held-mail lifecycle: no-live-pty rows for dead sessions never resolve, and workspace-scoped inbox hides them (global badge 25, every inbox 0)

[amrmelsayed]

Problem, in two halves

Field state on a real Tower (found via #1722's repro): 25 held rows with reason no-live-pty, workspace $HOME, newest 2026-09-04 — three weeks old, left by a long-gone architect session run from the home directory. Tower-wide held total is 28.

1. Held rows from a dead PTY never resolve. A no-live-pty hold means "deliver when the recipient's terminal comes back" — but a recipient that will NEVER come back (session long dead, workspace was a home-dir accident) leaves rows that sit indefinitely: never delivered, never expired, never escalated to a terminal disposition. They pin heldCount/mailboxEscalated on every unscoped surface forever.
2. Workspace-scoped afx inbox cannot see them. Inbox shows only the current workspace, so mail held under any other path is invisible to the CLI a user would naturally reach for — the global badge says 25, every repo's inbox says 0, and nothing bridges the two.

Fix shape (hypothesis, for the builder to validate)

For (2), cheap and immediate: afx inbox prints a one-line hint when OTHER workspaces hold mail — "N more held in other workspaces (afx inbox --all to list)" — plus an --all (or --workspace <path>) listing. Metadata-only redaction rules unchanged.

For (1), a disposition policy for undeliverable holds, decided deliberately rather than by silence:

• A hold whose recipient workspace/agent has no live session AND no registry row (the afx consistency check: reconcile registry vs git worktrees vs live processes (the independent observation that catches both under- and over-reporting) #1714 reconciliation classes) is a candidate for owner escalation with a terminal disposition: surfaced once to the owner (existing escalation channel) with age and reason, then dismissible in bulk (afx inbox --dismiss-stale or equivalent).
• Auto-EXPIRY by age alone is NOT proposed — a legitimately parked lane can be quiet for weeks (tower: delivery write edge — verify-or-retry 'delivered', settle-before-write, loud size limit (silent-loss residuals of #1564/#1521) #1573/tower: HOTFIX — echo-verify re-write loop re-injects a delivered message unboundedly (3.3.2 regression from #1573; zero re-writes after a completed write) #1584 taught that dropping or re-writing mail is how integrity bugs start). The policy should distinguish "recipient can plausibly return" (keep holding) from "recipient provably cannot" (escalate for disposition). Dismissal remains audit-preserving (soft transition), consistent with the existing cleanup semantics.

Related

• vscode: an empty window adopts $HOME as the workspace and badges unrelated held mail #1722 (vscode empty-window badge) — the surface that made these rows visible.
• vscode: held-mail drill-in — clickable held indicator with inspect + dismiss (revisits Spec 1313 Decision 8) #1594 (held-mail drill-in) — the in-editor inspect/dismiss surface would consume the same disposition affordances.
• afx consistency check: reconcile registry vs git worktrees vs live processes (the independent observation that catches both under- and over-reporting) #1714 / architect liveness: characterize dead-architect visibility and send behavior (prior claims partly retracted); architect table pid=0; no architect recover command #1717 — the liveness/reconciliation machinery that can prove "recipient cannot return".