+                                src.MessageCount = src.History.Count;
+                            }
+                            _ = SafeRefreshAsync();
+                        });
+                    }
+                });
+
+                // Add a system message in the source session indicating the forward
+                sourceSession?.History.Add(ChatMessage.SystemMessage(
+                    $"📨 Forwarded to @{targetName}: \"{TruncateForDisplay(strippedMessage, 80)}\""));
+            }
+
+            if (sourceSession != null)
+                sourceSession.MessageCount = sourceSession.History.Count;
+
+            _needsScrollToBottom = true;
+            await InvokeAsync(SafeRefreshAsync);
+            return;
+        }
+
+
         var session = sessions.FirstOrDefault(s => s.Name == sessionName);
         if (session?.IsCreating == true)
         {
@@ -3360,6 +3404,68 @@
     private IReadOnlyList<string> allSessionNames =>
         CopilotService.GetAllSessionNames().ToList();
 
+    /// <summary>
+    /// Parses @Mention tokens from the prompt and matches them against active session names.
+    /// Returns a list of (targetSessionName, strippedMessage) for each matched session.
+    /// The strippedMessage has the leading @Token removed so the target session receives clean text.
+    /// </summary>
+    private List<(string TargetName, string StrippedMessage)> RouteToMentionedSessions(string sourceSessionName, string prompt)
+    {
+        var result = new List<(string, string)>();
+        if (string.IsNullOrWhiteSpace(prompt)) return result;
+
+        // Build normalized-token → real session name lookup (excluding source session)
+        static string NormalizeToken(string s) =>
+            new(s.Trim().Where(ch => char.IsLetterOrDigit(ch) || ch == '.' || ch == '_' || ch == '-').ToArray());
+
+        var sessionLookup = CopilotService.GetAllSessionNames()
+            .Where(n => !string.Equals(n, sourceSessionName, StringComparison.OrdinalIgnoreCase))
+            .GroupBy(NormalizeToken, StringComparer.OrdinalIgnoreCase)
+            .ToDictionary(g => g.Key, g => g.First(), StringComparer.OrdinalIgnoreCase);
+
+        if (sessionLookup.Count == 0) return result;
+
+        // Extract @Token at the start of the message (e.g. "@TestReceive hello" or "@TestReceive\nhello")
+        // Only route if the prompt begins with @SessionName (possibly multiple stacked).
+        var remaining = prompt.TrimStart();
+        var matched = new List<string>();
+
+        while (remaining.StartsWith('@'))
+        {
+            // Grab the token (alphanumeric, dot, underscore, hyphen)
+            var tokenEnd = 1;
+            while (tokenEnd < remaining.Length &&
+                   (char.IsLetterOrDigit(remaining[tokenEnd]) || remaining[tokenEnd] == '.' ||
+                    remaining[tokenEnd] == '_' || remaining[tokenEnd] == '-'))
+                tokenEnd++;
+
+            var token = remaining[1..tokenEnd];
+            if (string.IsNullOrEmpty(token)) break;
+
+            if (sessionLookup.TryGetValue(token, out var targetSession))
+            {
+                matched.Add(targetSession);
+                remaining = remaining[tokenEnd..].TrimStart();
+            }
+            else
+            {
+                // Unknown @mention — not a session, stop parsing
+                break;
+            }
+        }
+
+        // Only route if we matched at least one session and there's a message body
+        if (matched.Count == 0 || string.IsNullOrWhiteSpace(remaining)) return result;
+
+        foreach (var target in matched.Distinct(StringComparer.OrdinalIgnoreCase))
+            result.Add((target, remaining));
+
+        return result;
+    }
+
+    private static string TruncateForDisplay(string text, int maxLength) =>
+        text.Length <= maxLength ? text : text[..maxLength] + "…";
+
     private string GetSessionModel(AgentSessionInfo session)
     {
         // Priority: 1) Usage info (TRUTH) - what the backend is actually using

From 209873d44ae6116bcaba6d34fcb64e0979c43652 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Tue, 31 Mar 2026 15:35:20 -0500
Subject: [PATCH 04/21] fix: route @mention anywhere in message, not just at
 start

Previously RouteToMentionedSessions only matched @SessionName when it
appeared at the very beginning of the message. This broke natural language
messages like 'can you send a message to @TestReceive about X'.

Now scans the entire prompt for @token patterns using regex, matches any
token that corresponds to a known session name, strips matched @tokens
from the forwarded message, and still routes to all matched sessions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot/Components/Pages/Dashboard.razor | 45 +++++++++-------------
 1 file changed, 18 insertions(+), 27 deletions(-)

diff --git a/PolyPilot/Components/Pages/Dashboard.razor b/PolyPilot/Components/Pages/Dashboard.razor
index ae41ab6c1f..36e25c388f 100644
--- a/PolyPilot/Components/Pages/Dashboard.razor
+++ b/PolyPilot/Components/Pages/Dashboard.razor
@@ -1592,6 +1592,7 @@
         // Cross-session routing: check for @SessionName mentions matching other PolyPilot sessions.
         // Build a lookup of normalized-token → session name for all sessions except the current one.
         var crossSessionTargets = RouteToMentionedSessions(sessionName, finalPrompt);
+        Console.WriteLine($"[CROSS-SESSION] source={sessionName} prompt={finalPrompt.Substring(0, Math.Min(50, finalPrompt.Length))} targets={crossSessionTargets.Count}");
         if (crossSessionTargets.Count > 0)
         {
             // Add the user message to the current session's history
@@ -3423,42 +3424,32 @@
             .GroupBy(NormalizeToken, StringComparer.OrdinalIgnoreCase)
             .ToDictionary(g => g.Key, g => g.First(), StringComparer.OrdinalIgnoreCase);
 
+        Console.WriteLine($"[CROSS-SESSION] sessionLookup has {sessionLookup.Count} entries, looking for @mention in: {prompt.Substring(0, Math.Min(60, prompt.Length))}");
         if (sessionLookup.Count == 0) return result;
 
-        // Extract @Token at the start of the message (e.g. "@TestReceive hello" or "@TestReceive\nhello")
-        // Only route if the prompt begins with @SessionName (possibly multiple stacked).
-        var remaining = prompt.TrimStart();
-        var matched = new List<string>();
+        // Scan the entire message for @SessionName mentions (not just at start).
+        // Matches: @word where word is alphanumeric, dot, underscore, or hyphen.
+        var atMentionRegex = new System.Text.RegularExpressions.Regex(@"@([\w.\-]+)");
+        var matched = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
 
-        while (remaining.StartsWith('@'))
+        foreach (System.Text.RegularExpressions.Match m in atMentionRegex.Matches(prompt))
         {
-            // Grab the token (alphanumeric, dot, underscore, hyphen)
-            var tokenEnd = 1;
-            while (tokenEnd < remaining.Length &&
-                   (char.IsLetterOrDigit(remaining[tokenEnd]) || remaining[tokenEnd] == '.' ||
-                    remaining[tokenEnd] == '_' || remaining[tokenEnd] == '-'))
-                tokenEnd++;
-
-            var token = remaining[1..tokenEnd];
-            if (string.IsNullOrEmpty(token)) break;
-
+            var token = m.Groups[1].Value;
             if (sessionLookup.TryGetValue(token, out var targetSession))
-            {
                 matched.Add(targetSession);
-                remaining = remaining[tokenEnd..].TrimStart();
-            }
-            else
-            {
-                // Unknown @mention — not a session, stop parsing
-                break;
-            }
         }
 
-        // Only route if we matched at least one session and there's a message body
-        if (matched.Count == 0 || string.IsNullOrWhiteSpace(remaining)) return result;
+        if (matched.Count == 0) return result;
+
+        // Strip all matched @SessionName tokens from the forwarded message and collapse whitespace.
+        var strippedMessage = atMentionRegex.Replace(prompt, m =>
+            sessionLookup.ContainsKey(m.Groups[1].Value) ? "" : m.Value);
+        strippedMessage = System.Text.RegularExpressions.Regex.Replace(strippedMessage, @"[ \t]{2,}", " ").Trim();
+
+        if (string.IsNullOrWhiteSpace(strippedMessage)) return result;
 
-        foreach (var target in matched.Distinct(StringComparer.OrdinalIgnoreCase))
-            result.Add((target, remaining));
+        foreach (var target in matched)
+            result.Add((target, strippedMessage));
 
         return result;
     }

From 2d8ce5a8bcb7b79d3b55c64181a7f53b11a8a794 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Tue, 31 Mar 2026 15:45:57 -0500
Subject: [PATCH 05/21] docs: add relaunch.sh safety rules to maui-ai-debugging
 skill

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .claude/skills/maui-ai-debugging/SKILL.md | 50 +++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/.claude/skills/maui-ai-debugging/SKILL.md b/.claude/skills/maui-ai-debugging/SKILL.md
index af22fd009c..5217af4316 100644
--- a/.claude/skills/maui-ai-debugging/SKILL.md
+++ b/.claude/skills/maui-ai-debugging/SKILL.md
@@ -522,6 +522,56 @@ something that would require OS-level control (e.g., dismissing a system dialog
 app), **ask the user** to do it manually rather than attempting automation that would hijack
 their input.
 
+## 🚨 PolyPilot relaunch.sh — Safety Rules (NEVER VIOLATE)
+
+`relaunch.sh` is **async by default**: it returns immediately after a successful build, then kills
+the old UI and launches the new one ~10 seconds later in a detached background process.
+PolyPilot hosts the active Copilot session via TCP. If any tool call is still in-flight when the
+old process is killed, **the TCP connection drops and the turn is interrupted**.
+
+### ✅ Correct pattern
+
+```bash
+# Turn 1: call relaunch.sh alone — nothing after it in the same bash call
+./relaunch.sh
+```
+
+relaunch.sh returns immediately after build. The old app dies ~10s later.
+On your **next turn** (after the kill window), verify and reconnect:
+
+```bash
+# Turn 2: quick check (each call <8s)
+tail -3 ~/.polypilot/relaunch.log
+maui-devflow cdp status
+```
+
+### ❌ What got us stuck — and why
+
+**Instance 1** — `initial_wait` too large:
+```bash
+# WRONG: initial_wait: 70 means this bash call runs for 70s — right through the kill window
+maui-devflow wait --timeout 60   # with initial_wait: 70  ← KILLED MID-CALL
+```
+
+**Instance 2 (happened again!)** — `sleep` chained in the same call:
+```bash
+# WRONG: sleep 15 runs through the kill window even though it looks innocent
+sleep 15 && tail -3 ~/.polypilot/relaunch.log   # ← KILLED MID-CALL (initial_wait: 20)
+```
+
+After the interruption in Instance 2, the turn ended with output that *looked* done
+("committed + relaunch succeeded"), so the orchestrator returned control to the user.
+**Verification never happened.**
+
+### Rules
+
+1. **NEVER chain anything after `./relaunch.sh`** — no `&&`, `;`, `|`, `sleep`, or follow-on commands in the same bash call. **`sleep N &&` is NOT safe either.**
+2. **After relaunch.sh returns, your turn is over.** End the turn immediately. Do all verification on the **next turn**.
+3. **`maui-devflow wait`** is only safe on a *new turn*, and use `initial_wait: 15` (not 60-70).
+4. If a tool call IS interrupted by the kill — that's OK. The CLI keeps the session alive. Resume on the next turn.
+5. Use `--sync` flag only for **human terminal use**. Never from an agent session.
+6. **CRITICAL: After relaunch, always explicitly say "Relaunch in progress — will verify on next turn."** so the orchestrator knows not to consider the task done. Never let relaunch be the last step of a turn without that statement.
+
 ## Tips
 
 - **Use `maui-devflow batch`** for multi-step interactions — resolves port once, adds delays,

From d2f1677654374549db201e27e28f230ffb44369d Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Tue, 31 Mar 2026 15:52:01 -0500
Subject: [PATCH 06/21] feat: use contains matching for @ mention autocomplete

Previously the dropdown only showed results that started with the typed
query. Now it matches anywhere in the session name, so typing @Receive
finds TestReceive, typing @Send finds TestSend, etc.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot/wwwroot/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/PolyPilot/wwwroot/index.html b/PolyPilot/wwwroot/index.html
index 11c7464c48..a51087c0da 100644
--- a/PolyPilot/wwwroot/index.html
+++ b/PolyPilot/wwwroot/index.html
@@ -559,7 +559,7 @@
 
                 var q = context.query.toLowerCase();
                 var filtered = workers.filter(function(w) {
-                    return w.toLowerCase().indexOf(q) === 0;
+                    return w.toLowerCase().indexOf(q) >= 0;
                 }).slice(0, 12);
 
                 if (filtered.length === 0) {

From f6d1758e1a82b1e6542afea161d43a6bf5801079 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Tue, 31 Mar 2026 15:56:51 -0500
Subject: [PATCH 07/21] docs: rewrite relaunch rules with consensus from 3
 agent review

Replaced broken 'verify next turn' pattern with correct 'relaunch early,
git during delay, verify late' pattern. All 3 agents (Sonnet 4.5,
GPT-5.1-Codex, explore) agree: workers get one turn, so verification
must happen in the same turn. Added timeline table, 3 documented
failure instances, and 7 concrete rules.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .claude/skills/maui-ai-debugging/SKILL.md | 75 +++++++++++++++--------
 1 file changed, 50 insertions(+), 25 deletions(-)

diff --git a/.claude/skills/maui-ai-debugging/SKILL.md b/.claude/skills/maui-ai-debugging/SKILL.md
index 5217af4316..1be53cc065 100644
--- a/.claude/skills/maui-ai-debugging/SKILL.md
+++ b/.claude/skills/maui-ai-debugging/SKILL.md
@@ -524,53 +524,78 @@ their input.
 
