From fe7007409fafa4fae7d31b4ac402ebaad394c592 Mon Sep 17 00:00:00 2001
From: Allan Thraen <allan@codeart.dk>
Date: Wed, 30 Sep 2026 13:07:33 +0200
Subject: [PATCH 1/2] feat(sessions): show a bulk restart running, and let it
 be stopped
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Restart all…" on a large fleet is a minute-scale operation — restarts are
strictly sequential and each Claude session waits for its old process to
exit — and until now nothing on screen said so and nothing could stop it.
On a 55-session setup that is roughly 3½–7 minutes during which the only
exit is closing the app.

Three parts:

**A rail, not the shutdown board.** RestartRail (2px, docked under
RestoreRail) plus a RestartPill counter in the toolbar's right stack,
driven by SetRestartProgress. ShutdownOverlay only works because OnClosing
collapses TerminalGrid first — WebView2 is an HwndHost and composites over
any WPF overlay — and collapsing the grid here would black out every live
pane for the whole run. A bulk restart doesn't block the user, so it gets
the quiet rail; shutdown does, so it keeps the board. Hidden for a single
target, so the toolbar ↻ never flashes one.

The restart pair is separate from the restore pair rather than a shared
rail: the OnLoaded restore loop leaves the UI responsive between awaits, so
the quick menu's "Restart all…" is clickable mid-restore and the two loops
can genuinely overlap. Peach (#fab387, the shutdown board's "closing…"
colour) keeps the two counters apart when both are up.

**Stop means "after the current one".** The ⏹ sets _restartCancelRequested,
read at the TOP of each iteration. It cannot abandon the session already
mid-restart: its VM is out of _vm.Sessions and its PTY is down by then, so
returning early would strand it as dormant — the failure path, not a stop.
Targets not yet reached keep their live terminals untouched.

**The confirmation quotes a duration.** Services/BulkRestartEstimate is
WPF-free so the wording is unit-testable at all (the ShellIntegrationPayload
/ SessionConfigEditor precedent). It costs a Claude target at 4–8s (exit
wait 2.3–4.7s + stagger + ~1.4s relaunch) and a plain shell at 1–2s, reports
a range rather than false precision, and switches to minutes only once the
optimistic bound passes 60s. At 10+ targets it also says the restarts are
sequential and names how many are Claude — that count is what makes the
estimate look earned rather than arbitrary.

Verified: 0-warning build, 609/609 unit tests (12 new). The chrome was
rendered against a live --clean instance and sampled by pixel: below the
toolbar border at #313244, the restore rail reads #89B4FA and the restart
rail #FAB387, each filling to exactly its k/N proportion, with both pills
side by side in the toolbar.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NDsEfog5kVkT5NmX1Ya5be
---
 CLAUDE.md                                     |   8 +
 src/CodeShellManager/MainWindow.xaml          |  43 ++++++
 src/CodeShellManager/MainWindow.xaml.cs       | 116 +++++++++++++-
 .../Services/BulkRestartEstimate.cs           | 110 +++++++++++++
 .../BulkRestartEstimateTests.cs               | 146 ++++++++++++++++++
 5 files changed, 418 insertions(+), 5 deletions(-)
 create mode 100644 src/CodeShellManager/Services/BulkRestartEstimate.cs
 create mode 100644 tests/CodeShellManager.Tests/BulkRestartEstimateTests.cs

diff --git a/CLAUDE.md b/CLAUDE.md
index cda4cd7..7857e07 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -409,6 +409,14 @@ Confirmation is driven by the `confirmHeadline` parameter rather than a count te
 
 `RestartSessionsAsync` runs its targets **strictly sequentially** — `RestartSessionAsync` waits for each Claude process to exit before starting its replacement, and awaiting those in parallel would put several `claude.exe` instances back on the shared config file at once, which is the race the wait exists to prevent. A `_restartInProgress` flag drops (rather than queues) an overlapping invocation for the same reason — see the guard note above. That sequencing is also why the bulk entry points confirm: restarting a fleet of Claude sessions is a minute-scale operation, not an instant one. Each target is re-resolved per iteration, since every restart replaces the `SessionViewModel` for that id and an earlier one in the loop may have failed into dormant.
 
+**The rail, and why it is not the shutdown board.** A bulk restart drives `RestartRail` (2px, docked under `RestoreRail`) plus a `RestartPill` counter in the toolbar's right stack, via `SetRestartProgress`. That is the *restore* pattern, deliberately, and the choice is forced: `ShutdownOverlay` only works because `OnClosing` collapses `TerminalGrid` before showing it — WebView2 is an `HwndHost` and composites over any WPF overlay — and collapsing the grid here would black out every live pane for the whole run. A bulk restart does not block the user, so it gets the quiet rail; shutdown does, so it gets the board. Both are hidden for a single target: the toolbar ↻ restarts in seconds and a rail that appears and vanishes is noise.
+
+The restart pair is **separate from the restore pair rather than a shared rail**. The `OnLoaded` restore loop leaves the UI responsive between awaits, so the sidebar quick menu is clickable while a restore is still running and the two loops can genuinely overlap; one shared rail would need a precedence rule to no benefit. Peach (`#fab387`, the shutdown board's "closing…" colour) rather than the restore blue, so the two counters stay apart when both are up.
+
+**Stop means "after the current one".** The `⏹` on the pill sets `_restartCancelRequested`, read at the **top** of each loop iteration. It cannot abandon the session already mid-restart: by that point the VM is out of `_vm.Sessions` and the PTY is down, so returning early would strand it as dormant — the failure path, not a stop. Targets not yet reached keep their live terminals untouched, and a toast reports how many were skipped. The flag clears in the same `finally` as `_restartInProgress`.
+
+**The confirmation quotes a duration**, built by the WPF-free `Services/BulkRestartEstimate` (tested in `BulkRestartEstimateTests`) so the wording is unit-testable at all. It costs a Claude target at 4–8s (exit wait 2.3–4.7s + stagger + ~1.4s relaunch) and a plain shell at 1–2s, reports a range rather than false precision, and switches to minutes only once the *optimistic* bound passes 60s. At or above `ScaleWarningThreshold` (10 targets) it also says the restarts are sequential and names how many are Claude — that count is what makes the estimate look earned rather than arbitrary. `MessageBox` cannot emphasise anything, so scale is carried by the words; making the warning *look* like one would mean a themed window instead.
+
 ## Editing a Session's Configuration
 
