Fix resumed copy truncation

Cargo.lock

@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "dosh"
-version = "1.0.0-rc7"
+version = "1.0.0-rc10"
 dependencies = [
  "anyhow",
  "base64",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dosh"
-version = "1.0.0-rc7"
+version = "1.0.0-rc10"
 edition = "2024"
 license = "MIT"
 

src/bin/dosh-client.rs

@@ -2498,11 +2498,15 @@ fn download_file(
         0
     };
     let mut file = if offset > 0 {
-        fs::OpenOptions::new()
+        let file = fs::OpenOptions::new()
             .read(true)
+            .write(true)
             .append(true)
             .open(local)
-            .with_context(|| format!("open {}", local.display()))?
+            .with_context(|| format!("open {}", local.display()))?;
+        file.set_len(offset)
+            .with_context(|| format!("truncate {}", local.display()))?;
+        file
     } else {
         fs::OpenOptions::new()
             .create(true)
@@ -6296,6 +6300,60 @@ const FLAG_TRIGGER_LOW_MS: f64 = 50.0;
 /// (covers a sudden latency spike on the very first slow keystroke).
 const GLITCH_FORCE_MS: u128 = 250;
 
+/// Enough recent bytes to join a CSI private-mode sequence split across frames
+/// without retaining arbitrary terminal output.
+const TERMINAL_OUTPUT_PARSE_TAIL: usize = 64;
+
+fn alternate_screen_after_output(mut active: bool, bytes: &[u8]) -> bool {
+    let mut offset = 0usize;
+    while offset < bytes.len() {
+        let Some((next, transition)) = terminal_private_mode_transition(bytes, offset) else {
+            offset += 1;
+            continue;
+        };
+        if let Some(enable) = transition {
+            active = enable;
+        }
+        offset = next.max(offset + 1);
+    }
+    active
+}
+
+fn terminal_private_mode_transition(bytes: &[u8], offset: usize) -> Option<(usize, Option<bool>)> {
+    let mut cursor = offset;
+    match bytes.get(cursor).copied()? {
+        0x1b if bytes.get(cursor + 1) == Some(&b'[') => cursor += 2,
+        0x9b => cursor += 1,
+        _ => return None,
+    }
+
+    if bytes.get(cursor) != Some(&b'?') {
+        return None;
+    }
+    cursor += 1;
+
+    let params_start = cursor;
+    while let Some(byte) = bytes.get(cursor).copied() {
+        match byte {
+            b'0'..=b'9' | b';' | b':' => cursor += 1,
+            b'h' | b'l' => {
+                let params = &bytes[params_start..cursor];
+                let touches_alt = terminal_private_params_include_alt_screen(params);
+                return Some((cursor + 1, touches_alt.then_some(byte == b'h')));
+            }
+            0x40..=0x7e => return Some((cursor + 1, None)),
+            _ => return None,
+        }
+    }
+    None
+}
+
+fn terminal_private_params_include_alt_screen(params: &[u8]) -> bool {
+    params
+        .split(|byte| matches!(byte, b';' | b':'))
+        .any(|param| matches!(param, b"47" | b"1047" | b"1049"))
+}
+
 /// One speculatively-echoed character on the current line.
 #[derive(Clone, Debug)]
 struct PredictedCell {
@@ -6313,6 +6371,9 @@ struct Predictor {
     /// as vim/htop); we never speculate there because we cannot model arbitrary
     /// cursor addressing safely.
     alternate_screen: bool,
+    /// Tail of recent terminal output, retained so alternate-screen transitions
+    /// split across UDP frames are still detected.
+    output_parse_tail: Vec<u8>,
 
     /// Predicted cells for the current line, left-to-right starting at the
     /// column where the cursor sat when this run of predictions began.
@@ -6359,6 +6420,7 @@ impl Predictor {
             mode,
             enabled: enabled && mode != PredictMode::Off,
             alternate_screen: false,
+            output_parse_tail: Vec::new(),
             cells: Vec::new(),
             cursor: 0,
             epoch: 1,
@@ -6381,6 +6443,7 @@ impl Predictor {
         self.epoch += 1;
         self.confirmed_epoch = self.epoch - 1;
         self.alternate_screen = false;
+        self.output_parse_tail.clear();
         self.oldest_pending_at = None;
     }
 