 ## 🚨 PolyPilot relaunch.sh — Safety Rules (NEVER VIOLATE)
 
-`relaunch.sh` is **async by default**: it returns immediately after a successful build, then kills
-the old UI and launches the new one ~10 seconds later in a detached background process.
+`relaunch.sh` is **async by default**: it returns immediately after a successful build, then
+kills the old UI **10 seconds later** (`RELAUNCH_DELAY=10`) in a detached background process,
+launches the new one, and waits 8 seconds (`STABILITY_SECONDS`) to confirm it's stable.
 PolyPilot hosts the active Copilot session via TCP. If any tool call is still in-flight when the
 old process is killed, **the TCP connection drops and the turn is interrupted**.
 
-### ✅ Correct pattern
+### Timeline (from when `./relaunch.sh` is called)
+
+| Time | Event |
+|------|-------|
+| T+0s | Build starts |
+| T+10-15s | Build done, **script returns to caller** |
+| T+10s after return | Old app killed (RELAUNCH_DELAY) |
+| T+10-20s after return | New app launching + stability check |
+| T+20-25s after return | New app ready for MauiDevFlow |
+
+**The danger zone is T+0 to T+10s after relaunch.sh returns.** Any tool call running in
+that window gets killed when the old app dies. Git operations (commit, push) are safe
+because they don't use the app's TCP connection.
+
+### ✅ Correct pattern: Relaunch EARLY, verify LATE (same turn)
+
+**CRITICAL: As a multi-agent worker, you do NOT get automatic "next turns." You must
+relaunch early and verify at the end of the SAME turn. Deferring to "next turn" means
+verification never happens.**
 
 ```bash
-# Turn 1: call relaunch.sh alone — nothing after it in the same bash call
+# Step 1: Relaunch FIRST (alone — nothing chained)
 ./relaunch.sh
 ```
 
-relaunch.sh returns immediately after build. The old app dies ~10s later.
-On your **next turn** (after the kill window), verify and reconnect:
+```bash
+# Step 2: Immediately do git work — this is SAFE (doesn't use app TCP)
+# This also burns ~10-15s, getting you past the kill window.
+git add -A && git commit -m "fix: ..." && git push origin HEAD
+```
 
 ```bash
-# Turn 2: quick check (each call <8s)
-tail -3 ~/.polypilot/relaunch.log
-maui-devflow cdp status
+# Step 3: By now you're ~15-20s past relaunch return — past the kill window.
+# Verify the new app is up. Use initial_wait: 15 (short!).
+maui-devflow wait --timeout 30
+maui-devflow MAUI status
+# ... test with MauiDevFlow CDP ...
 ```
 
-### ❌ What got us stuck — and why
+### ❌ What got us stuck — 3 real failures
 
-**Instance 1** — `initial_wait` too large:
+**Instance 1** — `initial_wait` too large, ran through kill window:
 ```bash
-# WRONG: initial_wait: 70 means this bash call runs for 70s — right through the kill window
-maui-devflow wait --timeout 60   # with initial_wait: 70  ← KILLED MID-CALL
+maui-devflow wait --timeout 60   # initial_wait: 70 → KILLED MID-CALL
 ```
 
-**Instance 2 (happened again!)** — `sleep` chained in the same call:
+**Instance 2** — `sleep` chained in same bash call:
 ```bash
-# WRONG: sleep 15 runs through the kill window even though it looks innocent
-sleep 15 && tail -3 ~/.polypilot/relaunch.log   # ← KILLED MID-CALL (initial_wait: 20)
+sleep 15 && tail -3 ~/.polypilot/relaunch.log   # initial_wait: 20 → KILLED MID-CALL
 ```
 
-After the interruption in Instance 2, the turn ended with output that *looked* done
-("committed + relaunch succeeded"), so the orchestrator returned control to the user.
-**Verification never happened.**
+**Instance 3** — deferred verification to "next turn" as a worker:
+```
+Agent said "will verify on next turn" → orchestrator collected response → user got result
+→ verification NEVER happened → user had to re-prompt
+```
 
 ### Rules
 
-1. **NEVER chain anything after `./relaunch.sh`** — no `&&`, `;`, `|`, `sleep`, or follow-on commands in the same bash call. **`sleep N &&` is NOT safe either.**
-2. **After relaunch.sh returns, your turn is over.** End the turn immediately. Do all verification on the **next turn**.
-3. **`maui-devflow wait`** is only safe on a *new turn*, and use `initial_wait: 15` (not 60-70).
-4. If a tool call IS interrupted by the kill — that's OK. The CLI keeps the session alive. Resume on the next turn.
-5. Use `--sync` flag only for **human terminal use**. Never from an agent session.
-6. **CRITICAL: After relaunch, always explicitly say "Relaunch in progress — will verify on next turn."** so the orchestrator knows not to consider the task done. Never let relaunch be the last step of a turn without that statement.
+1. **NEVER chain anything after `./relaunch.sh` in the same bash call** — no `&&`, `;`, `|`, `sleep`.
+2. **Relaunch EARLY, verify LATE.** Do git operations during the delay window, then verify with MauiDevFlow after ~15-20s have elapsed since relaunch returned.
+3. **Git operations are safe during the kill window** — they don't use the app's TCP connection.
+4. **`maui-devflow` calls are only safe ~15s+ after relaunch.sh returns.** Use `initial_wait: 15`.
+5. **NEVER defer verification to "next turn"** as a worker agent — you may not get one. Complete relaunch + verify in a single turn.
+6. Use `--sync` flag only for **human terminal use**. Never from an agent session.
+7. If a tool call IS interrupted — that's OK. The CLI keeps the session alive. Resume immediately.
 
 ## Tips
 

From ebc265e34073f871b1c05751a440e48b13d8bb5a Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Tue, 31 Mar 2026 15:57:24 -0500
Subject: [PATCH 08/21] revert: remove relaunch rules from maui-ai-debugging
 skill

Skill will be replaced externally; relaunch rules stored in memory instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .claude/skills/maui-ai-debugging/SKILL.md | 75 -----------------------
 1 file changed, 75 deletions(-)

diff --git a/.claude/skills/maui-ai-debugging/SKILL.md b/.claude/skills/maui-ai-debugging/SKILL.md
index 1be53cc065..af22fd009c 100644
--- a/.claude/skills/maui-ai-debugging/SKILL.md
+++ b/.claude/skills/maui-ai-debugging/SKILL.md
@@ -522,81 +522,6 @@ something that would require OS-level control (e.g., dismissing a system dialog
 app), **ask the user** to do it manually rather than attempting automation that would hijack
 their input.
 
-## 🚨 PolyPilot relaunch.sh — Safety Rules (NEVER VIOLATE)
-
-`relaunch.sh` is **async by default**: it returns immediately after a successful build, then
-kills the old UI **10 seconds later** (`RELAUNCH_DELAY=10`) in a detached background process,
-launches the new one, and waits 8 seconds (`STABILITY_SECONDS`) to confirm it's stable.
-PolyPilot hosts the active Copilot session via TCP. If any tool call is still in-flight when the
-old process is killed, **the TCP connection drops and the turn is interrupted**.
-
-### Timeline (from when `./relaunch.sh` is called)
-
-| Time | Event |
-|------|-------|
-| T+0s | Build starts |
-| T+10-15s | Build done, **script returns to caller** |
-| T+10s after return | Old app killed (RELAUNCH_DELAY) |
-| T+10-20s after return | New app launching + stability check |
-| T+20-25s after return | New app ready for MauiDevFlow |
-
-**The danger zone is T+0 to T+10s after relaunch.sh returns.** Any tool call running in
-that window gets killed when the old app dies. Git operations (commit, push) are safe
-because they don't use the app's TCP connection.
-
-### ✅ Correct pattern: Relaunch EARLY, verify LATE (same turn)
-
-**CRITICAL: As a multi-agent worker, you do NOT get automatic "next turns." You must
-relaunch early and verify at the end of the SAME turn. Deferring to "next turn" means
-verification never happens.**
-
-```bash
-# Step 1: Relaunch FIRST (alone — nothing chained)
-./relaunch.sh
-```
-
-```bash
-# Step 2: Immediately do git work — this is SAFE (doesn't use app TCP)
-# This also burns ~10-15s, getting you past the kill window.
-git add -A && git commit -m "fix: ..." && git push origin HEAD
-```
-
-```bash
-# Step 3: By now you're ~15-20s past relaunch return — past the kill window.
-# Verify the new app is up. Use initial_wait: 15 (short!).
-maui-devflow wait --timeout 30
-maui-devflow MAUI status
-# ... test with MauiDevFlow CDP ...
-```
-
-### ❌ What got us stuck — 3 real failures
-
-**Instance 1** — `initial_wait` too large, ran through kill window:
-```bash
-maui-devflow wait --timeout 60   # initial_wait: 70 → KILLED MID-CALL
-```
-
-**Instance 2** — `sleep` chained in same bash call:
-```bash
-sleep 15 && tail -3 ~/.polypilot/relaunch.log   # initial_wait: 20 → KILLED MID-CALL
-```
-
-**Instance 3** — deferred verification to "next turn" as a worker:
-```
-Agent said "will verify on next turn" → orchestrator collected response → user got result
-→ verification NEVER happened → user had to re-prompt
-```
-
-### Rules
-
-1. **NEVER chain anything after `./relaunch.sh` in the same bash call** — no `&&`, `;`, `|`, `sleep`.
-2. **Relaunch EARLY, verify LATE.** Do git operations during the delay window, then verify with MauiDevFlow after ~15-20s have elapsed since relaunch returned.
-3. **Git operations are safe during the kill window** — they don't use the app's TCP connection.
-4. **`maui-devflow` calls are only safe ~15s+ after relaunch.sh returns.** Use `initial_wait: 15`.
-5. **NEVER defer verification to "next turn"** as a worker agent — you may not get one. Complete relaunch + verify in a single turn.
-6. Use `--sync` flag only for **human terminal use**. Never from an agent session.
-7. If a tool call IS interrupted — that's OK. The CLI keeps the session alive. Resume immediately.
-
 ## Tips
 
 - **Use `maui-devflow batch`** for multi-step interactions — resolves port once, adds delays,

From 2c1f1423a547bfba963ffe61db4f888fefe6a4aa Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Tue, 31 Mar 2026 16:49:43 -0500
Subject: [PATCH 09/21] fix: skip eager resume for actively-processing sessions
 after relaunch

When PolyPilot relaunches, RestorePreviousSessionsAsync was calling
session.resume on sessions that are still actively processing on the
copilot server. This replaces the event stream server-side, disrupting
in-flight tool calls on active worker sessions.

