5a95bf3 refactor(daemon): deepen attachment lifecycle authority (#224) · vev

M internal/usecase/daemon/attachment_connection.go +68 -78


@@ -2,44 +2,42 @@ package daemon
2			2
3		import "github.com/bnema/vev/internal/ports"	3		import "github.com/bnema/vev/internal/ports"
4			4
5	-	// attachmentConnectionToken is the exact capability for one registered	5	+	// attachmentCapability is the exact capability for one registered
6	-	// attachment connection incarnation. It is invalid as soon as any of the	6	+	// Attachment Connection incarnation. It is invalid as soon as its Session
7	-	// session, attachment membership, connection generation, transport link, or	7	+	// membership, generation, Transport incarnation, or render lease changes.
8	-	// coordinator lease changes.	8	+	type attachmentCapability struct {
9	-	type attachmentConnectionToken struct {
10		sess *session	9		sess *session
11		ac *attachedClient	10		ac *attachedClient
12		generation uint64	11		generation uint64
13		transport transportSnapshot	12		transport transportSnapshot
14		lease *attachmentLease	13		lease *attachmentLease
15	-	effect *attachmentEffectTicket
16		// rebase marks a cross-session move whose first paint starts a dependency-	14		// rebase marks a cross-session move whose first paint starts a dependency-
17		// free output chain after publication releases architecture locks.	15		// free output chain after publication releases architecture locks.
18		rebase bool	16		rebase bool
19		}	17		}
20			18
21	-	func attachmentToken(entry session, ac attachedClient, tr ports.Transport) attachmentConnectionToken {	19	+	func captureAttachmentCapability(entry session, ac attachedClient, tr ports.Transport) attachmentCapability {
22		if entry == nil \|\| entry.core() == nil \|\| ac == nil \|\| tr == nil {	20		if entry == nil \|\| entry.core() == nil \|\| ac == nil \|\| tr == nil {
23	-	return attachmentConnectionToken{}	21	+	return attachmentCapability{}
24		}	22		}
25		// Capture one concrete link incarnation before taking the session lock. The	23		// Capture one concrete link incarnation before taking the session lock. The
26		// same snapshot is revalidated below; do not take a second snapshot and	24		// same snapshot is revalidated below; do not take a second snapshot and
27		// accidentally bind a replacement link.	25		// accidentally bind a replacement link.
28		transport := ac.transportSnapshot()	26		transport := ac.transportSnapshot()
29		if transport.transport != tr {	27		if transport.transport != tr {
30	-	return attachmentConnectionToken{}	28	+	return attachmentCapability{}
31		}	29		}
32	-	if ac.beforeAttachmentTokenValidation != nil {	30	+	if ac.beforeAttachmentCapabilityValidation != nil {
33	-	ac.beforeAttachmentTokenValidation()	31	+	ac.beforeAttachmentCapabilityValidation()
34		}	32		}
35		core := entry.core()	33		core := entry.core()
36		core.mu.Lock()	34		core.mu.Lock()
37		if !attachmentRegisteredLocked(entry, ac) \|\| !ac.transportSnapshotCurrent(transport) {	35		if !attachmentRegisteredLocked(entry, ac) \|\| !ac.transportSnapshotCurrent(transport) {
38		core.mu.Unlock()	36		core.mu.Unlock()
39	-	return attachmentConnectionToken{}	37	+	return attachmentCapability{}
40		}	38		}
41	-	generation := ac.connectionGeneration.Load()	39	+	generation := ac.lifecycle.generation.Load()
42	-	token := attachmentConnectionToken{	40	+	token := attachmentCapability{
43		sess: entry,	41		sess: entry,
44		ac: ac,	42		ac: ac,
45		generation: generation,	43		generation: generation,