 Any existing session can be reconfigured through the **same form used to create one** —
diff --git a/src/CodeShellManager/MainWindow.xaml b/src/CodeShellManager/MainWindow.xaml
index 8ef7615..fd9a306 100644
--- a/src/CodeShellManager/MainWindow.xaml
+++ b/src/CodeShellManager/MainWindow.xaml
@@ -113,6 +113,33 @@
                 </StackPanel>
 
                 <StackPanel DockPanel.Dock="Right" Orientation="Horizontal" VerticalAlignment="Center">
+                    <!-- Bulk-restart counter — paired with RestartRail, and deliberately a
+                         SEPARATE pair from the restore one below rather than a shared rail:
+                         the OnLoaded restore loop leaves the UI responsive between awaits,
+                         so the sidebar quick menu's "Restart all…" is clickable while a
+                         restore is still running and the two loops can genuinely overlap.
+                         Sharing one rail would need a precedence rule for no gain.
+
+                         Peach rather than the restore blue because peach is already the
+                         shutdown board's "closing…" colour — it reads as teardown in
+                         progress, and it keeps the two counters apart when both are up. -->
+                    <Border x:Name="RestartPill" Background="#181825" CornerRadius="10"
+                            BorderBrush="#313244" BorderThickness="1"
+                            Margin="0,0,8,0" VerticalAlignment="Center"
+                            Visibility="Collapsed">
+                        <DockPanel>
+                            <Button x:Name="RestartStopBtn" DockPanel.Dock="Right" Content="⏹"
+                                    Background="Transparent" BorderThickness="0"
+                                    Foreground="#fab387" FontSize="10" Padding="4,2,8,2"
+                                    Cursor="Hand"
+                                    ToolTip="Stop once the session currently restarting finishes"
+                                    Click="RestartStop_Click"/>
+                            <TextBlock x:Name="RestartPillText" Text="restarting…" Foreground="#fab387"
+                                       FontSize="11" FontWeight="SemiBold" Padding="9,2,4,2"
+                                       VerticalAlignment="Center"/>
+                        </DockPanel>
+                    </Border>
+
                     <!-- Restore counter — paired with RestoreRail; both live only for the
                          duration of the restore loop in OnLoaded. -->
                     <Border x:Name="RestorePill" Background="#181825" CornerRadius="10"
@@ -197,6 +224,22 @@
                      Style="{StaticResource FlatBar}" Background="Transparent"
                      Minimum="0" Maximum="1" Value="0" Visibility="Collapsed"/>
 
+        <!-- ── Bulk-restart rail ────────────────────────────────────────────
+             Same reasoning as the restore rail above — an HwndHost composites over any
+             overlay, so the toolbar strip is where an indicator is guaranteed to show.
+             A restart queue is strictly sequential and each Claude session waits for its
+             old process to exit, so "Restart all" on a large fleet runs for minutes; this
+             is the only thing on screen that says so while it does.
+
+             NOT the shutdown board: that only works because OnClosing collapses
+             TerminalGrid first, and doing that here would black out every live pane for
+             the whole run. A bulk restart does not block the user; the restore rail is
+             the right precedent. -->
+        <ProgressBar x:Name="RestartRail" DockPanel.Dock="Top" Height="2"
+                     Style="{StaticResource FlatBar}" Background="Transparent"
+                     Foreground="#fab387"
+                     Minimum="0" Maximum="1" Value="0" Visibility="Collapsed"/>
+
         <!-- ── Command helper panel ─────────────────────────────────────── -->
         <Border x:Name="CommandHelperPanel" DockPanel.Dock="Top" Background="#11111b"
                 BorderThickness="0,0,0,1" BorderBrush="#313244"
diff --git a/src/CodeShellManager/MainWindow.xaml.cs b/src/CodeShellManager/MainWindow.xaml.cs
index d6f6167..c5e8549 100644
--- a/src/CodeShellManager/MainWindow.xaml.cs
+++ b/src/CodeShellManager/MainWindow.xaml.cs
@@ -109,6 +109,16 @@ private enum SortField { None, Name, Folder, LastActive, Branch, Dirty, Repo }
     // there for why restarts have to stay strictly sequential.
     private bool _restartInProgress = false;
 
+    // Set by the ⏹ on the restart pill. Read at the top of each loop iteration, so the
+    // session currently mid-restart always finishes — abandoning one after its teardown
+    // would leave it with no terminal, which is the dormant failure path, not a stop.
+    private bool _restartCancelRequested = false;
+
+    // Last values handed to SetRestartProgress, so the stop button can repaint the pill
+    // without the loop having to hand them to it again.
+    private int _restartDone = 0;
+    private int _restartTotal = 0;
+
     public MainWindow()
     {
         InitializeComponent();
@@ -433,6 +443,76 @@ private void SetRestoreProgress(int done, int total, bool finished = false)
         RestorePill.Visibility = Visibility.Visible;
     }
 