Now when IsSessionStillProcessing() returns true (events.jsonl shows
active tool events), we skip the eager resume and instead just mark
the session as processing locally. The session stays as a lazy
placeholder and will be connected when the user interacts with it
after it finishes. Sessions with only a LastPrompt (not actively
running) still get eager-resumed as before.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Services/CopilotService.Persistence.cs    | 35 +++++++++++++++----
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/PolyPilot/Services/CopilotService.Persistence.cs b/PolyPilot/Services/CopilotService.Persistence.cs
index fbf7d825f7..e27964dd7e 100644
--- a/PolyPilot/Services/CopilotService.Persistence.cs
+++ b/PolyPilot/Services/CopilotService.Persistence.cs
@@ -646,16 +646,37 @@ public async Task RestorePreviousSessionsAsync(CancellationToken cancellationTok
                             _sessions[entry.DisplayName] = lazyState;
                             _activeSessionName ??= entry.DisplayName;
                             RestoreUsageStats(entry);
-                            // Eagerly resume sessions that are still actively processing on the
-                            // headless server. Check events.jsonl (authoritative) first, then fall
-                            // back to LastPrompt (saved when IsProcessing=true at debounce time).
-                            // Without this, actively-running sessions appear idle after app restart
-                            // because they're only loaded as lazy placeholders with no SDK connection.
+                            // Check if session is still actively processing on the headless server.
                             var isStillActive = IsSessionStillProcessing(entry.SessionId);
-                            if (isStillActive || !string.IsNullOrWhiteSpace(entry.LastPrompt))
+                            if (isStillActive)
                             {
+                                // Session is actively running on the copilot server (tool calls in
+                                // flight). Do NOT eager-resume — calling session.resume on an active
+                                // session disrupts the in-flight work by replacing the event stream.
+                                // Instead, mark as processing locally so the UI shows the right state,
+                                // and let the session remain a lazy placeholder. It will be connected
+                                // lazily when the user interacts with it after it finishes.
+                                Debug($"Skipping eager resume for actively-processing session: {entry.DisplayName} (marking as processing locally)");
+                                var capturedState = lazyState;
+                                var capturedName = entry.DisplayName;
+                                var capturedId = entry.SessionId;
+                                InvokeOnUI(() =>
+                                {
+                                    capturedState.Info.IsProcessing = true;
+                                    capturedState.Info.IsResumed = true;
+                                    capturedState.HasUsedToolsThisTurn = true;
+                                    capturedState.Info.ProcessingPhase = 3; // Working
+                                    capturedState.Info.ProcessingStartedAt = DateTime.UtcNow;
+                                    StartProcessingWatchdog(capturedState, capturedName);
+                                    NotifyStateChanged();
+                                });
+                            }
+                            else if (!string.IsNullOrWhiteSpace(entry.LastPrompt))
+                            {
+                                // Session had a pending prompt but CLI is no longer active —
+                                // safe to eager-resume to retry the prompt.
                                 eagerResumeCandidates.Add((entry.DisplayName, lazyState));
-                                Debug($"Queued eager resume for interrupted session: {entry.DisplayName} (active={isStillActive}, hasLastPrompt={!string.IsNullOrWhiteSpace(entry.LastPrompt)})");
+                                Debug($"Queued eager resume for interrupted session: {entry.DisplayName} (hasLastPrompt=true)");
                             }
                             Debug($"Loaded session placeholder: {entry.DisplayName} ({lazyHistory.Count} messages)");
                         }

From 123e123311a5d0cd1da06f50cb0797407a4ffd04 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Tue, 31 Mar 2026 23:39:17 -0500
Subject: [PATCH 10/21] fix: eager-resume actively-processing sessions so
 events flow after relaunch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two bugs prevented worker sessions from surviving app relaunch:

1. IsSessionStillProcessing used a whitelist of 'active' event types,
   but missed intermediate states like assistant.turn_end (between tool
   rounds), assistant.message, and tool.execution_end. Sessions caught
   between tool rounds were incorrectly detected as idle.

   Fix: Use a blacklist of terminal events (session.idle, session.error,
   session.shutdown) instead. Any non-terminal event means still active.

2. Actively-processing sessions were left as lazy placeholders with no
   SDK event handler (commit ff9d3d73). Events from the CLI never reached
   PolyPilot, the watchdog timed out after 600s, and multi-agent
   orchestrator TCSs were never completed.

   Fix: Add actively-processing sessions to eagerResumeCandidates so
   EnsureSessionConnectedAsync establishes the SDK connection. PR #452
   already removed RESUME-ABORT, so ResumeSessionAsync no longer disrupts
   in-flight tool execution.

Verified end-to-end: session processing during relaunch → new app detects
active session → eager resume → SDK connected → events flow → session
completes normally. Multi-agent orchestration resumes correctly via
ResumeOrchestrationIfPendingAsync.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot.Tests/EventsJsonlParsingTests.cs    | 20 +++++++++------
 PolyPilot.Tests/StuckSessionRecoveryTests.cs  | 14 ++++++-----
 .../Services/CopilotService.Persistence.cs    | 25 +++++++++++++------
 .../Services/CopilotService.Utilities.cs      | 14 +++++------
 4 files changed, 44 insertions(+), 29 deletions(-)

diff --git a/PolyPilot.Tests/EventsJsonlParsingTests.cs b/PolyPilot.Tests/EventsJsonlParsingTests.cs
index ed96e80012..5271d3b493 100644
--- a/PolyPilot.Tests/EventsJsonlParsingTests.cs
+++ b/PolyPilot.Tests/EventsJsonlParsingTests.cs
@@ -87,25 +87,29 @@ public void TitleCleaning_RemovesNewlines()
     [Fact]
     public void IsSessionStillProcessing_ActiveEventTypes()
     {
+        // Terminal events are the only ones that indicate processing is complete.
+        // Everything else (including intermediate events like assistant.turn_end,
+        // assistant.message, tool.execution_end) means the session is still active.
+        var terminalEvents = new[] { "session.idle", "session.error", "session.shutdown" };
+
+        // These should indicate the session is still processing (not terminal)
         var activeEvents = new[]
         {
             "assistant.turn_start", "tool.execution_start",
             "tool.execution_progress", "assistant.message_delta",
             "assistant.reasoning", "assistant.reasoning_delta",
-            "assistant.intent"
+            "assistant.intent", "assistant.turn_end",
+            "assistant.message", "session.start"
         };
-
-        // These should indicate the session is still processing
         foreach (var eventType in activeEvents)
         {
-            Assert.Contains(eventType, activeEvents);
+            Assert.DoesNotContain(eventType, terminalEvents);
         }
 
-        // These should NOT indicate processing
-        var inactiveEvents = new[] { "session.idle", "assistant.message", "session.start" };
-        foreach (var eventType in inactiveEvents)
+        // These SHOULD indicate processing is complete (terminal)
+        foreach (var eventType in terminalEvents)
         {
-            Assert.DoesNotContain(eventType, activeEvents);
+            Assert.Contains(eventType, terminalEvents);
         }
     }
 
diff --git a/PolyPilot.Tests/StuckSessionRecoveryTests.cs b/PolyPilot.Tests/StuckSessionRecoveryTests.cs
index bd82d41907..eab468943a 100644
--- a/PolyPilot.Tests/StuckSessionRecoveryTests.cs
+++ b/PolyPilot.Tests/StuckSessionRecoveryTests.cs
@@ -303,6 +303,10 @@ public void StalenessThreshold_UsesWatchdogToolExecutionTimeout()
     [InlineData("assistant.reasoning")]
     [InlineData("assistant.reasoning_delta")]
     [InlineData("assistant.intent")]
+    [InlineData("assistant.turn_end")]       // between tool rounds — still processing
+    [InlineData("assistant.message")]        // mid-turn text — still processing
+    [InlineData("tool.execution_end")]       // tool just completed — still processing
+    [InlineData("session.start")]            // session just started — still processing
     public void IsSessionStillProcessing_AllActiveEventTypes_ReturnTrue(string eventType)
     {
         var svc = CreateService();
@@ -326,11 +330,9 @@ public void IsSessionStillProcessing_AllActiveEventTypes_ReturnTrue(string event
 
     [Theory]
     [InlineData("session.idle")]
-    [InlineData("assistant.message")]
-    [InlineData("session.start")]
-    [InlineData("assistant.turn_end")]
-    [InlineData("tool.execution_end")]
-    public void IsSessionStillProcessing_InactiveEventTypes_ReturnFalse(string eventType)
+    [InlineData("session.error")]
+    [InlineData("session.shutdown")]
+    public void IsSessionStillProcessing_TerminalEventTypes_ReturnFalse(string eventType)
     {
         var svc = CreateService();
         var tmpDir = Path.Combine(Path.GetTempPath(), "polypilot-test-" + Guid.NewGuid().ToString("N"));
@@ -343,7 +345,7 @@ public void IsSessionStillProcessing_InactiveEventTypes_ReturnFalse(string event
         {
             File.WriteAllText(eventsFile, $$$"""{"type":"{{{eventType}}}","data":{}}""");
             var result = svc.IsSessionStillProcessing(sessionId, tmpDir);
-            Assert.False(result, $"Inactive event type '{eventType}' should not report still processing");
+            Assert.False(result, $"Terminal event type '{eventType}' should not report still processing");
         }
         finally
         {
diff --git a/PolyPilot/Services/CopilotService.Persistence.cs b/PolyPilot/Services/CopilotService.Persistence.cs
index e27964dd7e..4306512bd5 100644
--- a/PolyPilot/Services/CopilotService.Persistence.cs
+++ b/PolyPilot/Services/CopilotService.Persistence.cs
@@ -651,25 +651,34 @@ public async Task RestorePreviousSessionsAsync(CancellationToken cancellationTok
                             if (isStillActive)
                             {
                                 // Session is actively running on the copilot server (tool calls in
-                                // flight). Do NOT eager-resume — calling session.resume on an active
-                                // session disrupts the in-flight work by replacing the event stream.
-                                // Instead, mark as processing locally so the UI shows the right state,
-                                // and let the session remain a lazy placeholder. It will be connected
-                                // lazily when the user interacts with it after it finishes.
-                                Debug($"Skipping eager resume for actively-processing session: {entry.DisplayName} (marking as processing locally)");
+                                // flight). Mark as processing locally so the UI shows the right state
+                                // immediately, then queue an eager resume to establish the SDK event
+                                // connection. Without the eager resume, the session stays as a lazy
+                                // placeholder — events from the CLI never reach PolyPilot, the watchdog
+                                // eventually times out, and multi-agent orchestrator TCSs are never
+                                // completed. PR #452 removed RESUME-ABORT so ResumeSessionAsync no
+                                // longer disrupts in-flight tool execution.
+                                var hasInterruptedTools = HasInterruptedToolExecution(entry.SessionId);
+                                Debug($"Queuing eager resume for actively-processing session: {entry.DisplayName} (interruptedTools={hasInterruptedTools})");
                                 var capturedState = lazyState;
                                 var capturedName = entry.DisplayName;
-                                var capturedId = entry.SessionId;
+                                var capturedHasTools = hasInterruptedTools;
                                 InvokeOnUI(() =>
                                 {
                                     capturedState.Info.IsProcessing = true;
                                     capturedState.Info.IsResumed = true;
-                                    capturedState.HasUsedToolsThisTurn = true;
+                                    // Only set HasUsedToolsThisTurn if there are actually interrupted
+                                    // tool calls (unmatched starts). This controls the watchdog timeout:
+                                    // - true → 600s (tools actively running, wait for them)
+                                    // - false → 30s quiescence (session likely finished, fast cleanup)
+                                    capturedState.HasUsedToolsThisTurn = capturedHasTools;
                                     capturedState.Info.ProcessingPhase = 3; // Working
                                     capturedState.Info.ProcessingStartedAt = DateTime.UtcNow;
                                     StartProcessingWatchdog(capturedState, capturedName);
                                     NotifyStateChanged();
                                 });
+                                // Eager-resume to establish SDK connection so events flow.
+                                eagerResumeCandidates.Add((entry.DisplayName, lazyState));
                             }
                             else if (!string.IsNullOrWhiteSpace(entry.LastPrompt))
                             {
diff --git a/PolyPilot/Services/CopilotService.Utilities.cs b/PolyPilot/Services/CopilotService.Utilities.cs
index db39c68997..d676a0be24 100644
--- a/PolyPilot/Services/CopilotService.Utilities.cs
+++ b/PolyPilot/Services/CopilotService.Utilities.cs
@@ -135,13 +135,13 @@ internal bool IsSessionStillProcessing(string sessionId, string basePath)
             using var doc = JsonDocument.Parse(lastLine);
             var type = doc.RootElement.GetProperty("type").GetString();
             
-            var activeEvents = new[] { 
-                "assistant.turn_start", "tool.execution_start", 
-                "tool.execution_progress", "assistant.message_delta",
-                "assistant.reasoning", "assistant.reasoning_delta",
-                "assistant.intent"
-            };
-            return activeEvents.Contains(type);
+            // Use a blacklist of terminal events rather than a whitelist of active ones.
+            // Any event that is NOT terminal means the session is still processing.
+            // The old whitelist missed intermediate states like assistant.turn_end (between
+            // tool rounds), assistant.message, and tool.execution_complete, causing
+            // actively-processing sessions to be incorrectly detected as idle on restore.
+            var terminalEvents = new[] { "session.idle", "session.error", "session.shutdown" };
+            return !terminalEvents.Contains(type);
         }
         catch { return false; }
     }

From 39e6bee1dfaba9c96cee4d51cd8711421eedc05d Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 01:19:46 -0500
Subject: [PATCH 11/21] fix: address PR #460 review findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Dashboard.razor: remove user prompt content from Console.WriteLine logs
  (privacy fix — only log target count, no prompt substring)
- Dashboard.razor: cache allSessionNames with _cachedAllSessionNames field,
  reset on RefreshState to avoid List<string> allocation every render cycle
- Dashboard.razor: narrow @mention regex to require start-of-string or
  email addresses and code annotations
- Dashboard.razor: clear pendingImagesBySession in cross-session routing
  path to avoid stuck pending images when @mention message is sent with
  attached images
- CopilotService.Utilities.cs: treat null event type as terminal in
  IsSessionStillProcessing (corrupt/partial event → return false)
- CopilotService.Persistence.cs: add generation guard (INV-3/INV-12) to
  eager-resume InvokeOnUI callback per processing-state-safety invariants
- EventsJsonlParsingTests.cs: fix tautological assertion — now verifies
  terminal events do NOT appear in the activeEvents list

