183b9e4 Merge pull request #176 from bnema/chore/finalize-unified-session-access · vev

M AGENTS.md +6 -4


@@ -64,7 +64,7 @@ Before touching daemon teardown paths, read the lock-ordering notes at the top o
64		Wire payload types/codecs live in `internal/ports/frame.go` and `internal/ports/wire.go`. Connection framing lives in `internal/adapters/ipc/transport.go`.	64		Wire payload types/codecs live in `internal/ports/frame.go` and `internal/ports/wire.go`. Connection framing lives in `internal/adapters/ipc/transport.go`.
65			65
66		- IPC frames on a connection are 4-byte big-endian length, 1 type byte, then payload.	66		- IPC frames on a connection are 4-byte big-endian length, 1 type byte, then payload.
67	-	- Client message types currently occupy `1–13` (`MsgOutputResetRequest` is `13`); server types currently occupy `16–23` (`MsgSessionMeta` is `23`). The reserved bands are `1–15` and `16+` respectively.	67	+	- Client message types currently occupy `1–13` (`MsgOutputResetRequest` is `13`); server types occupy `16–23` (`MsgSessionMeta` is `23`) and `25` (`MsgAttachTarget`). Types `14–15` and `24` remain reserved.
68		- Version negotiation requires strict equality.	68		- Version negotiation requires strict equality.
69		- `Hello.Version` and `CommandRequest.Version` must stay first so their version peekers work.	69		- `Hello.Version` and `CommandRequest.Version` must stay first so their version peekers work.
70		- Bump `ProtocolVersion` for any message layout change.	70		- Bump `ProtocolVersion` for any message layout change.

@@ -74,6 +74,8 @@ Wire payload types/codecs live in `internal/ports/frame.go` and `internal/ports/
74		- Ephemeral numbered sessions survive detach while the daemon retains them, but are not persisted.	74		- Ephemeral numbered sessions survive detach while the daemon retains them, but are not persisted.
75		- Named sessions survive headless and persist across daemon restarts.	75		- Named sessions survive headless and persist across daemon restarts.
76		- The daemon starts on first use and exits when the last session ends.	76		- The daemon starts on first use and exits when the last session ends.
77	-	- Local attach sends `Hello`, receives `Welcome`, then pumps `Input`/`Resize` and `Output` frames.	77	+	- Each connection has a 15-second handshake budget from connect through the initial committed publication.
78	-	- Remote attach runs `ssh -- host vev _stdio` and proxies the same protocol over stdio; session selection is carried in `Hello`.	78	+	- Local and remote attach use the same `Hello`/`Welcome` session protocol, then pump `Input`/`Resize` and `Output` frames over a byte-only Transport.
79	-	- Only one client may attach to a session; a new attach replaces the old client.	79	+	- Remote attach opens a direct connection to the selected daemon over UDP by default; `VEV_REMOTE_TRANSPORT=stdio` explicitly selects an SSH-only carriage.
			80	+	- A session owns shared PTYs, VT state, tabs, panes, fixed PTY content size, and ordered mutations. Each attachment owns its window/view, copy and overlay state, rendering/output state, and reconnect lifecycle.
			81	+	- Command requests have a 10-second result deadline and are tracked per connection.

M README.md +4 -4


@@ -51,7 +51,7 @@ vev kill <name> kill a session (--all kills everything)
51			51
52		The daemon starts on first use and exits with the last session. Ephemeral sessions are numbered, survive detach, and disappear with the daemon. Named sessions persist across daemon restarts and come back with their layout, recovered terminal transcript, and allowlisted processes.	52		The daemon starts on first use and exits with the last session. Ephemeral sessions are numbered, survive detach, and disappear with the daemon. Named sessions persist across daemon restarts and come back with their layout, recovered terminal transcript, and allowlisted processes.
53			53
54	-	Each session has one active client. Attaching another client shows `Session snatched` on the prior client; press `r` to resume control, or `q`/Esc to quit that attachment. A remote snatched client that reconnects stays snatched and does not take control automatically.	54	+	A session may have multiple attachments. The session owns the PTYs, VT state, tabs, panes, fixed PTY content size, and ordered mutations. Each attachment owns its window, view, copy mode, overlays, rendering/output state, and reconnect lifecycle, so attachments can focus different tabs or panes without changing one another's view. The first valid attachment establishes the session's PTY content size; later window resizes affect only that attachment.
55			55
56		## Keys	56		## Keys
57			57

@@ -73,13 +73,13 @@ The palette does the rest: type a short code (`SPR` split right, `CNT` new tab,
73		vev attach user@host[:session]	73		vev attach user@host[:session]
74		```	74		```
75			75
76	-	SSH bootstraps the connection, then the session runs over UDP and resumes after sleep or Wi-Fi changes. vev must be installed on the remote. If your firewall only allows SSH, open the UDP range first (default `61000:61023`, override with `VEV_UDP_PORT_RANGE`):	76	+	The client opens a direct connection to the selected remote daemon. UDP is the default: SSH bootstraps an authenticated UDP endpoint, then the session runs over that connection and resumes after sleep or Wi-Fi changes. vev must be installed on the remote. If your firewall only allows SSH, open the UDP range first (default `61000:61023`, override with `VEV_UDP_PORT_RANGE`):
77			77
78		```sh	78		```sh
79		sudo ufw allow 61000:61023/udp	79		sudo ufw allow 61000:61023/udp
80		```	80		```
81			81
82	-	Where UDP is not an option, `VEV_REMOTE_TRANSPORT=stdio` keeps everything inside SSH at the cost of slower disconnect detection. Details in [docs/remote-resilience.md](docs/remote-resilience.md).	82	+	Where UDP is not an option, set `VEV_REMOTE_TRANSPORT=stdio` to keep the direct connection inside SSH; this is an explicit transport choice. Every connection has a 15-second handshake deadline, and each command request has a 10-second deadline. Details in [docs/remote-resilience.md](docs/remote-resilience.md).
83			83
84		List sessions on a known host (OpenSSH resolves aliases from your SSH config):	84		List sessions on a known host (OpenSSH resolves aliases from your SSH config):
85			85

@@ -119,7 +119,7 @@ vev cmd [-s <source-session>] [--self] move-pane <destination-session> <destinat
119		vev cmd [-s <source-session>] [--self] move-tab <destination-session>	119		vev cmd [-s <source-session>] [--self] move-tab <destination-session>
120		```	120		```
121			121
122	-	Use `vev cmd -s <destination-session> list-tabs` to find stable destination tab IDs. Destinations must be live, but may be named or ephemeral; stopped sessions are not eligible. A moved pane is split to the right of the destination tab's focused pane and becomes that tab's internal focus without activating the tab. A moved tab is appended to the destination in the background. If the move empties the source session, its client follows the moved pane or tab, activates the destination, and snatches any active destination client.	122	+	Use `vev cmd -s <destination-session> list-tabs` to find stable destination tab IDs. Destinations must be live, but may be named or ephemeral; stopped sessions are not eligible. A moved pane is split to the right of the destination tab's focused pane and becomes that tab's internal focus without activating the tab. A moved tab is appended to the destination in the background. If the move empties the source session, its attachment follows the moved pane or tab and activates the destination; existing destination attachments keep their own views.
123			123
124		Moving the final tiled pane out of a tab is rejected while that tab has a floating pane slot; close the floating pane or move the whole tab instead. Named-session persistence is best-effort across a move, not crash-atomic across source and destination snapshots.	124		Moving the final tiled pane out of a tab is rejected while that tab has a floating pane slot; close the floating pane or move the whole tab instead. Named-session persistence is best-effort across a move, not crash-atomic across source and destination snapshots.
125			125

M docs/performance.md +69 -185

@@ -1,212 +1,96 @@
1		# Performance measurement	1		# Performance measurement
2			2
3	-	## S5a transport observability	3	+	vev measures the current session and attachment stack with process-local runtime
4	-		4	+	marks and harness-owned end-to-end boundaries. Measurement does not alter
5	-	S5a is measurement-only. It records process-local runtime marks and harness-owned	5	+	rendering, pacing, transport policy, wire bytes, or `ProtocolVersion`.
6	-	end-to-end boundaries without changing rendering, pacing, transport policy, wire	6	+
7	-	bytes, or `ProtocolVersion`. The canonical matrix and workload/topology/	7	+	## Canonical matrix
8	-	transport coverage are in [`testdata/perf/manifest.json`](../testdata/perf/manifest.json):	8	+
9	-	`1x4`, `4x1`, `4x4`, and `8x1`, all at `120x40` with 10,000 rows per pane;	9	+	The canonical matrix is [`testdata/perf/manifest.json`](../testdata/perf/manifest.json):
10	-	idle, active/all/inactive output, interactive flood, copy search, resize sweep,	10	+
11	-	snapshot/output/resize, and attach/restore/tab switch; local, SSH stdio, UDP	11	+	- topologies `1x4`, `4x1`, `4x4`, and `8x1`;
12	-	baseline, UDP 25/100 ms, and UDP 0%/1% loss. It has 252 scenarios (4×9×7),	12	+	- `120x40` terminal content with 10,000 history rows per pane;
13	-	with inapplicable cases required to be explicit. The seven transport entries are	13	+	- idle, active output, all/inactive output, interactive flood, copy search,
14	-	`local`, `ssh_stdio`, `udp_baseline`, `udp_loss_0pct`, `udp_25ms`, `udp_100ms`,	14	+	resize sweep, snapshot/output/resize, and attach/restore/tab switch;
15	-	and `udp_loss_1pct`.	15	+	- local, SSH stdio, direct UDP, UDP with 25/100 ms latency, and UDP with 0%/1%
16	-		16	+	loss.
17	-	### Trace schema and clock domains	17	+
			18	+	The matrix contains 252 scenarios (4 topologies × 9 workloads × 7
			19	+	transports). Inapplicable scenarios stay present with an explicit reason.
			20	+	Multiple-attachment scenarios measure shared session mutations together with
			21	+	independent attachment views and output streams.
			22	+
			23	+	A connection handshake is bounded by 15 seconds. A command request is bounded
			24	+	by 10 seconds. These limits apply during measurement as well as normal use.
			25	+
			26	+	## Trace schema and clocks
18			27
19		Every process JSONL record has exactly these fields:	28		Every process JSONL record has exactly these fields:
20	-	`schema` (uint), `process_id` (string), `component` (string), `scenario`	29	+	`schema`, `process_id`, `component`, `scenario`, `run`, `sequence`, `request_id`,
21	-	(string), `run`, `sequence`, `request_id`, `epoch` (uint), `kind` (string),	30	+	`epoch`, `kind`, `tick`, `bytes`, `fragments`, `retransmits`, `pending`,
22	-	`tick` (int64), `bytes`, `fragments`, `retransmits`, `pending` (uint),	31	+	`ack_rtt_nanos`, and `valid`.
23	-	`ack_rtt_nanos` (int64), and `valid` (bool). Schema 1 is represented by:	32	+
			33	+	Schema 1 is represented by:
24			34
25		```json	35		```json
26		{"schema":1,"process_id":"p","component":"daemon","scenario":"s","run":1,"sequence":1,"request_id":1,"epoch":1,"kind":"diff_start","tick":0,"bytes":0,"fragments":0,"retransmits":0,"pending":0,"ack_rtt_nanos":0,"valid":true}	36		{"schema":1,"process_id":"p","component":"daemon","scenario":"s","run":1,"sequence":1,"request_id":1,"epoch":1,"kind":"diff_start","tick":0,"bytes":0,"fragments":0,"retransmits":0,"pending":0,"ack_rtt_nanos":0,"valid":true}
27		```	37		```
28			38
29	-	`tick` is stamped only by the concrete JSONL observer using its process-local	39	+	The concrete JSONL observer stamps `tick` with its process-local injected
30	-	injected monotonic clock; producers supply no timestamp. The harness sets `VEV_PERF_TRACE`,	40	+	monotonic clock; producers supply no timestamp. Components in one OS process
31	-	`VEV_PERF_PROCESS_ID`, `VEV_PERF_SCENARIO`, and `VEV_PERF_RUN` for every	41	+	share that observer. The harness owns a separate monotonic clock for the
32	-	launched role, identifying its exclusive trace path and process/scenario/run	42	+	input-injection to successfully-flushed-terminal-bytes boundary. Ticks from
33	-	mapping. Components in one OS	43	+	different processes or clock domains are never ordered or subtracted. Records
34	-	process share that observer. A spawned daemon is deliberately stripped of	44	+	correlate through scenario, run, sequence, request, and epoch IDs.
35	-	these variables so it cannot append to a role's trace. The harness clock is a
36	-	separate monotonic domain and is the sole clock for input-injection → terminal-
37	-	bytes-successfully-flushed end-to-end samples. Cross-process ticks are never
38	-	ordered or subtracted; records correlate only by scenario/run/sequence/request/
39	-	epoch IDs. A `component=observer`, `kind=transport_diagnostic`, `valid=false`
40	-	record explicitly reports bounded-observer loss; spans crossing that gap are
41	-	excluded, while an unmatched end without such a gap remains an error.
42	-
43	-	The named process-local spans are capture, compose, diff, queue wait,
44	-	ACK-blocked interval, emit, adapter send, and adapter receive. Their start/end
45	-	marks are paired within one process and summarized by component/adapter with
46	-	raw records, counts, p50/p95/p99, and max. Diagnostic fields (bytes, fragments,
47	-	retransmits, pending, ACK RTT) remain separate from duration calculations.
48	-
49	-	### Historical proxy ANSI baseline
50	-
51	-	Before this refactor, proxied state-bearing screen updates transported ANSI
52	-	and were applied through the local proxy VT parser. This parser benchmark remains
53	-	a historical diagnostic. Ordinary local output remains the ANSI `MsgOutput`
54	-	guardrail.
55	-
56	-	The binaries were built from clean, exact commits in temporary clones so their
57	-	provenance is embedded and checkable:
58			45
59	-	```sh	46	+	Process-local spans cover capture, compose, diff, queue wait, acknowledgement
60	-	GIT_CONFIG_GLOBAL=/dev/null git clone --no-local /home/brice/dev/projects/vev /tmp/vev-perf-baseline-1f2c802-clone	47	+	blocking, emit, adapter send, and adapter receive. Bytes, fragments,
61	-	GIT_CONFIG_GLOBAL=/dev/null git -C /tmp/vev-perf-baseline-1f2c802-clone checkout --detach 1f2c802d0707785cab979134db6a95645250a82c	48	+	retransmits, pending work, and acknowledgement RTT remain diagnostics rather
62	-	GIT_CONFIG_GLOBAL=/dev/null git clone --no-local /home/brice/dev/projects/vev/.worktrees/perf/proxy-screen-baseline /tmp/vev-perf-candidate-2b48abf9-clone	49	+	than duration inputs. Reports retain raw records, counts, p50/p95/p99, and max
63	-	GIT_CONFIG_GLOBAL=/dev/null git -C /tmp/vev-perf-candidate-2b48abf9-clone checkout --detach 2b48abf9b481c3dbdc371ba13c15cf06051d9df0	50	+	where applicable.
64	-	(cd /tmp/vev-perf-baseline-1f2c802-clone && go build -o /tmp/vev-proxy-baseline-1f2c802 .)
65	-	(cd /tmp/vev-perf-candidate-2b48abf9-clone && go build -o /tmp/vev-proxy-candidate-2b48abf9 .)
66	-	GIT_CONFIG_GLOBAL=/dev/null git clone --no-local /home/brice/dev/projects/vev/.worktrees/perf/proxy-screen-baseline /tmp/vev-perf-harness-d479fe9-clone
67	-	GIT_CONFIG_GLOBAL=/dev/null git -C /tmp/vev-perf-harness-d479fe9-clone checkout --detach d479fe99581cf1988efba7906914c9ddd8653d7d
68	-	(cd /tmp/vev-perf-harness-d479fe9-clone && go build -o /tmp/vev-perf-harness-d479fe9 ./cmd/vev-perf-harness)
69	-	go version -m /tmp/vev-proxy-baseline-1f2c802
70	-	go version -m /tmp/vev-proxy-candidate-2b48abf9
71	-	go version -m /tmp/vev-perf-harness-d479fe9
72	-	```
73			51
74	-	The baseline benchmark below is a measured median of ten repetitions on	52	+	## Running the matrix
75	-	Linux/amd64 with an AMD Ryzen 9 7900X3D, using Go 1.26.5 and commit
76	-	`1f2c802d0707785cab979134db6a95645250a82c`:
77			53
78	-	```sh	54	+	Use a clean build and at least a 10-second warmup, a 30-second measured
79	-	cd /tmp/vev-perf-baseline-clone	55	+	interval, and ten independent repetitions:
80	-	go test ./internal/usecase/daemon -run '^$' \
81	-	-bench '^BenchmarkProxyANSIApply$' -benchmem -count=10 \
82	-	\| tee /tmp/vev-perf-results/baseline-1f2c802-proxy-ansi.txt
83	-	```
84	-
85	-	\| ANSI workload \| ns/op \| B/op \| allocs/op \| ANSI bytes/op \|
86	-	\| --- \| ---: \| ---: \| ---: \| ---: \|
87	-	\| absolute-position one-cell \| 93.31 \| 16 \| 1 \| 9 \|
88	-	\| 120-column full line \| 4,777 \| 130 \| 1 \| 126 \|
89	-	\| fragmented truecolor styled line \| 6,119.5 \| 450 \| 1 \| 419 \|
90	-	\| full-width 40-row scroll \| 238,709 \| 5,477.5 \| 1 \| 4,880 \|
91	-
92	-	Keep the ordinary local ANSI renderer as a separate guardrail:
93			56
94		```sh	57		```sh
95	-	cd /tmp/vev-perf-candidate-2b48abf9-clone	58	+	go build -o /tmp/vev ./
96	-	go test ./pkg/renderer -run '^$' -bench '^BenchmarkRenderer' -benchmem -count=10 \	59	+	rm -rf testdata/perf/results
97	-	\| tee /tmp/vev-perf-results/candidate-2b48abf9-renderer.txt	60	+	go run ./cmd/vev-perf-harness \
			61	+	--vev-bin /tmp/vev \
			62	+	--manifest testdata/perf/manifest.json \
			63	+	--out testdata/perf/results \
			64	+	--warmup 10s --duration 30s --repetitions 10
98		```	65		```
99			66
100	-	The candidate guardrail completed with Go 1.26.5; its ten-repetition output is	67	+	Each run writes `manifest.json`, `raw-harness.jsonl`, one trace per launched
101	-	retained at `/tmp/vev-perf-results/candidate-2b48abf9-renderer.txt`.	68	+	process, `runs.json`, and `summary.json`. The process manifest records process
			69	+	identity, role, scenario/run, clock domain, and its exclusive trace path.
102			70
103	-	### Public-CLI transport runs	71	+	The harness injects at most one measured event per second. A sample requires
			72	+	both input injection and successful terminal flush inside the measured
			73	+	interval; warmup, straddling, and failed events remain raw diagnostics. Reject
			74	+	results with missing or unmatched boundaries, invalid correlation,
			75	+	nonmonotonic same-process sequence, negative same-domain duration, fewer than
			76	+	10 complete in-interval pairs, invalid denominators, cross-process tick math,
			77	+	less than 30 seconds measured, or fewer than 10 repetitions.
104			78
105	-	The adoption gate requires a 10-second warmup, a 30-second measured interval,	79	+	Before a full run, validate the manifest and harness:
106	-	and ten independent repetitions for each of seven workloads × five transports
107	-	(35 scenarios), for both exact baseline and candidate binaries. This exact
108	-	command template was executed for every scenario (the two 35-scenario sets
109	-	were run separately to avoid oversubscribing the host):
110			80
111		```sh	81		```sh
112	-	for bin in baseline candidate; do	82	+	jq -e '(.topologies\|length)==4 and (.workloads\|length)==9 and (.transports\|length)==7 and (.scenarios\|length)==252' testdata/perf/manifest.json
113	-	case "$bin" in	83	+	go test ./cmd/vev-perf-harness
114	-	baseline) vev_bin=/tmp/vev-proxy-baseline-1f2c802 ;;
115	-	candidate) vev_bin=/tmp/vev-proxy-candidate-2b48abf9 ;;
116	-	esac
117	-	for workload in active_output all_output inactive_output interactive_flood resize_sweep \
118	-	snapshot_output_resize attach_restore_tab_switch; do
119	-	for transport in local ssh_stdio udp_baseline udp_25ms udp_loss_1pct; do
120	-	scenario="1x4-${workload}-${transport}"
121	-	/tmp/vev-perf-harness-d479fe9 \
122	-	--vev-bin "$vev_bin" \
123	-	--manifest /tmp/vev-perf-harness-d479fe9-clone/testdata/perf/manifest.json \
124	-	--scenario "$scenario" \
125	-	--out "/tmp/vev-perf-results/public-final-${bin}-matrix/$scenario" \
126	-	--warmup 10s --duration 30s --repetitions 10
127	-	done
128	-	done
129	-	done
130		```	84		```
131			85
132	-	The measured outputs are retained only under `/tmp/vev-perf-results/`. Each	86	+	For a bounded local check, add `--scenario 1x4-idle-local`. The harness still
133	-	binary completed 13/35 scenarios with ten runs; 22 scenarios stopped before a	87	+	validates the complete manifest before selecting that scenario. Do not commit
134	-	summary. The common completed results below are harness end-to-end medians	88	+	result directories; raw traces and run manifests are the measurement evidence.
135	-	from `summary.json` (p50/p95, ns):
136	-
137	-	\| scenario \| baseline samples \| candidate samples \| baseline p50/p95 \| candidate p50/p95 \|
138	-	\| --- \| ---: \| ---: \| ---: \| ---: \|
139	-	\| 1x4-active_output-local \| 300 \| 300 \| 16,913,252 / 17,407,463 \| 16,922,803 / 17,444,022 \|
140	-	\| 1x4-active_output-ssh_stdio \| 300 \| 300 \| 17,204,192 / 17,621,643 \| 17,209,503 / 17,521,432 \|
141	-	\| 1x4-active_output-udp_baseline \| 300 \| 300 \| 17,065,232 / 17,715,522 \| 17,032,283 / 17,729,992 \|
142	-	\| 1x4-active_output-udp_25ms \| 290 \| 290 \| 43,067,851 / 69,676,961 \| 43,086,281 / 69,753,290 \|
143	-	\| 1x4-all_output-local \| 300 \| 300 \| 16,977,662 / 17,352,912 \| 16,958,053 / 17,326,013 \|
144	-	\| 1x4-all_output-ssh_stdio \| 300 \| 300 \| 17,250,583 / 17,541,982 \| 17,284,843 / 17,643,873 \|
145	-	\| 1x4-all_output-udp_baseline \| 300 \| 300 \| 19,826,321 / 20,920,741 \| 20,017,971 / 20,717,372 \|
146	-	\| 1x4-all_output-udp_25ms \| 290 \| 290 \| 48,814,889 / 70,035,730 \| 48,740,189 / 70,268,490 \|
147	-	\| 1x4-inactive_output-local \| 300 \| 300 \| 17,278,873 / 17,705,613 \| 17,279,933 / 17,690,672 \|
148	-	\| 1x4-inactive_output-ssh_stdio \| 300 \| 300 \| 17,140,253 / 17,731,882 \| 17,142,882 / 17,781,913 \|
149	-	\| 1x4-inactive_output-udp_baseline \| 300 \| 300 \| 21,030,321 / 23,221,780 \| 20,795,161 / 23,274,900 \|
150	-	\| 1x4-inactive_output-udp_25ms \| 280 \| 280 \| 89,857,641 / 104,327,126 \| 89,843,102 / 102,844,306 \|
151	-	\| 1x4-attach_restore_tab_switch-local \| 300 \| 300 \| 7,812,797 / 8,501,746 \| 7,725,516 / 8,593,246 \|
152	-
153	-	`1x4-active_output-ssh_stdio` now completes for both binaries, so the former
154	-	trace-correlation blocker is fixed. The remaining failed scenarios are
155	-	retained as stderr evidence: all five `interactive_flood`, all five
156	-	`resize_sweep`, all five `snapshot_output_resize`, the four non-local
157	-	`attach_restore_tab_switch` transports, and the three `udp_loss_1pct`
158	-	output scenarios. They report terminal-start/readiness failures or missing
159	-	receive span pairs; they are not converted into samples.
160	-
161	-	The balanced gate is blocked, not passed: only 13/35 scenarios have valid
162	-	A/B summaries, so the 5% gate and adoption cannot be declared. The completed
163	-	common p50 values happened to stay within ±1.12%, but that is not a gate
164	-	result and does not substitute for the 22 missing scenarios.
165	-
166	-	`summary.json` provenance was checked for every completed result:
167	-	`git_sha=d479fe99581cf1988efba7906914c9ddd8653d7d`, with
168	-	`vev_git_sha=1f2c802d0707785cab979134db6a95645250a82c` for baseline and
169	-	`vev_git_sha=2b48abf9b481c3dbdc371ba13c15cf06051d9df0` for candidate. The
170	-	complete 252-scenario canonical matrix was not run because the representative
171	-	gate was incomplete. Its exact command remains:
172			89
173	-	```sh	90	+	## In-process checks
174	-	rm -rf /tmp/vev-perf-results/public-full-baseline
175	-	/tmp/vev-perf-harness-d479fe9 --vev-bin /tmp/vev-proxy-baseline-1f2c802 \
176	-	--manifest /tmp/vev-perf-harness-d479fe9-clone/testdata/perf/manifest.json \
177	-	--out /tmp/vev-perf-results/public-full-baseline \
178	-	--warmup 10s --duration 30s --repetitions 10
179	-	```
180			91
181	-	Warmup is excluded. During the measured interval the harness injects at most	92	+	These commands measure local daemon or VT work only, not end-to-end transport
182	-	one event per second. At least 10 complete event pairs are required: both input	93	+	latency:
183	-	injection and successful terminal flush must fall inside the interval.
184	-	Straddling or failed events remain raw diagnostics, not samples. Each run must
185	-	contain `manifest.json`, `raw-harness.jsonl`, per-process JSONL, `runs.json`, and
186	-	`summary.json`.
187	-
188	-	`summary.json` records the harness source as `git_sha`, the measured vev binary
189	-	source as `vev_git_sha`, and the measurement parameters. `runs.json`, run
190	-	manifests, and JSONL identify scenario, run, process, component, and correlation
191	-	IDs. Preserve those files with the benchmark output and record
192	-	`go version -m /tmp/vev-proxy-baseline-1f2c802`,
193	-	`go version -m /tmp/vev-proxy-candidate-2b48abf9`, and
194	-	`go version -m /tmp/vev-perf-harness-d479fe9`; do not commit result directories.
195	-	CPU and allocation evidence comes from Go microbenchmarks and process-local
196	-	span durations. End-to-end latency, terminal flush, and byte evidence comes
197	-	from the public-CLI harness. Reset, snapshot, and span counters for structured
198	-	output are candidate-only until that output exists.
199	-
200	-	Reject results with missing input/flush boundaries, unmatched IDs, bad
201	-	correlation, nonmonotonic same-process sequence, negative same-domain spans,
202	-	fewer than 10 complete in-interval event pairs, invalid denominators, any
203	-	cross-process tick arithmetic, or unmet duration/repetition minima. Raw JSONL
204	-	and run manifests are evidence; no result alone authorizes an optimization.
205	-
206	-	## Existing in-process smoke checks
207	-
208	-	These commands measure local daemon work only and are not end-to-end transport
209	-	results:
210			94
211		```sh	95		```sh
212		go test ./internal/usecase/daemon -run '^$' -bench '^BenchmarkDaemonHistory' -benchtime=1x -benchmem	96		go test ./internal/usecase/daemon -run '^$' -bench '^BenchmarkDaemonHistory' -benchtime=1x -benchmem

M docs/remote-resilience.md +53 -27

 # Remote resilience
-Remote attach starts with SSH bootstrap and then carries the vev session over authenticated UDP. The design is inspired by mosh's mobile-shell resilience, but vev uses its own protocol and is not compatible with mosh clients or servers.
+Remote attachments connect directly to the selected vev daemon. UDP is the
+normal carriage: SSH bootstraps an authenticated endpoint, then the attachment
+carries the vev protocol over UDP. Set `VEV_REMOTE_TRANSPORT=stdio` to use an
+SSH-only carriage explicitly when UDP is unavailable. vev must be installed on
+the remote host.
-The raw UDP AEAD key is never persisted by vev; the proxy registry stores only its SHA-256 ownership fingerprint. During bootstrap, the key briefly exists in memory in the proxy, the `_udp-bootstrap` relay, the client, and associated SSH/readiness I/O and string buffers. vev promptly clears reachable key buffers after handoff on a best-effort basis. Builds made with Go 1.26 and `GOEXPERIMENT=runtimesecret` additionally protect key-handling call trees with `runtime/secret` on linux/amd64 and linux/arm64; on unsupported platforms, `runtime/secret` calls the function directly. These protections do not cover globals, goroutines started by protected calls, copies retained by I/O implementations, or key material retained in cipher state.
+The session remains shared across all attachments. It owns PTYs, VT state, tabs,
+panes, a fixed PTY content size, and ordered mutations. Each attachment keeps
+its own window size, selected tab and pane, copy mode, overlays, render/output
+acknowledgements, and reconnect state. Reconnecting one attachment resumes that
+attachment without replacing or changing its peers.
-## Operational model
+## Connection limits
-- SSH bootstrap starts or finds the remote UDP endpoint.
+- A connection handshake has one 15-second deadline from connection start
-- UDP carries normal session traffic after bootstrap. The remote proxy binds a port in a fixed range, `61000-61023` by default; `VEV_UDP_PORT_RANGE` overrides it (a range, a single port, or `0` for a random ephemeral port).
+  through Hello, Welcome, and the initial committed publication. The deadline
-- Named sessions remain recoverable across daemon restarts; ephemeral sessions remain recoverable only while the daemon retains them.
+  applies to local and remote connections.
-- `VEV_REMOTE_TRANSPORT=stdio` keeps all traffic inside SSH when direct UDP is blocked.
+- Each command request has a 10-second deadline for its result. A timeout
+  abandons only that request; it does not complete a later request with a stale
+  result.
+- The first valid attachment establishes the session's PTY content size. A
+  later attachment can resize its own window without resizing shared PTYs.
-## Recovery states
+## UDP operation
-Resilience work uses these user-facing states:
+- The remote host selects a UDP port in `61000-61023` by default. Set
+  `VEV_UDP_PORT_RANGE` to a range, one port, or `0` for an ephemeral port.
+- The UDP carriage authenticates and retransmits protocol frames, preserves
+  frame order, and reports bounded link-health state without logging payloads,
+  addresses, keys, or identities.
+- The attachment reconnects with its resume token after a path change. The
+  remote session and its PTYs remain in place while the attachment is offline.
-| State | Meaning |
+The raw UDP AEAD key is held only in memory during bootstrap and transport
-| --- | --- |
+setup. It is not written to durable state. Key buffers are cleared on the
-| `connected` | a complete record or meaningful ACK progress is recent |
+reachable handoff paths on a best-effort basis; cipher implementations and
-| `degraded` | authenticated UDP packets still arrive, but complete-record or ACK progress is delayed |
+other I/O owners may retain internal copies for their lifetime.
-| `probing` | authenticated UDP packet contact is absent, so vev probes for path recovery |
-| `resuming` | a replacement transport is attaching to the same session |
-| `offline` | authenticated UDP contact remains absent; vev re-runs the SSH bootstrap and re-dials UDP with the resume token |
-| `expired` | the session or recovery window is no longer available |
-When a terminal is in raw mode, recovery messages appear as vev status text rather than as bytes written into the remote program's output stream.
+## Connection states
-`VEV_REMOTE_TRANSPORT=stdio` is the SSH-stdio fallback: it keeps the session inside authenticated SSH when UDP is blocked or unavailable. It remains available while UDP recovery is attempted.
+| State | Meaning |
+| --- | --- |
+| `connected` | Recent authenticated contact and complete frame progress. |
+| `degraded` | Authenticated packets arrive, but complete-frame or acknowledgement progress is delayed. |
+| `probing` | Authenticated contact is absent and the carriage is probing for a recovered path. |
+| `resuming` | This attachment is opening a replacement connection with its resume token. |
+| `offline` | The attachment is re-establishing the selected remote transport. |
+| `expired` | The session or attachment resume window is no longer available. |
-## UDP transport health diagnostics
+In raw terminal mode, state changes appear as vev status text rather than bytes
+written into the PTY's output stream.
-At debug logging, UDP transport-health lines report only state, elapsed progress ages, and bounded transport counters; they do not include payloads, addresses, keys, or identities. For a real remote attempt, `scripts/debug-remote-attach.sh --udp-health user@host` stores redacted transport-health lines and Linux `ss -u -m` socket-memory counters, then prints the exact collected file paths.
+## Diagnostics and checks
-## Manual checks
+At debug level, transport-health logs contain only state, elapsed progress ages,
+and bounded counters. `scripts/debug-remote-attach.sh --udp-health user@host`
+collects redacted health lines and Linux `ss -u -m` socket-memory counters.
-Useful scenarios for validating resilience behavior:
+Useful checks are:
 - block and unblock the configured UDP port range;
 - move between networks or change VPN state;
-- suspend and resume the client machine;
+- suspend and resume the attachment machine;
-- retry `vev attach user@host:session` for the same named session;
+- reconnect to the same named session;
-- compare logs for UDP silence, probing, SSH bootstrap failure, proxy expiry, and missing sessions.
+- verify that a second attachment retains its independent view while the first
+  reconnects.
-Keep hostnames, usernames, and local paths out of shared logs and screenshots.
+Keep hostnames, usernames, keys, and local paths out of shared logs and
+screenshots.