+    // Frozen so the pill can repaint on every step without allocating. Peach while the
+    // queue runs, yellow once a stop has been asked for, muted for the disabled ⏹.
+    private static SolidColorBrush FrozenBrush(byte r, byte g, byte b)
+    {
+        var brush = new SolidColorBrush(Color.FromRgb(r, g, b));
+        brush.Freeze();   // frozen brushes skip change-tracking and are cheaper to render
+        return brush;
+    }
+
+    private static readonly SolidColorBrush RestartPeach = FrozenBrush(0xfa, 0xb3, 0x87);
+    private static readonly SolidColorBrush RestartYellow = FrozenBrush(0xf9, 0xe2, 0xaf);
+    private static readonly SolidColorBrush RestartMuted = FrozenBrush(0x6c, 0x70, 0x86);
+
+    /// <summary>
+    /// Drives the bulk-restart rail + toolbar pill, the mirror of
+    /// <see cref="SetRestoreProgress"/>.
+    ///
+    /// Hidden for a single target: the toolbar ↻ and the one-session menu entry restart
+    /// in seconds, and a rail that appears and vanishes is noise. The pill exists for the
+    /// "Restart all" case, which is minute-scale.
+    /// </summary>
+    private void SetRestartProgress(int done, int total, bool finished = false)
+    {
+        _restartDone = done;
+        _restartTotal = total;
+
+        if (total <= 1 || finished)
+        {
+            RestartRail.Visibility = Visibility.Collapsed;
+            RestartPill.Visibility = Visibility.Collapsed;
+            return;
+        }
+
+        RestartRail.Maximum = total;
+        RestartRail.Value = done;
+        RestartRail.Visibility = Visibility.Visible;
+
+        if (_restartCancelRequested)
+        {
+            // The queue is already stopping, so the button has nothing left to do. Saying
+            // so beats leaving a live-looking control that silently ignores clicks.
+            RestartPillText.Text = $"{done} / {total} · stopping after this one";
+            RestartPillText.Foreground = RestartYellow;
+            RestartRail.Foreground = RestartYellow;
+            RestartStopBtn.Foreground = RestartMuted;
+            RestartStopBtn.IsEnabled = false;
+        }
+        else
+        {
+            RestartPillText.Text = $"{done} / {total} restarting";
+            RestartPillText.Foreground = RestartPeach;
+            RestartRail.Foreground = RestartPeach;
+            RestartStopBtn.Foreground = RestartPeach;
+            RestartStopBtn.IsEnabled = true;
+        }
+
+        RestartPill.Visibility = Visibility.Visible;
+    }
+
+    /// <summary>
+    /// ⏹ on the restart pill — abandon the rest of the queue. The session currently
+    /// restarting is left to finish; see <see cref="_restartCancelRequested"/>.
+    /// </summary>
+    private void RestartStop_Click(object sender, RoutedEventArgs e)
+    {
+        if (!_restartInProgress) return;
+        _restartCancelRequested = true;
+        SetRestartProgress(_restartDone, _restartTotal);
+    }
+
     // ── Shutdown board ──────────────────────────────────────────────────────
     // Row handles, so each session's line can be updated in place as it closes.
     private readonly Dictionary<string, (Border Row, TextBlock Glyph, TextBlock Time)> _shutdownRows = new();
@@ -4823,24 +4903,43 @@ private async Task RestartSessionsAsync(
         if (confirmHeadline != null || targets.Count > 1)
         {
             string headline = confirmHeadline ?? $"Restart {targets.Count} sessions?";
+            // Claude sessions are what make the queue slow — they wait for the outgoing
+            // process to exit — so the estimate is driven by how many of the targets are
+            // one, not by the raw count.
+            int claudeCount = targets.Count(id =>
+                _vm.Sessions.FirstOrDefault(s => s.Id == id) is { } v
+                && ClaudeSessionService.IsClaudeCommand(v.Session.Command));
+
             // Defaults to No, like "Close all…" — this terminates every running process and
             // any in-flight run commands, and a stray Enter shouldn't start a minute-scale
-            // operation there's no way to stop.
+            // operation.
             var r = MessageBox.Show(this,
-                headline + Environment.NewLine + Environment.NewLine +
-                "Each running process is terminated and relaunched in turn, and any running "
-                + "session commands are stopped. Claude sessions resume their conversation. "
-                + "They restart one at a time, so this can take a while.",
+                Services.BulkRestartEstimate.BuildConfirmText(headline, targets.Count, claudeCount),
                 "Restart sessions", MessageBoxButton.YesNo, MessageBoxImage.Question,
                 MessageBoxResult.No);
             if (r != MessageBoxResult.Yes) return;
         }
 
         _restartInProgress = true;
+        _restartCancelRequested = false;
+        int done = 0;
+        SetRestartProgress(done, targets.Count);
         try
         {
             foreach (var id in targets)
             {
+                // The ⏹ on the toolbar pill. Checked at the TOP of the iteration, so the
+                // session already mid-restart is never abandoned: its VM is gone from
+                // _vm.Sessions and its PTY is down by then, and returning early there
+                // would strand it as dormant rather than stop anything.
+                if (_restartCancelRequested)
+                {
+                    Services.ToastHelper.Show("Restart stopped",
+                        $"Finished {done} of {targets.Count}. The remaining "
+                        + $"{targets.Count - done} session(s) were left running.");
+                    break;
+                }
+
                 // Abandon the rest of the queue once the window is closing. OnClosing
                 // snapshots _vm.Sessions and disposes exactly that set, so a relaunch that
                 // lands after the snapshot spawns a ConPTY child nothing will ever dispose —
@@ -4856,11 +4955,18 @@ private async Task RestartSessionsAsync(
                 // and the guarded entry point would reject its own iterations.
                 var vm = _vm.Sessions.FirstOrDefault(s => s.Id == id);
                 if (vm != null) await RestartSessionCoreAsync(vm);
+
+                // Advanced even when the session had vanished, exactly as the restore rail
+                // advances past a session that failed to restore: a counter that stalls
+                // short of its total reads as a hang.
+                SetRestartProgress(++done, targets.Count);
             }
         }
         finally
         {
             _restartInProgress = false;
+            _restartCancelRequested = false;
+            SetRestartProgress(done, targets.Count, finished: true);
         }
     }
 