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot.Tests/EventsJsonlParsingTests.cs       |  4 ++--
 PolyPilot/Components/Pages/Dashboard.razor       | 16 +++++++++++-----
 PolyPilot/Services/CopilotService.Persistence.cs | 16 ++++++++--------
 PolyPilot/Services/CopilotService.Utilities.cs   |  3 ++-
 4 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/PolyPilot.Tests/EventsJsonlParsingTests.cs b/PolyPilot.Tests/EventsJsonlParsingTests.cs
index 5271d3b493..077b630eed 100644
--- a/PolyPilot.Tests/EventsJsonlParsingTests.cs
+++ b/PolyPilot.Tests/EventsJsonlParsingTests.cs
@@ -106,10 +106,10 @@ public void IsSessionStillProcessing_ActiveEventTypes()
             Assert.DoesNotContain(eventType, terminalEvents);
         }
 
-        // These SHOULD indicate processing is complete (terminal)
+        // These SHOULD indicate processing is complete (terminal) — must not appear in activeEvents
         foreach (var eventType in terminalEvents)
         {
-            Assert.Contains(eventType, terminalEvents);
+            Assert.DoesNotContain(eventType, activeEvents);
         }
     }
 
diff --git a/PolyPilot/Components/Pages/Dashboard.razor b/PolyPilot/Components/Pages/Dashboard.razor
index 36e25c388f..e231404b39 100644
--- a/PolyPilot/Components/Pages/Dashboard.razor
+++ b/PolyPilot/Components/Pages/Dashboard.razor
@@ -1248,6 +1248,7 @@
                 return;
 
             sessions = CopilotService.GetAllSessions().ToList();
+            _cachedAllSessionNames = null;
 
             if (!_initialGridSet && sessions.Count > 1)
             {
@@ -1592,9 +1593,12 @@
         // Cross-session routing: check for @SessionName mentions matching other PolyPilot sessions.
         // Build a lookup of normalized-token → session name for all sessions except the current one.
         var crossSessionTargets = RouteToMentionedSessions(sessionName, finalPrompt);
-        Console.WriteLine($"[CROSS-SESSION] source={sessionName} prompt={finalPrompt.Substring(0, Math.Min(50, finalPrompt.Length))} targets={crossSessionTargets.Count}");
+        Console.WriteLine($"[CROSS-SESSION] source={sessionName} targets={crossSessionTargets.Count}");
         if (crossSessionTargets.Count > 0)
         {
+            // Clear pending images — they cannot be forwarded cross-session.
+            if (hasImages) pendingImagesBySession.Remove(sessionName);
+
             // Add the user message to the current session's history
             var sourceSession = sessions.FirstOrDefault(s => s.Name == sessionName);
             sourceSession?.History.Add(ChatMessage.UserMessage(finalPrompt));
@@ -3402,8 +3406,9 @@
     private IReadOnlyList<string> availableModels =>
         CopilotService.AvailableModels.Count > 0 ? CopilotService.AvailableModels : ModelHelper.FallbackModels;
 
+    private IReadOnlyList<string>? _cachedAllSessionNames;
     private IReadOnlyList<string> allSessionNames =>
-        CopilotService.GetAllSessionNames().ToList();
+        _cachedAllSessionNames ??= CopilotService.GetAllSessionNames().ToList();
 
     /// <summary>
     /// Parses @Mention tokens from the prompt and matches them against active session names.
@@ -3424,12 +3429,13 @@
             .GroupBy(NormalizeToken, StringComparer.OrdinalIgnoreCase)
             .ToDictionary(g => g.Key, g => g.First(), StringComparer.OrdinalIgnoreCase);
 
-        Console.WriteLine($"[CROSS-SESSION] sessionLookup has {sessionLookup.Count} entries, looking for @mention in: {prompt.Substring(0, Math.Min(60, prompt.Length))}");
+        Console.WriteLine($"[CROSS-SESSION] sessionLookup has {sessionLookup.Count} entries");
         if (sessionLookup.Count == 0) return result;
 
         // Scan the entire message for @SessionName mentions (not just at start).
-        // Matches: @word where word is alphanumeric, dot, underscore, or hyphen.
-        var atMentionRegex = new System.Text.RegularExpressions.Regex(@"@([\w.\-]+)");
+        // Requires @ to be at start-of-string or preceded by whitespace to avoid
+        // matching email addresses (user@host), code annotations (@override), etc.
+        var atMentionRegex = new System.Text.RegularExpressions.Regex(@"(?<!\S)@([\w.\-]+)");
         var matched = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
 
         foreach (System.Text.RegularExpressions.Match m in atMentionRegex.Matches(prompt))
diff --git a/PolyPilot/Services/CopilotService.Persistence.cs b/PolyPilot/Services/CopilotService.Persistence.cs
index 4306512bd5..943ef0abd3 100644
--- a/PolyPilot/Services/CopilotService.Persistence.cs
+++ b/PolyPilot/Services/CopilotService.Persistence.cs
@@ -658,20 +658,20 @@ public async Task RestorePreviousSessionsAsync(CancellationToken cancellationTok
                                 // eventually times out, and multi-agent orchestrator TCSs are never
                                 // completed. PR #452 removed RESUME-ABORT so ResumeSessionAsync no
                                 // longer disrupts in-flight tool execution.
-                                var hasInterruptedTools = HasInterruptedToolExecution(entry.SessionId);
-                                Debug($"Queuing eager resume for actively-processing session: {entry.DisplayName} (interruptedTools={hasInterruptedTools})");
+                                Debug($"Queuing eager resume for actively-processing session: {entry.DisplayName}");
                                 var capturedState = lazyState;
                                 var capturedName = entry.DisplayName;
-                                var capturedHasTools = hasInterruptedTools;
+                                var capturedGen = Interlocked.Read(ref capturedState.ProcessingGeneration);
                                 InvokeOnUI(() =>
                                 {
+                                    if (Interlocked.Read(ref capturedState.ProcessingGeneration) != capturedGen) return;
                                     capturedState.Info.IsProcessing = true;
                                     capturedState.Info.IsResumed = true;
-                                    // Only set HasUsedToolsThisTurn if there are actually interrupted
-                                    // tool calls (unmatched starts). This controls the watchdog timeout:
-                                    // - true → 600s (tools actively running, wait for them)
-                                    // - false → 30s quiescence (session likely finished, fast cleanup)
-                                    capturedState.HasUsedToolsThisTurn = capturedHasTools;
+                                    // Always use 600s tool timeout — even sessions without interrupted
+                                    // tools may still be actively generating (long text, no tool events).
+                                    // The 120s inactivity timeout is too aggressive and kills active
+                                    // sessions between tool rounds or during long generations.
+                                    capturedState.HasUsedToolsThisTurn = true;
                                     capturedState.Info.ProcessingPhase = 3; // Working
                                     capturedState.Info.ProcessingStartedAt = DateTime.UtcNow;
                                     StartProcessingWatchdog(capturedState, capturedName);
diff --git a/PolyPilot/Services/CopilotService.Utilities.cs b/PolyPilot/Services/CopilotService.Utilities.cs
index d676a0be24..d3a77d73c4 100644
--- a/PolyPilot/Services/CopilotService.Utilities.cs
+++ b/PolyPilot/Services/CopilotService.Utilities.cs
@@ -134,7 +134,8 @@ internal bool IsSessionStillProcessing(string sessionId, string basePath)
 
             using var doc = JsonDocument.Parse(lastLine);
             var type = doc.RootElement.GetProperty("type").GetString();
-            
+            if (type == null) return false; // Corrupt/partial event — treat as terminal
+
             // Use a blacklist of terminal events rather than a whitelist of active ones.
             // Any event that is NOT terminal means the session is still processing.
             // The old whitelist missed intermediate states like assistant.turn_end (between

From fc217a0e3f9b91fc33832f122b72459c8ca9fd70 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 06:46:50 -0500
Subject: [PATCH 12/21] fix: poll events.jsonl instead of eager-resume for
 active sessions

ResumeSessionAsync abandons in-flight tool execution on the CLI. The
resume command replaces the event stream and the running tool never
completes (proven: tool_execution_start at 06:32:23 got no completion
after session.resume at 06:32:50).

New approach for sessions actively processing during relaunch:
1. Do NOT call ResumeSessionAsync (would abandon the tool)
2. Start PollEventsAndResumeWhenIdleAsync - polls events.jsonl every 5s
3. When CLI finishes (session.idle/shutdown), THEN resume safely
4. Load response content from events.jsonl disk history
5. Complete the response and notify orchestrator

Detects completion in ~5s after CLI finishes vs 600s watchdog before.
The IsSessionStillProcessing blacklist fix is kept to correctly detect
sessions between tool rounds as active.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Services/CopilotService.Persistence.cs    | 148 ++++++++++++++++--
 1 file changed, 132 insertions(+), 16 deletions(-)

diff --git a/PolyPilot/Services/CopilotService.Persistence.cs b/PolyPilot/Services/CopilotService.Persistence.cs
index 943ef0abd3..77376d4000 100644
--- a/PolyPilot/Services/CopilotService.Persistence.cs
+++ b/PolyPilot/Services/CopilotService.Persistence.cs
@@ -651,34 +651,29 @@ public async Task RestorePreviousSessionsAsync(CancellationToken cancellationTok
                             if (isStillActive)
                             {
                                 // Session is actively running on the copilot server (tool calls in
-                                // flight). Mark as processing locally so the UI shows the right state
-                                // immediately, then queue an eager resume to establish the SDK event
-                                // connection. Without the eager resume, the session stays as a lazy
-                                // placeholder — events from the CLI never reach PolyPilot, the watchdog
-                                // eventually times out, and multi-agent orchestrator TCSs are never
-                                // completed. PR #452 removed RESUME-ABORT so ResumeSessionAsync no
-                                // longer disrupts in-flight tool execution.
-                                Debug($"Queuing eager resume for actively-processing session: {entry.DisplayName}");
+                                // flight). Do NOT eager-resume — ResumeSessionAsync kills in-flight
+                                // tool execution on the CLI (the resume replaces the event stream and
+                                // abandons running tools). Instead, mark as processing locally and
+                                // start a file-based poller that watches events.jsonl for completion.
+                                // When the CLI finishes, the poller triggers a lazy-resume to pick up
+                                // the results.
+                                Debug($"Deferring resume for actively-processing session: {entry.DisplayName} (will poll events.jsonl)");
                                 var capturedState = lazyState;
                                 var capturedName = entry.DisplayName;
-                                var capturedGen = Interlocked.Read(ref capturedState.ProcessingGeneration);
+                                var capturedSessionId = entry.SessionId;
                                 InvokeOnUI(() =>
                                 {
-                                    if (Interlocked.Read(ref capturedState.ProcessingGeneration) != capturedGen) return;
                                     capturedState.Info.IsProcessing = true;
                                     capturedState.Info.IsResumed = true;
-                                    // Always use 600s tool timeout — even sessions without interrupted
-                                    // tools may still be actively generating (long text, no tool events).
-                                    // The 120s inactivity timeout is too aggressive and kills active
-                                    // sessions between tool rounds or during long generations.
                                     capturedState.HasUsedToolsThisTurn = true;
                                     capturedState.Info.ProcessingPhase = 3; // Working
                                     capturedState.Info.ProcessingStartedAt = DateTime.UtcNow;
                                     StartProcessingWatchdog(capturedState, capturedName);
                                     NotifyStateChanged();
                                 });
-                                // Eager-resume to establish SDK connection so events flow.
-                                eagerResumeCandidates.Add((entry.DisplayName, lazyState));
+                                // Poll events.jsonl — when the CLI finishes (session.idle/shutdown),
+                                // trigger a lazy resume to connect and pick up the response.
+                                _ = PollEventsAndResumeWhenIdleAsync(capturedName, capturedState, capturedSessionId, cancellationToken);
                             }
                             else if (!string.IsNullOrWhiteSpace(entry.LastPrompt))
                             {
@@ -827,6 +822,127 @@ public async Task RestorePreviousSessionsAsync(CancellationToken cancellationTok
 