@@ -50,101 +48,93 @@ func attachmentToken(entry session, ac attachedClient, tr ports.Transport) att
50		}	48		}
51		core.mu.Unlock()	49		core.mu.Unlock()
52		if !token.current() {	50		if !token.current() {
53	-	return attachmentConnectionToken{}	51	+	return attachmentCapability{}
54		}	52		}
55	-	ac.bootstrapAttachmentCapability(token)	53	+	ac.lifecycle.installInitialCapability(token)
56		return token	54		return token
57		}	55		}
58			56
59	-	func (s session) attachmentToken(ac attachedClient, tr ports.Transport) attachmentConnectionToken {	57	+	func (s session) captureAttachmentCapability(ac attachedClient, tr ports.Transport) attachmentCapability {
60	-	return attachmentToken(s, ac, tr)	58	+	return captureAttachmentCapability(s, ac, tr)
61		}	59		}
62			60
63	-	// current validates every immutable identity captured by the token. Membership	61	+	func (t attachmentCapability) sameIdentity(other attachmentCapability) bool {
64	-	// is the sole authority; there is no owner, replacement, or compatibility role.	62	+	return t.sess != nil && t.ac != nil && t.sess == other.sess && t.ac == other.ac &&
65	-	func (t attachmentConnectionToken) current() bool {	63	+	t.generation == other.generation && t.transport.transport == other.transport.transport &&
66	-	return t.sess != nil && t.ac != nil &&	64	+	t.transport.incarnation == other.transport.incarnation && t.lease == other.lease
67	-	t.ac.connectionGeneration.Load() == t.generation &&
68	-	t.ac.currentAttachmentSession() == t.sess &&
69	-	t.ac.transportSnapshotCurrent(t.transport) &&
70	-	attachmentRegistered(t.sess, t.ac)
71		}	65		}
72			66
73	-	// attachmentCurrent additionally validates the optional coordinator lease used	67	+	func (t attachmentCapability) matchesConnectionSnapshot(sess session, ac attachedClient, transport transportSnapshot) bool {
74	-	// by render and resize effects. Attachments without that optional lease still	68	+	return t.sess == sess && t.ac == ac && ac != nil && t.transport == transport &&
75	-	// own their independent connection lifecycle.	69	+	ac.lifecycle.identityCurrent(t)
76	-	func (t attachmentConnectionToken) attachmentCurrent() bool {	70	+	}
77	-	if !t.current() \|\| t.ac.currentAttachmentSession() != t.sess {	71	+
			72	+	func (l *attachmentLifecycle) identityCurrent(capability attachmentCapability) bool {
			73	+	return l != nil && capability.sess != nil && capability.ac != nil &&
			74	+	capability.ac.lifecycle.generation.Load() == capability.generation &&
			75	+	capability.ac.currentAttachmentSession() == capability.sess &&
			76	+	capability.ac.transportSnapshotCurrent(capability.transport)
			77	+	}
			78	+
			79	+	// current validates every immutable identity captured by the capability.
			80	+	// Membership is the sole authority; there is no owner, replacement, or
			81	+	// compatibility role.
			82	+	func (l *attachmentLifecycle) current(capability attachmentCapability) bool {
			83	+	if !l.identityCurrent(capability) \|\| !attachmentRegistered(capability.sess, capability.ac) {
78		return false	84		return false
79		}	85		}
80	-	if t.lease == nil {	86	+	if capability.lease == nil {
81		return true	87		return true
82		}	88		}
83	-	rc := t.sess.core().coordinator.Load()	89	+	rc := capability.sess.core().coordinator.Load()
84	-	return rc != nil && t.lease.attachment == t.ac && rc.leaseCurrent(t.lease, true)	90	+	return rc != nil && capability.lease.attachment == capability.ac && rc.leaseCurrent(capability.lease, false)
85		}	91		}
86			92
87	-	func (t attachmentConnectionToken) attachmentEffectCurrent() bool {	93	+	func (t attachmentCapability) current() bool {
88	-	if t.effect != nil && !t.effect.ended.Load() {	94	+	return t.ac != nil && t.ac.lifecycle.current(t)
89	-	return true
90	-	}
91	-	return t.attachmentCurrent()
92		}	95		}
93			96
94	-	func beginAttachmentLeaseEffect(sess session, ac attachedClient, lease attachmentLease) (attachmentEffectTicket, bool) {	97	+	func beginAttachmentLeaseEffect(sess session, ac attachedClient, lease attachmentLease) (attachmentEffect, bool) {