diff --git a/src/CodeShellManager/Services/BulkRestartEstimate.cs b/src/CodeShellManager/Services/BulkRestartEstimate.cs
new file mode 100644
index 0000000..e76a28e
--- /dev/null
+++ b/src/CodeShellManager/Services/BulkRestartEstimate.cs
@@ -0,0 +1,110 @@
+using System;
+using System.Globalization;
+using System.Text;
+
+namespace CodeShellManager.Services;
+
+/// <summary>
+/// The wording of the "Restart all…" confirmation — how long the queue will take, and
+/// whether the user is told that it is a long one.
+///
+/// WPF-free on purpose, like <see cref="ShellIntegrationPayload"/> and
+/// <see cref="SessionConfigEditor"/>: this is the only part of the bulk-restart UI with
+/// logic worth testing, and it can only be tested if it does not touch a Window.
+/// </summary>
+public static class BulkRestartEstimate
+{
+    /// <summary>
+    /// Target count at which the confirmation stops merely quoting a duration and starts
+    /// explaining that the restarts are sequential. Below this the operation is short
+    /// enough that the estimate alone carries the point.
+    /// </summary>
+    public const int ScaleWarningThreshold = 10;
+
+    // Per-session cost, in seconds, as a low–high range.
+    //
+    // A Claude session dominates: RestartSessionCoreAsync waits for the outgoing process
+    // to actually exit (CLAUDE.md measures busy shutdowns at 2.3–4.7s), then a flat
+    // stagger of up to 1s, then the relaunch itself (~1.4s in the RESTORE log lines).
+    // A plain shell skips the exit wait entirely and is just the relaunch.
+    //
+    // A range rather than a point because the spread is real — quoting "4 minutes" to
+    // three significant figures would be false precision dressed up as help.
+    private const int ClaudeLowSeconds = 4;
+    private const int ClaudeHighSeconds = 8;
+    private const int OtherLowSeconds = 1;
+    private const int OtherHighSeconds = 2;
+
+    // Switch to minutes only once the OPTIMISTIC bound passes a minute. Deciding on the
+    // pessimistic bound instead would report "roughly ½–2 minutes" for a queue that
+    // usually finishes in forty seconds.
+    private const int MinutesThresholdSeconds = 60;
+
+    /// <summary>
+    /// A human range for how long restarting <paramref name="totalTargets"/> sessions
+    /// will take, of which <paramref name="claudeTargets"/> are Claude sessions.
+    /// </summary>
+    public static string DescribeDuration(int totalTargets, int claudeTargets)
+    {
+        int claude = Math.Max(0, claudeTargets);
+        int others = Math.Max(0, totalTargets - claude);
+
+        int lowSeconds = ClaudeLowSeconds * claude + OtherLowSeconds * others;
+        int highSeconds = ClaudeHighSeconds * claude + OtherHighSeconds * others;
+
+        if (lowSeconds < MinutesThresholdSeconds)
+            return $"about {lowSeconds}–{highSeconds} seconds";
+
+        return $"roughly {FormatMinutes(lowSeconds / 60.0)}–{FormatMinutes(highSeconds / 60.0)} minutes";
+    }
+
+    /// <summary>
+    /// The body of the confirmation dialog. <paramref name="headline"/> is the caller's
+    /// scope-naming first line ("Restart all 55 live sessions?").
+    /// </summary>
+    public static string BuildConfirmText(string headline, int totalTargets, int claudeTargets)
+    {
+        int claude = Math.Max(0, claudeTargets);
+        string duration = DescribeDuration(totalTargets, claude);
+
+        var sb = new StringBuilder();
+        sb.Append(headline);
+        sb.Append(Environment.NewLine).Append(Environment.NewLine);
+
+        if (totalTargets >= ScaleWarningThreshold)
+        {
+            // Naming the Claude count is what makes the estimate look earned rather than
+            // arbitrary — it is the reason the queue is slow. Omitted when there are none,
+            // since blaming absent sessions would just be wrong.
+            sb.Append(claude > 0
+                ? $"{claude} of them are Claude sessions and restart one at a time — expect {duration}."
+                : $"They restart one at a time — expect {duration}.");
+        }
+        else
+        {
+            sb.Append($"Expect {duration}.");
+        }
+
+        sb.Append(Environment.NewLine).Append(Environment.NewLine);
+        sb.Append("Each running process is terminated and relaunched in turn, and any running "
+                + "session commands are stopped.");
+        if (claude > 0)
+            sb.Append(" Claude sessions resume their conversation.");
+        sb.Append(" You can stop the queue from the toolbar once it starts.");
+
+        return sb.ToString();
+    }
+
+    /// <summary>Minutes to the nearest half, with the half written as a glyph.</summary>
+    private static string FormatMinutes(double minutes)
+    {
+        double rounded = Math.Round(minutes * 2, MidpointRounding.AwayFromZero) / 2;
+        int whole = (int)rounded;
+        bool hasHalf = Math.Abs(rounded - whole) > 0.01;
+
+        if (whole == 0) return "½";
+        return hasHalf
+            ? whole.ToString(CultureInfo.InvariantCulture) + "½"
+            : whole.ToString(CultureInfo.InvariantCulture);
+    }
+}
diff --git a/tests/CodeShellManager.Tests/BulkRestartEstimateTests.cs b/tests/CodeShellManager.Tests/BulkRestartEstimateTests.cs
new file mode 100644
index 0000000..fdcdae0
--- /dev/null
+++ b/tests/CodeShellManager.Tests/BulkRestartEstimateTests.cs
@@ -0,0 +1,146 @@
+using CodeShellManager.Services;
+using Xunit;
+
+namespace CodeShellManager.Tests;
+
+/// <summary>
+/// The confirmation a bulk restart shows before it runs. A restart queue is strictly
+/// sequential and a Claude session waits for its old process to exit, so "restart all" on
+/// a large fleet is a minute-scale operation — the whole point of this text is that the
+/// user learns that BEFORE clicking Yes rather than four minutes in.
+/// </summary>
+public class BulkRestartEstimateTests
+{
+    // ── Duration ──────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void NoClaudeSessions_StaysInSeconds()
+    {
+        // Plain shells skip the exit wait entirely; six of them is a few seconds, and
+        // quoting minutes for that would train the user to ignore the estimate.
+        string text = BulkRestartEstimate.DescribeDuration(totalTargets: 6, claudeTargets: 0);
+
+        Assert.Contains("seconds", text);
+        Assert.DoesNotContain("minute", text);
+    }
+
+    [Fact]
+    public void SingleClaudeSession_StaysInSeconds()
+    {
+        string text = BulkRestartEstimate.DescribeDuration(totalTargets: 1, claudeTargets: 1);
+
+        Assert.Contains("seconds", text);
+        Assert.DoesNotContain("minute", text);
+    }
+
+    [Fact]
+    public void LargeClaudeFleet_IsReportedAsAMinuteRange()
+    {
+        // 52 Claude at 4-8s each plus 3 plain shells at 1-2s: 211s to 422s.
+        string text = BulkRestartEstimate.DescribeDuration(totalTargets: 55, claudeTargets: 52);
+
+        Assert.Contains("3½", text);
+        Assert.Contains("7", text);
+        Assert.Contains("minutes", text);
+    }
+
+    [Fact]
+    public void WholeMinuteRange_OmitsTheHalfGlyph()
+    {
+        // 30 Claude: 120s to 240s, i.e. exactly 2-4 minutes. A bare "2" reads better
+        // than "2½" rounded down to it, so the half glyph must be conditional.
+        string text = BulkRestartEstimate.DescribeDuration(totalTargets: 30, claudeTargets: 30);
+
+        Assert.DoesNotContain("½", text);
+        Assert.Contains("minutes", text);
+    }
+
+    [Fact]
+    public void DurationGrowsWithTheNumberOfClaudeSessions()
+    {
+        // Guards the direction of the model rather than its exact constants: swapping the
+        // Claude and non-Claude costs would still satisfy every assertion above. Same
+        // fleet size both times, so only the Claude share can move the answer.
+        string small = BulkRestartEstimate.DescribeDuration(totalTargets: 40, claudeTargets: 0);
+        string large = BulkRestartEstimate.DescribeDuration(totalTargets: 40, claudeTargets: 40);
+
+        Assert.NotEqual(small, large);
+        Assert.DoesNotContain("minute", small);
+        Assert.Contains("minutes", large);
+    }
+
+    // ── Confirmation text ─────────────────────────────────────────────────────
+
+    [Fact]
+    public void ConfirmText_OpensWithTheHeadlineOnItsOwnLine()
+    {
+        string text = BulkRestartEstimate.BuildConfirmText(
+            "Restart all 55 live sessions?", totalTargets: 55, claudeTargets: 52);
+
+        string[] lines = text.Split('\n');
+        Assert.Equal("Restart all 55 live sessions?", lines[0].TrimEnd('\r'));
+    }
+
+    [Fact]
+    public void ConfirmText_SaysTheQueueCanBeStopped()
+    {
+        // The stop affordance is the answer to "I clicked Yes on 55 by mistake". If the
+        // dialog doesn't mention it, the user has no reason to look for the toolbar pill.
+        string text = BulkRestartEstimate.BuildConfirmText(
+            "Restart all 55 live sessions?", totalTargets: 55, claudeTargets: 52);
+
+        Assert.Contains("stop", text, System.StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void ConfirmText_SaysRunCommandsAreStopped()
+    {
+        string text = BulkRestartEstimate.BuildConfirmText(
+            "Restart 3 sessions?", totalTargets: 3, claudeTargets: 1);
+
+        Assert.Contains("session commands", text);
+    }
+
+    [Fact]
+    public void ConfirmText_BelowTheThreshold_HasNoScaleWarning()
+    {
+        string text = BulkRestartEstimate.BuildConfirmText(
+            "Restart 3 sessions?", totalTargets: 3, claudeTargets: 3);
+
+        Assert.DoesNotContain("one at a time", text);
+    }
+
+    [Fact]
+    public void ConfirmText_AtTheThreshold_WarnsAboutScale()
+    {
+        string text = BulkRestartEstimate.BuildConfirmText(
+            "Restart all 10 live sessions?",
+            totalTargets: BulkRestartEstimate.ScaleWarningThreshold,
+            claudeTargets: BulkRestartEstimate.ScaleWarningThreshold);
+
+        Assert.Contains("one at a time", text);
+    }
+
+    [Fact]
+    public void ConfirmText_ScaleWarning_NamesHowManyAreClaude()
+    {
+        // "52 of them are Claude sessions" is the line that explains WHY it is slow.
+        // Without it the estimate looks arbitrary.
+        string text = BulkRestartEstimate.BuildConfirmText(
+            "Restart all 55 live sessions?", totalTargets: 55, claudeTargets: 52);
+
+        Assert.Contains("52", text);
+    }
+
+    [Fact]
+    public void ConfirmText_ScaleWarning_WithNoClaudeSessions_DoesNotBlameClaude()
+    {
+        // 20 plain shells are still 20 relaunches, so the scale warning belongs — but
+        // naming Claude sessions that aren't there would be a lie.
+        string text = BulkRestartEstimate.BuildConfirmText(
+            "Restart all 20 live sessions?", totalTargets: 20, claudeTargets: 0);
+
+        Assert.Contains("one at a time", text);
+        Assert.DoesNotContain("Claude session", text);
+    }
+}