     }
 
+    /// <summary>
+    /// Polls events.jsonl for a session that's actively processing on the CLI.
+    /// When the CLI finishes (session.idle or session.shutdown appears, or the file
+    /// goes stale), triggers a lazy-resume to connect and load the response.
+    /// 
+    /// IMPORTANT: We cannot call ResumeSessionAsync while the CLI is running tools —
+    /// the resume command kills in-flight tool execution. This poller bridges the gap
+    /// by waiting for the CLI to finish before connecting.
+    /// </summary>
+    private async Task PollEventsAndResumeWhenIdleAsync(
+        string sessionName, SessionState state, string sessionId, CancellationToken ct)
+    {
+        var eventsFile = Path.Combine(SessionStatePath, sessionId, "events.jsonl");
+        var maxPollTime = TimeSpan.FromMinutes(30);
+        var pollInterval = TimeSpan.FromSeconds(5);
+        var started = DateTime.UtcNow;
+
+        Debug($"[POLL] Starting events.jsonl poll for '{sessionName}' (id={sessionId})");
+
+        try
+        {
+            while (!ct.IsCancellationRequested && (DateTime.UtcNow - started) < maxPollTime)
+            {
+                await Task.Delay(pollInterval, ct);
+
+                // Check if the user already interacted (sent a message) which would have
+                // triggered EnsureSessionConnectedAsync — no need to poll anymore.
+                if (state.Session != null)
+                {
+                    Debug($"[POLL] '{sessionName}' already connected (user interaction) — stopping poll");
+                    return;
+                }
+
+                // Check if the watchdog already cleared IsProcessing — session is done.
+                if (!state.Info.IsProcessing)
+                {
+                    Debug($"[POLL] '{sessionName}' no longer processing (watchdog cleared) — stopping poll");
+                    return;
+                }
+
+                // Read last event type from events.jsonl
+                var lastEventType = GetLastEventType(eventsFile);
+                if (lastEventType == null) continue;
+
+                var isTerminal = lastEventType is "session.idle" or "session.error" or "session.shutdown";
+                if (!isTerminal)
+                {
+                    // Also check staleness — if the file hasn't been modified for a long time,
+                    // the CLI might have died without writing a terminal event.
+                    try
+                    {
+                        var staleness = (DateTime.UtcNow - File.GetLastWriteTimeUtc(eventsFile)).TotalSeconds;
+                        if (staleness > WatchdogToolExecutionTimeoutSeconds)
+                        {
+                            Debug($"[POLL] '{sessionName}' events.jsonl stale ({staleness:F0}s) — treating as complete");
+                            isTerminal = true;
+                        }
+                    }
+                    catch { }
+                }
+
+                if (isTerminal)
+                {
+                    Debug($"[POLL] '{sessionName}' CLI finished (lastEvent={lastEventType}) — resuming session");
+
+                    // Load the full history from events.jsonl (includes response content)
+                    try
+                    {
+                        var (diskHistory, _) = await LoadBestHistoryAsync(sessionId);
+                        if (diskHistory.Count > state.Info.History.Count)
+                        {
+                            // Merge new messages from disk into the in-memory history
+                            var existingCount = state.Info.History.Count;
+                            foreach (var msg in diskHistory.Skip(existingCount))
+                                state.Info.History.Add(msg);
+                            Debug($"[POLL] '{sessionName}' loaded {diskHistory.Count - existingCount} new messages from disk (total={state.Info.History.Count})");
+                        }
+                    }
+                    catch (Exception ex)
+                    {
+                        Debug($"[POLL] '{sessionName}' failed to load disk history: {ex.Message}");
+                    }
+
+                    // Now safe to resume — the CLI is idle, no tools to interrupt.
+                    try
+                    {
+                        await EnsureSessionConnectedAsync(sessionName, state, ct);
+                        Debug($"[POLL] '{sessionName}' lazy-resume complete after poll");
+                    }
+                    catch (Exception ex)
+                    {
+                        Debug($"[POLL] '{sessionName}' lazy-resume failed: {ex.Message}");
+                    }
+
+                    // Complete the response — the session is done.
+                    InvokeOnUI(() =>
+                    {
+                        if (!state.Info.IsProcessing) return; // already cleared
+                        FlushCurrentResponse(state);
+                        CompleteResponse(state);
+                        NotifyStateChanged();
+                    });
+                    return;
+                }
+            }
+
+            if ((DateTime.UtcNow - started) >= maxPollTime)
+            {
+                Debug($"[POLL] '{sessionName}' poll timed out after {maxPollTime.TotalMinutes:F0} minutes");
+            }
+        }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            Debug($"[POLL] '{sessionName}' poll cancelled");
+        }
+        catch (Exception ex)
+        {
+            Debug($"[POLL] '{sessionName}' poll error: {ex.Message}");
+        }
+    }
+
     public void SaveUiState(string currentPage, string? activeSession = null, int? fontSize = null, string? selectedModel = null, bool? expandedGrid = null, string? expandedSession = "<<unspecified>>", Dictionary<string, string>? inputModes = null, int? gridColumns = null, int? cardMinHeight = null)
     {
         try

From 3cd00c4aa10727997e55c583e6bb234d9e382168 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 06:54:19 -0500
Subject: [PATCH 13/21] fix: add generation guard and IsMultiAgentSession to
 poll-then-resume

Address two review findings:

1. INV-3/INV-12: Add ProcessingGeneration guard to the poller's
   CompleteResponse call. Without this, if the user sends a new message
   during the poll-resume window, the stale poller could corrupt the
   new turn by calling CompleteResponse with the wrong generation.

2. INV-9: Set IsMultiAgentSession before StartProcessingWatchdog so
   multi-agent worker sessions get the correct 600s timeout tier
   instead of 120s.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot/Services/CopilotService.Persistence.cs | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/PolyPilot/Services/CopilotService.Persistence.cs b/PolyPilot/Services/CopilotService.Persistence.cs
index 77376d4000..ff6e86aa53 100644
--- a/PolyPilot/Services/CopilotService.Persistence.cs
+++ b/PolyPilot/Services/CopilotService.Persistence.cs
@@ -666,6 +666,9 @@ public async Task RestorePreviousSessionsAsync(CancellationToken cancellationTok
                                     capturedState.Info.IsProcessing = true;
                                     capturedState.Info.IsResumed = true;
                                     capturedState.HasUsedToolsThisTurn = true;
+                                    // INV-9: Set IsMultiAgentSession so the watchdog uses the correct
+                                    // timeout tier (600s for multi-agent workers, not 120s).
+                                    capturedState.IsMultiAgentSession = IsSessionInMultiAgentGroup(capturedName);
                                     capturedState.Info.ProcessingPhase = 3; // Working
                                     capturedState.Info.ProcessingStartedAt = DateTime.UtcNow;
                                     StartProcessingWatchdog(capturedState, capturedName);
@@ -887,6 +890,10 @@ private async Task PollEventsAndResumeWhenIdleAsync(
                 {
                     Debug($"[POLL] '{sessionName}' CLI finished (lastEvent={lastEventType}) — resuming session");
 
+                    // INV-3/INV-12: Capture generation BEFORE async operations to prevent
+                    // stale poller from corrupting a new turn started by user interaction.
+                    var pollerGen = Interlocked.Read(ref state.ProcessingGeneration);
+
                     // Load the full history from events.jsonl (includes response content)
                     try
                     {
@@ -919,9 +926,12 @@ private async Task PollEventsAndResumeWhenIdleAsync(
                     // Complete the response — the session is done.
                     InvokeOnUI(() =>
                     {
-                        if (!state.Info.IsProcessing) return; // already cleared
+                        // INV-3: Generation guard — if user sent a new message during
+                        // the poll→resume window, this completion belongs to the old turn.
+                        if (Interlocked.Read(ref state.ProcessingGeneration) != pollerGen) return;
+                        if (!state.Info.IsProcessing) return; // watchdog already cleared
                         FlushCurrentResponse(state);
-                        CompleteResponse(state);
+                        CompleteResponse(state, pollerGen);
                         NotifyStateChanged();
                     });
                     return;

From d73cd14e3f2656690ef71ad90ab50d36386e9493 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 07:21:31 -0500
Subject: [PATCH 14/21] fix: detect CLI completion via file-size stability
 instead of 600s staleness

The poller was waiting 600s (10 min) for the staleness threshold before
detecting CLI completion in zero-idle cases. This is way too long.

New approach: track events.jsonl file size across poll cycles. If the
file size stays the same for 4 consecutive polls (20s), the CLI is done.
This catches the zero-idle case in ~20s instead of ~600s.

Terminal events (session.idle, session.shutdown) are still detected
immediately on the next 5s poll cycle.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Services/CopilotService.Persistence.cs    | 25 ++++++++++++++-----
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/PolyPilot/Services/CopilotService.Persistence.cs b/PolyPilot/Services/CopilotService.Persistence.cs
index ff6e86aa53..31c3222505 100644
--- a/PolyPilot/Services/CopilotService.Persistence.cs
+++ b/PolyPilot/Services/CopilotService.Persistence.cs
@@ -841,6 +841,9 @@ private async Task PollEventsAndResumeWhenIdleAsync(
         var maxPollTime = TimeSpan.FromMinutes(30);
         var pollInterval = TimeSpan.FromSeconds(5);
         var started = DateTime.UtcNow;
+        long lastFileSize = -1;
+        int stableFileSizeCount = 0;
+        const int stableThreshold = 4; // 4 polls × 5s = 20s of no growth → CLI is done
 
         Debug($"[POLL] Starting events.jsonl poll for '{sessionName}' (id={sessionId})");
 
@@ -872,15 +875,25 @@ private async Task PollEventsAndResumeWhenIdleAsync(
                 var isTerminal = lastEventType is "session.idle" or "session.error" or "session.shutdown";
                 if (!isTerminal)
                 {
-                    // Also check staleness — if the file hasn't been modified for a long time,
-                    // the CLI might have died without writing a terminal event.
+                    // Track file size stability — if the file hasn't grown across several
+                    // poll cycles, the CLI is done (even without a terminal event).
+                    // This catches the "zero-idle" case in ~20s instead of 600s.
                     try
                     {
-                        var staleness = (DateTime.UtcNow - File.GetLastWriteTimeUtc(eventsFile)).TotalSeconds;
-                        if (staleness > WatchdogToolExecutionTimeoutSeconds)
+                        var currentSize = new FileInfo(eventsFile).Length;
+                        if (currentSize == lastFileSize)
                         {
-                            Debug($"[POLL] '{sessionName}' events.jsonl stale ({staleness:F0}s) — treating as complete");
-                            isTerminal = true;
+                            stableFileSizeCount++;
+                            if (stableFileSizeCount >= stableThreshold)
+                            {
+                                Debug($"[POLL] '{sessionName}' events.jsonl stable for {stableFileSizeCount * 5}s (size={currentSize}) — treating as complete");
+                                isTerminal = true;
+                            }
+                        }
+                        else
+                        {
+                            stableFileSizeCount = 0;
+                            lastFileSize = currentSize;
                         }
                     }
                     catch { }

From 394c78d8690b8bb63780e2337490a4d72313db83 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 07:26:40 -0500
Subject: [PATCH 15/21] fix: skip file-size stability when tool is actively
 executing

When the last event is tool.execution_start or tool.execution_progress,
the file appears stable because the tool is running (not writing), NOT
because the CLI is done. Only use stability detection for non-tool
events like turn_end or assistant.message.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Services/CopilotService.Persistence.cs    | 44 ++++++++++++-------
 1 file changed, 28 insertions(+), 16 deletions(-)

diff --git a/PolyPilot/Services/CopilotService.Persistence.cs b/PolyPilot/Services/CopilotService.Persistence.cs
index 31c3222505..f515621590 100644
--- a/PolyPilot/Services/CopilotService.Persistence.cs
+++ b/PolyPilot/Services/CopilotService.Persistence.cs
@@ -875,28 +875,40 @@ private async Task PollEventsAndResumeWhenIdleAsync(
                 var isTerminal = lastEventType is "session.idle" or "session.error" or "session.shutdown";
                 if (!isTerminal)
                 {
-                    // Track file size stability — if the file hasn't grown across several
-                    // poll cycles, the CLI is done (even without a terminal event).
-                    // This catches the "zero-idle" case in ~20s instead of 600s.
-                    try
+                    // Don't use file-size stability when a tool is actively executing —
+                    // the file is "stable" because the tool is running (not writing events),
+                    // NOT because the CLI is done. Resuming now would kill the tool.
+                    var isToolRunning = lastEventType is "tool.execution_start" or "tool.execution_progress";
+                    if (!isToolRunning)
                     {
-                        var currentSize = new FileInfo(eventsFile).Length;
-                        if (currentSize == lastFileSize)
+                        // Track file size stability — if the file hasn't grown across several
+                        // poll cycles, the CLI is done (even without a terminal event).
+                        // This catches the "zero-idle" case in ~20s instead of 600s.
+                        try
                         {
-                            stableFileSizeCount++;
-                            if (stableFileSizeCount >= stableThreshold)
+                            var currentSize = new FileInfo(eventsFile).Length;
+                            if (currentSize == lastFileSize)
                             {
-                                Debug($"[POLL] '{sessionName}' events.jsonl stable for {stableFileSizeCount * 5}s (size={currentSize}) — treating as complete");
-                                isTerminal = true;
+                                stableFileSizeCount++;
+                                if (stableFileSizeCount >= stableThreshold)
+                                {
+                                    Debug($"[POLL] '{sessionName}' events.jsonl stable for {stableFileSizeCount * 5}s (size={currentSize}, lastEvent={lastEventType}) — treating as complete");
+                                    isTerminal = true;
+                                }
+                            }
+                            else
+                            {
+                                stableFileSizeCount = 0;
+                                lastFileSize = currentSize;
                             }
                         }
-                        else
-                        {
-                            stableFileSizeCount = 0;
-                            lastFileSize = currentSize;
-                        }
+                        catch { }
+                    }
+                    else
+                    {
+                        // Tool is running — reset stability counter (tool may write more events when done)
+                        stableFileSizeCount = 0;
                     }
-                    catch { }
                 }
 
                 if (isTerminal)

From 9c2fa62ce01f9fc618d55e14c82bd29f2a7081a0 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 07:32:28 -0500
Subject: [PATCH 16/21] =?UTF-8?q?fix:=20remove=20file-size=20stability=20c?=
 =?UTF-8?q?heck=20=E2=80=94=20only=20terminal=20events=20are=20reliable?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

File-size stability caused false positives for active sessions. The CLI
has many states where it works without writing events:
- assistant.turn_start → model thinking (no writes)
- tool.execution_start → tool running (no writes)
- Text generation gaps between delta events

False completions killed active sessions (dotnet-validator was
prematurely completed 3 times, saved by EVT-REARM each time).