M docs/terminal.md +7 -1

 On each attach, the attaching environment becomes the session's source of truth for future PTY children. vev preserves it except that it replaces `TERM`, `COLORTERM`, `TERM_PROGRAM`, and `VEV`; `SHELL` selects the command used to start each PTY. Already-running processes keep their original environment.
-For remote attaches, the remote proxy substitutes the remote host's exported environment, so remote PTYs do not inherit the local client's environment.
+The attaching client's exported environment is sent in the connection handshake and becomes the session's source of truth for future PTY children, including remote attaches. A later attachment updates that shared environment for children created afterward; already-running processes keep their original environment.
 ## VT compatibility
 vev keeps a server-side VT screen per pane: scroll regions (DECOM), insert mode, cursor and mode-query reports, alternate screen, bracketed paste, mouse tracking, synchronized updates, OSC 9/777 notifications, OSC 52 clipboard, and double-width cells. Resizes repair double-width cells so CJK and emoji halves are never left behind.
+## Session content size
+The first valid attachment establishes the session's fixed PTY content size. Each
+attachment may have a different outer window and viewport; resizing it changes
+only its attachment-local presentation and does not resize shared PTYs.
 ## Recovery
 Named-session checkpoints preserve bounded scrollback and a recovery transcript containing the primary viewport followed by the active alternate viewport, when present. Each viewport trims only trailing untouched blank rows; leading, internal, styled, and otherwise touched blank rows remain.

M internal/adapters/sshstdio/transport.go +237 -30


@@ -12,6 +12,7 @@ import (
12		"fmt"	12		"fmt"
13		"io"	13		"io"
14		"log/slog"	14		"log/slog"
			15	+	"os"
15		"os/exec"	16		"os/exec"
16		"strings"	17		"strings"
17		"sync"	18		"sync"

@@ -33,6 +34,18 @@ var (
33			34
34		type closeFunc func() error	35		type closeFunc func() error
35		type eofErrFunc func() error	36		type eofErrFunc func() error
			37	+	type operationKind uint8
			38	+
			39	+	const (
			40	+	operationSend operationKind = iota
			41	+	operationReceive
			42	+	operationKindCount
			43	+	)
			44	+
			45	+	type operationWait struct {
			46	+	send <-chan struct{}
			47	+	receive <-chan struct{}
			48	+	}
36			49
37		type Option func(*transport)	50		type Option func(*transport)
38			51

@@ -57,7 +70,26 @@ func newTransport(r io.Reader, w io.Writer, closeFn closeFunc, eofErr eofErrFunc
57		if closeFn == nil {	70		if closeFn == nil {
58		closeFn = func() error { return nil }	71		closeFn = func() error { return nil }
59		}	72		}
60	-	return &transport{r: r, w: w, close: closeFn, eofErr: eofErr}	73	+	t := &transport{
			74	+	r: r,
			75	+	w: w,
			76	+	close: closeFn,
			77	+	eofErr: eofErr,
			78	+	done: make(chan struct{}),
			79	+	}
			80	+	if file, ok := r.(*os.File); ok && file == os.Stdin {
			81	+	t.r = newProcessStdinReader(file, t.done)
			82	+	} else if closer, ok := r.(io.Closer); ok {
			83	+	t.readerCloser = closer
			84	+	} else {
			85	+	t.r = newUnownedReader(r, t.done)
			86	+	}
			87	+	if file, ok := w.(*os.File); !ok \|\| file != os.Stdout {
			88	+	if closer, ok := w.(io.Closer); ok {
			89	+	t.writerCloser = closer
			90	+	}
			91	+	}
			92	+	return t
61		}	93		}
62			94
63		type transport struct {	95		type transport struct {

@@ -65,11 +97,14 @@ type transport struct {
65		w io.Writer	97		w io.Writer
66		close closeFunc	98		close closeFunc
67		eofErr eofErrFunc	99		eofErr eofErrFunc
			100	+	readerCloser io.Closer
			101	+	writerCloser io.Closer
			102	+	done chan struct{}
68		observer ports.SerializedRuntimeObserver	103		observer ports.SerializedRuntimeObserver
69		operationMu sync.Mutex	104		operationMu sync.Mutex
70	-	operationCount int	105	+	operationCount [operationKindCount]int
71		closing bool	106		closing bool
72	-	operationsDone chan struct{}	107	+	operationsDone [operationKindCount]chan struct{}
73		closeOnce sync.Once	108		closeOnce sync.Once
74		closeErr error	109		closeErr error
75			110

@@ -77,6 +112,154 @@ type transport struct {
77		readBuf []byte	112		readBuf []byte
78		}	113		}
79			114
			115	+	type readResult struct {
			116	+	data []byte
			117	+	err error
			118	+	}
			119	+
			120	+	// unownedReader is the generic cancellation boundary for readers that cannot
			121	+	// be closed by the transport. The worker may remain blocked until the source
			122	+	// itself is released; process stdin uses the singleton pump below instead.
			123	+	// ponytail: arbitrary io.Reader has no cancellation contract, so one fallback
			124	+	// worker may remain until that source returns; add a cancellable reader port if
			125	+	// another production unowned source appears.
			126	+	type unownedReader struct {
			127	+	r io.Reader
			128	+	done <-chan struct{}
			129	+	}
			130	+
			131	+	func newUnownedReader(r io.Reader, done <-chan struct{}) *unownedReader {
			132	+	return &unownedReader{r: r, done: done}
			133	+	}
			134	+
			135	+	func (r *unownedReader) Read(dst []byte) (int, error) {
			136	+	select {
			137	+	case <-r.done:
			138	+	return 0, io.ErrClosedPipe
			139	+	default:
			140	+	}
			141	+	result := make(chan readResult, 1)
			142	+	go func() {
			143	+	buf := make([]byte, len(dst))
			144	+	n, err := r.r.Read(buf)
			145	+	result <- readResult{data: buf[:n], err: err}
			146	+	}()
			147	+	select {
			148	+	case <-r.done:
			149	+	return 0, io.ErrClosedPipe
			150	+	case result := <-result:
			151	+	select {
			152	+	case <-r.done:
			153	+	return 0, io.ErrClosedPipe
			154	+	default:
			155	+	}
			156	+	copy(dst, result.data)
			157	+	return len(result.data), result.err
			158	+	}
			159	+	}
			160	+
			161	+	type processStdinPump struct {
			162	+	chunks chan readResult
			163	+	mu sync.Mutex
			164	+	buf []byte
			165	+	err error
			166	+	}
			167	+
			168	+	var processStdinPumps struct {
			169	+	sync.Mutex
			170	+	file *os.File
			171	+	pump *processStdinPump
			172	+	}
			173	+
			174	+	// processStdinPumpFor keeps one read worker for the process stdin lifetime.
			175	+	// Reconnects therefore do not strand one blocked worker per transport.
			176	+	func processStdinPumpFor(file os.File) processStdinPump {
			177	+	processStdinPumps.Lock()
			178	+	defer processStdinPumps.Unlock()
			179	+	if processStdinPumps.pump != nil && processStdinPumps.file == file {
			180	+	return processStdinPumps.pump
			181	+	}
			182	+	pump := &processStdinPump{chunks: make(chan readResult, 1)}
			183	+	processStdinPumps.file = file
			184	+	processStdinPumps.pump = pump
			185	+	go pump.run(file)
			186	+	return pump
			187	+	}
			188	+
			189	+	func (p processStdinPump) run(file os.File) {
			190	+	for {
			191	+	buf := make([]byte, 32*1024)
			192	+	n, err := file.Read(buf)
			193	+	if n > 0 {
			194	+	p.chunks <- readResult{data: append([]byte(nil), buf[:n]...)}
			195	+	}
			196	+	if err != nil {
			197	+	p.chunks <- readResult{err: err}
			198	+	close(p.chunks)
			199	+	return
			200	+	}
			201	+	}
			202	+	}
			203	+
			204	+	func (p *processStdinPump) read(done <-chan struct{}, dst []byte) (int, error) {
			205	+	select {
			206	+	case <-done:
			207	+	return 0, io.ErrClosedPipe
			208	+	default:
			209	+	}
			210	+	p.mu.Lock()
			211	+	if len(p.buf) != 0 {
			212	+	n := copy(dst, p.buf)
			213	+	p.buf = p.buf[n:]
			214	+	p.mu.Unlock()
			215	+	return n, nil
			216	+	}
			217	+	if p.err != nil {
			218	+	err := p.err
			219	+	p.mu.Unlock()
			220	+	return 0, err
			221	+	}
			222	+	p.mu.Unlock()
			223	+
			224	+	select {
			225	+	case <-done:
			226	+	return 0, io.ErrClosedPipe
			227	+	case result, ok := <-p.chunks:
			228	+	if !ok {
			229	+	return 0, io.EOF
			230	+	}
			231	+	if len(result.data) != 0 {
			232	+	select {
			233	+	case <-done:
			234	+	return 0, io.ErrClosedPipe
			235	+	default:
			236	+	}
			237	+	n := copy(dst, result.data)
			238	+	p.mu.Lock()
			239	+	p.buf = append(p.buf[:0], result.data[n:]...)
			240	+	p.mu.Unlock()
			241	+	return n, nil
			242	+	}
			243	+	p.mu.Lock()
			244	+	p.err = result.err
			245	+	p.mu.Unlock()
			246	+	return 0, result.err
			247	+	}
			248	+	}
			249	+
			250	+	type processStdinReader struct {
			251	+	pump *processStdinPump
			252	+	done <-chan struct{}
			253	+	}
			254	+
			255	+	func newProcessStdinReader(file *os.File, done <-chan struct{}) io.Reader {
			256	+	return processStdinReader{pump: processStdinPumpFor(file), done: done}
			257	+	}
			258	+
			259	+	func (r processStdinReader) Read(dst []byte) (int, error) {
			260	+	return r.pump.read(r.done, dst)
			261	+	}
			262	+
80		func (t *transport) Send(f ports.Frame) error {	263		func (t *transport) Send(f ports.Frame) error {
81		end := t.beginOperation(ports.RuntimeAdapterSendStart, uint64(len(f.Payload)))	264		end := t.beginOperation(ports.RuntimeAdapterSendStart, uint64(len(f.Payload)))
82		n := 1 + len(f.Payload)	265		n := 1 + len(f.Payload)

@@ -136,7 +319,11 @@ func (t *transport) beginOperation(start ports.RuntimeMarkKind, bytes uint64) fu
136		if t.observer == nil {	319		if t.observer == nil {
137		return func(bool) {}	320		return func(bool) {}
138		}	321		}
139	-	if !t.beginObservedOperation() {	322	+	kind := operationSend
			323	+	if start == ports.RuntimeAdapterReceiveStart {
			324	+	kind = operationReceive
			325	+	}
			326	+	if !t.beginObservedOperation(kind) {
140		return func(bool) {}	327		return func(bool) {}
141		}	328		}
142		correlation := ports.NewRuntimeCorrelation()	329		correlation := ports.NewRuntimeCorrelation()

@@ -146,7 +333,7 @@ func (t *transport) beginOperation(start ports.RuntimeMarkKind, bytes uint64) fu
146		end = ports.RuntimeAdapterReceiveEnd	333		end = ports.RuntimeAdapterReceiveEnd
147		}	334		}
148		return func(valid bool) {	335		return func(valid bool) {
149	-	defer t.finishObservedOperation()	336	+	defer t.finishObservedOperation(kind)
150		t.observer.ObserveRuntime(ports.NewRuntimeMarkWithCorrelation("sshstdio", correlation, end, bytes, valid))	337		t.observer.ObserveRuntime(ports.NewRuntimeMarkWithCorrelation("sshstdio", correlation, end, bytes, valid))
151		}	338		}
152		}	339		}

@@ -163,20 +350,25 @@ func (t *transport) mapEOFError(err error) error {
163			350
164		func (t *transport) Close() error {	351		func (t *transport) Close() error {
165		t.closeOnce.Do(func() {	352		t.closeOnce.Do(func() {
166	-	done := t.beginShutdown()	353	+	wait := t.beginShutdown()
167		// Close owned streams before waiting for in-flight operations. The	354		// Close owned streams before waiting for in-flight operations. The
168		// writer is what releases a Send blocked on a child stdin pipe; the	355		// writer is what releases a Send blocked on a child stdin pipe; the
169	-	// reader releases a Recv blocked in io.ReadFull.	356	+	// reader releases a Recv blocked in io.ReadFull. Unowned streams cannot
			357	+	// be interrupted safely, so the cancellation boundary releases Recv
			358	+	// without closing the source.
170		var writeErr, readErr error	359		var writeErr, readErr error
171	-	if w, ok := t.w.(io.Closer); ok {	360	+	if t.writerCloser != nil {
172	-	writeErr = w.Close()	361	+	writeErr = t.writerCloser.Close()
173		}	362		}
174	-	if r, ok := t.r.(io.Closer); ok {	363	+	if t.readerCloser != nil {
175	-	readErr = r.Close()	364	+	readErr = t.readerCloser.Close()
176		}	365		}
177		closeErr := t.close()	366		closeErr := t.close()
178	-	if done != nil {	367	+	if t.writerCloser != nil && wait.send != nil {
179	-	<-done	368	+	<-wait.send
			369	+	}
			370	+	if t.readerCloser != nil && wait.receive != nil {
			371	+	<-wait.receive
180		}	372		}
181		switch {	373		switch {
182		case closeErr != nil:	374		case closeErr != nil:

@@ -190,36 +382,41 @@ func (t *transport) Close() error {
190		return t.closeErr	382		return t.closeErr
191		}	383		}
192			384
193	-	func (t *transport) beginObservedOperation() bool {	385	+	func (t *transport) beginObservedOperation(kind operationKind) bool {
194		t.operationMu.Lock()	386		t.operationMu.Lock()
195		defer t.operationMu.Unlock()	387		defer t.operationMu.Unlock()
196		if t.closing {	388		if t.closing {
197		return false	389		return false
198		}	390		}
199	-	if t.operationCount == 0 {	391	+	if t.operationCount[kind] == 0 {
200	-	t.operationsDone = make(chan struct{})	392	+	t.operationsDone[kind] = make(chan struct{})
201		}	393		}
202	-	t.operationCount++	394	+	t.operationCount[kind]++
203		return true	395		return true
204		}	396		}
205			397
206	-	func (t *transport) finishObservedOperation() {	398	+	func (t *transport) finishObservedOperation(kind operationKind) {
207		t.operationMu.Lock()	399		t.operationMu.Lock()
208		defer t.operationMu.Unlock()	400		defer t.operationMu.Unlock()
209	-	t.operationCount--	401	+	t.operationCount[kind]--
210	-	if t.operationCount == 0 {	402	+	if t.operationCount[kind] == 0 {
211	-	close(t.operationsDone)	403	+	close(t.operationsDone[kind])
212		}	404		}
213		}	405		}
214			406
215	-	func (t *transport) beginShutdown() <-chan struct{} {	407	+	func (t *transport) beginShutdown() operationWait {
216		t.operationMu.Lock()	408		t.operationMu.Lock()
217		defer t.operationMu.Unlock()	409		defer t.operationMu.Unlock()
218		t.closing = true	410		t.closing = true
219	-	if t.operationCount == 0 {	411	+	close(t.done)
220	-	return nil	412	+	var wait operationWait
			413	+	if t.operationCount[operationSend] != 0 {
			414	+	wait.send = t.operationsDone[operationSend]
			415	+	}
			416	+	if t.operationCount[operationReceive] != 0 {
			417	+	wait.receive = t.operationsDone[operationReceive]
221		}	418		}
222	-	return t.operationsDone	419	+	return wait
223		}	420		}
224			421
225		type processWaiter struct {	422		type processWaiter struct {

@@ -344,10 +541,11 @@ func DialContextWithRuntimeObserver(ctx context.Context, target, session string,
344		return dialContext(ctx, target, session, logger, opts...)	541		return dialContext(ctx, target, session, logger, opts...)
345		}	542		}
346			543
347	-	// DialContext is like Dial, but the context is propagated to ssh startup so a	544	+	// DialContext is like Dial, but the context gates ssh startup. Once the
348	-	// canceled attach attempt interrupts the local ssh process. Callers may pass a	545	+	// transport is returned, its Close method owns the subprocess lifetime; the
349	-	// logger to record ssh start failures and non-clean exits without logging the	546	+	// handshake context must not kill an already-established carriage. Callers may
350	-	// generated command line.	547	+	// pass a logger to record ssh start failures and non-clean exits without logging
			548	+	// the generated command line.
351		func DialContext(ctx context.Context, target, session string, logger ...*slog.Logger) (ports.Transport, error) {	549		func DialContext(ctx context.Context, target, session string, logger ...*slog.Logger) (ports.Transport, error) {
352		var log *slog.Logger	550		var log *slog.Logger
353		if len(logger) > 0 {	551		if len(logger) > 0 {

@@ -361,7 +559,12 @@ func dialContext(ctx context.Context, target, session string, log *slog.Logger,
361		return nil, err	559		return nil, err
362		}	560		}
363		spec := BuildCommand(target, session)	561		spec := BuildCommand(target, session)
364	-	cmd := exec.CommandContext(ctx, spec.Path, spec.Args...)	562	+	// The caller's context is also the bounded protocol-handshake context and is
			563	+	// canceled after the first committed publication. Binding it to the command
			564	+	// would kill a healthy long-lived carriage at that boundary. Transport.Close
			565	+	// owns cancellation after Start; the preflight check above keeps canceled
			566	+	// attempts from starting a process.
			567	+	cmd := exec.Command(spec.Path, spec.Args...)
365		stdin, err := cmd.StdinPipe()	568		stdin, err := cmd.StdinPipe()
366		if err != nil {	569		if err != nil {
367		return nil, fmt.Errorf("sshstdio: stdin pipe: %w", err)	570		return nil, fmt.Errorf("sshstdio: stdin pipe: %w", err)

@@ -381,6 +584,10 @@ func dialContext(ctx context.Context, target, session string, log *slog.Logger,
381			584
382		waiter := newProcessWaiter(cmd, stdin, &stderr, sshCloseTimeout, log, target, session)	585		waiter := newProcessWaiter(cmd, stdin, &stderr, sshCloseTimeout, log, target, session)
383		transport := newTransport(stdout, stdin, waiter.close, waiter.eofErr)	586		transport := newTransport(stdout, stdin, waiter.close, waiter.eofErr)
			587	+	if err := ctx.Err(); err != nil {
			588	+	_ = transport.Close()
			589	+	return nil, err
			590	+	}
384		for _, opt := range opts {	591		for _, opt := range opts {
385		if opt != nil {	592		if opt != nil {
386		opt(transport)	593		opt(transport)

M internal/adapters/sshstdio/transport_observability_test.go +78 -1


@@ -4,6 +4,7 @@ import (
4		"bytes"	4		"bytes"
5		"encoding/json"	5		"encoding/json"
6		"errors"	6		"errors"
			7	+	"io"
7		"os"	8		"os"
8		"strings"	9		"strings"
9		"sync"	10		"sync"

@@ -93,7 +94,7 @@ func assertSSHReceiveFailurePair(t *testing.T, path string) {
93		Kind string `json:"kind"`	94		Kind string `json:"kind"`
94		Valid bool `json:"valid"`	95		Valid bool `json:"valid"`
95		}	96		}
96	-	for _, line := range strings.Split(strings.TrimSpace(string(data)), "\n") {	97	+	for line := range strings.SplitSeq(strings.TrimSpace(string(data)), "\n") {
97		var mark struct {	98		var mark struct {
98		ProcessID string `json:"process_id"`	99		ProcessID string `json:"process_id"`
99		Scenario string `json:"scenario"`	100		Scenario string `json:"scenario"`

@@ -126,6 +127,82 @@ func assertSSHReceiveFailurePair(t *testing.T, path string) {
126		}	127		}
127		}	128		}
128			129
			130	+	func TestProcessStdinPumpIsSingleton(t *testing.T) {
			131	+	first := processStdinPumpFor(os.Stdin)
			132	+	second := processStdinPumpFor(os.Stdin)
			133	+	if first != second {
			134	+	t.Fatal("process stdin created more than one lifetime pump")
			135	+	}
			136	+	}
			137	+
			138	+	func TestTransportCloseLeavesProcessStdinOpen(t *testing.T) {
			139	+	transport := NewTransport(os.Stdin, io.Discard, nil)
			140	+	if err := transport.Close(); err != nil {
			141	+	t.Fatalf("Close() error = %v", err)
			142	+	}
			143	+	if _, err := os.Stdin.Stat(); err != nil {
			144	+	t.Fatalf("process stdin was closed: %v", err)
			145	+	}
			146	+	}
			147	+
			148	+	func TestTransportObservabilitySSHStdioCloseDoesNotWaitForUnownedReceive(t *testing.T) {
			149	+	tracePath := t.TempDir() + "/ssh-unowned-close.jsonl"
			150	+	observer, closer, err := observability.NewJSONL(tracePath, sshRuntimeClock{now: time.Unix(0, 313)}, "ssh-process")
			151	+	if err != nil {
			152	+	t.Fatalf("NewJSONL() error = %v", err)
			153	+	}
			154	+	reporter := ports.NewSerializedRuntimeObserver(observer, 64)
			155	+	defer reporter.Close()
			156	+	reader := &sshUnownedBlockedReader{entered: make(chan struct{}), release: make(chan struct{})}
			157	+	t.Cleanup(reader.unblock)
			158	+	transport := NewTransport(reader, &bytes.Buffer{}, nil, WithRuntimeObserver(reporter))
			159	+	recvDone := make(chan error, 1)
			160	+	go func() { _, err := transport.Recv(); recvDone <- err }()
			161	+	<-reader.entered
			162	+
			163	+	closeDone := make(chan error, 1)
			164	+	go func() { closeDone <- transport.Close() }()
			165	+	select {
			166	+	case err := <-closeDone:
			167	+	if err != nil {
			168	+	t.Fatalf("Close() error = %v", err)
			169	+	}
			170	+	case <-time.After(time.Second):
			171	+	t.Fatal("Close() waited for an unowned blocked reader")
			172	+	}
			173	+
			174	+	select {
			175	+	case err := <-recvDone:
			176	+	if err == nil {
			177	+	t.Fatal("Recv() error = nil after Close()")
			178	+	}
			179	+	case <-time.After(time.Second):
			180	+	t.Fatal("Recv() did not finish after Close()")
			181	+	}
			182	+	reporter.Close()
			183	+	if err := closer.Close(); err != nil {
			184	+	t.Fatalf("trace Close() error = %v", err)
			185	+	}
			186	+	assertSSHReceiveFailurePair(t, tracePath)
			187	+	}
			188	+
			189	+	type sshUnownedBlockedReader struct {
			190	+	entered chan struct{}
			191	+	release chan struct{}
			192	+	enteredOnce sync.Once
			193	+	releaseOnce sync.Once
			194	+	}
			195	+
			196	+	func (r *sshUnownedBlockedReader) Read([]byte) (int, error) {
			197	+	r.enteredOnce.Do(func() { close(r.entered) })
			198	+	<-r.release
			199	+	return 0, errors.New("reader released")
			200	+	}
			201	+
			202	+	func (r *sshUnownedBlockedReader) unblock() {
			203	+	r.releaseOnce.Do(func() { close(r.release) })
			204	+	}
			205	+
129		func TestTransportObservabilitySSHStdioPreservesCarriage(t *testing.T) {	206		func TestTransportObservabilitySSHStdioPreservesCarriage(t *testing.T) {
130		tracePath := t.TempDir() + "/ssh.jsonl"	207		tracePath := t.TempDir() + "/ssh.jsonl"
131		observer, closer, err := observability.NewJSONL(tracePath, sshRuntimeClock{now: time.Unix(0, 307)}, "ssh-process")	208		observer, closer, err := observability.NewJSONL(tracePath, sshRuntimeClock{now: time.Unix(0, 307)}, "ssh-process")

A internal/app/final_acceptance_test.go +177 -0

@@ -0,0 +1,177 @@
	1	+	//go:build linux
	2	+
	3	+	package app
	4	+
	5	+	import (
	6	+	"testing"
	7	+	"time"
	8	+
	9	+	"github.com/bnema/vev/internal/domain"
	10	+	"github.com/bnema/vev/internal/ports"
	11	+	"github.com/bnema/vev/internal/usecase/daemon"
	12	+	"github.com/stretchr/testify/require"
	13	+	)
	14	+
	15	+	func sendAcceptanceInput(t *testing.T, tr ports.Transport, data string) {
	16	+	t.Helper()
	17	+	require.NoError(t, tr.Send(ports.Frame{Type: ports.MsgInput, Payload: ports.MarshalInput(ports.Input{Data: []byte(data)})}))
	18	+	}
	19	+
	20	+	func awaitAcceptanceFrame(t testing.T, p pump, typ ports.MsgType, predicate func(ports.Frame) bool) ports.Frame {
	21	+	t.Helper()
	22	+	deadline := time.NewTimer(5 * time.Second)
	23	+	defer deadline.Stop()
	24	+	for {
	25	+	select {
	26	+	case frame, ok := <-p.ch:
	27	+	require.True(t, ok, "connection closed before frame")
	28	+	if frame.Type == typ && predicate(frame) {
	29	+	return frame
	30	+	}
	31	+	case <-deadline.C:
	32	+	t.Fatal("timed out waiting for acceptance frame")
	33	+	}
	34	+	}
	35	+	}
	36	+
	37	+	func awaitAcceptanceCommand(t testing.T, p pump, requestID uint64) ports.CommandResult {
	38	+	t.Helper()
	39	+	frame := awaitAcceptanceFrame(t, p, ports.MsgCommandResult, func(frame ports.Frame) bool {
	40	+	result, err := ports.UnmarshalCommandResult(frame.Payload)
	41	+	require.NoError(t, err)
	42	+	return result.RequestID == requestID
	43	+	})
	44	+	result, err := ports.UnmarshalCommandResult(frame.Payload)
	45	+	require.NoError(t, err)
	46	+	return result
	47	+	}
	48	+
	49	+	func awaitAcceptanceOutput(t testing.T, p pump, predicate func(ports.Output) bool) ports.Output {
	50	+	t.Helper()
	51	+	frame := awaitAcceptanceFrame(t, p, ports.MsgOutput, func(frame ports.Frame) bool {
	52	+	output, err := ports.UnmarshalOutput(frame.Payload)
	53	+	require.NoError(t, err)
	54	+	return predicate(output)
	55	+	})
	56	+	output, err := ports.UnmarshalOutput(frame.Payload)
	57	+	require.NoError(t, err)
	58	+	return output
	59	+	}
	60	+
	61	+	func awaitAcceptanceCommandResult(t testing.T, tr ports.Transport, p pump, requestID uint64, slug string) ports.CommandResult {
	62	+	t.Helper()
	63	+	payload, err := ports.MarshalCommandRequest(ports.CommandRequest{
	64	+	Version: ports.ProtocolVersion, RequestID: requestID, Attached: true, Slug: slug,
	65	+	})
	66	+	require.NoError(t, err)
	67	+	require.NoError(t, tr.Send(ports.Frame{Type: ports.MsgCommand, Payload: payload}))
	68	+	return awaitAcceptanceCommand(t, p, requestID)
	69	+	}
	70	+
	71	+	func TestAcceptanceTwoLocalAttachmentsKeepViewsOverTransports(t *testing.T) {
	72	+	size := domain.Size{Cols: 80, Rows: 24}
	73	+	dir, _ := startDaemon(t, daemon.WithShell("/bin/cat", nil))
	74	+	first, firstPump := attach(t, dir, ports.IntentNew, "shared", size)
	75	+	second, secondPump := attach(t, dir, ports.IntentAttach, "shared", size)
	76	+	t.Cleanup(func() { _ = first.Close() })
	77	+	t.Cleanup(func() { _ = second.Close() })
	78	+
	79	+	sendAcceptanceInput(t, first, "SHARED_INPUT\n")
	80	+	awaitText(t, firstPump, size, "SHARED_INPUT")
	81	+	awaitText(t, secondPump, size, "SHARED_INPUT")
	82	+
	83	+	// A tab opened by the first attachment is shared session topology, but its
	84	+	// selected window is not. The second attachment stays on the original tab.
	85	+	sendAcceptanceInput(t, first, "\x1b ")
	86	+	awaitText(t, firstPump, size, "Commands")
	87	+	sendAcceptanceInput(t, first, "CNT\r")
	88	+	awaitText(t, firstPump, size, " 1 (cat) 2 (cat) ")
	89	+	assertNoTextAfterInput(t, secondPump, size, " 1 (cat) 2 (cat) ")
	90	+
	91	+	sendAcceptanceInput(t, first, "\x1b ")
	92	+	awaitText(t, firstPump, size, "Commands")
	93	+	sendAcceptanceInput(t, first, "SPR\r")
	94	+	sendAcceptanceInput(t, first, "FIRST_PANE_INPUT\n")
	95	+	awaitText(t, firstPump, size, "FIRST_PANE_INPUT")
	96	+	assertNoTextAfterInput(t, secondPump, size, "FIRST_PANE_INPUT")
	97	+	sendAcceptanceInput(t, second, "SECOND_TAB_INPUT\n")
	98	+	awaitText(t, secondPump, size, "SECOND_TAB_INPUT")
	99	+
	100	+	// Overlays are attachment-owned: a palette on one wire and copy mode on
	101	+	// the other must not repaint the peer's viewport.
	102	+	sendAcceptanceInput(t, first, "\x1b ")
	103	+	awaitText(t, firstPump, size, "Commands")
	104	+	assertNoTextAfterInput(t, secondPump, size, "Commands")
	105	+	sendAcceptanceInput(t, first, "\x1b")
	106	+
	107	+	sendAcceptanceInput(t, second, "\x1b ")
	108	+	awaitText(t, secondPump, size, "Commands")
	109	+	sendAcceptanceInput(t, second, "VIS\r")
	110	+	awaitText(t, secondPump, size, "[SCROLL]")
	111	+	assertNoTextAfterInput(t, firstPump, size, "[SCROLL]")
	112	+
	113	+	// A resize and an output reset are scoped to one attachment output stream;
	114	+	// the shared tab's PTY/content geometry and the peer stream remain intact.
	115	+	resizePayload, err := ports.MarshalResize(ports.Resize{Size: domain.Size{Cols: 100, Rows: 30}})
	116	+	require.NoError(t, err)
	117	+	require.NoError(t, first.Send(ports.Frame{Type: ports.MsgResize, Payload: resizePayload}))
	118	+	resized := awaitAcceptanceOutput(t, firstPump, func(output ports.Output) bool { return output.Size == (domain.Size{Cols: 100, Rows: 30}) })
	119	+	require.Equal(t, domain.Size{Cols: 100, Rows: 30}, resized.Size)
	120	+	assertNoTextAfterInput(t, secondPump, size, "FIRST_PANE_INPUT")
	121	+
	122	+	require.NoError(t, first.Send(ports.Frame{Type: ports.MsgOutputResetRequest, Payload: ports.MarshalOutputResetRequest(ports.OutputResetRequest{})}))
	123	+	reset := awaitAcceptanceOutput(t, firstPump, func(output ports.Output) bool { return output.Base == 0 && output.Full })
	124	+	require.True(t, reset.Full)
	125	+	assertNoTextAfterInput(t, secondPump, size, "FIRST_PANE_INPUT")
	126	+
	127	+	require.NoError(t, first.Send(ports.Frame{Type: ports.MsgDetach, Payload: ports.MarshalDetach(ports.Detach{})}))
	128	+	deadline := time.NewTimer(5 * time.Second)
	129	+	defer deadline.Stop()
	130	+	for {
	131	+	select {
	132	+	case frame := <-firstPump.ch:
	133	+	if frame.Type == ports.MsgDetached {
	134	+	goto detached
	135	+	}
	136	+	case <-deadline.C:
	137	+	t.Fatal("timed out waiting for first attachment detach")
	138	+	}
	139	+	}
	140	+
	141	+	detached:
	142	+	sendAcceptanceInput(t, second, "q")
	143	+	sendAcceptanceInput(t, second, "PEER_SURVIVES\n")
	144	+	awaitText(t, secondPump, size, "PEER_SURVIVES")
	145	+	}
	146	+
	147	+	func TestAcceptanceAttachedCommandUsesItsConnectionOnly(t *testing.T) {
	148	+	size := domain.Size{Cols: 80, Rows: 24}
	149	+	dir, _ := startDaemon(t, daemon.WithShell("/bin/cat", nil))
	150	+	first, firstPump := attach(t, dir, ports.IntentNew, "commands", size)
	151	+	second, secondPump := attach(t, dir, ports.IntentAttach, "commands", size)
	152	+	t.Cleanup(func() { _ = first.Close() })
	153	+	t.Cleanup(func() { _ = second.Close() })
	154	+
	155	+	firstResult := awaitAcceptanceCommandResult(t, first, firstPump, 101, "new-tab")
	156	+	secondResult := awaitAcceptanceCommandResult(t, second, secondPump, 202, "new-tab")
	157	+	require.True(t, firstResult.OK, firstResult.Text)
	158	+	require.True(t, secondResult.OK, secondResult.Text)
	159	+	require.Empty(t, firstResult.Output)
	160	+	require.Empty(t, secondResult.Output)
	161	+	require.NotEqual(t, firstResult.RequestID, secondResult.RequestID)
	162	+
	163	+	// Drain any asynchronous output before proving that a reset on one real
	164	+	// IPC transport does not create a reset frame on the other.
	165	+	for {
	166	+	select {
	167	+	case <-secondPump.ch:
	168	+	default:
	169	+	goto drained
	170	+	}
	171	+	}
	172	+
	173	+	drained:
	174	+	require.NoError(t, first.Send(ports.Frame{Type: ports.MsgOutputResetRequest, Payload: ports.MarshalOutputResetRequest(ports.OutputResetRequest{})}))
	175	+	awaitAcceptanceOutput(t, firstPump, func(output ports.Output) bool { return output.Full && output.Base == 0 })
	176	+	assertNoTextAfterInput(t, secondPump, size, "Commands")
	177	+	}