From d488221c6f6a6a125f69188883489dbb0fe04ef1 Mon Sep 17 00:00:00 2001
From: Allan Thraen <allan@codeart.dk>
Date: Wed, 30 Sep 2026 16:10:02 +0200
Subject: [PATCH 2/2] fix(sessions): close the review findings on the bulk
 restart rail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An independent review pass found seven things. All were real; six are fixed
here and the seventh is the reason for the biggest change.

**A restart can no longer start during the startup restore.** Both loops spawn
claude.exe and neither one's stagger can see the other's launches, so
overlapping them is the unlocked read-modify-write on ~/.claude.json that
ClaudeLaunchStaggerMs exists to prevent. The restore loop awaits per session
and leaves the quick menu clickable throughout, so "Restart all…" mid-restore
is an ordinary click on a 55-session start. Both RestartSessionAsync and
RestartSessionsAsync now refuse while _restoreInProgress, dropped with a toast
like the existing guard — one session is enough to lose the race.

This is the finding that should not have needed a reviewer: the previous
commit's XAML comment and CLAUDE.md paragraph both cited that overlap as the
*reason* the rails are separate pairs, which wrote a config race down as a
layout question. Both are corrected, and the separate pairs are now justified
on their own terms.

The rest:

- The confirmation promised a stop control that is never rendered. The bulk
  entry points confirm whatever the count, but SetRestartProgress hides the
  pill at total <= 1 — so at exactly one session the dialog pointed at
  something that never appears. Gated on totalTargets > 1.
- RestartStopBtn had no Style, so it fell through to Aero2's default Button
  template, whose IsEnabled=false trigger sets Background/BorderBrush/
  Foreground with TargetName and outranks both the Transparent TemplateBinding
  and the muted brush set in code. The disabled ⏹ would have rendered as a
  light-grey #F4F4F4 box inside the dark pill. ToolBtn has no disabled trigger.
- The stop toast counted vanished targets as "finished": close three
  not-yet-reached sessions mid-run, then stop, and three of the "finished"
  were never restarted. A separate counter now tracks work actually done, and
  "not restarted" replaces "left running" (a target an earlier failure dropped
  to dormant is neither).
- ConfirmText_SaysTheQueueCanBeStopped asserted Contains("stop"), which the
  always-present "...session commands are stopped" satisfied — deleting the
  whole affordance sentence left it green. Now asserts "stop the queue".
- DescribeDuration clamped `others` at 0 but never capped `claude` at the
  total, so (3 targets, 10 Claude) quoted 40-80 seconds for three sessions.
- The restart-failure MessageBox had no owner, so it could sit behind the main
  window while the bulk loop blocked in it — the rail frozen mid-count with
  nothing explaining why, which is the exact "reads as a hang" the rail exists
  to prevent. Now owned.
- RestartStop_Click guarded only on _restartInProgress, which the
  single-session path also holds, with stale _restartDone/_restartTotal from
  the previous bulk run. Not reachable (a Collapsed pill does not hit-test),
  but that made the handler's correctness rest on a visibility property;
  guarded on _restartTotal > 1 instead. _restartInProgress is also now the
  last statement before its try.