@@ -6537,20 +6600,20 @@ impl Predictor {
     /// and confirms outstanding predictions: a fresh frame means the server has
     /// re-rendered the line, so our speculative glyphs are superseded and erased.
     fn observe_output(&mut self, bytes: &[u8]) {
-        if contains_bytes(bytes, b"\x1b[?1049h")
-            || contains_bytes(bytes, b"\x1b[?1047h")
-            || contains_bytes(bytes, b"\x1b[?47h")
-        {
-            self.alternate_screen = true;
-            let _ = self.discard_all();
-        }
-        if contains_bytes(bytes, b"\x1b[?1049l")
-            || contains_bytes(bytes, b"\x1b[?1047l")
-            || contains_bytes(bytes, b"\x1b[?47l")
-        {
-            self.alternate_screen = false;
+        let mut parse = Vec::with_capacity(self.output_parse_tail.len() + bytes.len());
+        parse.extend_from_slice(&self.output_parse_tail);
+        parse.extend_from_slice(bytes);
+
+        let before = self.alternate_screen;
+        self.alternate_screen = alternate_screen_after_output(self.alternate_screen, &parse);
+        if self.alternate_screen != before {
             let _ = self.discard_all();
         }
+
+        self.output_parse_tail.clear();
+        let keep = parse.len().min(TERMINAL_OUTPUT_PARSE_TAIL);
+        self.output_parse_tail
+            .extend_from_slice(&parse[parse.len().saturating_sub(keep)..]);
     }
 
     /// Sample SRTT from a newly arrived frame and confirm/clear outstanding
@@ -7344,10 +7407,13 @@ const TERMINAL_CLEANUP: &[u8] = concat!(
     "\x1b[?1002l",
     "\x1b[?1001l",
     "\x1b[?1000l",
+    "\x1b[?1004l",
     "\x1b[?1015l",
     "\x1b[?1006l",
     "\x1b[?1005l",
     "\x1b[?2004l",
+    "\x1b[?47l",
+    "\x1b[?1047l",
     "\x1b[?1049l"
 )
 .as_bytes();
@@ -7372,8 +7438,9 @@ mod tests {
         should_hold_during_startup_gate, should_hold_post_submit_input,
         should_repaint_idle_alternate_screen, split_after_command_submit, ssh_destination_host,
         ssh_username, ssh_with_user, startup_command, status_ssh_target, strip_stale_mouse_reports,
-        strip_terminal_focus_reports, toml_bare_key_or_quoted, update_check_requested,
-        update_version_status, upsert_managed_block, valid_forward_host, vscode_safe_alias,
+        strip_terminal_focus_reports, terminal_private_mode_transition, toml_bare_key_or_quoted,
+        update_check_requested, update_version_status, upsert_managed_block, valid_forward_host,
+        vscode_safe_alias,
     };
     use dosh::config::{ClientConfig, CommandExtension, HostConfig};
     use dosh::native::EnvVar;
@@ -7892,6 +7959,61 @@ mod tests {
         assert!(!predictor.alternate_screen);
     }
 
+    #[test]
+    fn predictor_tracks_legacy_and_combined_alternate_screen_modes() {
+        let mut predictor = Predictor::new(true);
+
+        predictor.observe_output(b"\x1b[?1000;1006;1049h");
+        assert!(predictor.alternate_screen);
+
+        predictor.observe_output(b"\x1b[?1006;1000l");
+        assert!(
+            predictor.alternate_screen,
+            "leaving mouse modes must not imply leaving alternate screen"
+        );
+
+        predictor.observe_output(b"\x1b[?1047l");
+        assert!(!predictor.alternate_screen);
+
+        predictor.observe_output(b"\x1b[?47h");
+        assert!(predictor.alternate_screen);
+        predictor.observe_output(b"\x1b[?47l");
+        assert!(!predictor.alternate_screen);
+    }
+
+    #[test]
+    fn predictor_tracks_alternate_screen_split_across_frames() {
+        let mut predictor = Predictor::new(true);
+
+        predictor.observe_output(b"\x1b");
+        assert!(!predictor.alternate_screen);
+        predictor.observe_output(b"[?");
+        assert!(!predictor.alternate_screen);
+        predictor.observe_output(b"10");
+        assert!(!predictor.alternate_screen);
+        predictor.observe_output(b"49h");
+        assert!(predictor.alternate_screen);
+
+        predictor.observe_output(b"\x1b");
+        assert!(predictor.alternate_screen);
+        predictor.observe_output(b"[?104");
+        assert!(predictor.alternate_screen);
+        predictor.observe_output(b"9l");
+        assert!(!predictor.alternate_screen);
+    }
+
+    #[test]
+    fn private_mode_parser_ignores_non_alt_modes() {
+        assert_eq!(
+            terminal_private_mode_transition(b"\x1b[?1000;1006h", 0),
+            Some((13, None))
+        );
+        assert_eq!(
+            terminal_private_mode_transition(b"\x1b[?1000;1049h", 0),
+            Some((13, Some(true)))
+        );
+    }
+
     /// Typing printable characters builds an in-order predicted line and the
     /// local cursor tracks the end of it.
     #[test]