A internal/app/remote_final_acceptance_test.go +170 -0

@@ -0,0 +1,170 @@
	1	+	//go:build linux
	2	+
	3	+	package app
	4	+
	5	+	import (
	6	+	"bytes"
	7	+	"context"
	8	+	"io"
	9	+	"log/slog"
	10	+	"net"
	11	+	"sync"
	12	+	"testing"
	13	+
	14	+	"github.com/bnema/vev/internal/adapters/sshstdio"
	15	+	"github.com/bnema/vev/internal/domain"
	16	+	"github.com/bnema/vev/internal/ports"
	17	+	"github.com/bnema/vev/internal/usecase/client"
	18	+	"github.com/stretchr/testify/require"
	19	+	)
	20	+
	21	+	type acceptanceRemoteFactory struct {
	22	+	mu sync.Mutex
	23	+	calls []string
	24	+	handoff map[string]ports.AttachTarget
	25	+	outputs chan string
	26	+	}
	27	+
	28	+	func (f acceptanceRemoteFactory) DialerForRemote(target string, _ string, _ ports.RemoteTransportMode, _ slog.Logger) (ports.Dialer, error) {
	29	+	f.mu.Lock()
	30	+	f.calls = append(f.calls, target)
	31	+	targetHandoff := f.handoff[target]
	32	+	f.mu.Unlock()
	33	+	return acceptanceRemoteDialer{target: target, handoff: targetHandoff, outputs: f.outputs}, nil
	34	+	}
	35	+
	36	+	type acceptanceRemoteDialer struct {
	37	+	target string
	38	+	handoff ports.AttachTarget
	39	+	outputs chan<- string
	40	+	}
	41	+
	42	+	func (d acceptanceRemoteDialer) Dial(context.Context) (ports.Transport, error) {
	43	+	clientConn, serverConn := net.Pipe()
	44	+	clientTransport := sshstdio.NewTransport(clientConn, clientConn, clientConn.Close)
	45	+	serverTransport := sshstdio.NewTransport(serverConn, serverConn, serverConn.Close)
	46	+	go serveAcceptanceRemote(serverTransport, d.target, d.handoff, d.outputs)
	47	+	return clientTransport, nil
	48	+	}
	49	+
	50	+	func serveAcceptanceRemote(tr ports.Transport, target string, handoff ports.AttachTarget, outputs chan<- string) {
	51	+	defer func() { _ = tr.Close() }()
	52	+	welcomed := false
	53	+	for {
	54	+	frame, err := tr.Recv()
	55	+	if err != nil {
	56	+	return
	57	+	}
	58	+	if !welcomed {
	59	+	if frame.Type != ports.MsgHello {
	60	+	continue
	61	+	}
	62	+	if err := tr.Send(ports.Frame{Type: ports.MsgWelcome, Payload: ports.MarshalWelcome(ports.Welcome{SessionID: target})}); err != nil {
	63	+	return
	64	+	}
	65	+	welcomed = true
	66	+	continue
	67	+	}
	68	+	if handoff.Endpoint != "" {
	69	+	_ = tr.Send(ports.Frame{Type: ports.MsgAttachTarget, Payload: ports.MarshalAttachTarget(handoff)})
	70	+	for {
	71	+	if _, err := tr.Recv(); err != nil {
	72	+	return
	73	+	}
	74	+	}
	75	+	}
	76	+	data := []byte("remote:" + target)
	77	+	if outputs != nil {
	78	+	outputs <- string(data)
	79	+	}
	80	+	payload, err := ports.MarshalOutput(ports.Output{
	81	+	Epoch: 1, New: 1, Full: true, Size: domain.Size{Cols: 80, Rows: 24}, Data: data,
	82	+	})
	83	+	if err != nil {
	84	+	return
	85	+	}
	86	+	if err := tr.Send(ports.Frame{Type: ports.MsgOutput, Payload: payload}); err != nil {
	87	+	return
	88	+	}
	89	+	_ = tr.Send(ports.Frame{Type: ports.MsgDetached, Payload: ports.MarshalDetached(ports.Detached{Reason: ports.ReasonDetach})})
	90	+	for {
	91	+	if _, err := tr.Recv(); err != nil {
	92	+	return
	93	+	}
	94	+	}
	95	+	}
	96	+	}
	97	+
	98	+	type acceptanceRemoteTerminal struct {
	99	+	in io.Reader
	100	+	out bytes.Buffer
	101	+	}
	102	+
	103	+	func (t *acceptanceRemoteTerminal) EnterRaw() (func() error, error) {
	104	+	return func() error { return nil }, nil
	105	+	}
	106	+	func (*acceptanceRemoteTerminal) Size() (domain.Size, error) {
	107	+	return domain.Size{Cols: 80, Rows: 24}, nil
	108	+	}
	109	+	func (*acceptanceRemoteTerminal) ResizeEvents() <-chan domain.Size { return nil }
	110	+	func (t *acceptanceRemoteTerminal) In() io.Reader { return t.in }
	111	+	func (t *acceptanceRemoteTerminal) Out() io.Writer { return &t.out }
	112	+	func (*acceptanceRemoteTerminal) Flush() error { return nil }
	113	+
	114	+	func TestAcceptanceRemoteDirectAndPickerUseOnlyRemoteTransports(t *testing.T) {
	115	+	outputs := make(chan string, 4)
	116	+	factory := &acceptanceRemoteFactory{outputs: outputs}
	117	+	localCalls := 0
	118	+	terminals := make([]*acceptanceRemoteTerminal, 0, 3)
	119	+	deps := runAttachDeps{
	120	+	localDialer: func() ports.Dialer {
	121	+	localCalls++
	122	+	return acceptanceRemoteDialer{}
	123	+	},
	124	+	remoteDialerFactory: factory,
	125	+	selectedRemoteTransport: string(ports.RemoteTransportStdio),
	126	+	runClient: func(ctx context.Context, deps client.Dependencies, request client.AttachRequest) error {
	127	+	term := &acceptanceRemoteTerminal{in: bytes.NewReader(nil)}
	128	+	terminals = append(terminals, term)
	129	+	deps.Terminal = term
	130	+	deps.Logger = slog.New(slog.DiscardHandler)
	131	+	deps.Remote = true
	132	+	result := client.NewRunner(deps).Run(ctx, request)
	133	+	if request.SessionName == "work" {
	134	+	require.NoError(t, result, "the client handoff completes before the test injects the composition-root handoff")
	135	+	return &client.AttachTargetError{Target: ports.AttachTarget{Endpoint: "picked.example", Session: "picked", Intent: ports.IntentAttach}}
	136	+	}
	137	+	return result
	138	+	},
	139	+	}
	140	+
	141	+	wireTransport, err := (acceptanceRemoteDialer{
	142	+	target: "picker-wire.example",
	143	+	handoff: ports.AttachTarget{Endpoint: "picked.example", Session: "picked", Intent: ports.IntentAttach},
	144	+	}).Dial(context.Background())
	145	+	require.NoError(t, err)
	146	+	require.NoError(t, wireTransport.Send(ports.Frame{Type: ports.MsgHello, Payload: ports.MarshalHello(ports.Hello{
	147	+	Version: ports.ProtocolVersion, Intent: ports.IntentAttach, Name: "work", Size: domain.Size{Cols: 80, Rows: 24},
	148	+	})}))
	149	+	welcome, err := wireTransport.Recv()
	150	+	require.NoError(t, err)
	151	+	require.Equal(t, ports.MsgWelcome, welcome.Type)
	152	+	require.NoError(t, wireTransport.Send(ports.Frame{Type: ports.MsgTheme, Payload: ports.MarshalTheme(ports.Theme{})}))
	153	+	attachTarget, err := wireTransport.Recv()
	154	+	require.NoError(t, err)
	155	+	target, err := ports.UnmarshalAttachTarget(attachTarget.Payload)
	156	+	require.NoError(t, err)
	157	+	require.Equal(t, ports.MsgAttachTarget, attachTarget.Type)
	158	+	require.Equal(t, "picked.example", target.Endpoint)
	159	+	require.NoError(t, wireTransport.Close())
	160	+
	161	+	require.NoError(t, runAttachWithDeps(context.Background(), ports.IntentAttach, "direct", "direct.example", "", nil, deps))
	162	+	require.NoError(t, runAttachWithDeps(context.Background(), ports.IntentAttach, "work", "picker.example", "", nil, deps))
	163	+	factory.mu.Lock()
	164	+	calls := append([]string(nil), factory.calls...)
	165	+	factory.mu.Unlock()
	166	+	require.Equal(t, []string{"direct.example", "picker.example", "picked.example"}, calls)
	167	+	require.Zero(t, localCalls, "remote direct and picker connections must not create a local shadow")
	168	+	require.Len(t, terminals, 3)
	169	+	require.Equal(t, []string{"remote:direct.example", "remote:picker.example", "remote:picked.example"}, []string{<-outputs, <-outputs, <-outputs})
	170	+	}

M internal/app/run.go +3 -2

 	// sshstdio.Close owns and closes writers that implement io.Closer so a
 	// blocked Send can unwind. Keep process-global stdin/stdout outside that
-	// ownership boundary: input is a non-closing view and output is an owned
+	// ownership boundary: sshstdio recognizes process stdin as a shared
-	// pipe drained by a small forwarding goroutine.
+	// cancellable pump, while output is an owned pipe drained by a forwarding
+	// goroutine.
 	stdin, stdout := os.Stdin, os.Stdout
 	stdoutReader, stdoutWriter := io.Pipe()
 	forwardDone := make(chan struct{})

M internal/ports/wire.go +27 -11

 var errTrailingBytes = errors.New("ports: unexpected trailing bytes in payload")
 var errInvalidBoolean = errors.New("ports: invalid boolean flag")
+var errInvalidEnum = errors.New("ports: invalid enum value")
 const (
 	outputHeaderLen       = 5*8 + 2*2 + 1
 	}
 }
+func validDetachedReason(reason uint8) bool {
+	switch reason {
+	case ReasonDetach, ReasonSessionKilled, ReasonServerShutdown, ReasonReplaced:
+		return true
+	default:
+		return false
+	}
+}
 // Detach asks the daemon to detach the current client without killing the
 // session.
 type Detach struct{}
 }
 // AttachTarget identifies the endpoint and session selected for a new
-// attachment. It deliberately carries no viewport, resume, or proxy state.
+// attachment. It deliberately carries no viewport, resume, or session state.
 type AttachTarget struct {
 	Endpoint string
 	Session  string
 	if err != nil {
 		return Theme{}, err
 	}
+	if flags&^uint8(0x1f) != 0 {
+		return Theme{}, errInvalidEnum
+	}
 	fgR, err := r.getUint8()
 	if err != nil {
 		return Theme{}, err
 	if m.SessionName, err = r.getString(); err != nil {
 		return Welcome{}, err
 	}
-	eph, err := r.getUint8()
+	var ephemeral bool
-	if err != nil {
+	if ephemeral, err = r.getBool(); err != nil {
 		return Welcome{}, err
 	}
-	m.Ephemeral = eph != 0
+	m.Ephemeral = ephemeral
 	if m.ResumeToken, err = r.getUint64(); err != nil {
 		return Welcome{}, err
 	}
 	if err != nil {
 		return Detached{}, err
 	}
+	if !validDetachedReason(reason) {
+		return Detached{}, errInvalidEnum
+	}
 	if err := r.done(); err != nil {
 		return Detached{}, err
 	}
 	if err != nil {
 		return Kill{}, err
 	}
-	var all uint8
+	var all bool
 	if len(r.b) > 0 {
-		all, err = r.getUint8()
+		all, err = r.getBool()
 		if err != nil {
 			return Kill{}, err
 		}
 	if err := r.done(); err != nil {
 		return Kill{}, err
 	}
-	return Kill{Name: name, All: all != 0}, nil
+	return Kill{Name: name, All: all}, nil
 }
 // MarshalSessions encodes m into a Sessions message payload: a uint16 count
 		if s.Name, err = r.getString(); err != nil {
 			return Sessions{}, err
 		}
-		eph, err := r.getUint8()
+		eph, err := r.getBool()
 		if err != nil {
 			return Sessions{}, err
 		}
-		s.Ephemeral = eph != 0
+		s.Ephemeral = eph
 		if s.Tabs, err = r.getUint16(); err != nil {
 			return Sessions{}, err
 		}
-		att, err := r.getUint8()
+		att, err := r.getBool()
 		if err != nil {
 			return Sessions{}, err
 		}
-		s.Attached = att != 0
+		s.Attached = att
 		state, err := r.getUint8()
 		if err != nil {
 			return Sessions{}, err

M internal/ports/wire_final_test.go +68 -0


@@ -195,3 +195,71 @@ func TestFinalAttachTargetGoldenStrict(t *testing.T) {
195	}	195		}
196	}	196		}
197	}	197		}
		198	+
		199	+	func TestFinalClosedWireValuesRejectUnknownEnumsAndBooleans(t *testing.T) {
		200	+	meta, err := MarshalSessionMeta(SessionMeta{Tabs: []SessionTabMeta{{Name: "tab"}}})
		201	+	if err != nil {
		202	+	t.Fatal(err)
		203	+	}
		204	+	tests := []struct {
		205	+	name string
		206	+	payload []byte
		207	+	decode func([]byte) error
		208	+	}{
		209	+	{
		210	+	name: "hello boolean",
		211	+	payload: func() []byte {
		212	+	b := MarshalHello(Hello{Version: ProtocolVersion, Size: domain.Size{Cols: 1, Rows: 1}})
		213	+	b[len(b)-6] = 2
		214	+	return b
		215	+	}(),
		216	+	decode: func(b []byte) error { _, err := UnmarshalHello(b); return err },
		217	+	},
		218	+	{
		219	+	name: "welcome boolean",
		220	+	payload: func() []byte {
		221	+	b := MarshalWelcome(Welcome{SessionID: "id"})
		222	+	b[6] = 2
		223	+	return b
		224	+	}(),
		225	+	decode: func(b []byte) error { _, err := UnmarshalWelcome(b); return err },
		226	+	},
		227	+	{name: "detached reason", payload: []byte{0xff}, decode: func(b []byte) error { _, err := UnmarshalDetached(b); return err }},
		228	+	{
		229	+	name: "kill boolean",
		230	+	payload: func() []byte {
		231	+	b := MarshalKill(Kill{All: true})
		232	+	b[len(b)-1] = 2
		233	+	return b
		234	+	}(),
		235	+	decode: func(b []byte) error { _, err := UnmarshalKill(b); return err },
		236	+	},
		237	+	{
		238	+	name: "sessions ephemeral boolean",
		239	+	payload: func() []byte {
		240	+	b := MarshalSessions(Sessions{Sessions: []SessionInfo{{State: SessionRunning}}})
		241	+	b[6] = 2
		242	+	return b
		243	+	}(),
		244	+	decode: func(b []byte) error { _, err := UnmarshalSessions(b); return err },
		245	+	},
		246	+	{
		247	+	name: "sessions attached boolean",
		248	+	payload: func() []byte {
		249	+	b := MarshalSessions(Sessions{Sessions: []SessionInfo{{State: SessionRunning}}})
		250	+	b[9] = 2
		251	+	return b
		252	+	}(),
		253	+	decode: func(b []byte) error { _, err := UnmarshalSessions(b); return err },
		254	+	},
		255	+	{name: "session metadata boolean", payload: func() []byte { b := append([]byte(nil), meta...); b[len(b)-1] = 2; return b }(), decode: func(b []byte) error { _, err := UnmarshalSessionMeta(b); return err }},
		256	+	{name: "theme flags", payload: func() []byte { b := make([]byte, 57); b[0] = 0x20; return b }(), decode: func(b []byte) error { _, err := UnmarshalTheme(b); return err }},
		257	+	}
		258	+	for _, tt := range tests {
		259	+	t.Run(tt.name, func(t *testing.T) {
		260	+	if err := tt.decode(tt.payload); err == nil {
		261	+	t.Fatal("decoder accepted unknown closed wire value")
		262	+	}
		263	+	})
		264	+	}
		265	+	}

M internal/usecase/daemon/attachment_connection.go +5 -14

 import "github.com/bnema/vev/internal/ports"
-// attachmentSessionCore normalizes nil interfaces and implementations that
-// deliberately expose no attachment core.
-func attachmentSessionCore(entry attachmentSession) *sessionCore {
-	if entry == nil {
-		return nil
-	}
-	return entry.core()
-}
 // attachmentConnectionToken is the exact capability for one registered
 // attachment connection incarnation. It is invalid as soon as any of the
 // session, attachment membership, connection generation, transport link, or
 // coordinator lease changes.
 type attachmentConnectionToken struct {
-	sess       attachmentSession
+	sess       *session
 	ac         *attachedClient
 	generation uint64
 	transport  transportSnapshot
 	rebase bool
 }
-func attachmentToken(entry attachmentSession, ac *attachedClient, tr ports.Transport) attachmentConnectionToken {
+func attachmentToken(entry *session, ac *attachedClient, tr ports.Transport) attachmentConnectionToken {
 	if entry == nil || entry.core() == nil || ac == nil || tr == nil {
 		return attachmentConnectionToken{}
 	}
 }
 // current validates every immutable identity captured by the token. Membership
-// is the sole authority; there is no owner, replacement, or compatibility distinction.
+// is the sole authority; there is no owner, replacement, or compatibility role.
 func (t attachmentConnectionToken) current() bool {
 	return t.sess != nil && t.ac != nil &&
 		t.ac.connectionGeneration.Load() == t.generation &&
 	return t.attachmentCurrent()
 }
-func beginAttachmentLeaseEffect(sess attachmentSession, ac *attachedClient, lease *attachmentLease) (*attachmentEffectTicket, bool) {
+func beginAttachmentLeaseEffect(sess *session, ac *attachedClient, lease *attachmentLease) (*attachmentEffectTicket, bool) {
-	if sess == nil || ac == nil || lease == nil || lease.attachment != ac {
+	if sess == nil || ac == nil || lease == nil {
 		return nil, false
 	}
 	token := attachmentToken(sess, ac, ac.transport())

M internal/usecase/daemon/attachment_effect_gate.go +1 -1


@@ -18,7 +18,7 @@ const (
18		// effect admission. It deliberately contains no independently mutable state:	18		// effect admission. It deliberately contains no independently mutable state:
19		// a ticket is admitted only when every field matches the frame's token.	19		// a ticket is admitted only when every field matches the frame's token.
20		type attachmentCapability struct {	20		type attachmentCapability struct {
21	-	sess attachmentSession	21	+	sess *session
22		generation uint64	22		generation uint64
23		transport transportSnapshot	23		transport transportSnapshot
24		lease *attachmentLease	24		lease *attachmentLease

M internal/usecase/daemon/attachment_effect_gate_test.go +18 -18


@@ -165,7 +165,7 @@ func TestBeginCurrentAttachmentEffectFailsClosedOnStableCapabilityMismatch(t *te
165			165
166		func TestBeginAttachmentLeaseEffectRejectsForeignLease(t *testing.T) {	166		func TestBeginAttachmentLeaseEffectRejectsForeignLease(t *testing.T) {
167		d, sess, ac, _ := newManualSessionWithPTYs(t, newQuietPTY())	167		d, sess, ac, _ := newManualSessionWithPTYs(t, newQuietPTY())
168	-	rc := d.attachCoordinator(sess, ac, true)	168	+	rc := d.attachCoordinator(sess, nil, ac, true)
169		foreign := &attachmentLease{attachment: &attachedClient{}}	169		foreign := &attachmentLease{attachment: &attachedClient{}}
170		_, admitted := beginAttachmentLeaseEffect(sess, ac, foreign)	170		_, admitted := beginAttachmentLeaseEffect(sess, ac, foreign)
171		require.False(t, admitted)	171		require.False(t, admitted)

@@ -196,7 +196,7 @@ func TestKillSessionAcquisitionTimeoutDoesNotPublishPartialInvalidation(t *testi
196		sess.registerAttachmentLocked(later)	196		sess.registerAttachmentLocked(later)
197		sess.mu.Unlock()	197		sess.mu.Unlock()
198			198
199	-	rc := d.attachCoordinator(sess, first, true)	199	+	rc := d.attachCoordinator(sess, nil, first, true)
200		firstToken := sess.attachmentToken(first, firstTransport)	200		firstToken := sess.attachmentToken(first, firstTransport)
201		firstToken.lease = rc.attachmentLease(first)	201		firstToken.lease = rc.attachmentLease(first)
202		first.publishAttachmentCapability(firstToken)	202		first.publishAttachmentCapability(firstToken)

@@ -302,7 +302,7 @@ func TestKillSessionInterruptsOnlyExactParticipantBlockedSends(t *testing.T) {
302		d, sess, snatched, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})	302		d, sess, snatched, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})
303		snatchedTransport := newTeardownBlockingTransport()	303		snatchedTransport := newTeardownBlockingTransport()
304		snatched.replaceTransport(snatchedTransport)	304		snatched.replaceTransport(snatchedTransport)
305	-	d.attachCoordinator(sess, snatched, true)	305	+	d.attachCoordinator(sess, nil, snatched, true)
306		snatched.publishAttachmentCapability(sess.attachmentToken(snatched, snatchedTransport))	306		snatched.publishAttachmentCapability(sess.attachmentToken(snatched, snatchedTransport))
307			307
308		activeTransport := newTeardownBlockingTransport()	308		activeTransport := newTeardownBlockingTransport()

@@ -322,7 +322,7 @@ func TestKillSessionInterruptsOnlyExactParticipantBlockedSends(t *testing.T) {
322		d.mu.Lock()	322		d.mu.Lock()
323		d.sessions[unrelated.id] = unrelated	323		d.sessions[unrelated.id] = unrelated
324		d.mu.Unlock()	324		d.mu.Unlock()
325	-	d.attachCoordinator(unrelated, unrelatedClient, true)	325	+	d.attachCoordinator(unrelated, nil, unrelatedClient, true)
326			326
327		snatchedToken := sess.attachmentToken(snatched, snatchedTransport)	327		snatchedToken := sess.attachmentToken(snatched, snatchedTransport)
328		activeToken := sess.attachmentToken(active, activeTransport)	328		activeToken := sess.attachmentToken(active, activeTransport)

@@ -358,7 +358,7 @@ func TestKillSessionInterruptsCapturedSendWithoutClosingNewerIncarnation(t *test
358		d, sess, ac, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})	358		d, sess, ac, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})
359		stale := newTeardownBlockingTransport()	359		stale := newTeardownBlockingTransport()
360		ac.replaceTransport(stale)	360		ac.replaceTransport(stale)
361	-	d.attachCoordinator(sess, ac, true)	361	+	d.attachCoordinator(sess, nil, ac, true)
362		ac.publishAttachmentCapability(sess.attachmentToken(ac, stale))	362		ac.publishAttachmentCapability(sess.attachmentToken(ac, stale))
363			363
364		token := sess.attachmentToken(ac, stale)	364		token := sess.attachmentToken(ac, stale)

@@ -387,7 +387,7 @@ func TestShutdownSignalsServeWhenParticipantGateAcquisitionTimesOut(t *testing.T
387		d, sess, active, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})	387		d, sess, active, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})
388		transport := &closeTrackingTransport{}	388		transport := &closeTrackingTransport{}
389		active.replaceTransport(transport)	389		active.replaceTransport(transport)
390	-	d.attachCoordinator(sess, active, true)	390	+	d.attachCoordinator(sess, nil, active, true)
391		active.publishAttachmentCapability(sess.attachmentToken(active, transport))	391		active.publishAttachmentCapability(sess.attachmentToken(active, transport))
392			392
393		owner := freezeAttachmentEffectGates(active)	393		owner := freezeAttachmentEffectGates(active)

@@ -418,7 +418,7 @@ func TestShutdownInterruptsBlockedParticipantSend(t *testing.T) {
418		d, sess, active, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})	418		d, sess, active, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})
419		blocked := newTeardownBlockingTransport()	419		blocked := newTeardownBlockingTransport()
420		active.replaceTransport(blocked)	420		active.replaceTransport(blocked)
421	-	d.attachCoordinator(sess, active, true)	421	+	d.attachCoordinator(sess, nil, active, true)
422		active.publishAttachmentCapability(sess.attachmentToken(active, blocked))	422		active.publishAttachmentCapability(sess.attachmentToken(active, blocked))
423			423
424		token := sess.attachmentToken(active, blocked)	424		token := sess.attachmentToken(active, blocked)

@@ -444,7 +444,7 @@ func TestRenderSendFailureCleanupIsDeadlineBoundedWhileAttachmentEffectGateIsBus
444		d, sess, ac, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})	444		d, sess, ac, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})
445		transport := &closeTrackingTransport{}	445		transport := &closeTrackingTransport{}
446		ac.replaceTransport(transport)	446		ac.replaceTransport(transport)
447	-	rc := d.attachCoordinator(sess, ac, true)	447	+	rc := d.attachCoordinator(sess, nil, ac, true)
448		token := sess.attachmentToken(ac, transport)	448		token := sess.attachmentToken(ac, transport)
449		token.lease = rc.attachmentLease(ac)	449		token.lease = rc.attachmentLease(ac)
450		ac.publishAttachmentCapability(token)	450		ac.publishAttachmentCapability(token)

@@ -474,7 +474,7 @@ func TestAttachmentEffectGateReplacementInterruptsBlockedOldRenderBeforePublicat
474		d, sess, old, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})	474		d, sess, old, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})
475		oldTransport := newBlockedRenderReplacementTransport(d, sess)	475		oldTransport := newBlockedRenderReplacementTransport(d, sess)
476		old.replaceTransport(oldTransport)	476		old.replaceTransport(oldTransport)
477	-	rc := d.attachCoordinator(sess, old, true)	477	+	rc := d.attachCoordinator(sess, nil, old, true)
478		lease := rc.attachmentLease(old)	478		lease := rc.attachmentLease(old)
479		token := sess.attachmentToken(old, oldTransport)	479		token := sess.attachmentToken(old, oldTransport)
480		token.lease = lease	480		token.lease = lease

@@ -529,7 +529,7 @@ func TestAttachmentEffectGateAdmittedEffectCompletesBeforeConflictingTransition(
529		d, sess, old, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})	529		d, sess, old, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})
530		oldTransport := newDatagramTestTransport()	530		oldTransport := newDatagramTestTransport()
531		old.replaceTransport(oldTransport)	531		old.replaceTransport(oldTransport)
532	-	rc := d.attachCoordinator(sess, old, true)	532	+	rc := d.attachCoordinator(sess, nil, old, true)
533		token := sess.attachmentToken(old, oldTransport)	533		token := sess.attachmentToken(old, oldTransport)
534		token.lease = rc.attachmentLease(old)	534		token.lease = rc.attachmentLease(old)
535		old.publishAttachmentCapability(token)	535		old.publishAttachmentCapability(token)