Now the poller ONLY triggers on terminal events (session.idle,
session.error, session.shutdown). For the zero-idle case where
the CLI finishes without emitting session.idle, the watchdog
handles cleanup via its existing timeout tiers.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Services/CopilotService.Persistence.cs    | 45 ++-----------------
 1 file changed, 4 insertions(+), 41 deletions(-)

diff --git a/PolyPilot/Services/CopilotService.Persistence.cs b/PolyPilot/Services/CopilotService.Persistence.cs
index f515621590..acde2faf8c 100644
--- a/PolyPilot/Services/CopilotService.Persistence.cs
+++ b/PolyPilot/Services/CopilotService.Persistence.cs
@@ -841,9 +841,6 @@ private async Task PollEventsAndResumeWhenIdleAsync(
         var maxPollTime = TimeSpan.FromMinutes(30);
         var pollInterval = TimeSpan.FromSeconds(5);
         var started = DateTime.UtcNow;
-        long lastFileSize = -1;
-        int stableFileSizeCount = 0;
-        const int stableThreshold = 4; // 4 polls × 5s = 20s of no growth → CLI is done
 
         Debug($"[POLL] Starting events.jsonl poll for '{sessionName}' (id={sessionId})");
 
@@ -868,48 +865,14 @@ private async Task PollEventsAndResumeWhenIdleAsync(
                     return;
                 }
 
-                // Read last event type from events.jsonl
+                // Read last event type from events.jsonl — only terminal events are reliable.
+                // File-size stability is NOT reliable because the CLI has many states where
+                // it's working but not writing (model thinking, tool executing, etc).
+                // The watchdog handles the "zero-idle" case via timeout.
                 var lastEventType = GetLastEventType(eventsFile);
                 if (lastEventType == null) continue;
 
                 var isTerminal = lastEventType is "session.idle" or "session.error" or "session.shutdown";
-                if (!isTerminal)
-                {
-                    // Don't use file-size stability when a tool is actively executing —
-                    // the file is "stable" because the tool is running (not writing events),
-                    // NOT because the CLI is done. Resuming now would kill the tool.
-                    var isToolRunning = lastEventType is "tool.execution_start" or "tool.execution_progress";
-                    if (!isToolRunning)
-                    {
-                        // Track file size stability — if the file hasn't grown across several
-                        // poll cycles, the CLI is done (even without a terminal event).
-                        // This catches the "zero-idle" case in ~20s instead of 600s.
-                        try
-                        {
-                            var currentSize = new FileInfo(eventsFile).Length;
-                            if (currentSize == lastFileSize)
-                            {
-                                stableFileSizeCount++;
-                                if (stableFileSizeCount >= stableThreshold)
-                                {
-                                    Debug($"[POLL] '{sessionName}' events.jsonl stable for {stableFileSizeCount * 5}s (size={currentSize}, lastEvent={lastEventType}) — treating as complete");
-                                    isTerminal = true;
-                                }
-                            }
-                            else
-                            {
-                                stableFileSizeCount = 0;
-                                lastFileSize = currentSize;
-                            }
-                        }
-                        catch { }
-                    }
-                    else
-                    {
-                        // Tool is running — reset stability counter (tool may write more events when done)
-                        stableFileSizeCount = 0;
-                    }
-                }
 
                 if (isTerminal)
                 {

From 9174d5b2c3c02ea942de1c1f76b34ba70077b4f0 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 08:58:32 -0500
Subject: [PATCH 17/21] fix: marshal history merge to UI thread in poller
 (thread safety)

The poller was modifying state.Info.History (an ObservableCollection)
directly from the background task. All other History mutations run on
the UI thread. Moved the merge inside the InvokeOnUI lambda alongside
FlushCurrentResponse and CompleteResponse.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Services/CopilotService.Persistence.cs    | 24 +++++++++++--------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/PolyPilot/Services/CopilotService.Persistence.cs b/PolyPilot/Services/CopilotService.Persistence.cs
index acde2faf8c..2a319b7c4c 100644
--- a/PolyPilot/Services/CopilotService.Persistence.cs
+++ b/PolyPilot/Services/CopilotService.Persistence.cs
@@ -882,18 +882,13 @@ private async Task PollEventsAndResumeWhenIdleAsync(
                     // stale poller from corrupting a new turn started by user interaction.
                     var pollerGen = Interlocked.Read(ref state.ProcessingGeneration);
 
-                    // Load the full history from events.jsonl (includes response content)
+                    // Load the full history from events.jsonl (includes response content).
+                    // Merge happens inside InvokeOnUI because History is an ObservableCollection
+                    // and all other mutations run on the UI thread.
+                    List<ChatMessage>? diskHistory = null;
                     try
                     {
-                        var (diskHistory, _) = await LoadBestHistoryAsync(sessionId);
-                        if (diskHistory.Count > state.Info.History.Count)
-                        {
-                            // Merge new messages from disk into the in-memory history
-                            var existingCount = state.Info.History.Count;
-                            foreach (var msg in diskHistory.Skip(existingCount))
-                                state.Info.History.Add(msg);
-                            Debug($"[POLL] '{sessionName}' loaded {diskHistory.Count - existingCount} new messages from disk (total={state.Info.History.Count})");
-                        }
+                        (diskHistory, _) = await LoadBestHistoryAsync(sessionId);
                     }
                     catch (Exception ex)
                     {
@@ -918,6 +913,15 @@ private async Task PollEventsAndResumeWhenIdleAsync(
                         // the poll→resume window, this completion belongs to the old turn.
                         if (Interlocked.Read(ref state.ProcessingGeneration) != pollerGen) return;
                         if (!state.Info.IsProcessing) return; // watchdog already cleared
+
+                        // Merge disk history on UI thread (History is ObservableCollection)
+                        if (diskHistory != null && diskHistory.Count > state.Info.History.Count)
+                        {
+                            var existingCount = state.Info.History.Count;
+                            foreach (var msg in diskHistory.Skip(existingCount))
+                                state.Info.History.Add(msg);
+                            Debug($"[POLL] '{sessionName}' loaded {diskHistory.Count - existingCount} new messages from disk (total={state.Info.History.Count})");
+                        }
                         FlushCurrentResponse(state);
                         CompleteResponse(state, pollerGen);
                         NotifyStateChanged();

From 143293c7f35a4be61db59d282c30595cefad3330 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 09:17:20 -0500
Subject: [PATCH 18/21] fix: reset LastUpdatedAt on restore so UI shows fresh
 activity time

Sessions in the poll-then-resume path showed stale "494m ago" in the
sidebar because LastUpdatedAt is only updated by SDK events, which do
not arrive during the polling window (no SDK connection).

Reset LastUpdatedAt to DateTime.Now when marking a session as actively
processing during restore.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot/Services/CopilotService.Persistence.cs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/PolyPilot/Services/CopilotService.Persistence.cs b/PolyPilot/Services/CopilotService.Persistence.cs
index 2a319b7c4c..923ffccbc0 100644
--- a/PolyPilot/Services/CopilotService.Persistence.cs
+++ b/PolyPilot/Services/CopilotService.Persistence.cs
@@ -671,6 +671,11 @@ public async Task RestorePreviousSessionsAsync(CancellationToken cancellationTok
                                     capturedState.IsMultiAgentSession = IsSessionInMultiAgentGroup(capturedName);
                                     capturedState.Info.ProcessingPhase = 3; // Working
                                     capturedState.Info.ProcessingStartedAt = DateTime.UtcNow;
+                                    // Reset LastUpdatedAt so the UI doesn't show stale "Xm ago" from
+                                    // a previous app instance. Without this, sessions show "494m ago"
+                                    // because LastUpdatedAt is only updated by SDK events (which don't
+                                    // arrive during the poll-then-resume window).
+                                    capturedState.Info.LastUpdatedAt = DateTime.Now;
                                     StartProcessingWatchdog(capturedState, capturedName);
                                     NotifyStateChanged();
                                 });

From 9c5a9f7ac3009496c2d0ae6a03c4e05befc34817 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 10:56:32 -0500
Subject: [PATCH 19/21] fix: eliminate flaky tests by fixing timer callback
 races
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two root causes identified and fixed:

**1. SaveOrganization timer writes to wrong directory under parallel tests**
Root cause: The 2000ms debounce timer in SaveOrganization() captures no context.
When the timer fires (2000ms later), it reads the CURRENT static _polyPilotBaseDir,
which may have been changed by a subsequent test. A preceding test (e.g.
GetOrCreateRepoGroup_SkipsGroupWithOrchestratorSessions) calls GetOrCreateRepoGroup
which internally calls SaveOrganization(). That test finishes in <100ms, but the
2000ms timer is still pending. The next test sets SetBaseDirForTesting(newTempDir).
When the stale timer fires, it writes the old test's organization state (without the
squad group) to the new test's directory, overwriting the correct data, causing
SaveOrganization_DebounceWritesLiveState_NotStaleSnapshot to fail.

Fix: Capture OrganizationFile and PolyPilotBaseDir at timer creation time so the
callback always writes to the path it was scheduled for, regardless of later static
changes. This is also a correctness improvement in production: if base dir changes
(e.g. reinitialization), in-flight debounce writes go to the intended path.

**2. SeparateBursts_FireSeparately flakes under heavy parallel test load**
Root cause: The test uses fixed 800ms Task.Delay() to wait for a 150ms coalesce
window. Under heavy threadpool load (3074 parallel tests), the 150ms timer callback
can be delayed >800ms. When burst 2 starts while burst 1's timer hasn't fired yet,
_stateChangedPending is still 1. The CAS in NotifyStateChangedCoalesced returns 1,
skipping timer re-arm. Burst 2 is silently merged into burst 1 → only 1 notification
fires → Assert.InRange(fireCount, 2, 4) fails with fireCount=1.

Fix: Replace fixed Task.Delay() with TCS-based event-driven waiting. Each burst now
waits for the actual OnStateChanged event to fire (with 5s timeout), not a wall-clock
delay. This makes the test deterministic regardless of system load.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot.Tests/StateChangeCoalescerTests.cs  | 31 +++++++++++++------
 .../Services/CopilotService.Organization.cs   | 24 +++++++++-----
 2 files changed, 38 insertions(+), 17 deletions(-)

diff --git a/PolyPilot.Tests/StateChangeCoalescerTests.cs b/PolyPilot.Tests/StateChangeCoalescerTests.cs
index 5f41e44e54..336afd0895 100644
--- a/PolyPilot.Tests/StateChangeCoalescerTests.cs
+++ b/PolyPilot.Tests/StateChangeCoalescerTests.cs
@@ -70,22 +70,35 @@ public async Task SeparateBursts_FireSeparately()
     {
         var svc = CreateService();
         int fireCount = 0;
-        svc.OnStateChanged += () => Interlocked.Increment(ref fireCount);
 
-        // First burst
+        // First burst — wait via TCS so we don't depend on wall-clock timing.
+        // Under heavy parallel test load, fixed delays like 800ms can be shorter
+        // than the threadpool-delayed timer callback, causing the pending CAS flag
+        // to remain set when burst 2 starts — burst 2 then silently merges into burst 1
+        // and only one notification fires instead of two.
+        var tcs1 = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        svc.OnStateChanged += () =>
+        {
+            Interlocked.Increment(ref fireCount);
+            tcs1.TrySetResult();
+        };
+
         for (int i = 0; i < 10; i++)
             svc.NotifyStateChangedCoalesced();
-        // Wait well beyond the coalesce window (150ms) to ensure the timer fires,
-        // even under heavy CI/GC load. Previous 300ms was flaky under load.
-        await Task.Delay(800);
+        // Wait for first burst to actually fire (with generous 5s timeout)
+        await Task.WhenAny(tcs1.Task, Task.Delay(5000));
+        Assert.True(tcs1.Task.IsCompleted, "First burst should have fired within 5s");
 
