[quickbeard]

Problem

Removing a sandbox that had a session tab open takes the whole window down:

fatal renderer error {
  error: 'Error: Notification server not found: sandbox:codev-work\n' +
    '    at Object.ensure [as ensureServerState] (context/notification.tsx)\n' +
    '    at Object.fn (pages/layout/project-avatar-state.ts)\n' +
    '    at get unread (pages/layout/session-tab-avatar.tsx)\n' + ...
}

Sidecar connections are published only while healthy — readySandboxConnections and readyWslConnections put a server in the list only in its ready state. So removing, restarting, or crashing one drops its key while its session tabs are still mounted.

useSessionTabAvatarState.unread then called notification.ensureServerState(server()), which throws by design on a key it cannot find. Because that happens inside a render-time memo, the throw escapes as a fatal renderer error rather than a contained failure.

Two things made it reachable:

1. unread had no guard. The same hook already tolerates a missing connection everywhere else — hasPermissions, hasQuestions, and loading all bail when sync() is undefined. unread was the one path assuming the server still existed.
2. Cleanup ran after the destroy. handleRemove awaited platform.sandboxes.remove(key) — which deletes the rootfs, seconds for a multi-GB sandbox — and only then called tabs.removeServer(key). The connection leaves the list the instant that resolves, so there was a guaranteed window with live tabs pointing at a dead key.

Fix

• project-avatar-state.ts — unread gates on connection() like the sync paths do. A tab whose server is gone shows no unread marker instead of killing the window.
• dialog-select-server.tsx — close tabs and switch the active server before awaiting either platform removal. This also makes cleanup complete: the tab-pruning effect in tabs.tsx that would otherwise collect these tabs does not discard their persisted draft state, while removeServer does.

Scope

This is an upstream bug, not sandbox-specific — WSL servers go through the identical readyWslConnections → ensureServerState path, so removing or restarting one with a tab open crashes the same way. The guard covers both. DIVERGENCES.md says to drop our row in favour of an upstream fix if one lands.

Verification

bun typecheck and bun run test:unit (657 pass, 0 fail) clean in packages/app.

No unit test added: the hook depends on the global, notification, and permission contexts, so covering it would mean standing up mocks for all three, which the repo's testing guidance steers away from. The change is a guard on an existing memo that the neighbouring memos already apply.

Not addressed here

• Uncaught (in promise) Error: Path already exists: ".cache/codev/" appears in the same log but is unrelated — it comes from the third-party @pierre/trees path store behind the file tree, and it does not take the window down.
• The tab-pruning effect deletes tabs for any server not currently in the list, and a sandbox leaves the list whenever it is merely restarting — so a restart can silently close tabs. Fixing that means deciding whether non-ready sandboxes should be listed as unhealthy or whether the prune should learn about known-but-not-ready servers, which is a design call rather than a patch.

🤖 Generated with Claude Code