95		if sess == nil \|\| ac == nil \|\| lease == nil {	98		if sess == nil \|\| ac == nil \|\| lease == nil {
96		return nil, false	99		return nil, false
97		}	100		}
98	-	token := attachmentToken(sess, ac, ac.transport())	101	+	token := captureAttachmentCapability(sess, ac, ac.transport())
99		token.lease = lease	102		token.lease = lease
100		return ac.beginAttachmentEffect(token)	103		return ac.beginAttachmentEffect(token)
101		}	104		}
102			105
103	-	func (t *attachmentConnectionToken) endAttachmentEffect() {	106	+	func (t attachmentCapability) currentInSessionLocked(sess *session) bool {
104	-	if t == nil \|\| t.effect == nil {	107	+	return t.sess == sess && t.ac != nil && t.ac.lifecycle.currentSessionLocked(t)
105	-	return
106	-	}
107	-	t.effect.End()
108	-	t.effect = nil
109		}	108		}
110			109
111	-	// attachmentEffectCurrentSessionLocked validates authority at a session-owned	110	+	func (t attachmentCapability) currentInSessionAndLeaseLocked(sess session, ac attachedClient, coordinator *renderCoordinator) bool {
112	-	// mutation boundary where sess.core().mu is already held. A live effect ticket	111	+	return t.sess == sess && t.ac == ac && ac != nil &&
113	-	// preserves the exact capability it captured for the effect because attachment	112	+	ac.lifecycle.currentSessionAndLeaseLocked(t, coordinator)
114	-	// transitions drain the gate before changing identity. This differs from	113	+	}
115	-	// attachmentCurrent, which revalidates the attachment's currently published identity.	114	+
116	-	func (t attachmentConnectionToken) attachmentEffectCurrentSessionLocked() bool {	115	+	// currentSessionLocked validates capability authority where sess.core().mu is
117	-	if t.effect != nil && !t.effect.ended.Load() {	116	+	// already held. An admitted effect does not use this comparison: a transition
118	-	return true	117	+	// cannot change identity until that effect ends.
119	-	}	118	+	func (l *attachmentLifecycle) currentSessionLocked(capability attachmentCapability) bool {
120	-	if t.sess == nil \|\| t.ac == nil \|\|	119	+	if !l.identityCurrent(capability) \|\| !attachmentRegisteredLocked(capability.sess, capability.ac) {
121	-	t.ac.connectionGeneration.Load() != t.generation \|\|
122	-	!t.ac.transportSnapshotCurrent(t.transport) \|\|
123	-	t.ac.currentAttachmentSession() != t.sess \|\|
124	-	!attachmentRegisteredLocked(t.sess, t.ac) {
125		return false	120		return false
126		}	121		}
127	-	if t.lease == nil {	122	+	if capability.lease == nil {
128		return true	123		return true
129		}	124		}
130	-	rc := t.sess.core().coordinator.Load()	125	+	rc := capability.sess.core().coordinator.Load()
131	-	return rc != nil && t.lease.attachment == t.ac && rc.leaseCurrent(t.lease, true)	126	+	return rc != nil && capability.lease.attachment == capability.ac && rc.leaseCurrent(capability.lease, false)
132		}	127		}
133			128
134	-	func (t attachmentConnectionToken) sendControl(frame ports.Frame) error {	129	+	// currentSessionAndLeaseLocked validates the same capability tuple when the
135	-	if t.ac == nil \|\| t.transport.transport == nil {	130	+	// caller already holds both the Session and coordinator locks.
136	-	return errAttachmentTransition	131	+	func (l attachmentLifecycle) currentSessionAndLeaseLocked(capability attachmentCapability, coordinator renderCoordinator) bool {
137	-	}	132	+	if !l.identityCurrent(capability) \|\| !attachmentRegisteredLocked(capability.sess, capability.ac) {
138	-	t.ac.sendMu.Lock()	133	+	return false
139	-	defer t.ac.sendMu.Unlock()
140	-	if t.effect == nil \|\| t.effect.ended.Load() \|\| !t.ac.transportSnapshotCurrent(t.transport) \|\|
141	-	!t.effect.beginTransportSend(t.transport) {
142	-	return errAttachmentTransition
143		}	134		}
144	-	err := t.transport.transport.Send(frame)	135	+	if capability.lease == nil {
145	-	if err != nil {	136	+	return true
146	-	t.effect.reportTransportFailure(t.transport)
147		}	137		}
148	-	t.effect.endTransportSend()	138	+	return coordinator != nil && capability.lease.attachment == capability.ac &&
149	-	return err	139	+	coordinator.leaseCurrentLocked(capability.lease, false)
150		}	140		}

