@@ -168,8 +168,8 @@ function setup(
   const runner = new FakeRunner()
   const onUnregistered = vi.fn()
   const busy: boolean[] = []
-  /** Calls whose result the executor reported as journaled, in order. */
-  const journaled: string[] = []
+  /** Calls whose result the executor reported as reaching the model, in order. */
+  const delivered: string[] = []
   const executor = new DesktopExecutor({
     client: sim.client,
     journal,
@@ -179,13 +179,13 @@ function setup(
     onUnregistered,
     onBusyChange: (value) => busy.push(value),
     onApprovals: (items) => approvals.push(items),
-    onResultRecorded: (toolCallId) => journaled.push(toolCallId),
+    onResultDelivered: (toolCallId) => delivered.push(toolCallId),
     ...(options.maxHeldCalls ? { maxHeldCalls: options.maxHeldCalls } : {}),
     ...(options.deliveryAwakeLimitMs !== undefined
       ? { deliveryAwakeLimitMs: options.deliveryAwakeLimitMs }
       : {}),
   })
-  return { sim, journal, runner, executor, onUnregistered, busy, approvals, journaled }
+  return { sim, journal, runner, executor, onUnregistered, busy, approvals, delivered }
 }
 
 describe('claiming', () => {
@@ -206,20 +206,22 @@ describe('claiming', () => {
     expect(executor.heldCallCount()).toBe(0)
   })
 
-  it('reports a result as durable only once the journal holds it', async () => {
-    const { sim, journal, runner, executor, journaled } = setup()
+  it('reports a result as reaching the model only once Sim takes it as the call own', async () => {
+    const { sim, journal, runner, executor, delivered } = setup()
     runner.immediate = DONE
-    journal.failOn = 'result'
-    sim.inbox = [callItem('call-unjournaled', 'chat-a')]
+    // Sim settled this call first: the result never reached the model.
+    sim.completionOutcome = 'superseded'
+    sim.inbox = [callItem('call-superseded', 'chat-a')]
     await executor.reconcile()
     await vi.waitFor(() => expect(sim.completions).toHaveLength(1))
-    expect(journaled).toEqual([])
+    expect(delivered).toEqual([])
 
-    journal.failOn = null
-    sim.inbox = [callItem('call-journaled', 'chat-a')]
+    // Taken by Sim, even with nothing written locally (no OS encryption, say).
+    sim.completionOutcome = 'recorded'
+    journal.failOn = 'result'
+    sim.inbox = [callItem('call-recorded', 'chat-a')]
     await executor.reconcile()
-    await vi.waitFor(() => expect(sim.completions).toHaveLength(2))
-    expect(journaled).toEqual(['call-journaled'])
+    await vi.waitFor(() => expect(delivered).toEqual(['call-recorded']))
   })
 
   it('claims a whole backlog at once, before any of it runs', async () => {
 
@@ -68,10 +68,10 @@ export interface DesktopExecutorOptions {
   /** Called whenever the number of held calls changes between zero and more. */
   onBusyChange?: (busy: boolean) => void
   /**
-   * Called once a call's result is in the journal: from then on it reaches Sim, now or after a
-   * restart, so anything it hands back (a pane still running) can be counted on.
+   * Called once Sim has taken a call's result as the call's own (recorded, or a duplicate of one
+   * it recorded): the model has it, so anything it hands back (a pane still running) is in use.
    */
-  onResultRecorded?: (toolCallId: string, completion: DesktopToolCompletion) => void
+  onResultDelivered?: (toolCallId: string, completion: DesktopToolCompletion) => void
   maxHeldCalls?: number
   /** First delivery retry delay; tests shorten it. */
   retryBaseMs?: number
@@ -380,9 +380,7 @@ export class DesktopExecutor {
   ): Promise<void> {
     if (this.disposed) return
     // Best effort: unrecorded, a crash reports the call from its `started` entry as outcome unknown.
-    if (await this.record({ toolCallId, state: 'result', executionToken, completion })) {
-      this.options.onResultRecorded?.(toolCallId, completion)
-    }
+    await this.record({ toolCallId, state: 'result', executionToken, completion })
     const sendingSince = Date.now()
     try {
       await this.sendResult(toolCallId, executionToken, completion, sendingSince)
@@ -408,6 +406,8 @@ export class DesktopExecutor {
           completion: pending,
         })
         logger.info('Desktop call result acknowledged', { toolCallId, outcome })
+        // Superseded: Sim settled the call first, so this result never reached the model.
+        if (outcome !== 'superseded') this.options.onResultDelivered?.(toolCallId, pending)
         break
       } catch (error) {
         // Encoding failed on this machine, so nothing was sent; the same data would fail again.
 