3 new tests (612 total), build clean at 0 warnings.

Not verified: the disabled ⏹ on screen. The enabled pill and both rails were
confirmed by pixel earlier; the disabled state could not be captured because
Windows' foreground lock blocked every attempt to raise the test window. The
fix is reasoned from the Aero2 template, not seen.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NDsEfog5kVkT5NmX1Ya5be
---
 CLAUDE.md                                     |  4 +-
 src/CodeShellManager/MainWindow.xaml          | 31 +++++---
 src/CodeShellManager/MainWindow.xaml.cs       | 71 +++++++++++++++++--
 .../Services/BulkRestartEstimate.cs           | 17 ++++-
 .../BulkRestartEstimateTests.cs               | 41 ++++++++++-
 5 files changed, 144 insertions(+), 20 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 7857e07..7762c02 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -411,7 +411,9 @@ Confirmation is driven by the `confirmHeadline` parameter rather than a count te
 
 **The rail, and why it is not the shutdown board.** A bulk restart drives `RestartRail` (2px, docked under `RestoreRail`) plus a `RestartPill` counter in the toolbar's right stack, via `SetRestartProgress`. That is the *restore* pattern, deliberately, and the choice is forced: `ShutdownOverlay` only works because `OnClosing` collapses `TerminalGrid` before showing it — WebView2 is an `HwndHost` and composites over any WPF overlay — and collapsing the grid here would black out every live pane for the whole run. A bulk restart does not block the user, so it gets the quiet rail; shutdown does, so it gets the board. Both are hidden for a single target: the toolbar ↻ restarts in seconds and a rail that appears and vanishes is noise.
 
-The restart pair is **separate from the restore pair rather than a shared rail**. The `OnLoaded` restore loop leaves the UI responsive between awaits, so the sidebar quick menu is clickable while a restore is still running and the two loops can genuinely overlap; one shared rail would need a precedence rule to no benefit. Peach (`#fab387`, the shutdown board's "closing…" colour) rather than the restore blue, so the two counters stay apart when both are up.
+The restart pair is **separate from the restore pair rather than a shared rail** — two unrelated loops with unrelated lifetimes, and one shared rail would need a precedence rule to no benefit. Peach (`#fab387`, the shutdown board's "closing…" colour) rather than the restore blue.
+
+**A restart refuses to start while the restore loop is running** (`_restoreInProgress`, dropped with a toast like `_restartInProgress`). Both loops spawn `claude.exe` and neither one's stagger can see the other's launches, so overlapping them is exactly the unlocked read-modify-write on `~/.claude.json` that `ClaudeLaunchStaggerMs` exists to prevent. The `OnLoaded` restore loop awaits per session and leaves the quick menu clickable throughout, so this is an ordinary click on a 55-session start, not a corner case. An earlier version of this section cited that overlap as the *reason* for separate rails — writing a config race down as a layout question. Both single-session `RestartSessionAsync` and bulk `RestartSessionsAsync` carry the guard; one session is enough to lose the race.
 
 **Stop means "after the current one".** The `⏹` on the pill sets `_restartCancelRequested`, read at the **top** of each loop iteration. It cannot abandon the session already mid-restart: by that point the VM is out of `_vm.Sessions` and the PTY is down, so returning early would strand it as dormant — the failure path, not a stop. Targets not yet reached keep their live terminals untouched, and a toast reports how many were skipped. The flag clears in the same `finally` as `_restartInProgress`.
 
diff --git a/src/CodeShellManager/MainWindow.xaml b/src/CodeShellManager/MainWindow.xaml
index fd9a306..c324731 100644
--- a/src/CodeShellManager/MainWindow.xaml
+++ b/src/CodeShellManager/MainWindow.xaml
@@ -113,25 +113,38 @@
                 </StackPanel>
 
                 <StackPanel DockPanel.Dock="Right" Orientation="Horizontal" VerticalAlignment="Center">
-                    <!-- Bulk-restart counter — paired with RestartRail, and deliberately a
-                         SEPARATE pair from the restore one below rather than a shared rail:
-                         the OnLoaded restore loop leaves the UI responsive between awaits,
-                         so the sidebar quick menu's "Restart all…" is clickable while a
-                         restore is still running and the two loops can genuinely overlap.
-                         Sharing one rail would need a precedence rule for no gain.
+                    <!-- Bulk-restart counter — paired with RestartRail, and a SEPARATE pair
+                         from the restore one below rather than a shared rail: the two are
+                         driven by unrelated loops with unrelated lifetimes, and one shared
+                         rail would need a precedence rule for no gain.
+
+                         Note the two rails are NOT expected on screen together: a restart
+                         refuses to start while the restore loop is running, because both
+                         spawn claude.exe and neither stagger can see the other's launches
+                         (see _restoreInProgress). An earlier version of this comment cited
+                         the overlap as the reason for separate pairs, which quietly wrote
+                         down a config-writer race as a layout question.
 
                          Peach rather than the restore blue because peach is already the
                          shutdown board's "closing…" colour — it reads as teardown in
-                         progress, and it keeps the two counters apart when both are up. -->
+                         progress. -->
                     <Border x:Name="RestartPill" Background="#181825" CornerRadius="10"
                             BorderBrush="#313244" BorderThickness="1"
                             Margin="0,0,8,0" VerticalAlignment="Center"
                             Visibility="Collapsed">
                         <DockPanel>
+                            <!-- ToolBtn, not the default Button template. This is the only
+                                 button in the app that is ever disabled, and Aero2's stock
+                                 template has an IsEnabled=false trigger that sets its
+                                 Background/BorderBrush/Foreground with TargetName — which
+                                 outranks both the Transparent TemplateBinding and the muted
+                                 Foreground set in SetRestartProgress. The ⏹ would render as
+                                 a light-grey #F4F4F4 box inside the dark pill. ToolBtn's
+                                 template has no disabled trigger, so the code-set brush
+                                 actually applies. -->
                             <Button x:Name="RestartStopBtn" DockPanel.Dock="Right" Content="⏹"
-                                    Background="Transparent" BorderThickness="0"
+                                    Style="{StaticResource ToolBtn}"
                                     Foreground="#fab387" FontSize="10" Padding="4,2,8,2"
-                                    Cursor="Hand"
                                     ToolTip="Stop once the session currently restarting finishes"
                                     Click="RestartStop_Click"/>
                             <TextBlock x:Name="RestartPillText" Text="restarting…" Foreground="#fab387"
diff --git a/src/CodeShellManager/MainWindow.xaml.cs b/src/CodeShellManager/MainWindow.xaml.cs
index c5e8549..f8df923 100644
--- a/src/CodeShellManager/MainWindow.xaml.cs
+++ b/src/CodeShellManager/MainWindow.xaml.cs
@@ -114,6 +114,12 @@ private enum SortField { None, Name, Folder, LastActive, Branch, Dirty, Repo }
     // would leave it with no terminal, which is the dormant failure path, not a stop.
     private bool _restartCancelRequested = false;
 