src/bin/dosh-server.rs

@@ -52,6 +52,7 @@ const STREAM_INITIAL_WINDOW: usize = 1024 * 1024;
 /// have accumulated since the last mirror. Keeps the atomic write off the
 /// per-packet hot path while bounding how much fresh output a crash can lose.
 const SCREEN_PERSIST_BYTES: usize = 4096;
+const IMPLICIT_EMPTY_SESSION_GRACE_SECS: u64 = 300;
 
 /// Sentinel `target_host` sent to the client on a server-initiated `StreamOpen`
 /// that carries an SSH-agent connection (the client splices it into its local
@@ -512,15 +513,16 @@ impl ServerState {
         Ok(())
     }
 
-    /// Whether a session named `name` should be backed by a persistent holder.
+    /// Whether a session should be backed by a persistent holder.
     ///
-    /// With persistence enabled, explicitly named sessions get a detached
-    /// holder. Implicit `term-<millis>-<pid>` sessions are one-off terminals
-    /// created by `dosh host`; users cannot intentionally reattach to them by
-    /// name, so persisting them only leaves stale holders that can be
-    /// accidentally re-adopted after restarts.
-    fn should_persist_session(&self, name: &str) -> bool {
-        self.config.persist_sessions && !protocol::is_implicit_session_name(name)
+    /// With persistence enabled, every interactive session gets a detached holder
+    /// so an update/restart of `dosh-server` behaves like a transient network
+    /// break. Named sessions can sit empty for the normal client timeout.
+    /// Generated one-off sessions are also persisted, but cleanup gives them a
+    /// shorter empty grace period so invisible abandoned holders do not linger
+    /// indefinitely.
+    fn should_persist_session(&self, _name: &str) -> bool {
+        self.config.persist_sessions
     }
 
     /// Spawn (or, in the persistent case, spawn-and-adopt) a PTY for a session.
@@ -608,20 +610,6 @@ impl ServerState {
             if self.sessions.contains_key(&name) {
                 continue;
             }
-            if !self.should_persist_session(&name) {
-                eprintln!(
-                    "discarding stale implicit persistent session {name} (shell pid {})",
-                    meta.shell_pid
-                );
-                persist::request_shutdown(&sessions_dir, &name, None);
-                if meta.shell_pid > 0 {
-                    let _ = unsafe { libc::kill(meta.shell_pid, libc::SIGHUP) };
-                    let _ = unsafe { libc::kill(meta.shell_pid, libc::SIGTERM) };
-                    std::thread::sleep(Duration::from_millis(50));
-                    let _ = unsafe { libc::kill(meta.shell_pid, libc::SIGKILL) };
-                }
-                continue;
-            }
             let (pty, control) = match self.adopt_persistent_pty(&name) {
                 Ok(pair) => pair,
                 Err(err) => {
@@ -671,6 +659,7 @@ impl ServerState {
     fn insert_client(&mut self, session_name: &str, client_id: [u8; 16], client: ClientState) {
         if let Some(session) = self.sessions.get_mut(session_name) {
             session.clients.insert(client_id, client);
+            session.empty_since = None;
             self.client_index
                 .insert(client_id, session_name.to_string());
         }
@@ -2678,10 +2667,13 @@ async fn handle_file_request(
             let (file, temp_path, written, atomic) = if resume && final_path.exists() {
                 let mut file = fs::OpenOptions::new()
                     .read(true)
+                    .write(true)
                     .append(true)
                     .open(&final_path)
                     .with_context(|| format!("open {}", final_path.display()))?;
                 let written = file.metadata()?.len().min(size);
+                file.set_len(written)
+                    .with_context(|| format!("truncate {}", final_path.display()))?;
                 if written > 0 {
                     let mut prefix = fs::File::open(&final_path)?;
                     hash_exact_prefix(&mut prefix, written, &mut hasher)?;
@@ -3842,9 +3834,9 @@ fn cleanup_disconnected_clients(state: &Arc<Mutex<ServerState>>) {
             .iter()
             .filter(|(name, session)| {
                 !prewarm.contains(name.as_str())
-                    && session
-                        .empty_since
-                        .is_some_and(|since| now.duration_since(since) >= timeout)
+                    && session.empty_since.is_some_and(|since| {
+                        now.duration_since(since) >= empty_session_timeout(name, timeout)
+                    })
             })
             .map(|(name, _)| name.clone())
             .collect();
@@ -3863,6 +3855,14 @@ fn cleanup_disconnected_clients(state: &Arc<Mutex<ServerState>>) {
     }
 }
 