-        // Second burst after timer has fired
+        // Second burst after first has fired
+        var tcs2 = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        svc.OnStateChanged += () => tcs2.TrySetResult();
         for (int i = 0; i < 10; i++)
             svc.NotifyStateChangedCoalesced();
-        await Task.Delay(800);
+        await Task.WhenAny(tcs2.Task, Task.Delay(5000));
+        Assert.True(tcs2.Task.IsCompleted, "Second burst should have fired within 5s");
 
-        // Each burst should produce ~1 notification
-        Assert.InRange(fireCount, 2, 4);
+        // Each burst produced at least one notification — total should be 2 or slightly more
+        Assert.InRange(fireCount, 2, 6);
     }
 
     [Fact]
diff --git a/PolyPilot/Services/CopilotService.Organization.cs b/PolyPilot/Services/CopilotService.Organization.cs
index 09701d4467..324d027413 100644
--- a/PolyPilot/Services/CopilotService.Organization.cs
+++ b/PolyPilot/Services/CopilotService.Organization.cs
@@ -428,8 +428,14 @@ public void SaveOrganization()
         InvalidateOrganizedSessionsCache();
         // Debounce: restart the timer. The callback marshals to the UI thread for
         // serialization since Organization contains non-thread-safe List<T> collections.
+        // Capture paths at schedule time so stale timer callbacks from old service instances
+        // (created when SetBaseDirForTesting redirects the static) always write to the
+        // directory that was current when SaveOrganization was called, not wherever the
+        // static points at fire time. Fixes cross-test timer contamination in tests.
+        var capturedOrgFile = OrganizationFile;
+        var capturedBaseDir = PolyPilotBaseDir;
         _saveOrgDebounce?.Dispose();
-        _saveOrgDebounce = new Timer(_ => InvokeOnUI(() => SaveOrganizationCore()), null, 2000, Timeout.Infinite);
+        _saveOrgDebounce = new Timer(_ => InvokeOnUI(() => SaveOrganizationCore(capturedOrgFile, capturedBaseDir)), null, 2000, Timeout.Infinite);
     }
 
     internal void FlushSaveOrganization()
@@ -439,7 +445,9 @@ internal void FlushSaveOrganization()
         SaveOrganizationCore();
     }
 
-    private void SaveOrganizationCore()
+    private void SaveOrganizationCore() => SaveOrganizationCore(OrganizationFile, PolyPilotBaseDir);
+
+    private void SaveOrganizationCore(string orgFile, string baseDir)
     {
         try
         {
@@ -457,7 +465,7 @@ private void SaveOrganizationCore()
                 };
             }
             var json = JsonSerializer.Serialize(snapshot, new JsonSerializerOptions { WriteIndented = true });
-            WriteOrgFile(json);
+            WriteOrgFile(json, orgFile, baseDir);
         }
         catch (Exception ex)
         {
@@ -467,18 +475,18 @@ private void SaveOrganizationCore()
         }
     }
 
-    private void WriteOrgFile(string json)
+    private void WriteOrgFile(string json, string orgFile, string baseDir)
     {
         try
         {
-            Directory.CreateDirectory(PolyPilotBaseDir);
+            Directory.CreateDirectory(baseDir);
             // Atomic write: write to temp file then rename to prevent corruption on crash
-            var tempFile = OrganizationFile + ".tmp";
+            var tempFile = orgFile + ".tmp";
             File.WriteAllText(tempFile, json);
-            File.Move(tempFile, OrganizationFile, overwrite: true);
+            File.Move(tempFile, orgFile, overwrite: true);
 
             // Verify the write actually persisted (guards against silent filesystem failures)
-            var fi = new FileInfo(OrganizationFile);
+            var fi = new FileInfo(orgFile);
             if (!fi.Exists || fi.Length == 0)
             {
                 Debug($"[SAVE-ERROR] organization file verification failed — file missing or empty after write");

From 1456f983dadc7bbd3a215243941666f5b4a81f40 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 15:18:03 -0500
Subject: [PATCH 20/21] fix: prevent model reset to Haiku after abort/reconnect
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two bugs caused sessions to silently switch from Opus to Haiku:

1. GetSessionModel fallback was availableModels[0] — which is Haiku
   (alphabetical sort). Changed to use session.Model as first priority
   (the user explicit choice) and CopilotService.DefaultModel as the
   ultimate fallback instead of alphabetical first.

2. SessionStartEvent handler unconditionally overwrote state.Info.Model
   with the CLI reported selectedModel. After abort/reconnect cycles,
   the CLI may report a default model (Haiku) that overrides the user
   choice. Now only updates if the user has not already set a model.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot/Components/Pages/Dashboard.razor  | 13 +++++++------
 PolyPilot/Services/CopilotService.Events.cs | 14 ++++++++++++--
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/PolyPilot/Components/Pages/Dashboard.razor b/PolyPilot/Components/Pages/Dashboard.razor
index e231404b39..96b1a531fe 100644
--- a/PolyPilot/Components/Pages/Dashboard.razor
+++ b/PolyPilot/Components/Pages/Dashboard.razor
@@ -3465,15 +3465,16 @@
 
     private string GetSessionModel(AgentSessionInfo session)
     {
-        // Priority: 1) Usage info (TRUTH) - what the backend is actually using
-        if (usageBySession.TryGetValue(session.Name, out var u) && !string.IsNullOrEmpty(u.Model))
-            return u.Model;
-
-        // Priority: 2) Session model property (initial configuration)
+        // Priority: 1) Session model property (user's explicit choice, persisted across restarts)
         if (!string.IsNullOrEmpty(session.Model) && session.Model != "resumed")
             return session.Model;
 
-        return availableModels[0];
+        // Priority: 2) Usage info - what the backend reported
+        if (usageBySession.TryGetValue(session.Name, out var u) && !string.IsNullOrEmpty(u.Model))
+            return u.Model;
+
+        // Fallback: default model (never alphabetical first which may be haiku)
+        return CopilotService.DefaultModel;
     }
 
     private string GetExpandedModel(AgentSessionInfo session)
diff --git a/PolyPilot/Services/CopilotService.Events.cs b/PolyPilot/Services/CopilotService.Events.cs
index 295684bb33..51c36c6ad1 100644
--- a/PolyPilot/Services/CopilotService.Events.cs
+++ b/PolyPilot/Services/CopilotService.Events.cs
@@ -710,8 +710,18 @@ await notifService.SendNotificationAsync(
                 if (!string.IsNullOrEmpty(startModel))
                 {
                     var normalizedStartModel = Models.ModelHelper.NormalizeToSlug(startModel);
-                    state.Info.Model = normalizedStartModel;
-                    Debug($"Session model from start event: {startModel} → {normalizedStartModel}");
+                    // Only update if the user hasn't already set a model — the CLI may
+                    // report a default model (e.g. haiku) after abort/resume that overrides
+                    // the user's explicit choice.
+                    if (string.IsNullOrEmpty(state.Info.Model) || state.Info.Model == "resumed")
+                    {
+                        state.Info.Model = normalizedStartModel;
+                        Debug($"Session model from start event: {startModel} → {normalizedStartModel}");
+                    }
+                    else if (normalizedStartModel != state.Info.Model)
+                    {
+                        Debug($"Session model from start event ignored: {startModel} → {normalizedStartModel} (keeping user choice: {state.Info.Model})");
+                    }
                 }
                 Invoke(() => { if (!IsRestoring) SaveActiveSessionsToDisk(); });
                 break;

From 2d97842b8f0d58af6a7eb13a167ef76ee781d937 Mon Sep 17 00:00:00 2001
From: Shane Neuville <shneuvil@microsoft.com>
Date: Wed, 1 Apr 2026 17:08:45 -0500
Subject: [PATCH 21/21] =?UTF-8?q?feat:=20natural-language=20@mention=20rou?=
 =?UTF-8?q?ting=20=E2=80=94=20interpret=20routing=20instructions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The user can now write messages like:
  'please tell @Session that the tests pass'  → forwards 'the tests pass'
  'can you forward to @Session: hello world'  → forwards 'hello world'
  'please send a message to @Session: hi'     → forwards 'hi'
  'please pass this info to @Session'         → forwards 'please pass this info to' (fallback)
  'check this out @Session'                   → forwards 'check this out' (unchanged, already worked)

Implementation:
- New RoutingHelper.cs (Models/) with ExtractForwardedContent() using two-pattern approach:
  - Pattern A: verb + optional fillers + explicit 'to' or ':' marker → strips routing wrapper
  - Pattern B: verb + 'that'/'saying' connector → strips routing wrapper
  - Fallback: if result < 3 chars, returns original prompt minus @tokens (never empty)
- Word boundaries on 'a'/'an' in filler group prevent matching 'a' in 'about'
- ConnectorRegex handles residual ': ' after 'to' stripping
- Dashboard.razor: RouteToMentionedSessions calls RoutingHelper.ExtractForwardedContent
  and no longer silently drops routes when strippedMessage is empty
- Also added ExtractForwardedContent XML docs summary in RouteToMentionedSessions

Tests (17 new in RoutingHelperTests.cs):
- Plain content passthrough (no change)
- 'please tell @Bob that X' → X
- 'can you forward to @Bob: X' → X
- 'could you tell @S that X' → X
- 'please send a message to @S: X' → X
- 'please ask @S saying X' → X
- Fallback cases (no content, keeps original routing message)
- Regression: 'forward slash commands' not treated as routing instruction
- Regression: 'ask me anything' not stripped

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 PolyPilot.Tests/PolyPilot.Tests.csproj     |   1 +
 PolyPilot.Tests/RoutingHelperTests.cs      | 179 +++++++++++++++++++++
 PolyPilot/Components/Pages/Dashboard.razor |  30 +++-
 PolyPilot/Models/RoutingHelper.cs          |  81 ++++++++++
 4 files changed, 286 insertions(+), 5 deletions(-)
 create mode 100644 PolyPilot.Tests/RoutingHelperTests.cs
 create mode 100644 PolyPilot/Models/RoutingHelper.cs