+    // True while OnLoaded's restore loop is launching sessions. A bulk restart refuses to
+    // start during it: both loops spawn claude.exe and neither one's stagger can see the
+    // other's launches, which is the concurrent-config-writer race the stagger exists to
+    // prevent. The quick menu is clickable throughout a restore, so this is reachable.
+    private bool _restoreInProgress = false;
+
     // Last values handed to SetRestartProgress, so the stop button can repaint the pill
     // without the loop having to hand them to it again.
     private int _restartDone = 0;
@@ -339,6 +345,14 @@ private async void OnLoaded(object sender, RoutedEventArgs e)
             // the total is visible in crash.log (issue #82).
             var restoreClock = System.Diagnostics.Stopwatch.StartNew();
 
+            // Both this loop and RestartSessionsAsync spawn claude.exe, and neither one's
+            // stagger can see the other's launches — so a "Restart all…" started while this
+            // is still running recreates the unlocked read-modify-write on ~/.claude.json
+            // that the stagger exists to prevent. The quick menu stays clickable throughout
+            // a restore (this loop awaits per session), so that is an ordinary click, not a
+            // corner case. Restart refuses while this is set; see RestartSessionsAsync.
+            _restoreInProgress = true;
+
             // Determinate restore progress. A 25-session restore runs ~131s with
             // per-session cost swinging 12x, so there is no rate to extrapolate from and
             // an indeterminate spinner reads the same at session 2 as at session 22.
@@ -402,6 +416,11 @@ private async void OnLoaded(object sender, RoutedEventArgs e)
                 lastWasClaude = isClaude;
             }
             SetRestoreProgress(restoreTotal, restoreTotal, finished: true);
+            // Cleared here rather than in a finally: the only awaited call in the loop
+            // above is already inside its own try/catch, so nothing can escape between
+            // the two assignments. OnLoaded is async void — anything that did escape
+            // would take the app down, which makes a stranded flag moot.
+            _restoreInProgress = false;
             if (webView2AccessDenied.Count > 0)
             {
                 MessageBox.Show(
@@ -508,7 +527,12 @@ private void SetRestartProgress(int done, int total, bool finished = false)
     /// </summary>
     private void RestartStop_Click(object sender, RoutedEventArgs e)
     {
-        if (!_restartInProgress) return;
+        // _restartTotal > 1, not just _restartInProgress: that flag is held by the
+        // single-session RestartSessionAsync too, and _restartDone/_restartTotal keep the
+        // PREVIOUS bulk run's values after the finally clears it. A Collapsed pill neither
+        // hit-tests nor takes focus, so this is not reachable today — but that makes the
+        // handler's correctness rest on a visibility property rather than on state.
+        if (!_restartInProgress || _restartTotal <= 1) return;
         _restartCancelRequested = true;
         SetRestartProgress(_restartDone, _restartTotal);
     }
@@ -4893,6 +4917,17 @@ private async Task RestartSessionsAsync(
             return;
         }
 
+        // Same reason, different loop. The startup restore also spawns claude.exe and its
+        // stagger cannot see launches this loop makes, so running both at once is the
+        // concurrent-config-writer race on ~/.claude.json that the stagger exists to
+        // prevent. Dropped rather than queued, like the guard above.
+        if (_restoreInProgress)
+        {
+            Services.ToastHelper.Show("Restart unavailable",
+                "Sessions are still being restored — try again once that finishes.");
+            return;
+        }
+
         var targets = sessionIds
             .Select(id => _vm.Sessions.FirstOrDefault(s => s.Id == id))
             .Where(v => v != null)
@@ -4920,10 +4955,15 @@ private async Task RestartSessionsAsync(
             if (r != MessageBoxResult.Yes) return;
         }
 
-        _restartInProgress = true;
         _restartCancelRequested = false;
         int done = 0;
+        // Counted separately from `done`, which advances past a target that vanished mid-run.
+        // That is right for the rail and wrong for the toast: a user who closes three
+        // not-yet-reached sessions and then stops would be told those three were "finished".
+        int restarted = 0;
         SetRestartProgress(done, targets.Count);
+        // Last statement before the try, so nothing above it can strand the flag set.
+        _restartInProgress = true;
         try
         {
             foreach (var id in targets)
@@ -4934,9 +4974,11 @@ private async Task RestartSessionsAsync(
                 // would strand it as dormant rather than stop anything.
                 if (_restartCancelRequested)
                 {
+                    // "Not restarted" rather than "left running": a target an earlier
+                    // failed restart dropped to dormant is neither restarted nor running.
                     Services.ToastHelper.Show("Restart stopped",
-                        $"Finished {done} of {targets.Count}. The remaining "
-                        + $"{targets.Count - done} session(s) were left running.");
+                        $"Restarted {restarted} of {targets.Count}. The remaining "
+                        + $"{targets.Count - done} session(s) were not restarted.");
                     break;
                 }
 
@@ -4954,7 +4996,11 @@ private async Task RestartSessionsAsync(
                 // Core, not RestartSessionAsync: this loop already holds _restartInProgress,
                 // and the guarded entry point would reject its own iterations.
                 var vm = _vm.Sessions.FirstOrDefault(s => s.Id == id);
-                if (vm != null) await RestartSessionCoreAsync(vm);
+                if (vm != null)
+                {
+                    await RestartSessionCoreAsync(vm);
+                    restarted++;
+                }
 