+fn empty_session_timeout(name: &str, configured_timeout: Duration) -> Duration {
+    if protocol::is_implicit_session_name(name) {
+        configured_timeout.min(Duration::from_secs(IMPLICIT_EMPTY_SESSION_GRACE_SECS))
+    } else {
+        configured_timeout
+    }
+}
+
 /// Select the client key (current or retained previous epoch) matching the
 /// packet header's `session_key_id`, so a packet sealed under the pre-rekey key
 /// during the grace window still decrypts while an expired/stale epoch is
@@ -3909,7 +3909,7 @@ mod tests {
     use super::*;
 
     #[test]
-    fn persists_named_sessions_when_enabled() {
+    fn persists_terminal_sessions_when_enabled() {
         let (pty_tx, _rx) = mpsc::unbounded_channel();
         let config = ServerConfig {
             persist_sessions: true,
@@ -3919,7 +3919,7 @@ mod tests {
         let state = ServerState::new(config, [0u8; 32], pty_tx);
         assert!(state.should_persist_session("default")); // prewarmed
         assert!(state.should_persist_session("work")); // explicitly named
-        assert!(!state.should_persist_session("term-1781470634216-76685")); // one-off terminal
+        assert!(state.should_persist_session("term-1781470634216-76685")); // one-off update-survivable terminal
     }
 
     #[test]
@@ -4074,6 +4074,12 @@ mod tests {
             Some((key, "work".to_string()))
         );
         assert!(state.client_mut(&client_id).is_some());
+        state.sessions.get_mut("work").unwrap().empty_since = Some(Instant::now());
+        state.insert_client("work", [7u8; 16], test_client_state([9u8; 32]));
+        assert!(
+            state.sessions["work"].empty_since.is_none(),
+            "reattach must clear empty-since so cleanup cannot reap a live session"
+        );
 
         // Removing purges both the session map and the index.
         assert!(state.remove_client_everywhere(&client_id));
@@ -4113,6 +4119,26 @@ mod tests {
         assert!(locked.lookup_client(&client_id).is_none());
     }
 
+    #[test]
+    fn implicit_empty_session_timeout_is_bounded_for_update_reconnect() {
+        let configured = Duration::from_secs(2_592_000);
+        let implicit = protocol::generate_implicit_session_name();
+        assert_eq!(
+            empty_session_timeout(&implicit, configured),
+            Duration::from_secs(IMPLICIT_EMPTY_SESSION_GRACE_SECS)
+        );
+        assert_eq!(
+            empty_session_timeout("work", configured),
+            configured,
+            "named sessions keep the normal long timeout"
+        );
+        assert_eq!(
+            empty_session_timeout(&implicit, Duration::from_secs(1)),
+            Duration::from_secs(1),
+            "tests/admins can still configure a shorter timeout"
+        );
+    }
+
     #[tokio::test]
     async fn forged_plaintext_detach_does_not_remove_client() {
         let (pty_tx, _pty_rx) = mpsc::unbounded_channel();

tests/integration_smoke.rs

@@ -18,7 +18,8 @@ use dosh::crypto;
 use dosh::native::{host_public_key, load_or_create_host_key, ssh_ed25519_public_blob, trust_host};
 use dosh::protocol::{
     self, AttachOk, AttachReject, BootstrapAttachRequest, CLIENT_TO_SERVER, Frame, Input,
-    PacketKind, Resize, ResumeRequest, SERVER_TO_CLIENT,
+    PacketKind, Resize, ResumeRequest, SERVER_TO_CLIENT, TicketAttachBody, TicketAttachEnvelope,
+    TicketAttachOkEnvelope,
 };
 use ed25519_dalek::{Signer, SigningKey, VerifyingKey};
 