@@ -96,8 +96,8 @@ async function service(protocolVersion = 1, userDataPath?: string) {
   return { sim, desktopExecutor, busy }
 }
 
-describe('calls never handed back with a result', () => {
-  it('names claimed and started calls, and results that are not started or unknown', async () => {
+describe('results recovery will hand to the model', () => {
+  it('names the calls whose real result the journal holds for recovery to send', async () => {
     const userData = await mkdtemp(join(tmpdir(), 'sim-executor-service-'))
     const journal = createExecutorJournal(join(userData, 'desktop-executor-journal.json'))
     await journal.put({ toolCallId: 'claimed', state: 'claimed', executionToken: 't1' })
@@ -122,12 +122,7 @@ describe('calls never handed back with a result', () => {
     })
     const { desktopExecutor } = await service(1, userData)
 
-    expect([...((await desktopExecutor.unresolvedCalls()) ?? [])].sort()).toEqual([
-      'claimed',
-      'not-started',
-      'started',
-      'unknown',
-    ])
+    expect([...(await desktopExecutor.pendingResults())]).toEqual(['handed-back'])
   })
 })
 
 
@@ -62,8 +62,8 @@ export interface DesktopExecutorServiceDeps {
   onApprovals?: (items: DesktopApprovalItem[]) => void
   /** Whether any chat has desktop work claimed on this machine changed. */
   onBusyChange?: (busy: boolean) => void
-  /** A call's result is in the journal, so it reaches Sim even across a restart. */
-  onResultRecorded?: (toolCallId: string, completion: DesktopToolCompletion) => void
+  /** Sim has taken a call's result as the call's own, so the model has it. */
+  onResultDelivered?: (toolCallId: string, completion: DesktopToolCompletion) => void
 }
 
 export interface DesktopExecutorService {
@@ -72,11 +72,11 @@ export interface DesktopExecutorService {
   refreshRegistration(): void
   getDevice(): DesktopExecutorDevice | null
   /**
-   * The calls the journal shows as never handed back with a real result: claimed or started with
-   * none, or settled as not started or outcome unknown. Read before recovery reports them; null
-   * when the journal cannot be read.
+   * The calls whose real result (not one reported as not started or outcome unknown) is in the
+   * journal and not yet acknowledged, so recovery will hand it to the model. Read before recovery
+   * changes the journal; empty when it cannot be read.
    */
-  unresolvedCalls(): Promise<Set<string> | null>
+  pendingResults(): Promise<Set<string>>
   /** Stores one entry of a claimed import, as this device's registered session. */
   importEntry(
     request: DesktopImportEntryRequest,
@@ -248,7 +248,7 @@ export function createDesktopExecutorService(
         onUnregistered: handleUnrecognized,
         ...(deps.onApprovals ? { onApprovals: deps.onApprovals } : {}),
         ...(deps.onBusyChange ? { onBusyChange: deps.onBusyChange } : {}),
-        ...(deps.onResultRecorded ? { onResultRecorded: deps.onResultRecorded } : {}),
+        ...(deps.onResultDelivered ? { onResultDelivered: deps.onResultDelivered } : {}),
       })
       await executor.recover()
       // Signed out while recovering: sign-out already disposed this executor.
@@ -453,23 +453,21 @@ export function createDesktopExecutorService(
     getDevice() {
       return device
     },
-    async unresolvedCalls() {
+    async pendingResults() {
+      const pending = new Set<string>()
       try {
-        const unresolved = new Set<string>()
         for (const entry of await journal.load()) {
-          const data = entry.state === 'result' ? entry.completion.data : undefined
-          if (
-            entry.state !== 'result' ||
-            data?.outcomeUnknown === true ||
-            data?.notStarted === true
-          ) {
-            unresolved.add(entry.toolCallId)
-          }
+          if (entry.state !== 'result') continue
+          const data = entry.completion.data
+          if (data?.outcomeUnknown === true || data?.notStarted === true) continue
+          pending.add(entry.toolCallId)
         }
-        return unresolved
-      } catch {
-        return null
+      } catch (error) {
+        logger.warn('Could not read the executor journal for pending results', {
+          error: getErrorMessage(error),
+        })
       }
+      return pending
     },
     importEntry(request, signal) {
       if (!client) throw new Error('The Sim desktop app is not signed in to Sim.')
 