@@ -630,7 +630,7 @@ func TestAttachmentEffectGateAdmittedActiveEffectsFinishBeforeReplacement(t *tes
630		oldTransport := newDatagramTestTransport()	630		oldTransport := newDatagramTestTransport()
631		old.replaceTransport(oldTransport)	631		old.replaceTransport(oldTransport)
632		old.keys = keys.NewRouter(d.clock, daemonKeyHandler{d: d, ac: old}, &d.bindings)	632		old.keys = keys.NewRouter(d.clock, daemonKeyHandler{d: d, ac: old}, &d.bindings)
633	-	rc := d.attachCoordinator(sess, old, true)	633	+	rc := d.attachCoordinator(sess, nil, old, true)
634		token := sess.attachmentToken(old, oldTransport)	634		token := sess.attachmentToken(old, oldTransport)
635		token.lease = rc.attachmentLease(old)	635		token.lease = rc.attachmentLease(old)
636		if tt.setup != nil {	636		if tt.setup != nil {

@@ -683,7 +683,7 @@ func TestJumpAttentionAdmittedHandoffCrossesSessions(t *testing.T) {
683		target.tabs[1].attentionAt = time.Unix(1, 0)	683		target.tabs[1].attentionAt = time.Unix(1, 0)
684		d.sessions[target.id] = target	684		d.sessions[target.id] = target
685			685
686	-	rc := d.attachCoordinator(source, ac, true)	686	+	rc := d.attachCoordinator(source, nil, ac, true)
687		token := source.attachmentToken(ac, ac.transport())	687		token := source.attachmentToken(ac, ac.transport())
688		token.lease = rc.attachmentLease(ac)	688		token.lease = rc.attachmentLease(ac)
689		ac.publishAttachmentCapability(token)	689		ac.publishAttachmentCapability(token)

@@ -701,7 +701,7 @@ func TestPickerDeleteDoesNotDeleteSourceAfterInitiatorReplacement(t *testing.T)
701		d.enterPicker(sess, old)	701		d.enterPicker(sess, old)
702			702
703		oldTransport := old.transport()	703		oldTransport := old.transport()
704	-	rc := d.attachCoordinator(sess, old, true)	704	+	rc := d.attachCoordinator(sess, nil, old, true)
705		token := sess.attachmentToken(old, oldTransport)	705		token := sess.attachmentToken(old, oldTransport)
706		token.lease = rc.attachmentLease(old)	706		token.lease = rc.attachmentLease(old)
707		old.publishAttachmentCapability(token)	707		old.publishAttachmentCapability(token)

@@ -745,7 +745,7 @@ func TestPickerDeleteSourceForCurrentInitiatorDoesNotDeadlock(t *testing.T) {
745		defer release()	745		defer release()
746		d, sess, ac, _ := newManualSessionWithPTYs(t, p)	746		d, sess, ac, _ := newManualSessionWithPTYs(t, p)
747		d.enterPicker(sess, ac)	747		d.enterPicker(sess, ac)
748	-	rc := d.attachCoordinator(sess, ac, true)	748	+	rc := d.attachCoordinator(sess, nil, ac, true)
749		token := sess.attachmentToken(ac, ac.transport())	749		token := sess.attachmentToken(ac, ac.transport())
750		token.lease = rc.attachmentLease(ac)	750		token.lease = rc.attachmentLease(ac)
751		ac.publishAttachmentCapability(token)	751		ac.publishAttachmentCapability(token)

@@ -762,7 +762,7 @@ func TestAttachmentEffectGateAdmittedFirstPaintFinishesBeforeReplacement(t *test
762		d, sess, old, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})	762		d, sess, old, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})
763		oldTransport := newDatagramTestTransport()	763		oldTransport := newDatagramTestTransport()
764		old.replaceTransport(oldTransport)	764		old.replaceTransport(oldTransport)
765	-	rc := d.attachCoordinator(sess, old, true)	765	+	rc := d.attachCoordinator(sess, nil, old, true)
766		token := sess.attachmentToken(old, oldTransport)	766		token := sess.attachmentToken(old, oldTransport)
767		token.lease = rc.attachmentLease(old)	767		token.lease = rc.attachmentLease(old)
768			768

@@ -796,7 +796,7 @@ func TestAttachmentEffectGateReversedConcurrentTransitionsDoNotDeadlock(t *testi
796		d, first, a, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})	796		d, first, a, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})
797		aTransport := newDatagramTestTransport()	797		aTransport := newDatagramTestTransport()
798		a.replaceTransport(aTransport)	798		a.replaceTransport(aTransport)
799	-	d.attachCoordinator(first, a, true)	799	+	d.attachCoordinator(first, nil, a, true)
800		first.attachmentToken(a, aTransport)	800		first.attachmentToken(a, aTransport)
801			801
802		bTransport := newDatagramTestTransport()	802		bTransport := newDatagramTestTransport()

@@ -807,7 +807,7 @@ func TestAttachmentEffectGateReversedConcurrentTransitionsDoNotDeadlock(t *testi
807		d.mu.Lock()	807		d.mu.Lock()
808		d.sessions[second.id] = second	808		d.sessions[second.id] = second
809		d.mu.Unlock()	809		d.mu.Unlock()
810	-	d.attachCoordinator(second, b, true)	810	+	d.attachCoordinator(second, nil, b, true)
811		second.attachmentToken(b, bTransport)	811		second.attachmentToken(b, bTransport)
812			812
813		start := make(chan struct{})	813		start := make(chan struct{})

@@ -854,7 +854,7 @@ func TestAttachmentEffectGateFrozenConnectionRejectsLateEffect(t *testing.T) {
854		d, sess, ac, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})	854		d, sess, ac, _ := newManualSessionWithPTYs(t, &transactionalResizePTY{})
855		transport := newDatagramTestTransport()	855		transport := newDatagramTestTransport()
856		ac.replaceTransport(transport)	856		ac.replaceTransport(transport)
857	-	rc := d.attachCoordinator(sess, ac, true)	857	+	rc := d.attachCoordinator(sess, nil, ac, true)
858		token := sess.attachmentToken(ac, transport)	858		token := sess.attachmentToken(ac, transport)
859		token.lease = rc.attachmentLease(ac)	859		token.lease = rc.attachmentLease(ac)
860		ac.publishAttachmentCapability(token)	860		ac.publishAttachmentCapability(token)

M internal/usecase/daemon/attachment_registry.go +91 -69

 	revision   uint64
 }
-// viewInvalidation records the order in which attachment views observed one
+// attachmentViewSnapshot is the immutable value returned to callers that need
-// shared session mutation. The order is stable client-ID order, not map
+// to inspect attachment-local state without retaining its mutex.
-// iteration or lock-acquisition order, which keeps concurrent attaches
+type attachmentViewSnapshot struct {
-// deterministic.
-type viewInvalidation struct {
 	attachment *attachedClient
-	revision   uint64
+	view       attachmentView
 }
 func (ac *attachedClient) viewSnapshot() attachmentView {
 	return ac.view
 }
-func (ac *attachedClient) publishView(view attachmentView) {
+func (ac *attachedClient) publishViewLocked(view attachmentView) {
-	if ac == nil {
-		return
-	}
-	ac.viewMu.Lock()
 	// Rebase while viewMu is held, before the new revision becomes visible.
 	// Output fences take the same lock, so no side effect can pair the new
 	// ViewRevision with the previous output epoch. Test/headless fixtures may
 		}
 	}
 	ac.view = view
-	ac.viewMu.Unlock()
+}
+func (ac *attachedClient) publishView(view attachmentView) {
+	if ac == nil {
+		return
+	}
+	ac.viewMu.Lock()
+	defer ac.viewMu.Unlock()
+	ac.publishViewLocked(view)
+}
+func (ac *attachedClient) publishViewIfCurrent(before, view attachmentView) bool {
+	if ac == nil {
+		return false
+	}
+	ac.viewMu.Lock()
+	defer ac.viewMu.Unlock()
+	if ac.view != before {
+		return false
+	}
+	ac.publishViewLocked(view)
+	return true
 }
 // registerAttachmentLocked admits ac exactly once. Caller holds s.mu and must
 	return true
 }
-func registerAttachmentSessionLocked(entry attachmentSession, ac *attachedClient) bool {
+func registerAttachmentSessionLocked(entry *session, ac *attachedClient) bool {
 	if entry == nil || entry.core() == nil {
 		return false
 	}
 	return true
 }
-func unregisterAttachmentSessionLocked(entry attachmentSession, ac *attachedClient) bool {
+func unregisterAttachmentSessionLocked(entry *session, ac *attachedClient) bool {
 	if entry == nil || entry.core() == nil {
 		return false
 	}
 	return s.unregisterAttachmentLocked(ac)
 }
-// snapshotAttachmentsLocked returns a stable registration-ordered snapshot.
+func (s *session) snapshotAttachmentsLocked() []*attachedClient {
-// Callers hold s.mu; returned attachments may be used after unlocking.
+	if s == nil || len(s.attachments) == 0 {
-func (c *sessionCore) snapshotAttachmentsLocked() []*attachedClient {
-	if c == nil || len(c.attachments) == 0 {
 		return nil
 	}
-	out := make([]*attachedClient, 0, len(c.attachments))
+	out := make([]*attachedClient, 0, len(s.attachments))
-	for ac := range c.attachments {
+	for ac := range s.attachments {
 		out = append(out, ac)
 	}
 	slices.SortStableFunc(out, func(a, b *attachedClient) int {
+		// ClientID is the stable wire identity, so concurrent registration order
+		// cannot affect snapshots or invalidation order.
 		if id := bytes.Compare(a.clientID[:], b.clientID[:]); id != 0 {
 			return id
 		}
-		return cmp.Compare(c.attachmentOrder[a], c.attachmentOrder[b])
+		return cmp.Compare(s.attachmentOrder[a], s.attachmentOrder[b])
 	})
 	return out
 }
-func attachmentRegisteredLocked(entry attachmentSession, ac *attachedClient) bool {
+func attachmentRegisteredLocked(entry *session, ac *attachedClient) bool {
 	if entry == nil || ac == nil || entry.core() == nil {
 		return false
 	}
 	return ok
 }
-func attachmentRegistered(entry attachmentSession, ac *attachedClient) bool {
+func attachmentRegistered(entry *session, ac *attachedClient) bool {
 	if entry == nil || ac == nil || entry.core() == nil {
 		return false
 	}
 	return false
 }
-func snapshotAttachmentSession(entry attachmentSession) []*attachedClient {
-	if entry == nil || entry.core() == nil {
-		return nil
-	}
-	core := entry.core()
-	core.mu.Lock()
-	defer core.mu.Unlock()
-	return core.snapshotAttachmentsLocked()
-}
 func (s *session) snapshotAttachments() []*attachedClient {
 	if s == nil {
 		return nil
 	return s.snapshotAttachmentsLocked()
 }
+func (s *session) snapshotAttachmentViews() []attachmentViewSnapshot {
+	attachments := s.snapshotAttachments()
+	if len(attachments) == 0 {
+		return nil
+	}
+	views := make([]attachmentViewSnapshot, 0, len(attachments))
+	for _, ac := range attachments {
+		views = append(views, attachmentViewSnapshot{attachment: ac, view: ac.viewSnapshot()})
+	}
+	return views
+}
 // repairAttachmentViewLocked validates stable targets and chooses the nearest
 // surviving target when a tab or pane was removed. Caller holds s.mu.
 func (s *session) repairAttachmentViewLocked(ac *attachedClient, view attachmentView) attachmentView {
 	} else {
 		view.paneID = ""
 	}
+	targetTab.mu.Unlock()
 	if view.windowRows <= 0 {
+		targetTab.mu.Lock()
 		view.windowRows = targetTab.size.Rows
+		targetTab.mu.Unlock()
 	}
-	targetTab.mu.Unlock()
 	if view.windowTop < 0 {
 		view.windowTop = 0
 	}
 	if s == nil || ac == nil {
 		return false
 	}
+	before := ac.viewSnapshot()
 	s.mu.Lock()
-	defer s.mu.Unlock()
 	if _, ok := s.attachments[ac]; !ok {
+		s.mu.Unlock()
 		return false
 	}
-	before := ac.viewSnapshot()
 	after := s.repairAttachmentViewLocked(ac, before)
 	if before.tabID == after.tabID && before.paneID == after.paneID && before.windowTop == after.windowTop && before.windowRows == after.windowRows && before.windowSet == after.windowSet && before.bookmark == after.bookmark && before.liveBottom == after.liveBottom {
+		s.mu.Unlock()
 		return false
 	}
 	after.revision++
-	ac.publishView(after)
+	s.mu.Unlock()
-	return true
+	return ac.publishViewIfCurrent(before, after)
 }
 // prepareAttachmentViewsForRemovedTabLocked selects the nearest surviving tab
 // invalidateViewsLocked orders all per-attachment invalidations behind the
 // shared session mutation. Caller holds s.mu and dispatchMu.
-func (s *session) invalidateViewsLocked() []viewInvalidation {
+func (s *session) invalidateViewsLocked() {
-	attachments := s.snapshotAttachmentsLocked()
+	for _, ac := range s.snapshotAttachmentsLocked() {
-	invalidations := make([]viewInvalidation, 0, len(attachments))
-	for _, ac := range attachments {
 		view := ac.viewSnapshot()
 		repaired := s.repairAttachmentViewLocked(ac, view)
 		repaired.revision++
 		ac.publishView(repaired)
-		invalidations = append(invalidations, viewInvalidation{attachment: ac, revision: repaired.revision})
 	}
-	return invalidations
 }
 // runMutation is the one admission boundary for shared session mutations.
 	if s == nil || ac == nil {
 		return nil
 	}
-	s.mu.Lock()
+	for {
-	defer s.mu.Unlock()
+		view := ac.viewSnapshot()
-	if _, ok := s.attachments[ac]; !ok {
+		s.mu.Lock()
-		return nil
+		if _, ok := s.attachments[ac]; !ok {
-	}
+			s.mu.Unlock()
-	view := ac.viewSnapshot()
+			return nil
-	repaired := s.repairAttachmentViewLocked(ac, view)
+		}
-	if repaired.tabID != view.tabID || repaired.paneID != view.paneID || repaired.windowTop != view.windowTop || repaired.windowRows != view.windowRows || repaired.windowSet != view.windowSet || repaired.bookmark != view.bookmark || repaired.liveBottom != view.liveBottom {
+		repaired := s.repairAttachmentViewLocked(ac, view)
-		repaired.revision++
+		var target *tab
-		ac.publishView(repaired)
+		for _, tb := range s.tabs {
-	}
+			if tb != nil && domain.TabStableID(tb.stableID) == repaired.tabID {
-	for _, tb := range s.tabs {
+				target = tb
-		if tb != nil && domain.TabStableID(tb.stableID) == repaired.tabID {
+				break
-			return tb
+			}
 		}
+		s.mu.Unlock()
+		if repaired.tabID != view.tabID || repaired.paneID != view.paneID || repaired.windowTop != view.windowTop || repaired.windowRows != view.windowRows || repaired.windowSet != view.windowSet || repaired.bookmark != view.bookmark || repaired.liveBottom != view.liveBottom {
+			repaired.revision++
+		}
+		if !ac.publishViewIfCurrent(view, repaired) {
+			continue
+		}
+		return target
 	}
-	return nil
 }
 // paneForAttachment resolves both stable IDs and repairs a removed pane before
 // repairAttachmentViews repairs all live attachment targets after a shared
 // topology mutation.
-func (s *session) repairAttachmentViews() []viewInvalidation {
+func (s *session) repairAttachmentViews() {
 	if s == nil {
-		return nil
+		return
 	}
-	var invalidations []viewInvalidation
 	_ = s.runMutation(func() error {
 		s.mu.Lock()
-		invalidations = s.invalidateViewsLocked()
+		s.invalidateViewsLocked()
 		s.mu.Unlock()
 		return nil
 	})
-	return invalidations
 }
 // repairAttachmentViewsLocked repairs all live attachment targets after a tab
-// or pane mutation. Caller holds dispatchMu and s.mu; it is intended to run at
+// or pane mutation. It is intended to run at the same mutation linearization
-// the same mutation linearization point as the shared membership change.
+// point as the shared membership change.
-func (s *session) repairAttachmentViewsLocked() []viewInvalidation {
+func (s *session) repairAttachmentViewsLocked() {
 	if s == nil {
-		return nil
+		return
 	}
-	return s.invalidateViewsLocked()
+	s.invalidateViewsLocked()
 }

M internal/usecase/daemon/attachment_registry_test.go +10 -3

 			t.Fatalf("snapshot[%d] id = %d, want %d", i, got[i].clientID[0], want)
 		}
 	}
-	invalidations := sess.repairAttachmentViews()
+	ordered := sess.repairAttachmentViewsForTest()
 	for i, want := range []byte{1, 2, 3} {
-		if invalidations[i].attachment.clientID[0] != want {
+		if ordered[i].clientID[0] != want {
-			t.Fatalf("invalidation[%d] id = %d, want %d", i, invalidations[i].attachment.clientID[0], want)
+			t.Fatalf("ordered attachment[%d] id = %d, want %d", i, ordered[i].clientID[0], want)
 		}
 	}
 }
+func (s *session) repairAttachmentViewsForTest() []*attachedClient {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.repairAttachmentViewsLocked()
+	return s.snapshotAttachmentsLocked()
+}

M internal/usecase/daemon/attachment_render_test.go +143 -0


@@ -31,6 +31,72 @@ func (t *blockedAttachmentTransport) Send(frame ports.Frame) error {
31	func (*blockedAttachmentTransport) Recv() (ports.Frame, error) { return ports.Frame{}, io.EOF }	31		func (*blockedAttachmentTransport) Recv() (ports.Frame, error) { return ports.Frame{}, io.EOF }
32	func (*blockedAttachmentTransport) Close() error { return nil }	32		func (*blockedAttachmentTransport) Close() error { return nil }
33		33
		34	+	func TestStaleCapacityReadinessRequeuesWithoutAnotherInvalidation(t *testing.T) {
		35	+	d, sess, ac, sends := newManualSessionWithPTYs(t, nil)
		36	+	rc := d.attachCoordinator(sess, nil, ac, true)
		37	+	require.True(t, sess.repairAttachmentView(ac))
		38	+	rc.opts.clock = nil // drive fire explicitly; the interleaving is the test.
		39	+
		40	+	firstObserved := make(chan struct{})
		41	+	retryObserved := make(chan struct{})
		42	+	releaseFirst := make(chan struct{})
		43	+	releaseRetry := make(chan struct{})
		44	+	var probes atomic.Int32
		45	+	rc.opts.ackReadyFor = func(*attachedClient) bool {
		46	+	switch probes.Add(1) {
		47	+	case 1:
		48	+	close(firstObserved)
		49	+	<-releaseFirst
		50	+	case 2:
		51	+	close(retryObserved)
		52	+	<-releaseRetry
		53	+	}
		54	+	return true
		55	+	}
		56	+
		57	+	pane := sess.tabs[0].focusedPane()
		58	+	pane.mu.Lock()
		59	+	pane.screen.Write([]byte("capacity race"))
		60	+	pane.mu.Unlock()
		61	+	require.True(t, rc.invalidate(renderInvalidation{class: invalidateUrgent, producer: "capacity-race-test"}))
		62	+	fireDone := make(chan struct{})
		63	+	go func() {
		64	+	rc.fireCurrent(false)
		65	+	close(fireDone)
		66	+	}()
		67	+	awaitTestCompletion(t, firstObserved, "readiness probe did not start")
		68	+
		69	+	// Readiness was observed while the window had room. Fill it before the
		70	+	// wake reaches paint; paint must report the failed final capacity check.
		71	+	ac.sendMu.Lock()
		72	+	ac.output.maxOutstanding = 1
		73	+	ac.output.next = 1
		74	+	ac.output.acked = 0
		75	+	ac.output.syncCapacityLocked()
		76	+	ac.sendMu.Unlock()
		77	+	close(releaseFirst)
		78	+	awaitTestCompletion(t, retryObserved, "capacity failure did not schedule an internal retry")
		79	+
		80	+	// The retry is already in flight. Restore capacity without publishing any
		81	+	// new invalidation or ACK notification, then let that retry paint.
		82	+	ac.sendMu.Lock()
		83	+	ac.output.maxOutstanding = 2
		84	+	ac.output.syncCapacityLocked()
		85	+	ac.sendMu.Unlock()
		86	+	close(releaseRetry)
		87	+	frame := awaitFrame(t, sends, ports.MsgOutput)
		88	+	output, err := ports.UnmarshalOutput(frame.Payload)
		89	+	require.NoError(t, err)
		90	+	require.Contains(t, string(output.Data), "capacity race")
		91	+	awaitTestCompletion(t, fireDone, "initial fire did not finish")
		92	+
		93	+	rc.mu.Lock()
		94	+	requeuedPending := rc.pending
		95	+	rc.mu.Unlock()
		96	+	require.False(t, requeuedPending, "successful internal retry must consume the mutation")
		97	+	require.Equal(t, int32(2), probes.Load(), "retry must not require another external wake")
		98	+	}
		99	+
34	func TestAttachmentResizeKeepsSessionContentAndPeersFixed(t *testing.T) {	100		func TestAttachmentResizeKeepsSessionContentAndPeersFixed(t *testing.T) {
35	pty, releasePTY := newBlockingPTY(t)	101		pty, releasePTY := newBlockingPTY(t)
36	defer releasePTY()	102		defer releasePTY()

@@ -76,6 +142,83 @@ func TestAttachmentResizeKeepsSessionContentAndPeersFixed(t *testing.T) {
76	require.Greater(t, second.output.currentEpoch(), secondEpoch)	142		require.Greater(t, second.output.currentEpoch(), secondEpoch)
77	}	143		}
78		144
		145	+	func TestAttachmentFirstPaintDoesNotWaitForBlockedPeer(t *testing.T) {
		146	+	pty, releasePTY := newBlockingPTY(t)
		147	+	defer releasePTY()
		148	+	clock := &signalClock{timers: make(chan *signalTimer, 16)}
		149	+	d := newTestDaemon(t, newFactory(t, pty), clock)
		150	+	oldTransport := &blockedAttachmentTransport{entered: make(chan struct{}), release: make(chan struct{}), sends: make(chan ports.Frame, 8)}
		151	+	sess, old, err := d.route(ports.Hello{Version: ports.ProtocolVersion, Intent: ports.IntentNew, Name: "work", Size: domain.Size{Cols: 80, Rows: 24}, ClientID: [16]byte{1}}, oldTransport)
		152	+	require.NoError(t, err)
		153	+	newTransport := &blockedAttachmentTransport{entered: make(chan struct{}), release: make(chan struct{}), sends: make(chan ports.Frame, 8)}
		154	+	_, fresh, err := d.route(ports.Hello{Version: ports.ProtocolVersion, Intent: ports.IntentAttach, Name: "work", Size: domain.Size{Cols: 80, Rows: 24}, ClientID: [16]byte{2}}, newTransport)
		155	+	require.NoError(t, err)
		156	+
		157	+	rc := sess.renderCoordinator()
		158	+	oldLease := rc.attachmentLease(old)
		159	+	freshLease := rc.attachmentLease(fresh)
		160	+	require.True(t, rc.markAttachmentReady(oldLease))
		161	+	oldTransport.blocked.Store(true)
		162	+	pane := sess.tabs[0].focusedPane()
		163	+	pane.mu.Lock()
		164	+	pane.screen.Write([]byte("slow peer"))
		165	+	pane.mu.Unlock()
		166	+	require.True(t, rc.invalidate(renderInvalidation{class: invalidateUrgent, reset: true, producer: "test"}))
		167	+	rc.fireCurrent(false)
		168	+	awaitTestCompletion(t, oldTransport.entered, "slow attachment did not begin its blocked output")
		169	+
		170	+	require.True(t, rc.markAttachmentReady(freshLease))
		171	+	token := sess.attachmentToken(fresh, newTransport)
		172	+	token.lease = freshLease
		173	+	painted := make(chan bool, 1)
		174	+	go func() { painted <- d.firstPaintForTransition(token) }()
		175	+	frame := awaitTestValue(t, newTransport.sends, "healthy attachment first paint was gated by slow peer")
		176	+	require.Equal(t, ports.MsgOutput, frame.Type)
		177	+	require.True(t, <-painted)
		178	+	close(oldTransport.release)
		179	+	}
		180	+
		181	+	func TestMultiAttachmentHandshakeFirstPaintNotGatedByBlockedPeer(t *testing.T) {
		182	+	pty, releasePTY := newBlockingPTY(t)
		183	+	defer releasePTY()
		184	+	clock := &signalClock{timers: make(chan *signalTimer, 16)}
		185	+	d := newTestDaemon(t, newFactory(t, pty), clock)
		186	+	oldTransport := &blockedAttachmentTransport{entered: make(chan struct{}), release: make(chan struct{}), sends: make(chan ports.Frame, 8)}
		187	+	sess, old, err := d.route(ports.Hello{Version: ports.ProtocolVersion, Intent: ports.IntentNew, Name: "work", Size: domain.Size{Cols: 80, Rows: 24}, ClientID: [16]byte{1}}, oldTransport)
		188	+	require.NoError(t, err)
		189	+	rc := sess.renderCoordinator()
		190	+	require.True(t, rc.markAttachmentReady(rc.attachmentLease(old)))
		191	+
		192	+	oldTransport.blocked.Store(true)
		193	+	pane := sess.tabs[0].focusedPane()
		194	+	pane.mu.Lock()
		195	+	pane.screen.Write([]byte("slow peer"))
		196	+	pane.mu.Unlock()
		197	+	require.True(t, rc.invalidate(renderInvalidation{class: invalidateUrgent, reset: true, producer: "test"}))
		198	+	fireDone := make(chan struct{})
		199	+	go func() {
		200	+	rc.fireCurrent(false)
		201	+	close(fireDone)
		202	+	}()
		203	+	awaitTestCompletion(t, oldTransport.entered, "slow attachment did not begin its blocked output")
		204	+
		205	+	hello := ports.Hello{Version: ports.ProtocolVersion, Intent: ports.IntentAttach, Name: "work", Size: domain.Size{Cols: 80, Rows: 24}, ClientID: [16]byte{2}}
		206	+	tr, sends, releaseConn := newConn(t, ports.Frame{Type: ports.MsgHello, Payload: ports.MarshalHello(hello)})
		207	+	defer releaseConn()
		208	+	handshakeDone := make(chan struct{})
		209	+	go func() {
		210	+	d.handleConn(tr)
		211	+	close(handshakeDone)
		212	+	}()
		213	+	awaitFrame(t, sends, ports.MsgWelcome)
		214	+	firstPaint := awaitFrame(t, sends, ports.MsgOutput)
		215	+	require.Equal(t, ports.MsgOutput, firstPaint.Type)
		216	+	releaseConn()
		217	+	awaitTestCompletion(t, handshakeDone, "multi-attachment handshake did not complete after first paint")
		218	+	close(oldTransport.release)
		219	+	awaitTestCompletion(t, fireDone, "slow peer output did not finish after release")
		220	+	}
		221	+
79	func TestAttachmentPaintFanoutDoesNotWaitForBlockedPeer(t *testing.T) {	222		func TestAttachmentPaintFanoutDoesNotWaitForBlockedPeer(t *testing.T) {
80	pty, releasePTY := newBlockingPTY(t)	223		pty, releasePTY := newBlockingPTY(t)
81	defer releasePTY()	224		defer releasePTY()

M internal/usecase/daemon/attachment_transition.go +4 -4


@@ -20,8 +20,8 @@ type attachmentLifecycleFence struct {
20		}	20		}
21			21
22		type attachmentTransitionRequest struct {	22		type attachmentTransitionRequest struct {
23	-	source attachmentSession	23	+	source *session
24	-	target attachmentSession	24	+	target *session
25		next *attachedClient	25		next *attachedClient
26		expectedTransport transportSnapshot	26		expectedTransport transportSnapshot
27		sourceToken *attachmentConnectionToken	27		sourceToken *attachmentConnectionToken

@@ -44,7 +44,7 @@ type attachmentTransitionRequest struct {
44		attachmentEffectsFrozen bool	44		attachmentEffectsFrozen bool
45		}	45		}
46			46
47	-	func transitionSourceTokenMatchesRequest(token attachmentConnectionToken, source attachmentSession, req attachmentTransitionRequest) bool {	47	+	func transitionSourceTokenMatchesRequest(token attachmentConnectionToken, source *session, req attachmentTransitionRequest) bool {
48		return token.sess == source && token.ac == req.next &&	48		return token.sess == source && token.ac == req.next &&
49		token.generation == req.next.connectionGeneration.Load() &&	49		token.generation == req.next.connectionGeneration.Load() &&
50		token.transport.transport == req.expectedTransport.transport &&	50		token.transport.transport == req.expectedTransport.transport &&

@@ -54,7 +54,7 @@ func transitionSourceTokenMatchesRequest(token attachmentConnectionToken, source
54		// transitionSourceTokenCurrentLocked requires source.core().mu and, when a	54		// transitionSourceTokenCurrentLocked requires source.core().mu and, when a
55		// lease exists, sourceCoordinator.mu. It is the canonical exact-connection	55		// lease exists, sourceCoordinator.mu. It is the canonical exact-connection
56		// handoff check for client-originated navigation and lifecycle mutations.	56		// handoff check for client-originated navigation and lifecycle mutations.
57	-	func transitionSourceTokenCurrentLocked(token attachmentConnectionToken, source attachmentSession, sourceCoordinator *renderCoordinator, req attachmentTransitionRequest) bool {	57	+	func transitionSourceTokenCurrentLocked(token attachmentConnectionToken, source session, sourceCoordinator renderCoordinator, req attachmentTransitionRequest) bool {
58		if token.sess != source \|\| token.ac != req.next \|\|	58		if token.sess != source \|\| token.ac != req.next \|\|
59		token.generation != req.next.connectionGeneration.Load() \|\|	59		token.generation != req.next.connectionGeneration.Load() \|\|
60		token.sess == nil \|\| token.ac.currentAttachmentSession() != source \|\|	60		token.sess == nil \|\| token.ac.currentAttachmentSession() != source \|\|