M internal/usecase/daemon/attachment_effect_freeze.go +17 -17


@@ -60,7 +60,7 @@ func (d *attachmentEffectDrainDeadline) Done() <-chan struct{} {
60		return d.done	60		return d.done
61		}	61		}
62			62
63	-	type frozenAttachmentEffectGates struct {	63	+	type attachmentTransitionGuard struct {
64		clients []*attachedClient	64		clients []*attachedClient
65		interruptions map[*attachedClient]transportSnapshot	65		interruptions map[*attachedClient]transportSnapshot
66		acquired bool	66		acquired bool

@@ -84,7 +84,7 @@ type attachmentEffectFreezeOptions struct {
84			84
85		// freezeAttachmentEffectGates establishes transition priority in immutable attachment	85		// freezeAttachmentEffectGates establishes transition priority in immutable attachment
86		// order, then drains earlier admissions.	86		// order, then drains earlier admissions.
87	-	func freezeAttachmentEffectGates(clients ...*attachedClient) frozenAttachmentEffectGates {	87	+	func freezeAttachmentEffectGates(clients ...*attachedClient) attachmentTransitionGuard {
88		return freezeAttachmentEffectGatesWith(attachmentEffectFreezeOptions{}, clients...)	88		return freezeAttachmentEffectGatesWith(attachmentEffectFreezeOptions{}, clients...)
89		}	89		}
90			90

@@ -93,11 +93,11 @@ func freezeAttachmentEffectGates(clients ...*attachedClient) frozenAttachmentEff
93		// behind another owner, only gates acquired by this call are rolled back, in	93		// behind another owner, only gates acquired by this call are rolled back, in
94		// reverse order. nonblocking is used by move reservations to avoid inverting	94		// reverse order. nonblocking is used by move reservations to avoid inverting
95		// the move/teardown protocols.	95		// the move/teardown protocols.
96	-	func freezeAttachmentEffectGatesWith(options attachmentEffectFreezeOptions, clients ...*attachedClient) frozenAttachmentEffectGates {	96	+	func freezeAttachmentEffectGatesWith(options attachmentEffectFreezeOptions, clients ...*attachedClient) attachmentTransitionGuard {
97		ordered := orderedAttachmentEffectClients(clients)	97		ordered := orderedAttachmentEffectClients(clients)
98		frozen, acquired := acquireAttachmentEffectGates(ordered, options.done, options.afterFrozen, options.nonblocking)	98		frozen, acquired := acquireAttachmentEffectGates(ordered, options.done, options.afterFrozen, options.nonblocking)
99		if !acquired {	99		if !acquired {
100	-	return frozenAttachmentEffectGates{}	100	+	return attachmentTransitionGuard{}
101		}	101		}
102			102
103		interruptByClient := attachmentTransportInterruptsByClient(options.interrupts)	103		interruptByClient := attachmentTransportInterruptsByClient(options.interrupts)