                 // Advanced even when the session had vanished, exactly as the restore rail
                 // advances past a session that failed to restore: a counter that stalls
@@ -4994,6 +5040,14 @@ private async Task RestartSessionAsync(SessionViewModel vm, string? launchedComm
                 "Another restart is still running — try again when it finishes.");
             return;
         }
+        // One session is enough to lose the race: this relaunch and a restoring session
+        // can both be starting claude.exe against ~/.claude.json at the same moment.
+        if (_restoreInProgress)
+        {
+            Services.ToastHelper.Show("Restart unavailable",
+                "Sessions are still being restored — try again once that finishes.");
+            return;
+        }
         _restartInProgress = true;
         try { await RestartSessionCoreAsync(vm, launchedCommand); }
         finally { _restartInProgress = false; }
@@ -5099,7 +5153,12 @@ private async Task RestartSessionCoreAsync(SessionViewModel vm, string? launched
         catch (Exception ex)
         {
             Log($"Restart FAILED for '{session.Name}': {ex}");
-            MessageBox.Show($"Failed to restart '{session.Name}': {ex.Message}",
+            // Owned. The owner-less overload passes IntPtr.Zero and the dialog can end up
+            // BEHIND the main window — and the bulk loop is blocked in this modal call, so
+            // the rail freezes at k/N with the pill still saying "restarting" and nothing
+            // visible to explain it. That is precisely the "reads as a hang" the rail was
+            // added to prevent.
+            MessageBox.Show(this, $"Failed to restart '{session.Name}': {ex.Message}",
                 "Restart Error", MessageBoxButton.OK, MessageBoxImage.Warning);
         }
 
diff --git a/src/CodeShellManager/Services/BulkRestartEstimate.cs b/src/CodeShellManager/Services/BulkRestartEstimate.cs
index e76a28e..7b88b17 100644
--- a/src/CodeShellManager/Services/BulkRestartEstimate.cs
+++ b/src/CodeShellManager/Services/BulkRestartEstimate.cs
@@ -46,8 +46,13 @@ public static class BulkRestartEstimate
     /// </summary>
     public static string DescribeDuration(int totalTargets, int claudeTargets)
     {
-        int claude = Math.Max(0, claudeTargets);
-        int others = Math.Max(0, totalTargets - claude);
+        // Clamped at both ends. `others` was already floored at 0, but an uncapped claude
+        // count invented duration out of nothing — (3 targets, 10 Claude) quoted 40–80
+        // seconds for three sessions. Not reachable from MainWindow, where claudeCount is
+        // a subset count of the same list, but this is public and cheap to make honest.
+        int total = Math.Max(0, totalTargets);
+        int claude = Math.Min(total, Math.Max(0, claudeTargets));
+        int others = total - claude;
 
         int lowSeconds = ClaudeLowSeconds * claude + OtherLowSeconds * others;
         int highSeconds = ClaudeHighSeconds * claude + OtherHighSeconds * others;
@@ -90,7 +95,13 @@ public static string BuildConfirmText(string headline, int totalTargets, int cla
                 + "session commands are stopped.");
         if (claude > 0)
             sb.Append(" Claude sessions resume their conversation.");
-        sb.Append(" You can stop the queue from the toolbar once it starts.");
+
+        // Only when there is actually a queue to stop. The bulk entry points confirm
+        // whatever the count, but SetRestartProgress hides the rail and pill at
+        // totalTargets <= 1 — so at exactly one session this sentence was pointing the
+        // user at a control that never appears.
+        if (totalTargets > 1)
+            sb.Append(" You can stop the queue from the toolbar once it starts.");
 
         return sb.ToString();
     }
diff --git a/tests/CodeShellManager.Tests/BulkRestartEstimateTests.cs b/tests/CodeShellManager.Tests/BulkRestartEstimateTests.cs
index fdcdae0..7b5a2c2 100644
--- a/tests/CodeShellManager.Tests/BulkRestartEstimateTests.cs
+++ b/tests/CodeShellManager.Tests/BulkRestartEstimateTests.cs
@@ -86,10 +86,49 @@ public void ConfirmText_SaysTheQueueCanBeStopped()
     {
         // The stop affordance is the answer to "I clicked Yes on 55 by mistake". If the
         // dialog doesn't mention it, the user has no reason to look for the toolbar pill.
+        //
+        // Asserting on "stop the queue", not on "stop": the body always ends "...any
+        // running session commands are stopped", so the looser substring was satisfied by
+        // text that says nothing about the affordance, and deleting the sentence entirely
+        // left this test green.
         string text = BulkRestartEstimate.BuildConfirmText(
             "Restart all 55 live sessions?", totalTargets: 55, claudeTargets: 52);
 
-        Assert.Contains("stop", text, System.StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("stop the queue", text);
+    }
+
+    [Fact]
+    public void ConfirmText_SingleTarget_DoesNotPromiseAStopControl()
+    {
+        // The bulk entry points confirm whatever the count, but SetRestartProgress hides
+        // the rail and pill for a single target — so at exactly one session the dialog was
+        // pointing the user at a control that is never rendered.
+        string text = BulkRestartEstimate.BuildConfirmText(
+            "Restart all 1 live session(s)?", totalTargets: 1, claudeTargets: 1);
+
+        Assert.DoesNotContain("stop the queue", text);
+        Assert.DoesNotContain("toolbar", text);
+    }
+
+    [Fact]
+    public void MoreClaudeTargetsThanTargets_IsClampedNotCompounded()
+    {
+        // Public surface: nothing in MainWindow can pass this today (claudeCount is a
+        // subset count of targets), but an uncapped claude count invented duration out of
+        // nothing — DescribeDuration(3, 10) quoted 40-80 seconds for three sessions.
+        string clamped = BulkRestartEstimate.DescribeDuration(totalTargets: 3, claudeTargets: 10);
+        string honest = BulkRestartEstimate.DescribeDuration(totalTargets: 3, claudeTargets: 3);
+
+        Assert.Equal(honest, clamped);
+    }
+
+    [Fact]
+    public void NegativeTargets_DoNotThrowOrInventTime()
+    {
+        string text = BulkRestartEstimate.DescribeDuration(totalTargets: -5, claudeTargets: -2);
+
+        Assert.Contains("0", text);
+        Assert.Contains("seconds", text);
     }
 
     [Fact]