M internal/usecase/daemon/attachment_transition_publish.go +22 -27

 	return transitionSourceTokenCurrentLocked(token, token.sess, coordinator, req)
 }
-func transitionSourceTabCurrentLocked(source attachmentSession, expected *tab) bool {
+func transitionSourceTabCurrentLocked(source *session, expected *tab) bool {
 	return transitionSourceTabCurrentForRequestLocked(source, expected, false)
 }
-func transitionSourceTabCurrentForRequestLocked(source attachmentSession, expected *tab, transferExpected bool) bool {
+func transitionSourceTabCurrentForRequestLocked(source *session, expected *tab, transferExpected bool) bool {
 	if expected == nil {
 		return true
 	}
-	local, ok := localSession(source)
+	if source == nil || !containsTab(source.tabs, expected) {
-	if !ok || !containsTab(local.tabs, expected) {
 		return false
 	}
 	expected.mu.Lock()
 type attachmentPublication struct {
 	req                 attachmentTransitionRequest
-	source              attachmentSession
+	source              *session
 	targetCoordinator   *renderCoordinator
 	sourceCoordinator   *renderCoordinator
 	releaseCoordinators func()
 	p.releaseCoordinators()
 }
-func attachmentLifecycleCurrentLocked(entry attachmentSession, fence *attachmentLifecycleFence) bool {
+func attachmentLifecycleCurrentLocked(entry *session, fence *attachmentLifecycleFence) bool {
 	if fence == nil {
 		return true
 	}
-	target, ok := localSession(entry)
+	if entry == nil {
-	if !ok {
 		return false
 	}
-	if fence.checkCreatedAt && (target.name != fence.name || target.createdAt != fence.createdAt) {
+	if fence.checkCreatedAt && (entry.name != fence.name || entry.createdAt != fence.createdAt) {
 		return false
 	}
-	if fence.checkIncarnation && target.incarnation != fence.incarnation {
+	if fence.checkIncarnation && entry.incarnation != fence.incarnation {
 		return false
 	}
-	return !fence.checkTab || fence.tabIndex >= 0 && fence.tabIndex < len(target.tabs) &&
+	return !fence.checkTab || fence.tabIndex >= 0 && fence.tabIndex < len(entry.tabs) &&
-		domain.TabStableID(target.tabs[fence.tabIndex].stableID) == fence.tabID
+		domain.TabStableID(entry.tabs[fence.tabIndex].stableID) == fence.tabID
 }
 // validateAttachmentTransitionPrelocked performs every fallible check before
 // shared environment state as part of the same publication.
 func (d *Daemon) applyTargetStateLocked(publication *attachmentPublication) bool {
 	req := publication.req
-	if req.activateTargetTab {
+	if req.activateTargetTab && req.target != nil {
-		if target, ok := localSession(req.target); ok {
+		req.target.activateAttachmentViewLocked(req.next, req.targetTabIndex)
-			target.activateAttachmentViewLocked(req.next, req.targetTabIndex)
-		}
 	}
-	if req.copySourceEnvironment {
+	if req.copySourceEnvironment && publication.source != nil && req.target != nil {
-		source, sourceOK := localSession(publication.source)
+		req.target.terminal = publication.source.terminal
-		target, targetOK := localSession(req.target)
+		req.target.env = copyEnvironment(publication.source.env)
-		if sourceOK && targetOK {
-			target.terminal = source.terminal
-			target.env = copyEnvironment(source.env)
-		}
 	}
 	return req.preserveAttachment
 }
 }
 // lockAttachmentSessions gives every two-session transition one stable order.
-func lockAttachmentSessions(a, b attachmentSession) func() {
+func lockAttachmentSessions(a, b *session) func() {
-	aCore := attachmentSessionCore(a)
+	if a == nil || b == nil {
-	bCore := attachmentSessionCore(b)
+		return func() {}
+	}
+	aCore := a.core()
+	bCore := b.core()
 	if aCore == nil || bCore == nil {
 		return func() {}
 	}
 // lockAttachmentCoordinators follows the same immutable session-ID order as
 // lockAttachmentSessions. Callers already hold ordered session locks.
-func lockAttachmentCoordinators(a attachmentSession, aCoordinator *renderCoordinator, b attachmentSession, bCoordinator *renderCoordinator) func() {
+func lockAttachmentCoordinators(a *session, aCoordinator *renderCoordinator, b *session, bCoordinator *renderCoordinator) func() {
 	if aCoordinator == nil && bCoordinator == nil {
 		return func() {}
 	}

M internal/usecase/daemon/attention.go +4 -4


@@ -90,8 +90,8 @@ type attentionTarget struct {
90		func (d Daemon) oldestOtherSessionAttention(current session) (attentionTarget, bool) {	90		func (d Daemon) oldestOtherSessionAttention(current session) (attentionTarget, bool) {
91		d.mu.Lock()	91		d.mu.Lock()
92		sessions := make([]*session, 0, len(d.sessions))	92		sessions := make([]*session, 0, len(d.sessions))
93	-	for _, entry := range d.sessions {	93	+	for _, sess := range d.sessions {
94	-	if sess, ok := localSession(entry); ok && sess != current {	94	+	if sess != nil && sess != current {
95		sessions = append(sessions, sess)	95		sessions = append(sessions, sess)
96		}	96		}
97		}	97		}

@@ -137,7 +137,7 @@ func (d Daemon) repaintAttachedClients(sess session) {
137			137
138		func (d *Daemon) repaintAllAttachedClients() {	138		func (d *Daemon) repaintAllAttachedClients() {
139		d.mu.Lock()	139		d.mu.Lock()
140	-	sessions := localSessionsSnapshot(d.sessions)	140	+	sessions := sessionsSnapshot(d.sessions)
141		d.mu.Unlock()	141		d.mu.Unlock()
142			142
143		for _, sess := range sessions {	143		for _, sess := range sessions {

@@ -245,7 +245,7 @@ func (d *Daemon) attentionAnimator(ctx context.Context) {
245			245
246		func (d *Daemon) anyAttention() bool {	246		func (d *Daemon) anyAttention() bool {
247		d.mu.Lock()	247		d.mu.Lock()
248	-	sessions := localSessionsSnapshot(d.sessions)	248	+	sessions := sessionsSnapshot(d.sessions)
249		d.mu.Unlock()	249		d.mu.Unlock()
250			250
251		for _, sess := range sessions {	251		for _, sess := range sessions {

M internal/usecase/daemon/bar_refresh.go +2 -3

 func (d *Daemon) sessionsSnapshot() []*session {
 	d.mu.Lock()
 	defer d.mu.Unlock()
-	return localSessionsSnapshot(d.sessions)
+	return sessionsSnapshot(d.sessions)
 }
 func (d *Daemon) clearBarScriptsForSession(id domain.SessionID) {
 		return
 	}
 	attrs := []any{"anchor", anchor, "session", sessionName, "command", command, "err", err}
-	var scriptErr *barScriptError
+	if scriptErr, ok := errors.AsType[*barScriptError](err); ok {
-	if errors.As(err, &scriptErr) {
 		attrs = append(attrs, "exit_code", scriptErr.exitCode)
 		if scriptErr.stderr != "" {
 			attrs = append(attrs, "stderr", scriptErr.stderr)

M internal/usecase/daemon/bar_refresh_test.go +1 -1


@@ -219,7 +219,7 @@ func TestRefreshBarScriptsAllSessionsForcesRun(t *testing.T) {
219		d := newBarRefreshTestDaemon(r, 60*time.Second)	219		d := newBarRefreshTestDaemon(r, 60*time.Second)
220		sess := newBarRefreshTestSession()	220		sess := newBarRefreshTestSession()
221		sess.registerAttachment(&attachedClient{size: domain.Size{Cols: 80, Rows: 24}})	221		sess.registerAttachment(&attachedClient{size: domain.Size{Cols: 80, Rows: 24}})
222	-	d.sessions = map[domain.SessionID]attachmentSession{sess.id: sess}	222	+	d.sessions = map[domain.SessionID]*session{sess.id: sess}
223			223
224		// Verifies refreshBarScriptsAllSessions iterates every live session and	224		// Verifies refreshBarScriptsAllSessions iterates every live session and
225		// dispatches a run for each. This does not exercise force specifically:	225		// dispatches a run for each. This does not exercise force specifically:

M internal/usecase/daemon/client.go +39 -36

 	overlayOnce          sync.Once
 	clientID             [16]byte
 	// connectionGeneration is the wire-facing capability generation. attachmentEffects is
-	// the linearization gate for every attachment-bound observable operation. An attachment
+	// the linearization gate for every attachment-bound observable operation. A role
 	// transition freezes and drains this gate before changing either generation
 	// or the session/coordinator registries.
 	connectionGeneration atomic.Uint64
 	// tabs and panes without changing shared session ownership.
 	viewMu       sync.Mutex
 	view         attachmentView
-	sess         Guarded[attachmentSession]
+	sess         Guarded[*session]
 	mouseScan    mouse.Scanner
 	themeMu      sync.Mutex
 	clientTheme  themeui.Theme
 	renderStages renderStageHooks // optional render and handoff observability hooks
 	// previousSession is guarded independently. It is retained through temporary
 	// setSession(nil) hand-offs and cleared only on terminal teardown.
-	previousSession Guarded[attachmentSession]
+	previousSession Guarded[*session]
 	linkMu          sync.Mutex
 	sendMu          sync.Mutex
 	// routeCreatedSession marks a session created by this attachment's route.
 	ac.overlayOnce.Do(func() { ac.overlays = newOverlayRuntime(ac) })
 }
-func (ac *attachedClient) currentAttachmentSession() attachmentSession { return ac.sess.Get() }
+func (ac *attachedClient) currentAttachmentSession() *session { return ac.sess.Get() }
 // currentSession narrows the attachment to its owning local session.
 func (ac *attachedClient) currentSession() *session {
-	sess, _ := localSession(ac.currentAttachmentSession())
+	return ac.currentAttachmentSession()
-	return sess
 }
-func (ac *attachedClient) setSession(sess attachmentSession) { ac.sess.Set(sess) }
+func (ac *attachedClient) setSession(sess *session) { ac.sess.Set(sess) }
 func (ac *attachedClient) clearPreviousSession() {
 	if ac != nil {
 // attachCoordinator installs the coordinator lease for an attachment. Session
 // membership remains independent, so installing one attachment never displaces
 // another.
-func (d *Daemon) attachCoordinator(sess *session, current *attachedClient, ready bool) *renderCoordinator {
+func (d *Daemon) attachCoordinator(sess *session, old, current *attachedClient, ready bool) *renderCoordinator {
-	rc, cleanup := d.attachCoordinatorDeferred(sess, current, ready)
+	rc, cleanup := d.attachCoordinatorDeferred(sess, old, current, ready)
 	cleanup.finish()
 	return rc
 }
-func (d *Daemon) attachCoordinatorDeferred(sess *session, current *attachedClient, ready bool) (*renderCoordinator, renderLifecycleCleanup) {
+func (d *Daemon) attachCoordinatorDeferred(sess *session, _ *attachedClient, current *attachedClient, ready bool) (*renderCoordinator, renderLifecycleCleanup) {
 	rc := d.ensureRenderCoordinator(sess)
 	if current != nil {
 		rc.attachWithReadiness(current, ready)
 }
 // ensureAttachmentRenderCoordinatorPrelocked publishes the coordinator for an
-// exact attachment implementation. The caller holds entry.core().mu.
+// exact session. The caller holds entry.core().mu.
-func (d *Daemon) ensureAttachmentRenderCoordinatorPrelocked(entry attachmentSession) *renderCoordinator {
+func (d *Daemon) ensureAttachmentRenderCoordinatorPrelocked(entry *session) *renderCoordinator {
 	if rc := attachmentRenderCoordinator(entry); rc != nil {
 		return rc
 	}
 			// The session snapshot is deterministic. Each paint revalidates the
 			// attachment's membership and transport fence after that snapshot, so
 			// a detached peer cannot stop remaining attachments receiving output.
-			attachments := snapshotAttachmentSession(entry)
+			attachments := entry.snapshotAttachments()
 			for _, attachment := range attachments {
 				if !rc.wakeCurrent(w) {
 					return
 					continue
 				}
 				// Pane damage is session-shared; every fan-out attachment needs a
-				// complete frame because any peer may capture it first. A handshake
+				// fresh capture because any peer may acknowledge the damage first.
-				// target is the one synchronous exception: its first paint must finish
+				// Each attachment owns its send lock, so a blocked peer cannot stall
-				// before the handshake releases its lifecycle gate.
+				// this fan-out or the PTY reader. A handshake-targeted wake is the
+				// one synchronous exception: its first paint must finish before the
+				// handshake deadline is released.
 				fanoutReset := w.reset || len(attachments) > 1
+				paint := func() {
+					if d.paint(entry, attachment, fanoutReset, lease) == paintBlockedCapacity {
+						rc.retryCapacity(w, lease)
+					}
+				}
 				if w.lease != nil && w.lease.attachment == attachment {
-					d.paint(entry, attachment, fanoutReset, lease)
+					paint()
 				} else if len(attachments) > 1 {
-					go d.paint(entry, attachment, fanoutReset, lease)
+					go paint()
 				} else {
-					d.paint(entry, attachment, fanoutReset, lease)
+					paint()
 				}
 			}
 		},
+		ackReadyFor: func(attached *attachedClient) bool {
+			// outputStateStream publishes capacity atomically. Do not take
+			// attached.sendMu here: a slow transport may be holding it for an
+			// in-flight Send, and that peer must not gate healthy attachments.
+			return attached == nil || attached.output == nil || !attached.output.atCapacity()
+		},
 	})
-	rc.ackReadyFor = func(attached *attachedClient) bool {
-		// outputStateStream publishes capacity atomically. Do not take
-		// attached.sendMu here: a slow transport may be holding it for an
-		// in-flight Send, and that peer must not gate healthy attachments.
-		return attached == nil || attached.output == nil || !attached.output.atCapacity()
-	}
 	installAttachmentRenderCoordinator(entry, rc)
 	return rc
 }
 		token.ac.captureFrames = nil
 		token.ac.sendMu.Unlock()
 	}
-	sess, ok := localSession(token.sess)
+	if token.sess == nil {
-	if !ok {
 		return false
 	}
-	d.firstPaintWithLease(sess, token.ac, token.ac.size, token.lease)
+	d.firstPaintWithLease(token.sess, token.ac, token.ac.size, token.lease)
 	return true
 }
 	}
 	clientTheme := themeFromMessage(msg)
 	token.ac.setClientTheme(clientTheme)
-	sess, ok := localSession(token.sess)
+	sess := token.sess
-	if !ok || !token.attachmentEffectCurrent() || !d.applyHostTheme(sess, token.ac, clientTheme, false) {
+	if sess == nil || !token.attachmentEffectCurrent() || !d.applyHostTheme(sess, token.ac, clientTheme, false) {
 		return false
 	}
 	if !token.attachmentEffectCurrent() {
 	ac.pipelineScratch = composeCacheInput{}
 	ac.sendMu.Unlock()
-	sess, ok := localSession(token.sess)
+	sess := token.sess
-	if !ok {
+	if sess == nil {
 		return false
 	}
 	rc := sess.renderCoordinator()
 		d.notices.routingMu.Unlock()
 		return
 	}
-	sess, ok := localSession(token.sess)
+	if token.sess == nil {
-	if !ok {
 		d.notices.routingMu.Unlock()
 		return
 	}
-	repaint := d.mutateClientNotice(sess, token.ac, notice)
+	repaint := d.mutateClientNotice(token.sess, token.ac, notice)
 	d.notices.routingMu.Unlock()
 	if repaint && token.attachmentEffectCurrent() {
 		d.repaintForNotice(token.ac)

M internal/usecase/daemon/client_frame_routing.go +5 -9

 // currentAttachmentConnection retries the lock-free session-to-role snapshot when a
 // handoff lands between those reads. The attachment gate still performs the final
 // mutation admission after this function returns.
-func (d *Daemon) currentAttachmentConnection(ac *attachedClient, tr ports.Transport) (attachmentSession, attachmentConnectionToken, bool) {
+func (d *Daemon) currentAttachmentConnection(ac *attachedClient, tr ports.Transport) (*session, attachmentConnectionToken, bool) {
 	for range connectionSnapshotAttempts {
 		if !ac.currentTransportIs(tr) {
 			break
 				if !ok {
 					return
 				}
-				local, ok := localSession(sess)
+				d.clientGone(sess, ac, tr, false)
-				if !ok {
-					return
-				}
-				d.clientGone(local, ac, tr, false)
 				current := ac.currentAttachmentSession()
 				if current == sess || !ac.currentTransportIs(tr) || current == nil {
 					return
 		result.Text = "attached commands cannot override their active session target"
 		return result
 	}
-	sess, ok := localSession(token.sess)
+	sess := token.sess
-	if !ok || !token.attachmentEffectCurrent() {
+	if sess == nil || !token.attachmentEffectCurrent() {
 		result.Code = ports.ErrNoSuchTarget
 		result.Text = "attached session is no longer active"
 		return result
 	return result
 }
-// resetOutput rebases only the exact proxied attachment and transport admitted
+// resetOutput rebases only the exact attachment and transport admitted
 // by the frame router. sendMu serializes the rebase with every output send;
 // transport revalidation under that lock rejects a link replaced while waiting.
 func (d *Daemon) resetOutput(token attachmentConnectionToken) bool {

M internal/usecase/daemon/client_transport_errors.go +4 -4


@@ -37,8 +37,8 @@ func (d *Daemon) clientGoneForAttachment(token attachmentConnectionToken, explic
37		}	37		}
38		token.effect.bindActionEnd(d, "detach")	38		token.effect.bindActionEnd(d, "detach")
39		token.effect.End()	39		token.effect.End()
40	-	sess, ok := localSession(token.sess)	40	+	sess := token.sess
41	-	if !ok {	41	+	if sess == nil {
42		return false	42		return false
43		}	43		}
44		var parkingToken uint64	44		var parkingToken uint64

@@ -126,8 +126,8 @@ func (d *Daemon) detachOnAttachmentSendErrorUntil(token attachmentConnectionToke
126		if failed == nil \|\| failed != token.transport.transport {	126		if failed == nil \|\| failed != token.transport.transport {
127		return	127		return
128		}	128		}
129	-	sess, ok := localSession(token.sess)	129	+	sess := token.sess
130	-	if !ok {	130	+	if sess == nil {
131		return	131		return
132		}	132		}
133		parkingToken := d.markParkingInFlight(sess, token.ac)	133		parkingToken := d.markParkingInFlight(sess, token.ac)

M internal/usecase/daemon/clipboard.go +4 -4


@@ -89,8 +89,8 @@ func (d *Daemon) writeClipboardImageForAttachment(token attachmentConnectionToke
89		if err != nil {	89		if err != nil {
90		return "", err	90		return "", err
91		}	91		}
92	-	sess, ok := localSession(token.sess)	92	+	sess := token.sess
93	-	if !ok {	93	+	if sess == nil {
94		_ = os.Remove(path)	94		_ = os.Remove(path)
95		return "", errAttachmentTransition	95		return "", errAttachmentTransition
96		}	96		}

@@ -135,8 +135,8 @@ func (d Daemon) injectClipboardPath(sess session, path string) {
135		}	135		}
136			136
137		func (d *Daemon) injectClipboardPathForAttachment(token attachmentConnectionToken, path string) {	137		func (d *Daemon) injectClipboardPathForAttachment(token attachmentConnectionToken, path string) {
138	-	sess, ok := localSession(token.sess)	138	+	sess := token.sess
139	-	if !ok \|\| !token.attachmentEffectCurrent() {	139	+	if sess == nil \|\| !token.attachmentEffectCurrent() {
140		return	140		return
141		}	141		}
142		d.injectClipboardPathToTarget(sess, path, &token)	142		d.injectClipboardPathToTarget(sess, path, &token)

M internal/usecase/daemon/clipboard_test.go +1 -1


@@ -203,7 +203,7 @@ func chunkReadPTY(t testing.T, chunks ...[]byte) portsmocks.MockPTY {
203		}	203		}
204			204
205		func publishActiveClipboardCapability(d Daemon, sess session, ac *attachedClient, tr ports.Transport) {	205		func publishActiveClipboardCapability(d Daemon, sess session, ac *attachedClient, tr ports.Transport) {
206	-	rc := d.attachCoordinator(sess, ac, true)	206	+	rc := d.attachCoordinator(sess, nil, ac, true)
207		token := sess.attachmentToken(ac, tr)	207		token := sess.attachmentToken(ac, tr)
208		token.lease = rc.attachmentLease(ac)	208		token.lease = rc.attachmentLease(ac)
209		ac.publishAttachmentCapability(token)	209		ac.publishAttachmentCapability(token)

M internal/usecase/daemon/config.go +1 -1


@@ -336,7 +336,7 @@ func (d *Daemon) resolveAppliedTheme(raw theme.Theme) appliedTheme {
336			336
337		func (d *Daemon) reapplyThemeAllSessions() {	337		func (d *Daemon) reapplyThemeAllSessions() {
338		d.mu.Lock()	338		d.mu.Lock()
339	-	sessions := localSessionsSnapshot(d.sessions)	339	+	sessions := sessionsSnapshot(d.sessions)
340		d.mu.Unlock()	340		d.mu.Unlock()
341			341
342		for _, sess := range sessions {	342		for _, sess := range sessions {

M internal/usecase/daemon/control.go +5 -6

 			return nil, ports.ErrNoSuchTarget, "target tab and pane IDs must be provided together"
 		}
 		var match *session
-		for _, entry := range d.sessions {
+		for _, sess := range d.sessions {
-			sess, ok := localSession(entry)
+			if sess == nil || !sess.containsStableIDs(request.TargetTab, request.TargetPane) {
-			if !ok || !sess.containsStableIDs(request.TargetTab, request.TargetPane) {
 				continue
 			}
 			if match != nil {
 		}
 		return nil, ports.ErrNoSuchTarget, "no live session contains the target tab/pane"
 	}
-	locals := localSessionsSnapshot(d.sessions)
+	locals := sessionsSnapshot(d.sessions)
 	if len(locals) == 0 {
 		return nil, ports.ErrNoSuchTarget, "no live sessions"
 	}
 		Active    bool   `json:"active"`
 	}
 	e.d.mu.Lock()
-	sessions := localSessionsSnapshot(e.d.sessions)
+	sessions := sessionsSnapshot(e.d.sessions)
 	e.d.mu.Unlock()
 	snaps := make([]sessionView, 0, len(sessions))
 	for _, sess := range sessions {
 		return "", command.ErrInvalidArguments
 	}
 	e.d.mu.Lock()
-	sessions := localSessionsSnapshot(e.d.sessions)
+	sessions := sessionsSnapshot(e.d.sessions)
 	e.d.mu.Unlock()
 	rows := make([]ports.RemoteCatalogSession, 0, len(sessions))
 	// Stopped sessions live in d.stopped and are intentionally not in this listing.

M internal/usecase/daemon/daemon.go +8 -9

 type Daemon struct {
 	mu       sync.Mutex
-	sessions map[domain.SessionID]attachmentSession
+	sessions map[domain.SessionID]*session
 	stopped  map[string]stoppedSession
 	// creating reserves names while durable creation I/O runs without mu.
 	creating map[string]struct{}
 	afterResizeCommitSendLocked func()
 	// afterConnectionSessionSnapshot is a deterministic test seam after the
 	// connection loop reads its current session and before it captures that role.
-	afterConnectionSessionSnapshot func(attachmentSession)
+	afterConnectionSessionSnapshot func(*session)
 	// afterAttachmentFrameDispatch is a deterministic test seam after the
 	// connection loop snapshots a token and before a decoded frame takes effect.
 	afterAttachmentFrameDispatch func(attachmentConnectionToken)
 	}
 	paneProcessCtx, paneProcessCancel := context.WithCancel(context.Background())
 	d := &Daemon{
-		sessions:          make(map[domain.SessionID]attachmentSession),
+		sessions:          make(map[domain.SessionID]*session),
 		stopped:           make(map[string]stoppedSession),
 		creating:          make(map[string]struct{}),
 		parked:            make(map[uint64]*parkedAttachment),
 // registerSessionLocked publishes an exact attachment-session identity. Caller
 // holds d.mu.
-func (d *Daemon) registerSessionLocked(entry attachmentSession) bool {
+func (d *Daemon) registerSessionLocked(entry *session) bool {
 	if entry == nil {
 		return false
 	}
 // unregisterSessionLocked removes only the exact registered identity. Caller
 // holds d.mu.
-func (d *Daemon) unregisterSessionLocked(entry attachmentSession) bool {
+func (d *Daemon) unregisterSessionLocked(entry *session) bool {
 	if entry == nil {
 		return false
 	}
 }
 func (d *Daemon) sessionsSnapshotLocked() []*session {
-	return localSessionsSnapshot(d.sessions)
+	return sessionsSnapshot(d.sessions)
 }
 // handleConn reads the first frame off a fresh connection and routes it. A
 	d.mu.Lock()
 	infos := make([]ports.SessionInfo, 0, len(d.sessions)+len(d.stopped))
 	liveNames := make(map[string]struct{}, len(d.sessions))
-	for _, entry := range d.sessions {
+	for _, s := range d.sessions {
-		s, ok := localSession(entry)
+		if s == nil {
-		if !ok {
 			continue
 		}
 		s.mu.Lock()

M internal/usecase/daemon/daemon_test.go +2 -2


@@ -297,8 +297,8 @@ func awaitFrame(t *testing.T, ch chan ports.Frame, typ ports.MsgType) ports.Fram
297		func firstSession(d Daemon) session {	297		func firstSession(d Daemon) session {
298		d.mu.Lock()	298		d.mu.Lock()
299		defer d.mu.Unlock()	299		defer d.mu.Unlock()
300	-	for _, entry := range d.sessions {	300	+	for _, s := range d.sessions {
301	-	if s, ok := localSession(entry); ok {	301	+	if s != nil {
302		return s	302		return s
303		}	303		}
304		}	304		}

A internal/usecase/daemon/final_acceptance_test.go +165 -0

@@ -0,0 +1,165 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/bnema/vev/internal/domain"
	7	+	"github.com/bnema/vev/internal/ports"
	8	+	"github.com/bnema/vev/pkg/vt"
	9	+	"github.com/stretchr/testify/require"
	10	+	)
	11	+
	12	+	func TestAcceptancePaletteNewTabUsesSessionGeometryAfterAttachmentResize(t *testing.T) {
	13	+	d, sess, first, _ := newManualSessionWithPTYs(t, newQuietPTY())
	14	+	first.clientID[0] = 1
	15	+	firstTab := sess.tabs[0]
	16	+	firstTab.stableID = "tab-first"
	17	+	firstTab.panes[firstTab.focusedPane().id].stableID = "pane-first"
	18	+
	19	+	secondTransport, _ := newCapturingTransport(t)
	20	+	second := &attachedClient{
	21	+	tr: secondTransport,
	22	+	output: newOutputStateStream(),
	23	+	size: domain.Size{Cols: 80, Rows: 24},
	24	+	}
	25	+	second.initOverlays()
	26	+	second.clientID[0] = 2
	27	+	second.setSession(sess)
	28	+	secondTab := newTabWithStableID("tab-second", "pane-second", newQuietPTY(), domain.Size{Cols: 80, Rows: 23})
	29	+	secondTab.ctx, secondTab.cancel = sess.ctx, func() {}
	30	+	publishTiledPaneOwners(sess, secondTab)
	31	+	require.NoError(t, sess.runMutation(func() error {
	32	+	sess.mu.Lock()
	33	+	defer sess.mu.Unlock()
	34	+	sess.tabs = append(sess.tabs, secondTab)
	35	+	return nil
	36	+	}))
	37	+	require.True(t, sess.registerAttachment(second))
	38	+	require.True(t, sess.selectAttachmentTab(first, domain.TabStableID(firstTab.stableID)))
	39	+	require.True(t, sess.selectAttachmentTab(second, domain.TabStableID(secondTab.stableID)))
	40	+
	41	+	d.ptys = newFactory(t, newQuietPTY())
	42	+	rc := d.attachCoordinator(sess, nil, first, true)
	43	+	d.attachCoordinator(sess, nil, second, true)
	44	+	firstToken := sess.attachmentToken(first, first.transport())
	45	+	firstToken.lease = rc.attachmentLease(first)
	46	+	first.publishAttachmentCapability(firstToken)
	47	+	secondToken := sess.attachmentToken(second, second.transport())
	48	+	secondToken.lease = rc.attachmentLease(second)
	49	+	second.publishAttachmentCapability(secondToken)
	50	+
	51	+	firstView := first.viewSnapshot()
	52	+	secondView := second.viewSnapshot()
	53	+	first.sendMu.Lock()
	54	+	firstEpoch := first.output.currentEpoch()
	55	+	first.sendMu.Unlock()
	56	+	require.True(t, d.resizeAttachmentForLease(secondToken, domain.Size{Cols: 120, Rows: 40}))
	57	+
	58	+	d.enterPalette(sess, second)
	59	+	d.handlePaletteInput(second, []byte("CNT\r"))
	60	+
	61	+	sess.mu.Lock()
	62	+	tabs := append([]*tab(nil), sess.tabs...)
	63	+	sess.mu.Unlock()
	64	+	require.Len(t, tabs, 3)
	65	+	wantContent := domain.Size{Cols: 80, Rows: 23}
	66	+	for _, tb := range tabs {
	67	+	tb.mu.Lock()
	68	+	gotTabSize := tb.size
	69	+	pane := tb.focusedPane()
	70	+	pane.mu.Lock()
	71	+	gotPaneSize := domain.Size{Cols: pane.screen.Frame.Width, Rows: pane.screen.Frame.Height}
	72	+	pane.mu.Unlock()
	73	+	tb.mu.Unlock()
	74	+	require.Equal(t, wantContent, gotTabSize)
	75	+	require.Equal(t, wantContent, gotPaneSize)
	76	+	}
	77	+	require.Equal(t, firstView.tabID, first.viewSnapshot().tabID, "new tab selection crossed attachment boundary")
	78	+	require.NotEqual(t, secondView.tabID, second.viewSnapshot().tabID, "palette did not select the created tab")
	79	+	first.sendMu.Lock()
	80	+	gotFirstEpoch := first.output.currentEpoch()
	81	+	first.sendMu.Unlock()
	82	+	require.Equal(t, firstEpoch, gotFirstEpoch, "new tab render crossed attachment boundary")
	83	+	second.sendMu.Lock()
	84	+	gotSecondSize := second.size
	85	+	second.sendMu.Unlock()
	86	+	require.Equal(t, domain.Size{Cols: 120, Rows: 40}, gotSecondSize)
	87	+	}
	88	+
	89	+	func TestAcceptanceAttachmentStateIsolationAcrossResetResizeAndDetach(t *testing.T) {
	90	+	d, sess, first, _ := newManualSessionWithPTYs(t, newQuietPTY())
	91	+	first.clientID[0] = 1
	92	+	firstTab := sess.tabs[0]
	93	+	firstTab.stableID = "tab-first"
	94	+	firstTab.panes[firstTab.focusedPane().id].stableID = "pane-first"
	95	+
	96	+	secondTransport, _ := newCapturingTransport(t)
	97	+	second := &attachedClient{
	98	+	tr: secondTransport,
	99	+	output: newOutputStateStream(),
	100	+	size: domain.Size{Cols: 80, Rows: 24},
	101	+	}
	102	+	second.initOverlays()
	103	+	second.clientID[0] = 2
	104	+	second.setSession(sess)
	105	+
	106	+	secondTab := newTabWithStableID("tab-second", "pane-second", newQuietPTY(), domain.Size{Cols: 80, Rows: 23})
	107	+	secondTab.ctx, secondTab.cancel = sess.ctx, func() {}
	108	+	publishTiledPaneOwners(sess, secondTab)
	109	+	require.NoError(t, sess.runMutation(func() error {
	110	+	sess.mu.Lock()
	111	+	defer sess.mu.Unlock()
	112	+	sess.tabs = append(sess.tabs, secondTab)
	113	+	return nil
	114	+	}))
	115	+	require.True(t, sess.registerAttachment(second))
	116	+	require.True(t, sess.selectAttachmentTab(first, domain.TabStableID(firstTab.stableID)))
	117	+	require.True(t, sess.selectAttachmentTab(second, domain.TabStableID(secondTab.stableID)))
	118	+
	119	+	firstBefore := first.viewSnapshot()
	120	+	secondBefore := second.viewSnapshot()
	121	+	require.True(t, sess.updateAttachmentView(first, func(view *attachmentView) {
	122	+	view.windowTop = 7
	123	+	view.windowRows = 12
	124	+	view.bookmark = 11
	125	+	view.liveBottom = false
	126	+	}))
	127	+	gotFirst := first.viewSnapshot()
	128	+	gotSecond := second.viewSnapshot()
	129	+	require.Equal(t, domain.TabStableID(firstTab.stableID), gotFirst.tabID)
	130	+	require.Equal(t, 7, gotFirst.windowTop)
	131	+	require.Equal(t, vt.RowID(11), gotFirst.bookmark)
	132	+	require.False(t, gotFirst.liveBottom)
	133	+	require.Equal(t, secondBefore, gotSecond, "first attachment view mutation leaked to peer")
	134	+	require.NotEqual(t, firstBefore.revision, gotFirst.revision)
	135	+
	136	+	rc := d.attachCoordinator(sess, nil, first, true)
	137	+	d.attachCoordinator(sess, nil, second, true)
	138	+	firstToken := sess.attachmentToken(first, first.transport())
	139	+	firstToken.lease = rc.attachmentLease(first)
	140	+	first.publishAttachmentCapability(firstToken)
	141	+	secondToken := sess.attachmentToken(second, second.transport())
	142	+	secondToken.lease = rc.attachmentLease(second)
	143	+	second.publishAttachmentCapability(secondToken)
	144	+	firstEpoch := first.output.currentEpoch()
	145	+	secondEpoch := second.output.currentEpoch()
	146	+
	147	+	d.handleAttachmentClientFrame(secondToken, ports.Frame{
	148	+	Type: ports.MsgOutputResetRequest,
	149	+	Payload: ports.MarshalOutputResetRequest(ports.OutputResetRequest{}),
	150	+	})
	151	+	require.Greater(t, second.output.currentEpoch(), secondEpoch)
	152	+	require.Equal(t, firstEpoch, first.output.currentEpoch(), "peer output reset crossed attachment boundary")
	153	+
	154	+	require.True(t, d.resizeAttachmentForLease(secondToken, domain.Size{Cols: 120, Rows: 40}))
	155	+	require.Equal(t, domain.Size{Cols: 120, Rows: 40}, second.size)
	156	+	require.Equal(t, domain.Size{Cols: 80, Rows: 24}, first.size, "peer resize crossed attachment boundary")
	157	+	sess.mu.Lock()
	158	+	require.Equal(t, domain.Size{Cols: 80, Rows: 23}, sess.tabs[0].size, "attachment resize mutated shared session content")
	159	+	sess.mu.Unlock()
	160	+
	161	+	d.clientGone(sess, first, first.transport(), true)
	162	+	require.NotContains(t, sess.snapshotAttachments(), first)
	163	+	require.Contains(t, sess.snapshotAttachments(), second, "detaching one attachment removed its peer")
	164	+	require.Same(t, sess, second.currentSession())
	165	+	}