@@ -530,6 +531,75 @@ fn direct_attach_session(
     (socket, bootstrap, ok)
 }
 
+fn ticket_attach_session(
+    socket: &UdpSocket,
+    port: u16,
+    bootstrap: &dosh::auth::BootstrapResponse,
+    session: &str,
+    mode: &str,
+) -> AttachOk {
+    let client_nonce = crypto::random_12();
+    let request_key = crypto::hkdf32(
+        &bootstrap.attach_ticket_psk,
+        &client_nonce,
+        b"dosh/ticket-attach-request/v1",
+    )
+    .unwrap();
+    let body = protocol::to_body(&TicketAttachBody {
+        session: session.to_string(),
+        mode: mode.to_string(),
+        cols: 80,
+        rows: 24,
+        requested_env: Vec::new(),
+    })
+    .unwrap();
+    let ciphertext = crypto::seal(
+        &request_key,
+        &client_nonce,
+        b"dosh-ticket-attach-request-v1",
+        &body,
+    )
+    .unwrap();
+    let envelope = TicketAttachEnvelope {
+        ticket: bootstrap.attach_ticket.clone(),
+        client_nonce,
+        ciphertext,
+    };
+    let packet = protocol::encode_plain(
+        PacketKind::TicketAttachRequest,
+        [0u8; 16],
+        1,
+        0,
+        &protocol::to_body(&envelope).unwrap(),
+    )
+    .unwrap();
+    socket
+        .send_to(&packet, format!("127.0.0.1:{port}"))
+        .unwrap();
+    let mut buf = [0u8; 65535];
+    let (n, _) = socket.recv_from(&mut buf).unwrap();
+    let packet = protocol::decode(&buf[..n]).unwrap();
+    assert_eq!(packet.header.kind, PacketKind::AttachOk);
+    let envelope: TicketAttachOkEnvelope = protocol::from_body(&packet.body).unwrap();
+    let mut salt = Vec::with_capacity(24);
+    salt.extend_from_slice(&client_nonce);
+    salt.extend_from_slice(&envelope.server_nonce);
+    let response_key = crypto::hkdf32(
+        &bootstrap.attach_ticket_psk,
+        &salt,
+        b"dosh/ticket-attach-ok/v1",
+    )
+    .unwrap();
+    let plain = crypto::open(
+        &response_key,
+        &envelope.server_nonce,
+        b"dosh-ticket-attach-ok-v1",
+        &envelope.ciphertext,
+    )
+    .unwrap();
+    protocol::from_body(&plain).unwrap()
+}
+
 #[allow(clippy::too_many_arguments)]
 fn send_encrypted(
     socket: &UdpSocket,
@@ -1038,6 +1108,117 @@ fn native_file_copy_recursive_round_trip() {
     let _ = server.wait();
 }
 