@@ -121,18 +121,18 @@ func orderedAttachmentEffectClients(clients []attachedClient) []attachedClient
121		continue	121		continue
122		}	122		}
123		unique[ac] = struct{}{}	123		unique[ac] = struct{}{}
124	-	ac.attachmentEffects.immutableOrder()	124	+	ac.lifecycle.immutableOrder()
125		ordered = append(ordered, ac)	125		ordered = append(ordered, ac)
126		}	126		}
127		sort.Slice(ordered, func(i, j int) bool {	127		sort.Slice(ordered, func(i, j int) bool {
128	-	return ordered[i].attachmentEffects.order.Load() < ordered[j].attachmentEffects.order.Load()	128	+	return ordered[i].lifecycle.order.Load() < ordered[j].lifecycle.order.Load()
129		})	129		})
130		return ordered	130		return ordered
131		}	131		}
132			132
133		// waitForAttachmentEffectChangeLocked requires g.mu and returns with g.mu held. A	133		// waitForAttachmentEffectChangeLocked requires g.mu and returns with g.mu held. A
134		// true result means the overall deadline won and the caller must stop waiting.	134		// true result means the overall deadline won and the caller must stop waiting.
135	-	func waitForAttachmentEffectChangeLocked(g *attachmentEffectGate, done func() <-chan struct{}) bool {	135	+	func waitForAttachmentEffectChangeLocked(g *attachmentLifecycle, done func() <-chan struct{}) bool {
136		if done == nil {	136		if done == nil {
137		g.cond.Wait()	137		g.cond.Wait()
138		return false	138		return false

@@ -156,22 +156,22 @@ func waitForAttachmentEffectChangeLocked(g *attachmentEffectGate, done func() <-
156		// acquireAttachmentEffectGates establishes exclusive transition ownership in order.	156		// acquireAttachmentEffectGates establishes exclusive transition ownership in order.
157		// It must run without architecture locks. Deadline rollback releases only this	157		// It must run without architecture locks. Deadline rollback releases only this
158		// call's partial acquisition and does so in reverse order.	158		// call's partial acquisition and does so in reverse order.
159	-	func acquireAttachmentEffectGates(ordered []attachedClient, done func() <-chan struct{}, afterFrozen func(attachedClient), nonblocking bool) (frozenAttachmentEffectGates, bool) {	159	+	func acquireAttachmentEffectGates(ordered []attachedClient, done func() <-chan struct{}, afterFrozen func(attachedClient), nonblocking bool) (attachmentTransitionGuard, bool) {
160	-	frozen := frozenAttachmentEffectGates{clients: make([]*attachedClient, 0, len(ordered))}	160	+	frozen := attachmentTransitionGuard{clients: make([]*attachedClient, 0, len(ordered))}
161		for _, ac := range ordered {	161		for _, ac := range ordered {
162	-	g := &ac.attachmentEffects	162	+	g := &ac.lifecycle
163		g.mu.Lock()	163		g.mu.Lock()
164		g.initLocked()	164		g.initLocked()
165		for g.phase == attachmentEffectsFrozen {	165		for g.phase == attachmentEffectsFrozen {
166		if nonblocking {	166		if nonblocking {
167		g.mu.Unlock()	167		g.mu.Unlock()
168		frozen.unfreeze()	168		frozen.unfreeze()
169	-	return frozenAttachmentEffectGates{}, false	169	+	return attachmentTransitionGuard{}, false
170		}	170		}
171		if waitForAttachmentEffectChangeLocked(g, done) {	171		if waitForAttachmentEffectChangeLocked(g, done) {
172		g.mu.Unlock()	172		g.mu.Unlock()
173		frozen.unfreeze()	173		frozen.unfreeze()
174	-	return frozenAttachmentEffectGates{}, false	174	+	return attachmentTransitionGuard{}, false
175		}	175		}
176		}	176		}
177		g.phase = attachmentEffectsFrozen	177		g.phase = attachmentEffectsFrozen

@@ -204,7 +204,7 @@ func interruptFrozenAttachmentTransports(ordered []*attachedClient, interruptByC
204		if !mayInterrupt {	204		if !mayInterrupt {
205		continue	205		continue
206		}	206		}
207	-	g := &ac.attachmentEffects	207	+	g := &ac.lifecycle
208		g.mu.Lock()	208		g.mu.Lock()
209		if gateHasTransportEffectLocked(g, expected) {	209		if gateHasTransportEffectLocked(g, expected) {
210		toClose = append(toClose, attachmentTransportInterrupt{ac: ac, transport: expected})	210		toClose = append(toClose, attachmentTransportInterrupt{ac: ac, transport: expected})