M internal/usecase/daemon/input.go +3 -5

 func (h daemonKeyHandler) acquireAttachmentEffect() (*session, *attachmentEffectTicket, bool) {
 	if h.connectionToken.ac != nil {
 		if effect := h.connectionToken.effect; effect != nil && !effect.ended.Load() {
-			sess, _ := localSession(h.connectionToken.sess)
+			return h.connectionToken.sess, effect, false
-			return sess, effect, false
 		}
 		effect, admitted := h.connectionToken.ac.beginAttachmentEffect(h.connectionToken)
 		if h.d.afterDelayedKeyEffectAttempt != nil {
 			token.effect = effect
 			h.d.afterAttachmentEffectAdmitted(token)
 		}
-		sess, ok := localSession(h.connectionToken.sess)
+		if h.connectionToken.sess == nil {
-		if !ok {
 			effect.End()
 			return nil, nil, false
 		}
-		return sess, effect, true
+		return h.connectionToken.sess, effect, true
 	}
 	sess := h.ac.currentSession()
 	if sess == nil {

M internal/usecase/daemon/move.go +2 -2


@@ -180,8 +180,8 @@ func moveSessionForLocatorLocked(d Daemon, locator moveSessionLocator) session
180		if d == nil {	180		if d == nil {
181		return nil	181		return nil
182		}	182		}
183	-	sess, ok := localSession(d.sessions[locator.ID])	183	+	sess := d.sessions[locator.ID]
184	-	if !ok \|\| sess.incarnation != locator.Incarnation {	184	+	if sess == nil \|\| sess.incarnation != locator.Incarnation {
185		return nil	185		return nil
186		}	186		}
187		return sess	187		return sess

M internal/usecase/daemon/move_cleanup_test.go +2 -2


@@ -35,7 +35,7 @@ func TestMovePaneReleasesResizeFencesBeforeAttachmentCleanup(t *testing.T) {
35		defer releaseDestination()	35		defer releaseDestination()
36			36
37		d, source, client, _ := newManualSessionWithPTYs(t, movedPTY, remainingPTY)	37		d, source, client, _ := newManualSessionWithPTYs(t, movedPTY, remainingPTY)
38	-	require.NotNil(t, d.attachCoordinator(source, client, true))	38	+	require.NotNil(t, d.attachCoordinator(source, nil, client, true))
39		sourceTab := source.tabs[0]	39		sourceTab := source.tabs[0]
40		sourceTab.stableID = "source-tab"	40		sourceTab.stableID = "source-tab"
41		moved := sourceTab.focusedPane()	41		moved := sourceTab.focusedPane()

@@ -117,7 +117,7 @@ func TestMovePaneCleanupUsesCommitPointSourceAttachmentToken(t *testing.T) {
117		sourceTab.stableID = "source-tab"	117		sourceTab.stableID = "source-tab"
118		remainingTab.stableID = "remaining-tab"	118		remainingTab.stableID = "remaining-tab"
119		moved := sourceTab.focusedPane()	119		moved := sourceTab.focusedPane()
120	-	require.NotNil(t, d.attachCoordinator(source, displaced, true))	120	+	require.NotNil(t, d.attachCoordinator(source, nil, displaced, true))
121			121
122		destination := &session{sessionCore: sessionCore{id: "destination", name: "destination", ephemeral: true}, tabs: []*tab{newTabWithStableID("destination-tab", "destination-pane", destinationPTY, domain.Size{Cols: 80, Rows: 23})}}	122		destination := &session{sessionCore: sessionCore{id: "destination", name: "destination", ephemeral: true}, tabs: []*tab{newTabWithStableID("destination-tab", "destination-pane", destinationPTY, domain.Size{Cols: 80, Rows: 23})}}
123		destinationTab := destination.tabs[0]	123		destinationTab := destination.tabs[0]

M internal/usecase/daemon/move_gate_race_test.go +3 -3


@@ -19,7 +19,7 @@ func newMoveGateRaceFixture(t testing.T) (Daemon, session, tab, pane, sess
19		sourceTab := source.tabs[0]	19		sourceTab := source.tabs[0]
20		sourceTab.stableID = "source-tab"	20		sourceTab.stableID = "source-tab"
21		moved := sourceTab.focusedPane()	21		moved := sourceTab.focusedPane()
22	-	require.NotNil(t, d.attachCoordinator(source, client, true))	22	+	require.NotNil(t, d.attachCoordinator(source, nil, client, true))
23			23
24		destination := &session{sessionCore: sessionCore{id: "destination", name: "destination", ephemeral: true}, tabs: []*tab{newTabWithStableID("destination-tab", "destination-pane", destinationPTY, domain.Size{Cols: 80, Rows: 23})}}	24		destination := &session{sessionCore: sessionCore{id: "destination", name: "destination", ephemeral: true}, tabs: []*tab{newTabWithStableID("destination-tab", "destination-pane", destinationPTY, domain.Size{Cols: 80, Rows: 23})}}
25		destinationTab := destination.tabs[0]	25		destinationTab := destination.tabs[0]

@@ -184,7 +184,7 @@ func TestFinalCloseDoesNotDeadlockWithMoveDispatchAdmission(t *testing.T) {
184			184
185		func TestPaletteFinalCloseEndsCurrentEffectBeforeDrainingPeers(t *testing.T) {	185		func TestPaletteFinalCloseEndsCurrentEffectBeforeDrainingPeers(t *testing.T) {
186		d, sess, current, _ := newManualSessionWithPTYs(t, newQuietPTY())	186		d, sess, current, _ := newManualSessionWithPTYs(t, newQuietPTY())
187	-	d.attachCoordinator(sess, current, true)	187	+	d.attachCoordinator(sess, nil, current, true)
188		otherTransport := &closeTrackingTransport{}	188		otherTransport := &closeTrackingTransport{}
189		other := &attachedClient{tr: otherTransport, output: newOutputStateStream(), size: current.size}	189		other := &attachedClient{tr: otherTransport, output: newOutputStateStream(), size: current.size}
190		other.initOverlays()	190		other.initOverlays()

@@ -192,7 +192,7 @@ func TestPaletteFinalCloseEndsCurrentEffectBeforeDrainingPeers(t *testing.T) {
192		sess.mu.Lock()	192		sess.mu.Lock()
193		require.True(t, sess.registerAttachmentLocked(other))	193		require.True(t, sess.registerAttachmentLocked(other))
194		sess.mu.Unlock()	194		sess.mu.Unlock()
195	-	d.attachCoordinator(sess, other, true)	195	+	d.attachCoordinator(sess, nil, other, true)
196			196
197		currentToken := sess.attachmentToken(current, current.transport())	197		currentToken := sess.attachmentToken(current, current.transport())
198		currentEffect, admitted := current.beginAttachmentEffect(currentToken)	198		currentEffect, admitted := current.beginAttachmentEffect(currentToken)

M internal/usecase/daemon/move_picker.go +4 -4


@@ -10,8 +10,8 @@ func (d *Daemon) movePickerSourceError(source moveSourceLocator) error {
10		if d == nil \|\| source.Session.ID == "" \|\| source.TabID == "" {	10		if d == nil \|\| source.Session.ID == "" \|\| source.TabID == "" {
11		return domain.UserWarn(domain.NoticeSessionUnavailable, "Source session is no longer available.", errMovePaneInvalid)	11		return domain.UserWarn(domain.NoticeSessionUnavailable, "Source session is no longer available.", errMovePaneInvalid)
12		}	12		}
13	-	sess, ok := localSession(d.sessionByID(source.Session.ID))	13	+	sess := d.sessionByID(source.Session.ID)
14	-	if !ok \|\| sess.incarnation != source.Session.Incarnation {	14	+	if sess == nil \|\| sess.incarnation != source.Session.Incarnation {
15		return domain.UserWarn(domain.NoticeSessionUnavailable, "Source session is no longer available.", errMovePaneInvalid)	15		return domain.UserWarn(domain.NoticeSessionUnavailable, "Source session is no longer available.", errMovePaneInvalid)
16		}	16		}
17		sess.mu.Lock()	17		sess.mu.Lock()

@@ -120,8 +120,8 @@ func (d *Daemon) commitMovePickerSelection(intent pickerIntent, source moveSourc
120			120
121		func (d Daemon) previewTarget(target picker.Target, intent pickerIntent) (session, *tab) {	121		func (d Daemon) previewTarget(target picker.Target, intent pickerIntent) (session, *tab) {
122		d.mu.Lock()	122		d.mu.Lock()
123	-	sess, ok := localSession(d.sessions[target.Session])	123	+	sess := d.sessions[target.Session]
124	-	if !ok {	124	+	if sess == nil {
125		d.mu.Unlock()	125		d.mu.Unlock()
126		return nil, nil	126		return nil, nil
127		}	127		}

M internal/usecase/daemon/move_tab_test.go +2 -2


@@ -152,7 +152,7 @@ func TestMoveTabFinalSourceVisibleFloatingRejectsStaleSlotTransitions(t *testing
152		d, source, client, _ := newManualSessionWithPTYs(t, newQuietPTY())	152		d, source, client, _ := newManualSessionWithPTYs(t, newQuietPTY())
153		moved := source.tabs[0]	153		moved := source.tabs[0]
154		moved.stableID = "moved-tab"	154		moved.stableID = "moved-tab"
155	-	require.NotNil(t, d.attachCoordinator(source, client, true))	155	+	require.NotNil(t, d.attachCoordinator(source, nil, client, true))
156		destination := addMoveTabTestSession(d, "destination", "destination-tab")	156		destination := addMoveTabTestSession(d, "destination", "destination-tab")
157		floating := newPaneWithStableID("floating", "floating-stable", newQuietPTY(), domain.Size{Cols: 20, Rows: 8})	157		floating := newPaneWithStableID("floating", "floating-stable", newQuietPTY(), domain.Size{Cols: 20, Rows: 8})
158		moved.mu.Lock()	158		moved.mu.Lock()

@@ -453,7 +453,7 @@ func (r *moveTabPurgeRepository) DeleteIncarnation(_ context.Context, id domain.
453			453
454		func TestMoveTabFinalNamedSourcePurgesAfterDestinationAdmissionAndFailureDoesNotRollback(t *testing.T) {	454		func TestMoveTabFinalNamedSourcePurgesAfterDestinationAdmissionAndFailureDoesNotRollback(t *testing.T) {
455		d, source, client, _ := newManualSessionWithPTYs(t, newQuietPTY())	455		d, source, client, _ := newManualSessionWithPTYs(t, newQuietPTY())
456	-	require.NotNil(t, d.attachCoordinator(source, client, true))	456	+	require.NotNil(t, d.attachCoordinator(source, nil, client, true))
457		source.incarnation = domain.IncarnationID{4}	457		source.incarnation = domain.IncarnationID{4}
458		moved := source.tabs[0]	458		moved := source.tabs[0]
459		moved.stableID = "moved-tab"	459		moved.stableID = "moved-tab"

M internal/usecase/daemon/navigation_attachment_handoff_test.go +2 -2


@@ -97,7 +97,7 @@ func TestNavigationHandoffsDropReplacedInitiatorWithoutMutation(t *testing.T) {
97		d.sessions[target.id] = target	97		d.sessions[target.id] = target
98		d.mu.Unlock()	98		d.mu.Unlock()
99			99
100	-	rc := d.attachCoordinator(source, old, true)	100	+	rc := d.attachCoordinator(source, nil, old, true)
101		token := source.attachmentToken(old, old.transport())	101		token := source.attachmentToken(old, old.transport())
102		token.lease = rc.attachmentLease(old)	102		token.lease = rc.attachmentLease(old)
103		old.publishAttachmentCapability(token)	103		old.publishAttachmentCapability(token)

@@ -152,7 +152,7 @@ func TestStoppedSessionHandoffDoesNotResumeAfterInitiatorReplacement(t *testing.
152		d.stopped["stopped"] = stoppedSession{name: "stopped", cwd: "/tmp", createdAt: 7, state: ports.SessionStopped}	152		d.stopped["stopped"] = stoppedSession{name: "stopped", cwd: "/tmp", createdAt: 7, state: ports.SessionStopped}
153		d.mu.Unlock()	153		d.mu.Unlock()
154			154
155	-	rc := d.attachCoordinator(source, old, true)	155	+	rc := d.attachCoordinator(source, nil, old, true)
156		token := source.attachmentToken(old, old.transport())	156		token := source.attachmentToken(old, old.transport())
157		token.lease = rc.attachmentLease(old)	157		token.lease = rc.attachmentLease(old)
158		old.publishAttachmentCapability(token)	158		old.publishAttachmentCapability(token)

M internal/usecase/daemon/navigation_attachment_incarnation_test.go +1 -1


@@ -47,7 +47,7 @@ func TestNavigationHandoffRejectsResumedOrReboundInitiatorIncarnation(t *testing
47		d.sessions[target.id] = target	47		d.sessions[target.id] = target
48		d.mu.Unlock()	48		d.mu.Unlock()
49			49
50	-	rc := d.attachCoordinator(source, ac, true)	50	+	rc := d.attachCoordinator(source, nil, ac, true)
51		token := source.attachmentToken(ac, ac.transport())	51		token := source.attachmentToken(ac, ac.transport())
52		token.lease = rc.attachmentLease(ac)	52		token.lease = rc.attachmentLease(ac)
53		ac.publishAttachmentCapability(token)	53		ac.publishAttachmentCapability(token)

M internal/usecase/daemon/navigation_overflow.go +1 -1


@@ -85,7 +85,7 @@ func (d Daemon) prepareSessionOverflow(current session, dir layout.Direction,
85		current.mu.Unlock()	85		current.mu.Unlock()
86			86
87		d.mu.Lock()	87		d.mu.Lock()
88	-	live := localSessionsSnapshot(d.sessions)	88	+	live := sessionsSnapshot(d.sessions)
89		d.mu.Unlock()	89		d.mu.Unlock()
90			90
91		snapshots := make([]sessionOverflowSnapshot, 0, len(live))	91		snapshots := make([]sessionOverflowSnapshot, 0, len(live))

M internal/usecase/daemon/navigation_overflow_test.go +4 -6

 	d.mu.Lock()
 	_, stopped := d.stopped["bravo"]
 	var bravoLive bool
-	for _, entry := range d.sessions {
+	for _, candidate := range d.sessions {
-		candidate, ok := localSession(entry)
+		if candidate == nil {
-		if !ok {
 			continue
 		}
 		candidate.mu.Lock()
 	current := ac.currentSession()
 	owners := make([]*session, 0, 1)
 	d.mu.Lock()
-	for _, entry := range d.sessions {
+	for _, candidate := range d.sessions {
-		candidate, ok := localSession(entry)
+		if candidate == nil {
-		if !ok {
 			continue
 		}
 		candidate.mu.Lock()

M internal/usecase/daemon/notices_overlay.go +4 -4


@@ -17,7 +17,7 @@ var noticesModal = ui.Modal{WidthPct: 70, HeightPct: 70, MinWidth: 40, MinHeight
17			17
18		// enterNotices opens the notification history overlay from the daemon's full	18		// enterNotices opens the notification history overlay from the daemon's full
19		// notice center history, newest first.	19		// notice center history, newest first.
20	-	func (d Daemon) enterNotices(sess attachmentSession, ac attachedClient) {	20	+	func (d Daemon) enterNotices(sess session, ac *attachedClient) {
21		history := d.notices.history()	21		history := d.notices.history()
22		now := d.clock.Now()	22		now := d.clock.Now()
23		ac.overlays.noticeMu.Lock()	23		ac.overlays.noticeMu.Lock()

@@ -221,13 +221,13 @@ func (d Daemon) handleNoticesInput(ac attachedClient, data []byte) {
221		// OSC52, mirroring copy mode's own yank path (copymode.go handleCopyInput):	221		// OSC52, mirroring copy mode's own yank path (copymode.go handleCopyInput):
222		// send each chunk, then leave a one-shot status-bar confirmation that the	222		// send each chunk, then leave a one-shot status-bar confirmation that the
223		// next repaint clears.	223		// next repaint clears.
224	-	func (d Daemon) yankNotice(entry attachmentSession, ac attachedClient, n domain.Notification) {	224	+	func (d Daemon) yankNotice(entry session, ac *attachedClient, n domain.Notification) {
225		chunks := scopy.OSC52(noticeYankPayload(n))	225		chunks := scopy.OSC52(noticeYankPayload(n))
226		for _, chunk := range chunks {	226		for _, chunk := range chunks {
227		failed, err := d.boundedSendOutputErrTransport(ac, chunk)	227		failed, err := d.boundedSendOutputErrTransport(ac, chunk)
228		if err != nil {	228		if err != nil {
229	-	if sess, ok := localSession(entry); ok {	229	+	if entry != nil {
230	-	d.detachOnSendError(sess, ac, failed)	230	+	d.detachOnSendError(entry, ac, failed)
231		} else {	231		} else {
232		_ = ac.closeCapturedTransport(failed)	232		_ = ac.closeCapturedTransport(failed)
233		}	233		}

M internal/usecase/daemon/notify.go +7 -5

 	d.notify(sess, domain.NoticeError, domain.NoticeInternal, "internal error", err)
 }
-func (d *Daemon) reportAttachmentError(entry attachmentSession, err error) {
+func (d *Daemon) reportAttachmentError(entry *session, err error) {
-	local, _ := localSession(entry)
+	d.reportError(entry, err)
-	d.reportError(local, err)
 }
 // notify records a notice and routes it to whoever can see it. A nil sess means
 func (d *Daemon) deliverGlobal(n domain.Notification) {
 	d.mu.Lock()
 	d.notices.routingMu.Lock()
-	sessions := make([]attachmentSession, 0, len(d.sessions))
+	sessions := make([]*session, 0, len(d.sessions))
 	for _, entry := range d.sessions {
 		sessions = append(sessions, entry)
 	}
 	}
 	targets := make([]*attachedClient, 0, len(sessions))
 	for _, s := range sessions {
-		for _, ac := range snapshotAttachmentSession(s) {
+		if s == nil {
+			continue
+		}
+		for _, ac := range s.snapshotAttachments() {
 			if !d.publishToast(ac, n) {
 				continue
 			}

M internal/usecase/daemon/notify_test.go +1 -1


@@ -52,7 +52,7 @@ func TestClientNoticeMapsFixedActionsAndDismissesOnlyConnectionToast(t *testing.
52			52
53		func TestMalformedClientNoticeIsIgnored(t *testing.T) {	53		func TestMalformedClientNoticeIsIgnored(t *testing.T) {
54		d, sess, ac, _ := newNoticeFixture(t, &noticeClock{})	54		d, sess, ac, _ := newNoticeFixture(t, &noticeClock{})
55	-	d.attachCoordinator(sess, ac, true)	55	+	d.attachCoordinator(sess, nil, ac, true)
56		tr, ok := ac.tr.(*portsmocks.MockTransport)	56		tr, ok := ac.tr.(*portsmocks.MockTransport)
57		require.True(t, ok, "attached client transport must be a MockTransport")	57		require.True(t, ok, "attached client transport must be a MockTransport")
58		frames := []ports.Frame{	58		frames := []ports.Frame{

M internal/usecase/daemon/output_state_stream.go +6 -3

 		maxOutstanding: uint64(window),
 	}
 	stream.maxOutstandingAtomic.Store(uint64(window))
-	stream.publishOutstanding()
 	return stream
 }
 	s.next = 0
 	s.acked = 0
 	s.generation++
-	s.maxOutstandingAtomic.Store(s.maxOutstanding)
 	s.publishOutstanding()
+	s.maxOutstandingAtomic.Store(s.maxOutstanding)
 	s.renderer.Reset()
 	s.forceSnapshot = true
 	s.initialized = false
 	if s == nil {
 		return false
 	}
-	return s.outstandingAtomic.Load() >= s.maxOutstandingAtomic.Load()
+	maxOutstanding := s.maxOutstandingAtomic.Load()
+	if maxOutstanding == 0 {
+		maxOutstanding = s.maxOutstanding
+	}
+	return s.outstandingAtomic.Load() >= maxOutstanding
 }
 func (s *outputStateStream) outstanding() uint64 {

M internal/usecase/daemon/palette.go +11 -25

 	if entry == nil {
 		return
 	}
-	sess, local := localSession(entry)
+	sess := entry
 	var cmd command.Command
 	var sessionTarget palette.Result
 	var hasSessionTarget bool
 		var err error
 		if effect != nil {
 			err = d.switchToTargetForAttachment(effect.connectionToken(), target, sessionHandoffGuard{}, "palette-session")
-		} else if local {
-			err = d.switchToTarget(sess, ac, target)
 		} else {
-			err = errAttachmentTransition
+			err = d.switchToTarget(sess, ac, target)
 		}
 		if errors.Is(err, errAttachmentTransition) {
 			return
 		}
 		return
 	}
-	if !local {
-		if ac.closeExecutedPalette(generation, rawQuery) {
-			d.notify(nil, domain.NoticeError, domain.NoticeSessionUnavailable, cmd.Name+" is unavailable for this attachment", nil)
-		}
-		return
-	}
 	attachmentHandoff := cmd.Slug == "back-session" || cmd.Slug == "detach"
 	if !attachmentHandoff && !ac.closeExecutedPalette(generation, rawQuery) {
 		return
 type paletteExec struct {
 	d                   *Daemon
 	sess                *session
-	attachment          attachmentSession
+	attachment          *session
 	ac                  *attachedClient
 	recent              []recentSession
 	actions             daemonActionRunner
 }
 func (e paletteExec) CreateTab() error {
-	return e.runAction(daemonActionRequest{kind: daemonActionCreateTab, viewport: e.ac.size})
+	return e.runAction(daemonActionRequest{kind: daemonActionCreateTab, viewport: e.sess.fullViewportSize()})
 }
 func (e paletteExec) CreateSession() error {
 	}
 	e.d.enterTransitionPrompt(entry, e.ac, " Create session ", "", func(name string, token attachmentConnectionToken) error {
 		if token.ac == nil {
-			sess, ok := e.localSession()
+			if e.sess == nil {
-			if !ok {
 				return errAttachmentTransition
 			}
-			return e.d.createSessionAndSwitch(sess, e.ac, name)
+			return e.d.createSessionAndSwitch(e.sess, e.ac, name)
 		}
 		return e.d.createSessionAndSwitchForAttachment(token, name)
 	})
 	return nil
 }
-func (e paletteExec) localSession() (*session, bool) {
-	entry := e.attachment
-	if entry == nil {
-		entry = e.sess
-	}
-	return localSession(entry)
-}
 func (e paletteExec) JumpRecentSession(rank int) error {
 	if rank < 1 || rank > len(e.recent) {
 		return command.ErrInvalidArguments
 	if e.effect != nil {
 		err = e.d.switchToTargetForAttachment(e.effect.connectionToken(), picker.Target{Session: target.id, TabIndex: -1}, sessionHandoffGuard{}, "palette-recent-session")
 	} else {
-		sess, ok := e.localSession()
+		sess := e.attachment
-		if !ok {
+		if sess == nil {
+			sess = e.sess
+		}
+		if sess == nil {
 			return errAttachmentTransition
 		}
 		err = e.d.switchToTarget(sess, e.ac, picker.Target{Session: target.id, TabIndex: -1})

M internal/usecase/daemon/performance_benchmark_test.go +1 -1


@@ -1083,7 +1083,7 @@ func newPerformanceFixtureWithCleanup(t testing.TB, config performanceConfig, re
1083		compose: func() { fixture.renderCompositions++ },	1083		compose: func() { fixture.renderCompositions++ },
1084		emit: func() { fixture.renderEmissions++ },	1084		emit: func() { fixture.renderEmissions++ },
1085		}	1085		}
1086	-	d.attachCoordinator(sess, ac, true)	1086	+	d.attachCoordinator(sess, nil, ac, true)
1087			1087
1088		// Prime the real renderer shadow before measurements. Subsequent paints use	1088		// Prime the real renderer shadow before measurements. Subsequent paints use
1089		// actual production diffs rather than the initial full frame.	1089		// actual production diffs rather than the initial full frame.