@@ -607,9 +607,9 @@ function main(): void {
     accountDataAvailable,
     onApprovals: (items) => approvalNotifier.update(items),
     onBusyChange: (busy) => sleepBlocker.setBusy(busy),
-    // A result that will reach the model (not one reported as not started or outcome unknown)
-    // makes a tmux run it handed back as still going collectable across a restart.
-    onResultRecorded: (toolCallId, completion) => {
+    // A result the model has (not one reported as not started or outcome unknown) makes a tmux
+    // run it handed back as still going collectable across a restart.
+    onResultDelivered: (toolCallId, completion) => {
       if (completion.data?.outcomeUnknown !== true && completion.data?.notStarted !== true) {
         terminal.markRunDelivered(toolCallId)
       }
@@ -822,8 +822,8 @@ function main(): void {
     // it does, so it is stopped, while its pane still carries its tag. A run already handed back as
     // still going, with its pane, is left to the model, which may come back to it. Read before the
     // executor starts, since its recovery rewrites the journal.
-    const unresolvedCalls = desktopExecutor.unresolvedCalls()
-    void unresolvedCalls.then((unresolved) => terminal.stopUncollectableRuns(unresolved))
+    const pendingResults = desktopExecutor.pendingResults()
+    void pendingResults.then((pending) => terminal.stopUncollectableRuns(pending))
 
     if (!accountDataAvailable()) {
       logger.warn(
@@ -974,7 +974,7 @@ function main(): void {
       ensureAppSession().cookies.on('changed', (_event, cookie, _cause, removed) => {
         if (!removed && isSessionCookieName(cookie.name)) desktopExecutor.refreshRegistration()
       })
-      await unresolvedCalls
+      await pendingResults
       desktopExecutor.start()
     }
     await ensureMainWindow()
 
@@ -538,13 +538,16 @@ export class TerminalService {
     if (!pending) return
     for (const handle of pending) {
       // A finished run's pane may still be open (`remain-on-exit`): it is closed, while still the
-      // run's, before the record goes. Without the shell's environment the record stays, and the
-      // next sweep closes it. An untracked run is never stopped, so it is not kept either.
+      // run's, before the record goes, and its files go only after that check, which an untracked
+      // run needs them for. Without the shell's environment the record stays, and the next sweep
+      // closes it. An untracked run is never stopped, so it is not kept either.
       if (isRunComplete(handle) && env) {
-        void closeRunPane(handle, env).then(async () => {
-          // A pane tmux could not answer for keeps its record, for the next sweep to close.
-          if ((await runPaneState(handle, env)) === 'gone') this.forgetRun(handle)
-        })
+        void closeRunPane(handle, env)
+          .then(async () => {
+            if ((await runPaneState(handle, env)) === 'gone') this.forgetRun(handle)
+          })
+          .finally(() => this.releaseRun(handle))
+        continue
       }
       if (env && handle.runId !== null && !isRunComplete(handle)) this.orphanedRuns.set(handle, env)
       this.releaseRun(handle)
@@ -1351,8 +1354,8 @@ export class TerminalService {
       handle.dispose()
     }
     // Still going, it stays tracked, and nothing polls the status file again: `read` captures
-    // the pane instead. Its record is marked handed back only once that result is durable
-    // (the executor's journal); see `TerminalRegistry.markRunDelivered`.
+    // the pane instead. Its record is marked handed back only once that result reaches the model;
+    // see `TerminalRegistry.markRunDelivered`.
 
     const { text, truncated } = elideOutput(outcome.output)
     return {
 
@@ -69,23 +69,29 @@ describe('stopping recorded tmux runs', () => {
   it("at launch, leaves the same user's runs the model can come back to, and stops the rest", async () => {
     const dir = ledgerDir()
     const previous = createRunLedger(dir)
+    // Sim took its result: the model has the pane.
     previous.record(run('handed-back', '%1', true))
     previous.record(run('never-handed-back', '%2'))
-    // Handed back, but the call's journal still shows no result: the model never got it.
-    previous.record(run('lost-on-the-way', '%3', true))
+    // Its result is in the journal, unacknowledged: recovery will hand the pane to the model.
+    previous.record(run('on-its-way', '%3'))
     previous.record(run('handed-back-and-gone', '%4', true))
     panes.set('handed-back-and-gone', 'gone')
     const ledger = createRunLedger(dir)
-    const unresolved = new Set(['call-lost-on-the-way'])
 
