fix(tab-setter): keep a manual kitty tab rename across repaints; serialize stamps per tab

[bnkath2o]

Fixes #2212.

This is Abe, Ben's AI Assistant, reporting on Ben's behalf.

Heads-up on the red check. The repo's Claude Code Review workflow needs maintainer approval and the CLAUDE_CODE_OAUTH_TOKEN secret, which GitHub does not give to pull requests from forks. On this PR it will show as awaiting approval or failed without having run. Measured on 2026-09-21: the last 40 runs of that workflow, all from fork PRs, ended 31 failed and 9 awaiting approval. It is not a signal about this change.

What this changes

Every stamp (setAscentTab, setTabState) calls set-tab-title without checking whether the title it replaces is one it painted, so a manual kitty rename lasts until the next prompt. This keeps the user's name and repaints only the leading state and activity glyphs:

• A stamp compares kitty's live tab title (kitten @ ls --match id:<window>) to the last title it painted. A difference is a manual rename, and the name is pinned; a whitespace-only title unpins, because kitty's own empty rename clears the override instantly.
• Pin state lives in its own per-window file, MEMORY/STATE/tab-pins/<windowId>.json, since the startup idle stamp deletes the tab-state file.
• Stamps are serialized per tab. A mkdir lock covers read → paint → record. Without it the detection races: PromptProcessing runs async, so its second stamp can overlap the Stop stamp, and a stamp holding a stale title snapshot compares it with a fresh record and pins an automatic description as if the user typed it. The lock fails open after 3s and treats a lock older than 5s as abandoned.
• Records are written tmp-then-rename; concurrent plain writes were observed leaving NUL-truncated JSON.
• nameTab(text) is exported so a command can name the tab on purpose under the same lock; empty text repaints the last automatic title and clears the pin.
• Idle paints reset the pin, so a name lasts one session. Tab colors and window_id: matching are unchanged.

Verification

• 22 pure cases and 17 end-to-end cases, run locally against a fake kitten in separate bun processes, including concurrent stamps, a named tab landing mid-stamp, refusals and a fresh machine. The end-to-end suite runs the unpatched file as a positive control, and it loses the rename.
• The race was reproduced deterministically before the lock went in (the stale snapshot pinned the automatic title), and passes after.
• Mutation-tested: every surviving mutant in the new code was either removed as redundant or killed by an added case.
• bun build clean. Running on a live install: a rename survives the Stop stamp and the next prompt, and a reset takes effect immediately.

Not claimed

The tests are not included, because the repo ships none; they can be shared if useful. One known edge: in a tab already open when the patch is installed, a rename made before that tab's first repaint is lost once, since no last-painted record exists yet.

🤖 Generated with Claude Code