M internal/usecase/daemon/picker.go +28 -31

 // enterPicker preserves the existing navigation entry point. Navigation always
 // publishes its model, including an empty one; only move entry can fail for a
 // missing destination.
-func (d *Daemon) enterPicker(sess attachmentSession, ac *attachedClient) {
+func (d *Daemon) enterPicker(sess *session, ac *attachedClient) {
 	model := d.newPickerModel(sess, ac, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
 	d.publishPicker(sess, ac, model, pickerNavigate, moveSourceLocator{})
 }
-func (d *Daemon) publishPicker(sess attachmentSession, ac *attachedClient, model *picker.Model, intent pickerIntent, source moveSourceLocator) {
+func (d *Daemon) publishPicker(sess *session, ac *attachedClient, model *picker.Model, intent pickerIntent, source moveSourceLocator) {
 	rt := ac.overlays
 	rt.pickerMu.Lock()
 	previous, previousGeneration := rt.pickerPreviewSession, rt.pickerPreviewGeneration
 // pickerViews captures one canonical lifecycle/tab snapshot. It intentionally
 // knows nothing about picker intent; picker.New owns all destination policy.
-func (d *Daemon) pickerViews(cur attachmentSession, ac *attachedClient) ([]picker.SessionView, picker.SourceFilter) {
+func (d *Daemon) pickerViews(cur *session, ac *attachedClient) ([]picker.SessionView, picker.SourceFilter) {
 	d.mu.Lock()
-	sessions := make([]attachmentSession, 0, len(d.sessions))
+	sessions := make([]*session, 0, len(d.sessions))
 	for _, entry := range d.sessions {
+		if entry == nil {
+			continue
+		}
 		sessions = append(sessions, entry)
 	}
 	stopped := make([]stoppedSession, 0, len(d.stopped))
 	d.mu.Unlock()
 	for _, entry := range sessions {
-		if local, ok := localSession(entry); ok {
+		if entry != nil {
-			d.refreshSessionFocusedTitles(local)
+			d.refreshSessionFocusedTitles(entry)
 		}
 	}
 	opts := viewOptions{tabDetails: true, focusedTitles: true, terminalTitle: d.currentTabsConfig().TerminalTitle}
 	type liveSnapshot struct {
-		entry attachmentSession
+		entry *session
 		view  sessionView
 	}
 	// One snapshot per live session: sorting and view building read the same
 	var current picker.SourceFilter
 	for _, entry := range sessions {
 		if entry == cur && ac != nil {
-			if local, ok := localSession(entry); ok {
+			entry.repairAttachmentView(ac)
-				local.repairAttachmentView(ac)
-			}
 		}
 		snap := entry.snapshotView(opts)
 		if entry == cur {
-			if _, ok := localSession(entry); ok && ac != nil {
+			if ac != nil {
 				view := ac.viewSnapshot()
 				if view.tabID != "" {
 					current = picker.SourceFilter{Session: snap.id, Incarnation: snap.incarnation, TabID: view.tabID}
 	return views, current
 }
-func (d *Daemon) newPickerModel(cur attachmentSession, ac *attachedClient, intent pickerIntent, source moveSourceLocator, current picker.SourceFilter) *picker.Model {
+func (d *Daemon) newPickerModel(cur *session, ac *attachedClient, intent pickerIntent, source moveSourceLocator, current picker.SourceFilter) *picker.Model {
 	views, attachedCurrent := d.pickerViews(cur, ac)
 	if intent == pickerNavigate && current == (picker.SourceFilter{}) {
 		current = attachedCurrent
 		var err error
 		if len(effects) != 0 && effects[0] != nil {
 			err = d.switchToTargetForAttachment(effects[0].connectionToken(), target, sessionHandoffGuard{closePicker: true}, "picker-select")
-		} else if local, ok := localSession(sess); ok {
-			d.closePicker(ac)
-			err = d.switchToTarget(local, ac, target)
 		} else {
-			err = errAttachmentTransition
+			d.closePicker(ac)
+			err = d.switchToTarget(sess, ac, target)
 		}
 		if errors.Is(err, errAttachmentTransition) {
 			return
 	if targetSess == ac.currentAttachmentSession() {
 		return
 	}
-	rc := d.attachCoordinator(targetSess, nil, false)
+	rc := d.attachCoordinator(targetSess, nil, nil, false)
 	rc.subscribePreviewFor(ac, generation, func(renderWake) {
 		if pickerPreviewCurrent(ac, targetSess, next, generation) {
 			if owner := ac.currentAttachmentSession(); owner != nil {
 	}
 	d.mu.Lock()
 	var clients []*attachedClient
-	for _, entry := range d.sessions {
+	for _, sess := range d.sessions {
-		sess, ok := localSession(entry)
+		if sess == nil {
-		if !ok {
 			continue
 		}
 		sess.mu.Lock()
 	return *left == *right
 }
-func (d *Daemon) sessionByID(id domain.SessionID) attachmentSession {
+func (d *Daemon) sessionByID(id domain.SessionID) *session {
 	d.mu.Lock()
 	defer d.mu.Unlock()
 	return d.sessions[id]
 		return nil
 	}
 	d.mu.Lock()
-	targetSess, ok := localSession(d.sessions[target.Session])
+	targetSess := d.sessions[target.Session]
 	d.mu.Unlock()
-	if !ok {
+	if targetSess == nil {
 		if !token.attachmentCurrent() {
 			return nil
 		}
 	}
 	token.effect.bindActionEnd(d, action)
 	token.effect.End()
-	sess, ok := localSession(token.sess)
+	if token.sess == nil {
-	if !ok {
 		return errAttachmentTransition
 	}
-	return d.switchToTargetGuardedForAttachment(sess, token.ac, target, guard, &token, action)
+	return d.switchToTargetGuardedForAttachment(token.sess, token.ac, target, guard, &token, action)
 }
 // sendRemoteAttachTargetForAttachment validates the catalog row and hands the
 				targetSess, transition, switched = d.switchToActiveTargetLocked(from, ac, active, resolvedTarget, guard, sourceToken, action)
 			}
 		}
-	} else if active, ok := localSession(d.sessions[target.Session]); ok {
+	} else if active := d.sessions[target.Session]; active != nil {
 		targetSess, transition, switched = d.switchToActiveTargetLocked(from, ac, active, target, guard, sourceToken, action)
 	}
 	d.mu.Unlock()
 		return d.killPickerTarget(target)
 	}
 	d.mu.Lock()
-	targetSess, ok := localSession(d.sessions[target.Session])
+	targetSess := d.sessions[target.Session]
 	d.mu.Unlock()
-	if !ok {
+	if targetSess == nil {
 		return nil
 	}
 	return d.killSessionForAttachment(targetSess, ports.ReasonSessionKilled, true, token, "picker-delete")
 		return nil
 	}
 	d.mu.Lock()
-	targetSess, ok := localSession(d.sessions[target.Session])
+	targetSess := d.sessions[target.Session]
 	d.mu.Unlock()
-	if ok {
+	if targetSess != nil {
 		return d.killSession(targetSess, ports.ReasonSessionKilled, true)
 	}
 	return nil

M internal/usecase/daemon/picker_test.go +1 -1


@@ -1550,7 +1550,7 @@ func TestPickerAttachmentEffectDeleteRemovesSelectedSessionAndRefreshes(t *testi
1550		current.mu.Lock()	1550		current.mu.Lock()
1551		current.registerAttachmentLocked(ac)	1551		current.registerAttachmentLocked(ac)
1552		current.mu.Unlock()	1552		current.mu.Unlock()
1553	-	require.NotNil(t, d.attachCoordinator(current, ac, true))	1553	+	require.NotNil(t, d.attachCoordinator(current, nil, ac, true))
1554			1554
1555		d.enterPicker(current, ac)	1555		d.enterPicker(current, ac)
1556		d.handlePickerInput(ac, []byte("k"))	1556		d.handlePickerInput(ac, []byte("k"))

M internal/usecase/daemon/prompt.go +2 -2


@@ -13,7 +13,7 @@ func promptModalFor(title string) ui.Modal {
13		return ui.Modal{WidthPct: 100, MinWidth: 32, FixedHeight: 4, Title: title, Anchor: domain.AnchorBottom, Margins: ui.Margins{Bottom: 1}}	13		return ui.Modal{WidthPct: 100, MinWidth: 32, FixedHeight: 4, Title: title, Anchor: domain.AnchorBottom, Margins: ui.Margins{Bottom: 1}}
14		}	14		}
15			15
16	-	func (d Daemon) enterPrompt(sess attachmentSession, ac attachedClient, title, initial string, submit func(string) error) {	16	+	func (d Daemon) enterPrompt(sess session, ac *attachedClient, title, initial string, submit func(string) error) {
17		d.closePrompt(ac)	17		d.closePrompt(ac)
18		ac.overlays.promptMu.Lock()	18		ac.overlays.promptMu.Lock()
19		ac.overlays.prompt = promptui.New(title, initial)	19		ac.overlays.prompt = promptui.New(title, initial)

@@ -23,7 +23,7 @@ func (d Daemon) enterPrompt(sess attachmentSession, ac attachedClient, title,
23		d.invalidateRender(sess, ac, true, "prompt.go")	23		d.invalidateRender(sess, ac, true, "prompt.go")
24		}	24		}
25			25
26	-	func (d Daemon) enterTransitionPrompt(sess attachmentSession, ac attachedClient, title, initial string, submit func(string, attachmentConnectionToken) error) {	26	+	func (d Daemon) enterTransitionPrompt(sess session, ac *attachedClient, title, initial string, submit func(string, attachmentConnectionToken) error) {
27		d.closePrompt(ac)	27		d.closePrompt(ac)
28		ac.overlays.promptMu.Lock()	28		ac.overlays.promptMu.Lock()
29		ac.overlays.prompt = promptui.New(title, initial)	29		ac.overlays.prompt = promptui.New(title, initial)

M internal/usecase/daemon/recent_sessions.go +2 -2


@@ -17,14 +17,14 @@ type recentSession struct {
17			17
18		// recentSessions returns the current session's capped named-session MRU list.	18		// recentSessions returns the current session's capped named-session MRU list.
19		// Callers may retain the returned values for the lifetime of an interaction.	19		// Callers may retain the returned values for the lifetime of an interaction.
20	-	func (d *Daemon) recentSessions(current attachmentSession) []recentSession {	20	+	func (d Daemon) recentSessions(current session) []recentSession {
21		if d == nil {	21		if d == nil {
22		return nil	22		return nil
23		}	23		}
24		d.mu.Lock()	24		d.mu.Lock()
25		recent := make([]recentSession, 0, len(d.sessions))	25		recent := make([]recentSession, 0, len(d.sessions))
26		for _, sess := range d.sessions {	26		for _, sess := range d.sessions {
27	-	if sess == current {	27	+	if sess == nil \|\| sess == current {
28		continue	28		continue
29		}	29		}
30		snap := sess.snapshotView(viewOptions{})	30		snap := sess.snapshotView(viewOptions{})

M internal/usecase/daemon/render.go +30 -13

 		return false
 	}
 	d.mu.Lock()
-	sessions := localSessionsSnapshot(d.sessions)
+	sessions := sessionsSnapshot(d.sessions)
 	d.mu.Unlock()
 	for _, sess := range sessions {
 		for _, ac := range sess.snapshotAttachments() {
 	}
 }
-func (d *Daemon) paint(entry attachmentSession, ac *attachedClient, reset bool, lease *attachmentLease) {
+type paintResult uint8
+const (
+	paintRejected paintResult = iota
+	paintEmitted
+	paintBlockedCapacity
+)
+func (d *Daemon) paint(entry *session, ac *attachedClient, reset bool, lease *attachmentLease) paintResult {
 	// Session-owned PTY preparation remains local; attachment rendering is
-	// captured through attachmentSession.captureRenderState.
+	// captured through session.captureRenderState.
-	sess, local := localSession(entry)
+	sess := entry
+	local := sess != nil
 	marks := d.newRuntimeMarkBatch()
 	if lease != nil {
 		token := attachmentToken(entry, ac, ac.transport())
 		token.lease = lease
 		ticket, admitted := ac.beginAttachmentEffect(token)
 		if !admitted {
-			return
+			return paintRejected
 		}
 		marks.attachmentEffect = ticket
 		defer ticket.End()
 	if local {
 		tb = sess.tabForAttachment(ac)
 		if tb == nil {
-			return
+			return paintRejected
 		}
 	}
 	entry.core().mu.Unlock()
 	if !owned || ac.currentAttachmentSession() != entry {
 		ac.sendMu.Unlock()
-		return
+		return paintRejected
 	}
 	if lease != nil {
 		rc := attachmentRenderCoordinator(entry)
 		if rc == nil || lease.attachment != ac || !rc.leaseCurrent(lease, true) {
 			ac.sendMu.Unlock()
-			return
+			return paintRejected
 		}
 	}
-	// Capacity is checked before any destructive capture. The coordinator is
+	// Capacity is checked before any destructive capture. Refresh the atomic
-	// the normal gate, but this ownership check also protects direct resize and
+	// readiness snapshot while sendMu is held so direct test/setup mutations of
-	// test paint paths from consuming damage that cannot be emitted.
+	// the stream fields remain covered without making coordinator probes wait on
+	// a blocked transport send.
+	if ac.output != nil {
+		ac.output.syncCapacityLocked()
+	}
+	// The coordinator is the normal gate, but this ownership check also protects
+	// direct resize and test paint paths from consuming damage that cannot be
+	// emitted.
 	if ac.output != nil && ac.output.atCapacity() {
 		// The coordinator owns the blocked interval; this guard only protects
 		// direct test/resize paint calls from destructive capture.
 		ac.sendMu.Unlock()
-		return
+		return paintBlockedCapacity
 	}
 	// Composition owns attachment sendMu; initialize its lazy overlay state
 	// under that same ownership so concurrent fallback paints cannot observe a
 	endCapture(0, ok)
 	if !ok {
 		ac.sendMu.Unlock()
-		return
+		return paintRejected
 	}
 	if ac.renderStages.capture != nil {
 		ac.renderStages.capture()
 		ac.renderStages.compose()
 	}
 	d.emitFrame(entry, ac, state, composed, &marks)
+	return paintEmitted
 }
 var fallbackChromeStyles = themeui.Resolve(themeui.Theme{}, domain.ThemeAccent{Mode: domain.ThemeAccentAuto}).Styles

M internal/usecase/daemon/render_capture.go +1 -1


@@ -344,7 +344,7 @@ func captureLocalRenderState(
344		}	344		}
345			345
346		// captureRenderState preserves the focused local test seam. Production	346		// captureRenderState preserves the focused local test seam. Production
347	-	// rendering delegates through attachmentSession.captureRenderState.	347	+	// rendering delegates through *session.captureRenderState.
348		func captureRenderState(sess session, ac attachedClient, request renderCaptureRequest) (*capturedRenderState, bool) {	348		func captureRenderState(sess session, ac attachedClient, request renderCaptureRequest) (*capturedRenderState, bool) {
349		return captureLocalRenderState(sess, ac, request)	349		return captureLocalRenderState(sess, ac, request)
350		}	350		}

M internal/usecase/daemon/render_coordinator.go +86 -9


@@ -39,9 +39,6 @@ type renderCoordinator struct {
39		// invalidations retain only their exact target lease here.	39		// invalidations retain only their exact target lease here.
40		pendingShared bool	40		pendingShared bool
41		pendingTargets map[attachedClient]attachmentLease	41		pendingTargets map[attachedClient]attachmentLease
42	-	// ackReadyFor is production's attachment-scoped ACK-window probe. The
43	-	// legacy options callback remains for coordinator-only tests.
44	-	ackReadyFor func(*attachedClient) bool
45		// ackBlocked retains the first rejected ACK-capacity probe until the	42		// ackBlocked retains the first rejected ACK-capacity probe until the
46		// matching consume or lifecycle closure releases that exact interval.	43		// matching consume or lifecycle closure releases that exact interval.
47		ackBlocked *ackBlockedSpan	44		ackBlocked *ackBlockedSpan

@@ -316,6 +313,81 @@ func (c renderCoordinator) notifyAckForLease(lease attachmentLease) {
316		c.fire(gen, false, false)	313		c.fire(gen, false, false)
317		}	314		}
318			315
			316	+	// retryCapacity restores only the attachment whose wake failed the final
			317	+	// capacity check. Readiness is an atomic observation, so paint may discover
			318	+	// backpressure after fire has marked the wake delivered. Requeueing the exact
			319	+	// wake generation keeps that stale result from clearing shared work and avoids
			320	+	// making a healthy peer wait for the blocked attachment.
			321	+	func (c renderCoordinator) retryCapacity(w renderWake, lease attachmentLease) {
			322	+	if lease == nil \|\| w.generation == 0 {
			323	+	return
			324	+	}
			325	+	var queueStart bool
			326	+	c.mu.Lock()
			327	+	if !c.leaseCurrentLocked(lease, true) \|\| c.pendingGeneration < w.generation {
			328	+	c.mu.Unlock()
			329	+	return
			330	+	}
			331	+	// A newer wake already attempted this lease; its callback owns any
			332	+	// capacity retry. An older callback may still widen a newer targeted wake
			333	+	// to include this lease when that newer wake never reached it.
			334	+	if c.pendingGeneration > w.generation && lease.deliveredGeneration == c.pendingGeneration {
			335	+	c.mu.Unlock()
			336	+	return
			337	+	}
			338	+	if !c.pending {
			339	+	c.pending = true
			340	+	c.pendingReset = w.reset
			341	+	c.pendingUrgent = w.urgent
			342	+	c.pendingShared = false
			343	+	c.pendingTargets = map[attachedClient]attachmentLease{lease.attachment: lease}
			344	+	c.coalesced = max(1, w.coalesced)
			345	+	c.deadlineDue = false
			346	+	c.armed = false
			347	+	if c.opts.observer != nil && !c.queueMarked {
			348	+	c.queueMarked = true
			349	+	c.queueCorrelation = ports.NewRuntimeCorrelation()
			350	+	queueStart = true
			351	+	}
			352	+	} else {
			353	+	c.pendingReset = c.pendingReset \|\| w.reset
			354	+	c.pendingUrgent = c.pendingUrgent \|\| w.urgent
			355	+	if !c.pendingShared {
			356	+	if c.pendingTargets == nil {
			357	+	c.pendingTargets = make(map[attachedClient]attachmentLease)
			358	+	}
			359	+	c.pendingTargets[lease.attachment] = lease
			360	+	}
			361	+	}
			362	+	if c.delivered != nil {
			363	+	delete(c.delivered, lease.attachment)
			364	+	}
			365	+	if c.ackDeferredFor == nil {
			366	+	c.ackDeferredFor = make(map[*attachedClient]bool)
			367	+	}
			368	+	c.ackDeferredFor[lease.attachment] = true
			369	+	c.ackDeferred = true
			370	+	generation := c.pendingGeneration
			371	+	queueCorrelation := c.queueCorrelation
			372	+	observer := c.opts.observer
			373	+	c.supervisor.startTaskLocked(func() { c.retryPendingGeneration(generation) })
			374	+	c.mu.Unlock()
			375	+	if queueStart && observer != nil {
			376	+	observer.ObserveRuntime(ports.NewRuntimeMarkWithCorrelation("daemon", queueCorrelation, ports.RuntimeQueueEnqueued, 0, true))
			377	+	}
			378	+	}
			379	+
			380	+	func (c *renderCoordinator) retryPendingGeneration(generation uint64) {
			381	+	c.mu.Lock()
			382	+	if c.torndown \|\| !c.pending \|\| c.pendingGeneration != generation {
			383	+	c.mu.Unlock()
			384	+	return
			385	+	}
			386	+	gen, token := c.normalLane.generation, c.normalLane.token
			387	+	c.mu.Unlock()
			388	+	c.fireWithTimerToken(token, gen, false, false)
			389	+	}
			390	+
319		// noteSyncBegin records a synchronized-output batch for its stable pane and	391		// noteSyncBegin records a synchronized-output batch for its stable pane and
320		// arms that pane's watchdog. Overlapping pane batches are independent.	392		// arms that pane's watchdog. Overlapping pane batches are independent.
321		// markDeadlineDue records a received timer tick before the worker probes ACK	393		// markDeadlineDue records a received timer tick before the worker probes ACK

@@ -807,7 +879,7 @@ func (c *renderCoordinator) waitForTimerWorkers() { c.supervisor.wait() }
807		// invalidateRender is the sole producer fan-in. In tests and transitional	879		// invalidateRender is the sole producer fan-in. In tests and transitional
808		// headless paths without an attached coordinator it retains the old private	880		// headless paths without an attached coordinator it retains the old private
809		// compositor; attached sessions always schedule through their coordinator.	881		// compositor; attached sessions always schedule through their coordinator.
810	-	func (d Daemon) invalidateRender(entry attachmentSession, ac attachedClient, reset bool, producer string) {	882	+	func (d Daemon) invalidateRender(entry session, ac *attachedClient, reset bool, producer string) {
811		if rc := attachmentRenderCoordinator(entry); rc != nil {	883		if rc := attachmentRenderCoordinator(entry); rc != nil {
812		invalidation := renderInvalidation{class: invalidateUrgent, reset: reset, producer: producer}	884		invalidation := renderInvalidation{class: invalidateUrgent, reset: reset, producer: producer}
813		if rc.invalidateForAttachment(ac, invalidation) {	885		if rc.invalidateForAttachment(ac, invalidation) {

@@ -832,7 +904,7 @@ func (d Daemon) invalidateRender(entry attachmentSession, ac attachedClient, r
832		// invalidateRenderNow publishes through the coordinator but immediately	904		// invalidateRenderNow publishes through the coordinator but immediately
833		// flushes the wake when the client can accept state. Attach uses this path so	905		// flushes the wake when the client can accept state. Attach uses this path so
834		// the required first full frame never depends on a debounce timer.	906		// the required first full frame never depends on a debounce timer.
835	-	func (d Daemon) invalidateRenderNow(entry attachmentSession, ac attachedClient, reset bool, producer string) {	907	+	func (d Daemon) invalidateRenderNow(entry session, ac *attachedClient, reset bool, producer string) {
836		if rc := attachmentRenderCoordinator(entry); rc != nil {	908		if rc := attachmentRenderCoordinator(entry); rc != nil {
837		if rc.invalidateForAttachment(ac, renderInvalidation{class: invalidateUrgent, reset: reset, producer: producer}) {	909		if rc.invalidateForAttachment(ac, renderInvalidation{class: invalidateUrgent, reset: reset, producer: producer}) {
838		rc.fireCurrent(false)	910		rc.fireCurrent(false)

@@ -880,8 +952,8 @@ func (c renderCoordinator) fireWithTimerToken(token timerToken, gen uint64, wa
880		}	952		}
881			953
882		func (c renderCoordinator) attachmentAckReady(ac attachedClient) bool {	954		func (c renderCoordinator) attachmentAckReady(ac attachedClient) bool {
883	-	if c.ackReadyFor != nil {	955	+	if c.opts.ackReadyFor != nil {
884	-	return c.ackReadyFor(ac)	956	+	return c.opts.ackReadyFor(ac)
885		}	957		}
886		if c.opts.ackReady != nil {	958		if c.opts.ackReady != nil {
887		return c.opts.ackReady()	959		return c.opts.ackReady()

@@ -1013,7 +1085,11 @@ func (c renderCoordinator) fireWithTimerTokenAndLease(token timerToken, gen ui
1013		if len(leases) == 0 && legacyOutput {	1085		if len(leases) == 0 && legacyOutput {
1014		allDelivered = true	1086		allDelivered = true
1015		}	1087		}
1016	-	w := renderWake{reset: c.pendingReset, urgent: c.pendingUrgent, coalesced: c.coalesced, attachmentLeases: attachmentLeases, watchdog: watchdog}	1088	+	wakeGeneration := uint64(0)
			1089	+	if len(leases) != 0 {
			1090	+	wakeGeneration = c.pendingGeneration
			1091	+	}
			1092	+	w := renderWake{reset: c.pendingReset, urgent: c.pendingUrgent, coalesced: c.coalesced, generation: wakeGeneration, attachmentLeases: attachmentLeases, watchdog: watchdog}
1017		if syncLease != nil {	1093		if syncLease != nil {
1018		if selected, ok := attachmentLeases[syncLease.attachment]; ok && selected == syncLease {	1094		if selected, ok := attachmentLeases[syncLease.attachment]; ok && selected == syncLease {
1019		w.lease = syncLease	1095		w.lease = syncLease

@@ -1043,11 +1119,12 @@ func (c renderCoordinator) fireWithTimerTokenAndLease(token timerToken, gen ui
1043		}	1119		}
1044			1120
1045		if outputReady {	1121		if outputReady {
1046	-	for ac := range attachmentLeases {	1122	+	for ac, lease := range attachmentLeases {
1047		if c.delivered == nil {	1123		if c.delivered == nil {
1048		c.delivered = make(map[*attachedClient]uint64)	1124		c.delivered = make(map[*attachedClient]uint64)
1049		}	1125		}
1050		c.delivered[ac] = c.pendingGeneration	1126		c.delivered[ac] = c.pendingGeneration
			1127	+	lease.deliveredGeneration = c.pendingGeneration
1051		}	1128		}
1052		}	1129		}
1053		if len(leases) != 0 {	1130		if len(leases) != 0 {

M internal/usecase/daemon/render_coordinator_support.go +2 -2


@@ -15,7 +15,7 @@ func (c *renderCoordinator) burstMetricsSnapshot() renderCoordinatorBurstMetrics
15			15
16		// attachmentRenderCoordinator returns the coordinator installed for the exact	16		// attachmentRenderCoordinator returns the coordinator installed for the exact
17		// attachment-session identity.	17		// attachment-session identity.
18	-	func attachmentRenderCoordinator(entry attachmentSession) *renderCoordinator {	18	+	func attachmentRenderCoordinator(entry session) renderCoordinator {
19		if entry == nil \|\| entry.core() == nil {	19		if entry == nil \|\| entry.core() == nil {
20		return nil	20		return nil
21		}	21		}

@@ -24,7 +24,7 @@ func attachmentRenderCoordinator(entry attachmentSession) *renderCoordinator {
24			24
25		// installAttachmentRenderCoordinator publishes rc for the exact	25		// installAttachmentRenderCoordinator publishes rc for the exact
26		// attachment-session identity.	26		// attachment-session identity.
27	-	func installAttachmentRenderCoordinator(entry attachmentSession, rc *renderCoordinator) {	27	+	func installAttachmentRenderCoordinator(entry session, rc renderCoordinator) {
28		if entry == nil \|\| entry.core() == nil {	28		if entry == nil \|\| entry.core() == nil {
29		return	29		return
30		}	30		}

M internal/usecase/daemon/render_coordinator_test.go +4 -4

 	t.Helper()
 	wake := awaitTestValue(t, ch, "coordinator did not publish a wake after fake-clock advancement")
 	wake.attachmentLeases = nil
+	wake.generation = 0
 	return wake
 }
 func TestRenderCoordinatorAckReadinessIsAttachmentScoped(t *testing.T) {
 	slow, healthy := &attachedClient{}, &attachedClient{}
 	var slowReady atomic.Bool
-	slowReady.Store(false)
 	wakes := make(chan renderWake, 2)
 	rc := newRenderCoordinator(renderCoordinatorOptions{
-		wake: func(w renderWake) { wakes <- w },
+		ackReadyFor: func(ac *attachedClient) bool { return ac == healthy || slowReady.Load() },
+		wake:        func(w renderWake) { wakes <- w },
 	})
-	rc.ackReadyFor = func(ac *attachedClient) bool { return ac == healthy || slowReady.Load() }
 	rc.attach(slow)
 	rc.attach(healthy)
 	rc.invalidate(renderInvalidation{class: invalidateUrgent, reset: true, producer: "test"})
 }
 func TestRenderCoordinatorSyncBatchSurvivesAttachmentLifecycle(t *testing.T) {
-	t.Run("detach and park retain a gated headless preview until complete", func(t *testing.T) {
+	t.Run("detach retains a gated headless preview until complete", func(t *testing.T) {
 		for _, transition := range []struct {
 			name string
 			run  func(*renderCoordinator, *attachedClient)

M internal/usecase/daemon/render_coordinator_types.go +14 -4

 	reset     bool
 	urgent    bool
 	coalesced int
+	// generation fences a capacity retry to the mutation that produced this
+	// wake. A newer invalidation owns its own retry path.
+	generation uint64
 	// lease is optional coordinator-owned lifecycle safety for an attachment
 	// specific wake. Shared wakes leave it nil and snapshot live attachment
 	// leases at dispatch time; each paint then revalidates its exact connection
 	attachment *attachedClient
 	ready      bool
 	active     bool
-	// A lease is an immutable callback capability. Its lifecycle bits are
+	// deliveredGeneration records the latest wake that reached this lease. It
-	// changed only under renderCoordinator.mu; callbacks revalidate it at each
+	// outlives the coordinator's coalesced delivered map so an older capacity
+	// failure cannot overwrite a newer attempt.
+	deliveredGeneration uint64
+	// A lease is an immutable callback capability. Its lifecycle and delivery
+	// bits are changed only under renderCoordinator.mu; callbacks revalidate it at each
 	// short effect boundary and never retain coordinator ownership while routing
 	// arbitrary handlers.
 }
 	// wake composes a coalesced render request.
 	wake func(renderWake)
 	// ackReady reports whether the attachment may compose another output
-	// state (the outputStateStream window has capacity).
+	// state (the outputStateStream window has capacity). It is retained for
-	ackReady func() bool
+	// coordinator-only tests and headless callers; production uses ackReadyFor
+	// so one attachment cannot gate another.
+	ackReady    func() bool
+	ackReadyFor func(*attachedClient) bool
 	// syncRenderable reports whether a pane's synchronized batch currently
 	// contributes to the attached composition. It must not acquire c.mu.
 	syncRenderable func(*pane) bool

M internal/usecase/daemon/render_damage_receipt_test.go +2 -2


@@ -134,7 +134,7 @@ func TestRenderDamageReceiptRetainsRealVTDamageAcrossFailedEmission(t *testing.T
134		// Prepare failures now schedule recovery through the coordinator;	134		// Prepare failures now schedule recovery through the coordinator;
135		// retain the failed transaction here until this test explicitly retries.	135		// retain the failed transaction here until this test explicitly retries.
136		d.clock = newNoticeClock()	136		d.clock = newNoticeClock()
137	-	d.attachCoordinator(sess, ac, true)	137	+	d.attachCoordinator(sess, nil, ac, true)
138		healthy := ac.transport()	138		healthy := ac.transport()
139		p := sess.tabs[0].focusedPane()	139		p := sess.tabs[0].focusedPane()
140			140

@@ -170,7 +170,7 @@ func TestRenderDamageReceiptRetainsRealVTDamageAcrossFailedEmission(t *testing.T
170		func TestPrepareFailureNotifiesAndSchedulesRecovery(t *testing.T) {	170		func TestPrepareFailureNotifiesAndSchedulesRecovery(t *testing.T) {
171		clock := newNoticeClock()	171		clock := newNoticeClock()
172		d, sess, ac, _ := newNoticeFixture(t, clock)	172		d, sess, ac, _ := newNoticeFixture(t, clock)
173	-	rc := d.attachCoordinator(sess, ac, true)	173	+	rc := d.attachCoordinator(sess, nil, ac, true)
174		var producers []string	174		var producers []string
175		rc.opts.onInvalidate = func(inv renderInvalidation) {	175		rc.opts.onInvalidate = func(inv renderInvalidation) {
176		// Both the notice repaint and the explicit recovery must re-enter only	176		// Both the notice repaint and the explicit recovery must re-enter only

M internal/usecase/daemon/render_pipeline.go +8 -12

 // emitFrame is the sole side-effecting half of the pipeline. The caller holds
 // sendMu for the complete capture/compose/emit transaction.
-func (d *Daemon) emitFrame(entry attachmentSession, ac *attachedClient, state *capturedRenderState, composed composedRenderFrame, batches ...*runtimeMarkBatch) bool {
+func (d *Daemon) emitFrame(entry *session, ac *attachedClient, state *capturedRenderState, composed composedRenderFrame, batches ...*runtimeMarkBatch) bool {
 	var ownedMarks runtimeMarkBatch
 	var marks *runtimeMarkBatch
 	if len(batches) != 0 {
 		// Without a coordinator reportError repaints synchronously. Suppress only
 		// that nested notice repaint; leave the guard before returning so a later,
 		// independent failed transaction can still notify the user.
-		if sess, ok := localSession(entry); ok {
+		if entry.renderCoordinator() == nil {
-			if sess.renderCoordinator() == nil {
+			if !ac.prepareFailureFallback.CompareAndSwap(false, true) {
-				if !ac.prepareFailureFallback.CompareAndSwap(false, true) {
-					return true
-				}
-				d.reportError(sess, domain.UserErr(domain.NoticeInternal, "display update failed", err))
-				ac.prepareFailureFallback.Store(false)
 				return true
 			}
-			d.reportError(sess, domain.UserErr(domain.NoticeInternal, "display update failed", err))
+			d.reportError(entry, domain.UserErr(domain.NoticeInternal, "display update failed", err))
+			ac.prepareFailureFallback.Store(false)
+			return true
 		}
+		d.reportError(entry, domain.UserErr(domain.NoticeInternal, "display update failed", err))
 		// Notices are session-scoped, while the attachment repaint still needs
 		// to redraw its chrome after a failed transaction.
 		d.invalidateRender(entry, ac, true, "render_pipeline.go:prepare-failed")
 		// admission first. Detachment freezes the gate and therefore cannot mutate
 		// ownership until any enclosing admitted operation has also ended.
 		if marks.attachmentEffect == nil {
-			if sess, ok := localSession(entry); ok {
+			d.detachOnSendError(entry, ac, sendTr)
-				d.detachOnSendError(sess, ac, sendTr)
-			}
 		} else {
 			// Capture the exact admitted capability, including its coordinator
 			// lease, before End permits a new attachment publication. Reserve

M internal/usecase/daemon/render_test.go +5 -5


@@ -313,7 +313,7 @@ func TestPTYReaderSyncVisibilityTransitions(t *testing.T) {
313		d, sess, ac, sends := newManualSessionWithPTYs(t, activePTY, inactivePTY)	313		d, sess, ac, sends := newManualSessionWithPTYs(t, activePTY, inactivePTY)
314		clock := newCoordinatorMockClock(t, 8)	314		clock := newCoordinatorMockClock(t, 8)
315		d.clock = clock.clock	315		d.clock = clock.clock
316	-	rc := d.attachCoordinator(sess, ac, true)	316	+	rc := d.attachCoordinator(sess, nil, ac, true)
317			317
318		d.sessWg.Add(1)	318		d.sessWg.Add(1)
319		go d.ptyReader(sess, sess.tabs[1], sess.tabs[1].focusedPane())	319		go d.ptyReader(sess, sess.tabs[1], sess.tabs[1].focusedPane())

@@ -349,7 +349,7 @@ func TestPTYReaderSyncVisibilityTransitions(t *testing.T) {
349		d, sess, ac, sends := newManualSessionWithPTYs(t, oldPTY, newPTY, parkedPTY)	349		d, sess, ac, sends := newManualSessionWithPTYs(t, oldPTY, newPTY, parkedPTY)
350		clock := newCoordinatorMockClock(t, 8)	350		clock := newCoordinatorMockClock(t, 8)
351		d.clock = clock.clock	351		d.clock = clock.clock
352	-	rc := d.attachCoordinator(sess, ac, true)	352	+	rc := d.attachCoordinator(sess, nil, ac, true)
353			353
354		d.sessWg.Add(2)	354		d.sessWg.Add(2)
355		go d.ptyReader(sess, sess.tabs[0], sess.tabs[0].focusedPane())	355		go d.ptyReader(sess, sess.tabs[0], sess.tabs[0].focusedPane())