@@ -221,7 +221,7 @@ func interruptFrozenAttachmentTransports(ordered []*attachedClient, interruptByC
221		// late tickets can then retire without pinning the owner indefinitely.	221		// late tickets can then retire without pinning the owner indefinitely.
222		func drainFrozenAttachmentEffects(ordered []attachedClient, interruptByClient, interruptions map[attachedClient]transportSnapshot, done func() <-chan struct{}) bool {	222		func drainFrozenAttachmentEffects(ordered []attachedClient, interruptByClient, interruptions map[attachedClient]transportSnapshot, done func() <-chan struct{}) bool {
223		for _, ac := range ordered {	223		for _, ac := range ordered {
224	-	g := &ac.attachmentEffects	224	+	g := &ac.lifecycle
225		g.mu.Lock()	225		g.mu.Lock()
226		for g.inFlight != 0 {	226		for g.inFlight != 0 {
227		if waitForAttachmentEffectChangeLocked(g, done) {	227		if waitForAttachmentEffectChangeLocked(g, done) {

@@ -238,7 +238,7 @@ func drainFrozenAttachmentEffects(ordered []*attachedClient, interruptByClient,
238		return true	238		return true
239		}	239		}
240			240
241	-	func gateHasTransportEffectLocked(g *attachmentEffectGate, expected transportSnapshot) bool {	241	+	func gateHasTransportEffectLocked(g *attachmentLifecycle, expected transportSnapshot) bool {
242		for _, active := range g.transportEffects {	242		for _, active := range g.transportEffects {
243		if active.transport == expected.transport && active.incarnation == expected.incarnation {	243		if active.transport == expected.transport && active.incarnation == expected.incarnation {
244		return true	244		return true

@@ -247,9 +247,9 @@ func gateHasTransportEffectLocked(g *attachmentEffectGate, expected transportSna
247		return false	247		return false
248		}	248		}
249			249
250	-	func (f frozenAttachmentEffectGates) unfreeze() {	250	+	func (f attachmentTransitionGuard) unfreeze() {
251		for i := len(f.clients) - 1; i >= 0; i-- {	251		for i := len(f.clients) - 1; i >= 0; i-- {
252	-	g := &f.clients[i].attachmentEffects	252	+	g := &f.clients[i].lifecycle
253		g.mu.Lock()	253		g.mu.Lock()
254		g.initLocked()	254		g.initLocked()
255		g.phase = attachmentEffectsStable	255		g.phase = attachmentEffectsStable

M internal/usecase/daemon/attachment_effect_gate.go +108 -101


@@ -15,46 +15,33 @@ const (
15		attachmentEffectsFrozen	15		attachmentEffectsFrozen
16		)	16		)
17			17
18	-	// attachmentCapability is the single attachment-local publication consumed by	18	+	// attachmentLifecycle owns the immutable committed capability and the
19	-	// effect admission. It deliberately contains no independently mutable state:	19	+	// linearization gate for every attachment-bound observable effect. Transitions
20	-	// a ticket is admitted only when every field matches the frame's token.	20	+	// freeze and drain it before changing membership, generation, Transport, or
21	-	type attachmentCapability struct {	21	+	// render lease identity.
22	-	sess *session	22	+	type attachmentLifecycle struct {
23	-	generation uint64	23	+	generation atomic.Uint64
24	-	transport transportSnapshot
25	-	lease *attachmentLease
26	-	}
27	-
28	-	func capabilityFromToken(token attachmentConnectionToken) attachmentCapability {
29	-	return attachmentCapability{
30	-	sess: token.sess,
31	-	generation: token.generation,
32	-	transport: token.transport,
33	-	lease: token.lease,
34	-	}
35	-	}
36	-
37	-	func (c attachmentCapability) matches(token attachmentConnectionToken) bool {
38	-	return token.ac != nil && c.sess != nil && token.sess != nil && c.sess == token.sess &&
39	-	c.generation == token.generation && c.transport.transport == token.transport.transport &&
40	-	c.transport.incarnation == token.transport.incarnation && c.lease == token.lease
41	-	}
42	-
43	-	type attachmentEffectGate struct {
44		mu sync.Mutex	24		mu sync.Mutex
45		cond *sync.Cond	25		cond *sync.Cond
46		changed chan struct{}	26		changed chan struct{}
47		phase attachmentEffectPhase	27		phase attachmentEffectPhase
48		capability attachmentCapability	28		capability attachmentCapability
49		inFlight uint64	29		inFlight uint64
50	-	transportEffects map[*attachmentEffectTicket]transportSnapshot	30	+	transportEffects map[*attachmentEffect]transportSnapshot
51		failedTransport transportSnapshot	31		failedTransport transportSnapshot
52		order atomic.Uint64	32		order atomic.Uint64
53		}	33		}
54			34
55		var nextAttachmentEffectGateOrder atomic.Uint64	35		var nextAttachmentEffectGateOrder atomic.Uint64
56			36
57	-	func (g *attachmentEffectGate) initLocked() {	37	+	func (g *attachmentLifecycle) generationValue() uint64 {
			38	+	if g == nil {
			39	+	return 0
			40	+	}
			41	+	return g.generation.Load()
			42	+	}
			43	+
			44	+	func (g *attachmentLifecycle) initLocked() {
58		if g.cond == nil {	45		if g.cond == nil {
59		g.cond = sync.NewCond(&g.mu)	46		g.cond = sync.NewCond(&g.mu)
60		}	47		}