+#[test]
+fn native_file_copy_resume_truncates_oversized_destinations() {
+    let dir = tempfile::tempdir().unwrap();
+    let port = free_udp_port();
+    let config = write_server_config(&dir, port);
+    write_native_client_auth(&dir, &config);
+    let mut server = start_server(&dir, &config);
+    let client_bin = env!("CARGO_BIN_EXE_dosh-client");
+
+    let local_short = dir.path().join("short.txt");
+    fs::write(&local_short, b"short\n").unwrap();
+
+    let seed_remote = Command::new(client_bin)
+        .arg("--dosh-host")
+        .arg("127.0.0.1")
+        .arg("--dosh-port")
+        .arg(port.to_string())
+        .arg("exec")
+        .arg("local")
+        .arg("printf 'short\\nSTALE' > \"$HOME/resume-upload.txt\"")
+        .env("HOME", dir.path())
+        .output()
+        .unwrap();
+    assert!(
+        seed_remote.status.success(),
+        "seed remote failed: stdout={} stderr={}",
+        String::from_utf8_lossy(&seed_remote.stdout),
+        String::from_utf8_lossy(&seed_remote.stderr)
+    );
+
+    let resume_upload = Command::new(client_bin)
+        .arg("--dosh-host")
+        .arg("127.0.0.1")
+        .arg("--dosh-port")
+        .arg(port.to_string())
+        .arg("cp")
+        .arg("--resume")
+        .arg(&local_short)
+        .arg("local:resume-upload.txt")
+        .env("HOME", dir.path())
+        .output()
+        .unwrap();
+    assert!(
+        resume_upload.status.success(),
+        "resume upload failed: stdout={} stderr={}",
+        String::from_utf8_lossy(&resume_upload.stdout),
+        String::from_utf8_lossy(&resume_upload.stderr)
+    );
+
+    let cat_upload = Command::new(client_bin)
+        .arg("--dosh-host")
+        .arg("127.0.0.1")
+        .arg("--dosh-port")
+        .arg(port.to_string())
+        .arg("cat")
+        .arg("local:resume-upload.txt")
+        .env("HOME", dir.path())
+        .output()
+        .unwrap();
+    assert!(
+        cat_upload.status.success(),
+        "cat upload failed: stdout={} stderr={}",
+        String::from_utf8_lossy(&cat_upload.stdout),
+        String::from_utf8_lossy(&cat_upload.stderr)
+    );
+    assert_eq!(String::from_utf8_lossy(&cat_upload.stdout), "short\n");
+
+    let seed_download = Command::new(client_bin)
+        .arg("--dosh-host")
+        .arg("127.0.0.1")
+        .arg("--dosh-port")
+        .arg(port.to_string())
+        .arg("exec")
+        .arg("local")
+        .arg("printf 'tiny\\n' > \"$HOME/resume-download.txt\"")
+        .env("HOME", dir.path())
+        .output()
+        .unwrap();
+    assert!(
+        seed_download.status.success(),
+        "seed download failed: stdout={} stderr={}",
+        String::from_utf8_lossy(&seed_download.stdout),
+        String::from_utf8_lossy(&seed_download.stderr)
+    );
+
+    let local_download = dir.path().join("resume-download-local.txt");
+    fs::write(&local_download, b"tiny\nSTALE").unwrap();
+    let resume_download = Command::new(client_bin)
+        .arg("--dosh-host")
+        .arg("127.0.0.1")
+        .arg("--dosh-port")
+        .arg(port.to_string())
+        .arg("cp")
+        .arg("--resume")
+        .arg("local:resume-download.txt")
+        .arg(&local_download)
+        .env("HOME", dir.path())
+        .output()
+        .unwrap();
+    assert!(
+        resume_download.status.success(),
+        "resume download failed: stdout={} stderr={}",
+        String::from_utf8_lossy(&resume_download.stdout),
+        String::from_utf8_lossy(&resume_download.stderr)
+    );
+    assert_eq!(fs::read_to_string(&local_download).unwrap(), "tiny\n");
+
+    let _ = server.kill();
+    let _ = server.wait();
+}
+
 #[test]
 fn native_exec_command_smoke() {
     let dir = tempfile::tempdir().unwrap();
@@ -2733,7 +2914,7 @@ fn session_survives_server_restart_same_shell_and_screen() {
 }
 
 #[test]
-fn implicit_session_does_not_create_restart_holder() {
+fn implicit_session_survives_update_restart_via_ticket_reattach() {
     let dir = tempfile::tempdir().unwrap();
     let sessions_dir = dir.path().join("sessions");
     let port = free_udp_port();
@@ -2743,21 +2924,34 @@ fn implicit_session_does_not_create_restart_holder() {
     let mut server = start_server(&dir, &config);
     let (socket, bootstrap, ok) = direct_attach_session(&config, port, "read-write", &session);
     let key = bootstrap.session_key;
+    type_line(&socket, port, &ok, &key, 2, "cd /tmp\n");
     type_line(
         &socket,
         port,
         &ok,
         &key,
-        2,
+        3,
         "export IMPLICIT_MARK=implicit_restart_42\n",
     );
-    let _ = collect_frame_text(&socket, &key, 1000);
+    type_line(
+        &socket,
+        port,
+        &ok,
+        &key,
+        4,
+        "printf 'IMPLICIT_SCREEN_MARKER\\n'\n",
+    );
+    let pre = collect_frame_text(&socket, &key, 1500);
+    assert!(
+        pre.contains("IMPLICIT_SCREEN_MARKER"),
+        "implicit marker missing before restart: {pre:?}"
+    );
     thread::sleep(Duration::from_secs(3));
 
     let shell_pid_before = holder_shell_pid(&sessions_dir, &session);
     assert!(
-        shell_pid_before.is_none(),
-        "implicit sessions must not get persistent holders when persistence is enabled"
+        shell_pid_before.is_some(),
+        "implicit sessions must get temporary holders so active clients survive updates"
     );
 