@@ -385,7 +385,7 @@ func TestPTYReaderRepublishesSynchronizedCompletionAfterAttachmentLifecycle(t *t
385		d, target, targetClient, _ := newManualSessionWithPTYs(t, pty)	385		d, target, targetClient, _ := newManualSessionWithPTYs(t, pty)
386		clock := newCoordinatorMockClock(t, 8)	386		clock := newCoordinatorMockClock(t, 8)
387		d.clock = clock.clock	387		d.clock = clock.clock
388	-	rc := d.attachCoordinator(target, targetClient, true)	388	+	rc := d.attachCoordinator(target, nil, targetClient, true)
389			389
390		// A viewer in a different session is previewing the headless target.	390		// A viewer in a different session is previewing the headless target.
391		viewer := &attachedClient{}	391		viewer := &attachedClient{}

@@ -429,7 +429,7 @@ func TestPTYReaderRepublishesSynchronizedCompletionAfterAttachmentLifecycle(t *t
429		d, target, detached, _ := newManualSessionWithPTYs(t, pty)	429		d, target, detached, _ := newManualSessionWithPTYs(t, pty)
430		clock := newCoordinatorMockClock(t, 8)	430		clock := newCoordinatorMockClock(t, 8)
431		d.clock = clock.clock	431		d.clock = clock.clock
432	-	rc := d.attachCoordinator(target, detached, true)	432	+	rc := d.attachCoordinator(target, nil, detached, true)
433			433
434		secondTransport, secondSends := newCapturingTransport(t)	434		secondTransport, secondSends := newCapturingTransport(t)
435		remaining := &attachedClient{tr: secondTransport, output: newOutputStateStream(), size: detached.size}	435		remaining := &attachedClient{tr: secondTransport, output: newOutputStateStream(), size: detached.size}

@@ -470,7 +470,7 @@ func TestPTYReaderRepublishesSynchronizedCompletionAfterAttachmentLifecycle(t *t
470		d, target, client, _ := newManualSessionWithPTYs(t, pty)	470		d, target, client, _ := newManualSessionWithPTYs(t, pty)
471		clock := newCoordinatorMockClock(t, 8)	471		clock := newCoordinatorMockClock(t, 8)
472		d.clock = clock.clock	472		d.clock = clock.clock
473	-	rc := d.attachCoordinator(target, client, true)	473	+	rc := d.attachCoordinator(target, nil, client, true)
474		wakes := make(chan renderWake, 1)	474		wakes := make(chan renderWake, 1)
475		rc.opts.wake = func(w renderWake) { wakes <- w }	475		rc.opts.wake = func(w renderWake) { wakes <- w }
476		target.mu.Lock()	476		target.mu.Lock()

M internal/usecase/daemon/render_timer.go +12 -3

 type timerSupervisor struct{ workers sync.WaitGroup }
 func (s *timerSupervisor) startLocked(token *timerToken, timerC <-chan time.Time, fire func()) {
-	s.workers.Add(1)
+	s.startTaskLocked(func() {
-	go func() {
-		defer s.workers.Done()
 		defer close(token.done)
 		select {
 		case <-timerC:
 			fire()
 		case <-token.cancel:
 		}
+	})
+}
+// startTaskLocked accounts for coordinator work that is not backed by a timer
+// token. The caller must hold the coordinator lock so terminal teardown cannot
+// begin waiting between registration and launch.
+func (s *timerSupervisor) startTaskLocked(task func()) {
+	s.workers.Add(1)
+	go func() {
+		defer s.workers.Done()
+		task()
 	}()
 }

M internal/usecase/daemon/resume.go +3 -6

 	d.mu.Lock()
 	defer d.mu.Unlock()
 	token := ac.resumeClaimToken
-	if token == 0 {
-		return true
-	}
 	parked := d.parked[token]
-	if parked == nil || parked.ac != ac || !parked.claimed {
+	if token == 0 || parked == nil || parked.ac != ac || !parked.claimed {
-		return false
+		return token == 0
 	}
 	delete(d.parked, token)
 	parked.claimed = false
 	// mandatory first paint cannot be blocked by ACKs that died with the link.
 	ac.rebaseOutput()
 	ac.output.maxOutstanding = uint64(normalizeOutputWindow(h.MaxOutputInFlight))
-	ac.output.syncCapacityLocked()
+	ac.output.maxOutstandingAtomic.Store(ac.output.maxOutstanding)
 	ac.replaceTransport(tr)
 	ac.size = sz
 	ac.resumeToken = d.nextResumeTokenLocked()

M internal/usecase/daemon/resume_test.go +1 -1


@@ -874,7 +874,7 @@ func TestLiveResumeRejectsLateMarkerAfterTerminalCleanupWins(t *testing.T) {
874		}	874		}
875			875
876		// TestMarkParkingInFlightRequiresExactLiveOwnership covers lock-safe rejection	876		// TestMarkParkingInFlightRequiresExactLiveOwnership covers lock-safe rejection
877	-	// when the attachment is no longer the exact active or snatched owner, while	877	+	// when the attachment is no longer the exact registered owner, while
878		// still advertising for both live roles.	878		// still advertising for both live roles.
879		func TestStaleClientGoneAfterTransportCheckDoesNotDetachReboundAttachment(t *testing.T) {	879		func TestStaleClientGoneAfterTransportCheckDoesNotDetachReboundAttachment(t *testing.T) {
880		pty, release := newBlockingPTY(t)	880		pty, release := newBlockingPTY(t)

M internal/usecase/daemon/resume_wake_incarnation_test.go +1 -1


@@ -69,7 +69,7 @@ func TestParkedResumeRejectsDispatchedWakeFromPriorAttachment(t *testing.T) {
69			69
70		func TestSameAttachmentRebindRejectsQueuedWakeAndFansOutFreshGeneration(t *testing.T) {	70		func TestSameAttachmentRebindRejectsQueuedWakeAndFansOutFreshGeneration(t *testing.T) {
71		d, sess, ac, sends := newManualSessionWithPTYs(t, newQuietPTY())	71		d, sess, ac, sends := newManualSessionWithPTYs(t, newQuietPTY())
72	-	rc := d.attachCoordinator(sess, ac, true)	72	+	rc := d.attachCoordinator(sess, nil, ac, true)
73		oldLease := rc.attachmentLease(ac)	73		oldLease := rc.attachmentLease(ac)
74		require.NotNil(t, oldLease)	74		require.NotNil(t, oldLease)
75			75

M internal/usecase/daemon/session.go +18 -27

 // what it has actually seen). sendMu serialises the two senders — the render
 // coordinator and the connection handler — so the transport's single-writer
-func (d *Daemon) touchMRU(entry attachmentSession) {
+func (d *Daemon) touchMRU(entry *session) {
 	if d == nil || entry == nil || entry.core() == nil {
 		return
 	}
 			break
 		}
 	}
-	sess, ok := localSession(entry)
+	entry.mu.Lock()
-	if !ok {
+	if !entry.ephemeral {
-		return
+		d.markCatalogueDirty(entry.persistRecordLocked(max(d.nowUnixNano(), entry.createdAt, int64(1))).MetadataUpdate())
-	}
-	sess.mu.Lock()
-	if !sess.ephemeral {
-		d.markCatalogueDirty(sess.persistRecordLocked(max(d.nowUnixNano(), sess.createdAt, int64(1))).MetadataUpdate())
 	}
-	sess.mu.Unlock()
+	entry.mu.Unlock()
 }
 func (d *Daemon) createSessionLocked(name string, ephemeral bool, cwd string, sz domain.Size, term terminalEnv, env []string, restoredTabNames ...[]string) (*session, error) {
 		expectedTransport: token.transport, sourceToken: &token, action: "create-session",
 		copySourceEnvironment: true, ready: true,
 		createTargetLocked: func() (*session, error) {
-			source, ok := localSession(token.sess)
+			source := token.sess
-			if !ok {
+			if source == nil {
 				return nil, errAttachmentTransition
 			}
 			if d.closing {
 	}
 	d.touchMRU(created)
-	if source, ok := localSession(token.sess); ok {
+	if token.sess != nil {
-		token.ac.recordPreviousSession(source)
+		token.ac.recordPreviousSession(token.sess)
 	}
 	d.log.Info("client attached", "session", created.name, "resume", token.ac.resumeCapable)
 	d.deferAttachmentTransitionCleanups(transition)
 	return d.createTabForAttachment(sess, nil, sz)
 }
-func (d *Daemon) createTabForAttachment(sess *session, ac *attachedClient, sz domain.Size) error {
+func (d *Daemon) createTabForAttachment(sess *session, ac *attachedClient, _ domain.Size) error {
 	sess.mu.Lock()
 	name := sess.name
 	cwd := sess.cwd
 	env := copyEnvironment(sess.env)
 	attachments := sess.snapshotAttachmentsLocked()
 	sess.mu.Unlock()
-	tbSize := contentSize(sz)
+	tbSize := contentSize(sess.fullViewportSize())
 	tabStableID, paneStableID, err := d.newTabPaneStableIDs()
 	if err != nil {
 		return err
 	// own an independent connection lifecycle and detach through the same exact
 	// transport/generation fence.
 	if token.lease == nil {
-		if sess, ok := localSession(token.sess); ok {
+		return d.detachIfCurrentTransport(token.sess, token.ac, token.transport)
-			return d.detachIfCurrentTransport(sess, token.ac, token.transport)
-		}
-		return false
 	}
 	frozen := freezeAttachmentEffectGatesWith(attachmentEffectFreezeOptions{done: done}, token.ac)
 	defer frozen.unfreeze()
 		if token.sess == nil || token.ac == nil || token.transport.transport == nil {
 			return sessionKillParticipants{}, false
 		}
-		var ok bool
+		snapshot.source = token.sess
-		snapshot.source, ok = localSession(token.sess)
+		if snapshot.source == nil {
-		if !ok {
 			return sessionKillParticipants{}, false
 		}
 		snapshot.sourceToken = &admission.token
 // d.mu.
 func (d *Daemon) allocEphemeralNameLocked() string {
 	used := make(map[string]struct{}, len(d.sessions)+len(d.stopped))
-	for _, entry := range d.sessions {
+	for _, s := range d.sessions {
-		if s, ok := localSession(entry); ok {
+		if s != nil {
 			used[s.name] = struct{}{}
 		}
 	}
 }
 func (d *Daemon) findByNameLocked(name string) *session {
-	for _, entry := range d.sessions {
+	for _, s := range d.sessions {
-		s, ok := localSession(entry)
+		if s != nil && s.name == name {
-		if ok && s.name == name {
 			return s
 		}
 	}

M internal/usecase/daemon/session_back.go +3 -3


@@ -45,11 +45,11 @@ func (d Daemon) backSession(current session, ac *attachedClient) {
45			45
46		// clearPreviousSessionIf clears target only if it has not been replaced since	46		// clearPreviousSessionIf clears target only if it has not been replaced since
47		// the caller observed it. This preserves a concurrent successful hand-off.	47		// the caller observed it. This preserves a concurrent successful hand-off.
48	-	func (ac *attachedClient) clearPreviousSessionIf(target attachmentSession) {	48	+	func (ac attachedClient) clearPreviousSessionIf(target session) {
49		if ac == nil {	49		if ac == nil {
50		return	50		return
51		}	51		}
52	-	ac.previousSession.With(func(previous *attachmentSession) {	52	+	ac.previousSession.With(func(previous **session) {
53		if *previous == target {	53		if *previous == target {
54		*previous = nil	54		*previous = nil
55		}	55		}

@@ -59,7 +59,7 @@ func (ac *attachedClient) clearPreviousSessionIf(target attachmentSession) {
59		// recordPreviousSession is called only after a cross-session hand-off has	59		// recordPreviousSession is called only after a cross-session hand-off has
60		// committed. Keeping this after the commit makes failed/displaced switches	60		// committed. Keeping this after the commit makes failed/displaced switches
61		// leave the toggle pair intact.	61		// leave the toggle pair intact.
62	-	func (ac *attachedClient) recordPreviousSession(origin attachmentSession) {	62	+	func (ac attachedClient) recordPreviousSession(origin session) {
63		if ac != nil && origin != nil {	63		if ac != nil && origin != nil {
64		ac.previousSession.Set(origin)	64		ac.previousSession.Set(origin)
65		}	65		}

M internal/usecase/daemon/session_core.go +6 -23

 	"github.com/bnema/vev/internal/domain"
 )
-// attachmentSession is the private attachment-facing session contract. Local
-// process, tab, persistence, and teardown behavior remains on *session.
-type attachmentSession interface {
-	core() *sessionCore
-	snapshotView(viewOptions) sessionView
-	statusSegments(includeTerminalTitle bool) statusSnapshot
-	captureRenderState(*attachedClient, renderCaptureRequest) (*capturedRenderState, bool)
-	validTargetTabLocked(tabIndex int) bool
-}
 // sessionCore is the state shared by every attachment-capable session. It is
 // embedded as the first field of session so the existing s.mu selector remains
 // the one lock guarding both attachment membership and local tab state.
 	return tabIndex < len(s.tabs)
 }
-// localSession narrows an attachment entry for operations that own local PTYs,
+func sessionsSnapshot(entries map[domain.SessionID]*session) []*session {
-// tabs, snapshots, or durable lifecycle state.
+	sessions := make([]*session, 0, len(entries))
-func localSession(entry attachmentSession) (*session, bool) {
+	for _, sess := range entries {
-	sess, ok := entry.(*session)
+		if sess != nil {
-	return sess, ok && sess != nil
+			sessions = append(sessions, sess)
-}
-func localSessionsSnapshot(entries map[domain.SessionID]attachmentSession) []*session {
-	locals := make([]*session, 0, len(entries))
-	for _, entry := range entries {
-		if sess, ok := localSession(entry); ok {
-			locals = append(locals, sess)
 		}
 	}
-	return locals
+	return sessions
 }

M internal/usecase/daemon/session_core_test.go +4 -6

 	core := sess.core()
 	require.Same(t, &sess.sessionCore, core)
-	require.Same(t, sess, mustLocalSession(t, attachmentSession(sess)))
 	require.Equal(t, sessionCapabilities{}, core.caps, "zero-value local sessions must retain all local capabilities")
 	core.mu.Lock()
 }
 func TestAttachmentSessionRegistryUsesExactIdentity(t *testing.T) {
-	d := &Daemon{sessions: make(map[domain.SessionID]attachmentSession)}
+	d := &Daemon{sessions: make(map[domain.SessionID]*session)}
 	first := &session{}
 	first.id = domain.SessionID("same")
 	second := &session{}
 	second.core().mu.Unlock()
 }
-func mustLocalSession(t *testing.T, entry attachmentSession) *session {
+func mustLocalSession(t *testing.T, entry *session) *session {
 	t.Helper()
-	sess, ok := localSession(entry)
+	require.NotNil(t, entry)
-	require.True(t, ok)
+	return entry
-	return sess
 }

M internal/usecase/daemon/session_purge_retry_test.go +1 -1


@@ -38,7 +38,7 @@ func TestLivePurgeLeavesFailedDirectoryDeletionForStartupGarbageCollection(t *te
38		pty, ok := sess.tabs[0].panes["pane-1"].pty.(*portsmocks.MockPTY)	38		pty, ok := sess.tabs[0].panes["pane-1"].pty.(*portsmocks.MockPTY)
39		require.True(t, ok)	39		require.True(t, ok)
40		pty.EXPECT().Close().Return(nil).Once()	40		pty.EXPECT().Close().Return(nil).Once()
41	-	d.sessions = map[domain.SessionID]attachmentSession{sess.id: sess}	41	+	d.sessions = map[domain.SessionID]*session{sess.id: sess}
42			42
43		require.Error(t, d.killSession(sess, ports.ReasonSessionKilled, true))	43		require.Error(t, d.killSession(sess, ports.ReasonSessionKilled, true))
44		require.Equal(t, []string{"delete incarnation"}, repository.calls)	44		require.Equal(t, []string{"delete incarnation"}, repository.calls)

M internal/usecase/daemon/session_rename_purge_test.go +1 -1


@@ -16,7 +16,7 @@ func TestRenamePreservesIncarnationSnapshotSources(t *testing.T) {
16		store, state := newMockStore(t)	16		store, state := newMockStore(t)
17		WithStore(t, store)(d)	17		WithStore(t, store)(d)
18		sess := newSnapshotTestSession(t, "old", false, "/work")	18		sess := newSnapshotTestSession(t, "old", false, "/work")
19	-	d.sessions = map[domain.SessionID]attachmentSession{sess.id: sess}	19	+	d.sessions = map[domain.SessionID]*session{sess.id: sess}
20		sess.mu.Lock()	20		sess.mu.Lock()
21		record := sess.persistRecordLocked(1)	21		record := sess.persistRecordLocked(1)
22		sess.mu.Unlock()	22		sess.mu.Unlock()

M internal/usecase/daemon/status.go +8 -15

 // palette interaction has captured recent-session hints. Normal palette state
 // continues to use the canonical, live MRU list.
 func (d *Daemon) barStateForPaletteHints(cur *session, statusFeedback string, hints *palette.ContextualHints, recent []recentSession) barState {
-	var entry attachmentSession
+	var entry *session
 	if cur != nil {
 		entry = cur
 	}
 	return d.barStateForAttachmentPaletteHints(entry, statusFeedback, hints, recent)
 }
-// barStateForAttachmentPaletteHints composes daemon-owned chrome for either
+// barStateForAttachmentPaletteHints composes daemon-owned chrome for an
-// attachment implementation. Bar scripts remain local-session-only because
+// attachment. Bar scripts remain local-session-only because
 // their existing execution contract depends on local tabs and PTYs.
-func (d *Daemon) barStateForAttachmentPaletteHints(cur attachmentSession, statusFeedback string, hints *palette.ContextualHints, recent []recentSession) barState {
+func (d *Daemon) barStateForAttachmentPaletteHints(cur *session, statusFeedback string, hints *palette.ContextualHints, recent []recentSession) barState {
 	return d.barStateForAttachmentPaletteHintsFor(cur, nil, statusFeedback, hints, recent)
 }
-func (d *Daemon) barStateForAttachmentPaletteHintsFor(cur attachmentSession, ac *attachedClient, statusFeedback string, hints *palette.ContextualHints, recent []recentSession) barState {
+func (d *Daemon) barStateForAttachmentPaletteHintsFor(cur *session, ac *attachedClient, statusFeedback string, hints *palette.ContextualHints, recent []recentSession) barState {
-	if attachmentSessionCore(cur) == nil {
-		cur = nil
-	}
 	ranked := rankedRecentForHints(hints, recent)
 	state := barState{statusFeedback: statusFeedback}
 	if d != nil {
 		if d != nil {
 			includeTerminalTitle = d.currentTabsConfig().TerminalTitle
 		}
-		if local, ok := localSession(cur); ok {
+		state.status = cur.statusSegmentsFor(ac, includeTerminalTitle)
-			state.status = local.statusSegmentsFor(ac, includeTerminalTitle)
-		} else {
-			state.status = cur.statusSegments(includeTerminalTitle)
-		}
 	}
-	if local, ok := localSession(cur); ok && d != nil {
+	if cur != nil && d != nil {
-		state.topRight, state.bottomRight = d.barScriptSnapshot(local)
+		state.topRight, state.bottomRight = d.barScriptSnapshot(cur)
 	}
 	if ranked != nil {
 		state.rankedRecent = ranked

M internal/usecase/daemon/status_test.go +3 -18

 	"github.com/bnema/vev/pkg/renderer"
 )
-// --- test doubles -----------------------------------------------------------
-type coreNilAttachment struct{}
-func (*coreNilAttachment) core() *sessionCore { return nil }
-func (*coreNilAttachment) snapshotView(viewOptions) sessionView {
-	return sessionView{}
-}
-func (*coreNilAttachment) statusSegments(bool) statusSnapshot { return statusSnapshot{} }
-func (*coreNilAttachment) captureRenderState(*attachedClient, renderCaptureRequest) (*capturedRenderState, bool) {
-	return nil, false
-}
-func (*coreNilAttachment) validTargetTabLocked(int) bool { return false }
 // stubClock returns timers whose channel never fires, so a scheduler under it
 // blocks in its debounce loop until the session context is cancelled. Used by
 }
 func TestLockAttachmentSessionsRejectsNilEntriesWithoutPanic(t *testing.T) {
-	var nilEntry attachmentSession
+	var nilEntry *session
 	var typedNil *session
 	valid := &session{sessionCore: sessionCore{id: "valid"}}
 	for _, tc := range []struct {
 		name string
-		a    attachmentSession
+		a    *session
-		b    attachmentSession
+		b    *session
 	}{
 		{name: "nil interfaces", a: nilEntry, b: nilEntry},
 		{name: "typed nil", a: typedNil, b: valid},
-		{name: "core nil", a: &coreNilAttachment{}, b: valid},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			require.NotPanics(t, func() {

M internal/usecase/daemon/transactional_resize.go +1 -1


@@ -848,7 +848,7 @@ func (d Daemon) requestTransactionalResize(sess session, ac *attachedClient, s
848		if ac == nil {	848		if ac == nil {
849		return d.requestTransactionalResizeForLease(sess, nil, nil, size, immediate)	849		return d.requestTransactionalResizeForLease(sess, nil, nil, size, immediate)
850		}	850		}
851	-	rc := d.attachCoordinator(sess, ac, true)	851	+	rc := d.attachCoordinator(sess, nil, ac, true)
852		return d.requestTransactionalResizeForLease(sess, ac, rc.attachmentLease(ac), size, immediate)	852		return d.requestTransactionalResizeForLease(sess, ac, rc.attachmentLease(ac), size, immediate)
853		}	853		}
854			854

M internal/usecase/daemon/transactional_resize_test.go +4 -4


@@ -410,7 +410,7 @@ func TestTransactionalResizeRejectsNewerEpochBeforeSessionPublication(t *testing
410		d, sess, ac, _ := newManualSessionWithPTYs(t, first, second)	410		d, sess, ac, _ := newManualSessionWithPTYs(t, first, second)
411		observer := &daemonRuntimeObserver{}	411		observer := &daemonRuntimeObserver{}
412		d.runtimeObserver = observer	412		d.runtimeObserver = observer
413	-	rc := d.attachCoordinator(sess, ac, true)	413	+	rc := d.attachCoordinator(sess, nil, ac, true)
414		lease := rc.attachmentLease(ac)	414		lease := rc.attachmentLease(ac)
415		var newer uint64	415		var newer uint64
416		d.beforeSessionResizePublication = func() {	416		d.beforeSessionResizePublication = func() {

@@ -471,7 +471,7 @@ func TestTransactionalResizeRechecksLeaseAtAttachmentPublication(t *testing.T) {
471		t.Run(tc.name, func(t *testing.T) {	471		t.Run(tc.name, func(t *testing.T) {
472		pty := &transactionalResizePTY{}	472		pty := &transactionalResizePTY{}
473		d, sess, ac, _ := newManualSessionWithPTYs(t, pty)	473		d, sess, ac, _ := newManualSessionWithPTYs(t, pty)
474	-	rc := d.attachCoordinator(sess, ac, true)	474	+	rc := d.attachCoordinator(sess, nil, ac, true)
475		lease := rc.attachmentLease(ac)	475		lease := rc.attachmentLease(ac)
476		epoch := rc.recordResizeRequestForLease(domain.Size{Cols: 100, Rows: 30}, ac, lease)	476		epoch := rc.recordResizeRequestForLease(domain.Size{Cols: 100, Rows: 30}, ac, lease)
477		require.NotZero(t, epoch)	477		require.NotZero(t, epoch)

@@ -555,7 +555,7 @@ func TestRetryOwnerCannotPublishFloatingGeometryAfterMove(t *testing.T) {
555		tb.mu.Unlock()	555		tb.mu.Unlock()
556		owner := publishPaneOwner(popup, source, tb, 7)	556		owner := publishPaneOwner(popup, source, tb, 7)
557			557
558	-	rc := d.attachCoordinator(source, ac, true)	558	+	rc := d.attachCoordinator(source, nil, ac, true)
559		lease := rc.attachmentLease(ac)	559		lease := rc.attachmentLease(ac)
560		epoch := rc.recordResizeRequestForLease(domain.Size{Cols: 80, Rows: 24}, ac, lease)	560		epoch := rc.recordResizeRequestForLease(domain.Size{Cols: 80, Rows: 24}, ac, lease)
561		require.True(t, d.runResizeTransaction(source, ac, lease, epoch))	561		require.True(t, d.runResizeTransaction(source, ac, lease, epoch))

@@ -780,7 +780,7 @@ func TestTransactionalResizeRetriesAcceptedFloatingSlotByIdentity(t *testing.T)
780		tb.floating = floatingSlot{state: floatingVisible, pane: popup, generation: 7}	780		tb.floating = floatingSlot{state: floatingVisible, pane: popup, generation: 7}
781		tb.mu.Unlock()	781		tb.mu.Unlock()
782			782
783	-	rc := d.attachCoordinator(sess, ac, true)	783	+	rc := d.attachCoordinator(sess, nil, ac, true)
784		lease := rc.attachmentLease(ac)	784		lease := rc.attachmentLease(ac)
785		epoch := rc.recordResizeRequestForLease(domain.Size{Cols: 80, Rows: 24}, ac, lease)	785		epoch := rc.recordResizeRequestForLease(domain.Size{Cols: 80, Rows: 24}, ac, lease)
786		require.NotZero(t, epoch)	786		require.NotZero(t, epoch)

M internal/usecase/daemon/transport_observability_test.go +1 -1


@@ -20,7 +20,7 @@ func TestTransportObservabilityDaemonBoundaries(t *testing.T) {
20		// One in-flight state makes the second public resize take the ACK-blocked	20		// One in-flight state makes the second public resize take the ACK-blocked
21		// path. The real coordinator owns both renders and the ACK wake.	21		// path. The real coordinator owns both renders and the ACK wake.
22		ac.output = newOutputStateStream(1)	22		ac.output = newOutputStateStream(1)
23	-	rc := d.attachCoordinator(sess, ac, true)	23	+	rc := d.attachCoordinator(sess, nil, ac, true)
24			24
25		if !d.resizeForFirstPaint(sess, ac, domain.Size{Cols: 90, Rows: 25}) {	25		if !d.resizeForFirstPaint(sess, ac, domain.Size{Cols: 90, Rows: 25}) {
26		t.Fatal("first resize was not accepted")	26		t.Fatal("first resize was not accepted")

M internal/usecase/daemon/wire.go +3 -1

 )
 func frameWelcome(s *session, ac *attachedClient) ports.Frame {
+	s.mu.Lock()
 	w := ports.Welcome{
 		SessionID:    string(s.id),
 		SessionName:  s.name,
 		Ephemeral:    s.ephemeral,
 		Capabilities: ports.CapabilityResume,
-		ResumeToken:  ac.resumeToken,
 	}
+	s.mu.Unlock()
+	w.ResumeToken = ac.resumeToken
 	return ports.Frame{Type: ports.MsgWelcome, Payload: ports.MarshalWelcome(w)}
 }

A internal/usecase/daemon/wire_metadata_test.go +36 -0

@@ -0,0 +1,36 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"fmt"
	5	+	"sync"
	6	+	"testing"
	7	+
	8	+	"github.com/bnema/vev/internal/ports"
	9	+	)
	10	+
	11	+	func TestFrameWelcomeSnapshotsSessionMetadataUnderLock(t *testing.T) {
	12	+	sess := &session{sessionCore: sessionCore{id: "session", name: "initial"}}
	13	+	ac := &attachedClient{resumeToken: 42}
	14	+
	15	+	var wg sync.WaitGroup
	16	+	wg.Go(func() {
	17	+	for i := range 1000 {
	18	+	sess.mu.Lock()
	19	+	sess.name = fmt.Sprintf("session-%d", i)
	20	+	sess.ephemeral = i%2 == 0
	21	+	sess.mu.Unlock()
	22	+	}
	23	+	})
	24	+
	25	+	for range 1000 {
	26	+	frame := frameWelcome(sess, ac)
	27	+	welcome, err := ports.UnmarshalWelcome(frame.Payload)
	28	+	if err != nil {
	29	+	t.Fatalf("UnmarshalWelcome() error = %v", err)
	30	+	}
	31	+	if welcome.SessionID != "session" \|\| welcome.SessionName == "" {
	32	+	t.Fatalf("welcome metadata = %+v", welcome)
	33	+	}
	34	+	}
	35	+	wg.Wait()
	36	+	}

A pkg/vt/history_final_acceptance_test.go +57 -0

@@ -0,0 +1,57 @@
	1	+	package vt
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/bnema/vev/pkg/renderer"
	7	+	"github.com/stretchr/testify/require"
	8	+	)
	9	+
	10	+	func TestHistoryAcceptanceKeepsBookmarksAcrossLiveScrollEvictionAndRestore(t *testing.T) {
	11	+	history := NewHistory(HistoryConfig{MaxRows: 3, MaxCells: 32, ChunkRows: 2})
	12	+	for _, text := range []string{"live-1", "live-2", "live-3"} {
	13	+	require.NoError(t, history.Append(historyAcceptanceRow(text), LineBound{End: len(text)}))
	14	+	}
	15	+
	16	+	beforeScroll := history.View()
	17	+	bookmark := beforeScroll.RowID(1)
	18	+	immutable := beforeScroll.Row(1)
	19	+	immutable[0].Rune = 'X'
	20	+	require.Equal(t, 'l', beforeScroll.Row(1)[0].Rune, "immutable history view exposed mutable cells")
	21	+
	22	+	require.NoError(t, history.Append(historyAcceptanceRow("live-4"), LineBound{End: 6}))
	23	+	afterScroll := history.View()
	24	+	require.Equal(t, 3, afterScroll.Len())
	25	+	require.Equal(t, 0, afterScroll.FindRowID(bookmark), "bookmark row was not retained after one live scroll")
	26	+	require.Equal(t, "live-2", historyAcceptanceText(afterScroll.Row(0)))
	27	+	require.Equal(t, "live-1", historyAcceptanceText(beforeScroll.Row(0)), "retained view changed after eviction")
	28	+
	29	+	sealed, tail, err := MarshalSealedHistory(history.SealAndView())
	30	+	require.NoError(t, err)
	31	+	restored, err := HistoryFromBlobs(HistoryConfig{MaxRows: 3, MaxCells: 32, ChunkRows: 2}, sealed, tail)
	32	+	require.NoError(t, err)
	33	+	restoredView := restored.View()
	34	+	require.Equal(t, afterScroll.Len(), restoredView.Len())
	35	+	require.Equal(t, bookmark, restoredView.RowID(0), "bookmark row identity changed during restore")
	36	+	require.Equal(t, "live-2", historyAcceptanceText(restoredView.Row(0)))
	37	+
	38	+	next := restoredView.NextRowID()
	39	+	require.NoError(t, restored.Append(historyAcceptanceRow("live-5"), LineBound{End: 6}))
	40	+	require.Greater(t, restored.View().NextRowID(), next)
	41	+	}
	42	+
	43	+	func historyAcceptanceRow(text string) []renderer.Cell {
	44	+	row := make([]renderer.Cell, len(text))
	45	+	for i, r := range text {
	46	+	row[i] = renderer.Cell{Rune: r}
	47	+	}
	48	+	return row
	49	+	}
	50	+
	51	+	func historyAcceptanceText(row []renderer.Cell) string {
	52	+	text := make([]rune, len(row))
	53	+	for i, cell := range row {
	54	+	text[i] = cell.Rune
	55	+	}
	56	+	return string(text)
	57	+	}