diff --git a/PolyPilot.Tests/PolyPilot.Tests.csproj b/PolyPilot.Tests/PolyPilot.Tests.csproj
index 052f81c420..0bda4e79b0 100644
--- a/PolyPilot.Tests/PolyPilot.Tests.csproj
+++ b/PolyPilot.Tests/PolyPilot.Tests.csproj
@@ -36,6 +36,7 @@
     <Compile Include="../PolyPilot/Models/SessionOrganization.cs" Link="Shared/SessionOrganization.cs" />
     <Compile Include="../PolyPilot/Models/FiestaModels.cs" Link="Shared/FiestaModels.cs" />
     <Compile Include="../PolyPilot/Models/ModelHelper.cs" Link="Shared/ModelHelper.cs" />
+    <Compile Include="../PolyPilot/Models/RoutingHelper.cs" Link="Shared/RoutingHelper.cs" />
     <Compile Include="../PolyPilot/Models/CommandHistory.cs" Link="Shared/CommandHistory.cs" />
     <Compile Include="../PolyPilot/Models/RepositoryInfo.cs" Link="Shared/RepositoryInfo.cs" />
     <Compile Include="../PolyPilot/Models/RenderThrottle.cs" Link="Shared/RenderThrottle.cs" />
diff --git a/PolyPilot.Tests/RoutingHelperTests.cs b/PolyPilot.Tests/RoutingHelperTests.cs
new file mode 100644
index 0000000000..4e890b6fc7
--- /dev/null
+++ b/PolyPilot.Tests/RoutingHelperTests.cs
@@ -0,0 +1,179 @@
+using PolyPilot.Models;
+
+namespace PolyPilot.Tests;
+
+/// <summary>
+/// Tests for RoutingHelper.ExtractForwardedContent — the natural-language routing
+/// extraction that enables "please tell @Session that X" → forwards "X" to @Session.
+/// </summary>
+public class RoutingHelperTests
+{
+    // ── Helper: call both args the same way we do in Dashboard.razor ─────────
+    private static string Extract(string strippedMessage, string originalPrompt)
+        => RoutingHelper.ExtractForwardedContent(strippedMessage, originalPrompt);
+
+    // ─────────────────────────────────────────────────────────────────────────
+    // Passthrough — messages that need no transformation
+    // ─────────────────────────────────────────────────────────────────────────
+
+    [Theory]
+    [InlineData("hello world", "hello world")]
+    [InlineData("please fix this bug", "please fix this bug")]
+    [InlineData("the tests are now passing", "the tests are now passing")]
+    public void PlainContent_ReturnsUnchanged(string stripped, string original)
+        => Assert.Equal(stripped, Extract(stripped, original));
+
+    // ─────────────────────────────────────────────────────────────────────────
+    // "please tell @Session that X" → X
+    // ─────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void PleaseTell_ThatContent_ExtractsContent()
+    {
+        // "please tell @Bob that the tests pass" after @-strip → "please tell that the tests pass"
+        var result = Extract("please tell that the tests pass", "please tell @Bob that the tests pass");
+        Assert.Equal("the tests pass", result);
+    }
+
+    [Fact]
+    public void PleaseForward_ColonContent_ExtractsContent()
+    {
+        // "please forward to @Bob: hello world" after @-strip → "please forward to : hello world"
+        // after colon-cleanup → "hello world"
+        var stripped = "please forward to : hello world";
+        var result = Extract(stripped, "please forward to @Bob: hello world");
+        Assert.Equal("hello world", result);
+    }
+
+    [Fact]
+    public void CanYouSend_ThatContent_ExtractsContent()
+    {
+        var stripped = "can you send that the meeting is at 3pm";
+        var result = Extract(stripped, "can you send @Bob that the meeting is at 3pm");
+        Assert.Equal("the meeting is at 3pm", result);
+    }
+
+    [Fact]
+    public void CouldYouTell_ThatContent_ExtractsContent()
+    {
+        var stripped = "could you tell that everything is working";
+        var result = Extract(stripped, "could you tell @Session that everything is working");
+        Assert.Equal("everything is working", result);
+    }
+
+    [Fact]
+    public void PleaseSend_MessageContent_ExtractsContent()
+    {
+        var stripped = "please send a message to : hello there";
+        var result = Extract(stripped, "please send a message to @Session: hello there");
+        Assert.Equal("hello there", result);
+    }
+
+    [Fact]
+    public void PleaseAsk_SayingContent_ExtractsContent()
+    {
+        var stripped = "please ask saying can you fix the bug";
+        var result = Extract(stripped, "please ask @Session saying can you fix the bug");
+        Assert.Equal("can you fix the bug", result);
+    }
+
+    // ─────────────────────────────────────────────────────────────────────────
+    // Fallback: empty content after stripping → return original minus @tokens
+    // ─────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void PleasePassThisInfoTo_NoContent_FallsBackToOriginal()
+    {
+        // After stripping @Session: "please pass this info to"
+        // No extractable content → fallback to original minus @mention
+        var stripped = "please pass this info to";
+        var original = "please pass this info to @Session";
+        var result = Extract(stripped, original);
+        // Fallback preserves the original routing instruction (target gets context)
+        Assert.Equal("please pass this info to", result);
+    }
+
+    [Fact]
+    public void PleaseForwardThis_NoContent_FallsBackToOriginal()
+    {
+        var stripped = "please forward this";
+        var original = "please forward this @Bob";
+        var result = Extract(stripped, original);
+        Assert.Equal("please forward this", result);
+    }
+
+    [Fact]
+    public void TellAbout_NoExplicitContent_FallsBackToOriginal()
+    {
+        // "tell @Session about it" → stripped: "tell about it"
+        // After routing prefix strip: "about it" → connector "about" strip → "it"
+        // "it" is too short (< 3 chars) → fallback to "tell about it"
+        var stripped = "tell about it";
+        var original = "tell @Session about it";
+        var result = Extract(stripped, original);
+        // "it" is only 2 chars so fallback fires → "tell about it"
+        Assert.Equal("tell about it", result);
+    }
+
+    // ─────────────────────────────────────────────────────────────────────────
+    // Message BEFORE the @mention — already handled by @-strip, no change needed
+    // ─────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void ContentBeforeMention_PassesThrough()
+    {
+        // "check this out @Session" → stripped: "check this out"
+        // No routing prefix → return as-is
+        var stripped = "check this out";
+        var result = Extract(stripped, "check this out @Session");
+        Assert.Equal("check this out", result);
+    }
+
+    [Fact]
+    public void HeyMention_Content_PassesThrough()
+    {
+        // "@Session please fix this bug" → stripped: "please fix this bug"
+        var stripped = "please fix this bug";
+        var result = Extract(stripped, "@Session please fix this bug");
+        Assert.Equal("please fix this bug", result);
+    }
+
+    // ─────────────────────────────────────────────────────────────────────────
+    // Regression: plain routing phrases don't eat normal sentences
+    // ─────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void MessageStartingWithForward_NotARoutingInstruction_IsKept()
+    {
+        // "forward slash commands are important" should NOT be stripped
+        // because "slash" doesn't match the routing prefix pattern
+        var stripped = "forward slash commands are important";
+        var result = Extract(stripped, "forward slash commands are important @Session");
+        // "forward slash" doesn't match (next word after "forward" isn't recognized)
+        // so stripped → "forward slash commands are important"
+        Assert.Equal("forward slash commands are important", result);
+    }
+
+    [Fact]
+    public void MessageStartingWithAsk_Question_IsKept()
+    {
+        // "ask me anything" after strip → "ask me anything" — "me" doesn't trigger routing
+        var stripped = "ask me anything";
+        var result = Extract(stripped, "ask me anything @Session");
+        // "ask me" doesn't match the routing suffix (no "to/:" after) so it passes through
+        // (or gets partially stripped but enough remains)
+        Assert.True(result.Length >= 3, $"Result should be non-trivial, got: '{result}'");
+    }
+
+    // ─────────────────────────────────────────────────────────────────────────
+    // Whitespace handling
+    // ─────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void ExtraWhitespace_IsCollapsed()
+    {
+        var stripped = "please  tell  that   hello   world";
+        var result = Extract(stripped, "please tell @Bob that   hello   world");
+        Assert.Equal("hello world", result);
+    }
+}
diff --git a/PolyPilot/Components/Pages/Dashboard.razor b/PolyPilot/Components/Pages/Dashboard.razor
index 96b1a531fe..4f732c2d4e 100644
--- a/PolyPilot/Components/Pages/Dashboard.razor
+++ b/PolyPilot/Components/Pages/Dashboard.razor
@@ -3412,8 +3412,11 @@
 
     /// <summary>
     /// Parses @Mention tokens from the prompt and matches them against active session names.
-    /// Returns a list of (targetSessionName, strippedMessage) for each matched session.
-    /// The strippedMessage has the leading @Token removed so the target session receives clean text.
+    /// Returns a list of (targetSessionName, forwardedMessage) for each matched session.
+    /// The forwardedMessage has routing-instruction wrappers removed so the target session
+    /// receives clean, natural content (e.g. "please tell @Bob that X" → forwards "X" to Bob).
+    /// Falls back to the full original prompt (minus @tokens) when no explicit content is found,
+    /// so the target always gets something useful.
     /// </summary>
     private List<(string TargetName, string StrippedMessage)> RouteToMentionedSessions(string sourceSessionName, string prompt)
     {
@@ -3447,19 +3450,36 @@
 
         if (matched.Count == 0) return result;
 
-        // Strip all matched @SessionName tokens from the forwarded message and collapse whitespace.
+        // Strip all matched @SessionName tokens from the message and collapse whitespace.
         var strippedMessage = atMentionRegex.Replace(prompt, m =>
             sessionLookup.ContainsKey(m.Groups[1].Value) ? "" : m.Value);
         strippedMessage = System.Text.RegularExpressions.Regex.Replace(strippedMessage, @"[ \t]{2,}", " ").Trim();
 
-        if (string.IsNullOrWhiteSpace(strippedMessage)) return result;
+        // Extract the actual content from natural-language routing instructions.
+        // e.g. "please tell @Bob that X" → "X"
+        //      "can you forward to @Bob: X" → "X"
+        //      "hey @Bob please do X" → "please do X"  (already correct after @-strip)
+        // Falls back to the full stripped message if no routing wrapper is found,
+        // and to the original prompt (without @tokens) if the message becomes empty.
+        var forwardedContent = RoutingHelper.ExtractForwardedContent(strippedMessage, prompt);
 
         foreach (var target in matched)
-            result.Add((target, strippedMessage));
+            result.Add((target, forwardedContent));
 
         return result;
     }
 
+    /// <summary>
+    /// Cleans routing-instruction wrappers from a message that has already had @mention tokens
+    /// stripped, extracting the actual content the user wants forwarded.
+    ///
+    /// Handles patterns like:
+    ///   "please tell that X"        → "X"
+    ///   "can you send this to: X"   → "X"
+    ///   "please pass this info to"  → (fallback to rawPromptNoMentions)
+    ///   "forward the following to"  → (fallback to rawPromptNoMentions)
+    ///   "X" (no routing wrapper)    → "X"  (unchanged)
+    /// </summary>
     private static string TruncateForDisplay(string text, int maxLength) =>
         text.Length <= maxLength ? text : text[..maxLength] + "…";
 
diff --git a/PolyPilot/Models/RoutingHelper.cs b/PolyPilot/Models/RoutingHelper.cs
new file mode 100644
index 0000000000..1dfc82fa72
--- /dev/null
+++ b/PolyPilot/Models/RoutingHelper.cs
@@ -0,0 +1,81 @@
+using System.Text.RegularExpressions;
+
+namespace PolyPilot.Models;
+
+/// <summary>
+/// Helpers for natural-language cross-session @mention routing.
+/// </summary>
+public static class RoutingHelper
+{
+    private static readonly Regex AtMentionRegex = new(@"(?<!\S)@[\w.\-]+", RegexOptions.Compiled);
+    private static readonly Regex CollapseWhitespace = new(@"\s{2,}", RegexOptions.Compiled);
+
+    // Pattern A — verb + optional filler/noun + explicit "to" or ":" marker.
+    // Requires "to" or ":" at end to avoid false positives (e.g. "forward slash commands").
+    // Word boundaries on "a" and "an" prevent "a" from matching the first char of "about".
+    // Examples: "please forward to :", "send a message to", "please pass this info to"
+    private static readonly Regex RoutingToColonRegex = new(
+        @"^(?:(?:please|can\s+you|could\s+you|would\s+you)\s+)?(?:tell|send|forward|pass(?:\s+(?:along|on))?|relay|share|ask|message|route|give)(?:\s+(?:this|the|a\b|an\b|some|any|them|him|her|along|on))*\s*(?:info(?:rmation)?|message|note|update|news|details|content|context|following)?\s*(?:to\s*|:\s*)",
+        RegexOptions.IgnoreCase | RegexOptions.Compiled);
+
+    // Pattern B — verb directly followed by explicit "that" or "saying" connector.
+    // Examples: "please tell that X", "send saying X"
+    private static readonly Regex RoutingThatSayingRegex = new(
+        @"^(?:(?:please|can\s+you|could\s+you|would\s+you)\s+)?(?:tell|send|forward|pass|relay|share|ask|message|route|give)\s+(?:that|saying)\s+",
+        RegexOptions.IgnoreCase | RegexOptions.Compiled);
+
+    // Strips residual connectors after "to" or ":" stripping: "that ...", "saying ...", ": ..."
+    private static readonly Regex ConnectorRegex = new(
+        @"^(?:that|saying|:)\s*",
+        RegexOptions.IgnoreCase | RegexOptions.Compiled);
+
+    /// <summary>
+    /// Given a message that has already had @mention tokens stripped (strippedMessage),
+    /// extracts the actual content the user wants forwarded by removing routing-instruction
+    /// wrappers. Falls back to the full original prompt (minus @tokens) if stripping leaves
+    /// nothing substantive, so the target session always receives useful context.
+    ///
+    /// Examples:
+    ///   "please tell that the tests pass"      -> "the tests pass"
+    ///   "can you forward to : hello world"     -> "hello world"
+    ///   "please send a message to : hi"        -> "hi"
+    ///   "please pass this info to"             -> "please pass this info to"  (fallback)
+    ///   "forward slash commands are important" -> "forward slash commands are important"
+    ///   "hello world"                          -> "hello world"  (unchanged)
+    /// </summary>
+    public static string ExtractForwardedContent(string strippedMessage, string originalPrompt)
+    {
+        var s = strippedMessage.Trim();
+
+        // Try Pattern A: verb + ... + explicit "to" or ":"
+        var matchA = RoutingToColonRegex.Match(s);
+        if (matchA.Success && matchA.Length > 0)
+        {
+            s = s[matchA.Length..].Trim();
+            // Strip any residual ": " or "that/saying " left after the "to" marker
+            s = ConnectorRegex.Replace(s, "").Trim();
+        }
+        else
+        {
+            // Try Pattern B: verb + "that/saying"
+            var matchB = RoutingThatSayingRegex.Match(s);
+            if (matchB.Success && matchB.Length > 0)
+                s = s[matchB.Length..].Trim();
+        }
+
+        // Collapse whitespace
+        s = CollapseWhitespace.Replace(s, " ").Trim();
+
+        // Fallback: if stripping left nothing substantive (< 3 chars), return the original
+        // prompt with @tokens removed so the target still gets the full routing instruction
+        // as context (e.g. "please pass this info to @Session" -> "please pass this info to")
+        if (s.Length < 3)
+        {
+            var fallback = AtMentionRegex.Replace(originalPrompt, "").Trim();
+            fallback = CollapseWhitespace.Replace(fallback, " ").Trim();
+            return string.IsNullOrWhiteSpace(fallback) ? strippedMessage : fallback;
+        }
+
+        return s;
+    }
+}