-    await new TerminalRegistry(undefined, undefined, ledger).stopUncollectableRuns(unresolved)
+    await new TerminalRegistry(undefined, undefined, ledger).stopUncollectableRuns(
+      new Set(['call-on-its-way'])
+    )
 
     expect(Object.fromEntries(panes)).toEqual({
       'never-handed-back': 'stopped',
-      'lost-on-the-way': 'stopped',
       'handed-back-and-gone': 'gone',
     })
-    expect(ledger.list().map((record) => record.runId)).toEqual(['handed-back'])
+    expect(
+      ledger
+        .list()
+        .map((record) => record.runId)
+        .sort()
+    ).toEqual(['handed-back', 'on-its-way'])
   })
 
   it('keeps meaning to stop a run a stop for everything could not confirm', async () => {
 
@@ -388,21 +388,21 @@ export class TerminalRegistry {
   }
 
   /**
-   * At launch, for the same user: stops a previous process's tmux run whose call never handed back
-   * its result, or whose result the executor's journal (`unresolvedCalls`, null when unreadable)
-   * shows as never reaching the model. A run handed back as still going, with its pane, is left
-   * to the model, which may come back to it.
+   * At launch, for the same user: leaves a previous process's tmux run going only when the model
+   * has, or will get, the result that handed it back as still going: Sim acknowledged it
+   * (`delivered`), or the executor's journal holds it for recovery to send (`pendingResults`).
+   * Every other run is stopped, as is one a stop for everything could not confirm.
    */
-  stopUncollectableRuns(unresolvedCalls: ReadonlySet<string> | null): Promise<void> {
+  stopUncollectableRuns(pendingResults: ReadonlySet<string>): Promise<void> {
     return this.stopRecordedRuns({
       excludeLive: true,
-      keep: (run) => run.delivered && !run.mustStop && !unresolvedCalls?.has(run.callId),
+      keep: (run) => !run.mustStop && (run.delivered || pendingResults.has(run.callId)),
     })
   }
 
   /**
-   * Notes that a call's result is durable (in the executor's journal), so a tmux run it handed
-   * back as still going may be left to the model across a restart.
+   * Notes that a call's result reached the model, so a tmux run it handed back as still going may
+   * be left to the model across a restart.
    */
   markRunDelivered(callId: string): void {
     const ledger = this.runLedger
 
@@ -84,6 +84,10 @@ vi.mock('@/main/terminal/tmux', async () => {
     closeRunPane: async (...args: Parameters<typeof actual.closeRunPane>) => {
       if (!tmuxFake.on) return actual.closeRunPane(...args)
       if (tmuxFake.unanswered) return
+      // An untracked run's pane is proven its own only from the run's files, read after tmux
+      // has answered, as the real check does.
+      await sleep(10)
+      if (args[0].runId === null && !existsSync(args[0].statusPath)) return
       tmuxFake.open.delete(args[0].pane)
       tmuxFake.gone.add(args[0].pane)
     },
@@ -755,6 +759,27 @@ describe('agent commands in tmux', () => {
     }
   })
 
+  it("closes a finished untracked run's pane when its terminal closes", async () => {
+    tmuxFake.on = true
+    tmuxFake.untracked = true
+    tmuxFake.statusPaths.clear()
+    tmuxFake.open.clear()
+    try {
+      const terminal = new TerminalService({ loadCwd: () => '/tmp' })
+      const { activeTerminalId } = terminal.start({ cols: 80, rows: 24 })
+      await terminal.executeTool('call-old-tmux', 'run', { command: 'make build', waitSeconds: 1 })
+      const [[pane = '', statusPath = ''] = []] = [...tmuxFake.statusPaths]
+      writeFileSync(statusPath, '0')
+
+      terminal.closeTerminal(activeTerminalId as string)
+
+      await vi.waitFor(() => expect(tmuxFake.open.has(pane)).toBe(false))
+    } finally {
+      tmuxFake.on = false
+      tmuxFake.untracked = false
+    }
+  })
+
   it('keeps the record of a finished run whose pane tmux could not confirm closing', async () => {
     tmuxFake.on = true
     tmuxFake.statusPaths.clear()
 
@@ -391,6 +391,8 @@ describe('stopping a run another process started, from its record', () => {
     })
 
     expect(result).toMatchObject({ error: expect.stringContaining('was not run') })
+    // The pane it opened and tagged is closed with it.
+    expect(tmux.read().panes).toEqual({})
     await sleep(1_500)
     expect(existsSync(marker)).toBe(false)
   })