     let _ = server.kill();
@@ -2765,34 +2959,78 @@ fn implicit_session_does_not_create_restart_holder() {
     thread::sleep(Duration::from_millis(300));
 
     let mut server = start_server(&dir, &config);
-    let (socket2, bootstrap2, ok2) = direct_attach_session(&config, port, "read-write", &session);
-    let key2 = bootstrap2.session_key;
+
+    let resume = ResumeRequest {
+        session: session.clone(),
+        last_rendered_seq: ok.initial_seq,
+        cols: 80,
+        rows: 24,
+    };
+    send_encrypted(
+        &socket,
+        port,
+        PacketKind::ResumeRequest,
+        ok.client_id,
+        5,
+        0,
+        &key,
+        &protocol::to_body(&resume).unwrap(),
+    );
+    let mut buf = [0u8; 65535];
+    let deadline = std::time::Instant::now() + Duration::from_secs(2);
+    loop {
+        assert!(
+            std::time::Instant::now() < deadline,
+            "old live resume did not receive unknown-client reject"
+        );
+        let (n, _) = socket.recv_from(&mut buf).unwrap();
+        let packet = protocol::decode(&buf[..n]).unwrap();
+        if packet.header.kind == PacketKind::Frame {
+            continue;
+        }
+        assert_eq!(packet.header.kind, PacketKind::AttachReject);
+        assert_eq!(packet.header.conn_id, ok.client_id);
+        break;
+    }
+
+    let ok2 = ticket_attach_session(&socket, port, &bootstrap, &session, "read-write");
+    let key2 = ok2.session_key;
+    let snapshot = String::from_utf8_lossy(&ok2.snapshot).to_string();
     type_line(
-        &socket2,
+        &socket,
         port,
         &ok2,
         &key2,
         2,
-        "printf 'IMPLICIT_MARK=%s\\n' \"$IMPLICIT_MARK\"\n",
+        "printf 'IMPLICIT_MARK=%s PWD=%s\\n' \"$IMPLICIT_MARK\" \"$PWD\"\n",
     );
-    let post = collect_frame_text(&socket2, &key2, 2000);
+    let post = collect_frame_text(&socket, &key2, 2000);
     let shell_pid_after = holder_shell_pid(&sessions_dir, &session);
 
     let _ = server.kill();
     let _ = server.wait();
+    kill_holder(&sessions_dir, &session);
 
     assert!(
-        shell_pid_after.is_none(),
-        "implicit restart attach must stay ephemeral"
+        snapshot.contains("IMPLICIT_SCREEN_MARKER"),
+        "ticket reattach snapshot must repaint the exact pre-update screen, got {snapshot:?}"
+    );
+    assert_eq!(
+        shell_pid_after, shell_pid_before,
+        "implicit update reconnect must use the same holder shell"
     );
     assert!(
-        post.contains("IMPLICIT_MARK=") && !post.contains("implicit_restart_42"),
-        "implicit session must start fresh after server restart, got {post:?}"
+        post.contains("IMPLICIT_MARK=implicit_restart_42"),
+        "implicit session env must survive update reconnect, got {post:?}"
+    );
+    assert!(
+        post.contains("PWD=/tmp"),
+        "implicit session cwd must survive update reconnect, got {post:?}"
     );
 }
 
 #[test]
-fn startup_discards_legacy_implicit_holders() {
+fn startup_readopts_implicit_holders_for_update_reconnect() {
     let dir = tempfile::tempdir().unwrap();
     let sessions_dir = dir.path().join("sessions");
     let port = free_udp_port();
@@ -2812,13 +3050,14 @@ fn startup_discards_legacy_implicit_holders() {
     let _ = server.kill();
     let _ = server.wait();
     assert!(
-        holder_shell_pid(&sessions_dir, &session).is_none(),
-        "startup must remove old implicit holder metadata"
+        holder_shell_pid(&sessions_dir, &session).is_some(),
+        "startup must keep live implicit holders so active update reconnects can reattach"
     );
     assert!(
-        unsafe { libc::kill(shell_pid, 0) } != 0,
-        "startup must shut down old implicit holder shell"
+        unsafe { libc::kill(shell_pid, 0) } == 0,
+        "startup must not shut down a live implicit holder before reconnect grace"
     );
+    kill_holder(&sessions_dir, &session);
 }
 
 #[test]