@@ -63,14 +50,14 @@ func (g *attachmentEffectGate) initLocked() {
63		}	50		}
64		}	51		}
65			52
66	-	func (g *attachmentEffectGate) signalLocked() {	53	+	func (g *attachmentLifecycle) signalLocked() {
67		g.initLocked()	54		g.initLocked()
68		close(g.changed)	55		close(g.changed)
69		g.changed = make(chan struct{})	56		g.changed = make(chan struct{})
70		g.cond.Broadcast()	57		g.cond.Broadcast()
71		}	58		}
72			59
73	-	func (g *attachmentEffectGate) immutableOrder() uint64 {	60	+	func (g *attachmentLifecycle) immutableOrder() uint64 {
74		if order := g.order.Load(); order != 0 {	61		if order := g.order.Load(); order != 0 {
75		return order	62		return order
76		}	63		}

@@ -81,7 +68,7 @@ func (g *attachmentEffectGate) immutableOrder() uint64 {
81		return g.order.Load()	68		return g.order.Load()
82		}	69		}
83			70
84	-	func (g *attachmentEffectGate) inFlightCount() uint64 {	71	+	func (g *attachmentLifecycle) inFlightCount() uint64 {
85		if g == nil {	72		if g == nil {
86		return 0	73		return 0
87		}	74		}

@@ -90,17 +77,18 @@ func (g *attachmentEffectGate) inFlightCount() uint64 {
90		return g.inFlight	77		return g.inFlight
91		}	78		}
92			79
93	-	// attachmentEffectTicket reserves the exact published capability until End. End is	80	+	// attachmentEffect is an explicit admission of one immutable capability. It
94	-	// idempotent so error paths can safely defer it before doing any observable I/O.	81	+	// remains valid until End because transitions freeze admission and drain all
95	-	type attachmentEffectTicket struct {	82	+	// existing effects before changing lifecycle identity. End is idempotent.
96	-	gate *attachmentEffectGate	83	+	type attachmentEffect struct {
97	-	token attachmentConnectionToken	84	+	attachmentCapability
			85	+	lifecycle *attachmentLifecycle
98		actionDaemon *Daemon	86		actionDaemon *Daemon
99		action string	87		action string
100		ended atomic.Bool	88		ended atomic.Bool
101		}	89		}
102			90
103	-	func (t attachmentEffectTicket) bindActionEnd(d Daemon, action string) {	91	+	func (t attachmentEffect) bindActionEnd(d Daemon, action string) {
104		if t == nil \|\| t.ended.Load() {	92		if t == nil \|\| t.ended.Load() {
105		return	93		return
106		}	94		}

@@ -108,25 +96,31 @@ func (t attachmentEffectTicket) bindActionEnd(d Daemon, action string) {
108		t.action = action	96		t.action = action
109		}	97		}
110			98
111	-	func (t *attachmentEffectTicket) connectionToken() attachmentConnectionToken {	99	+	func (t *attachmentEffect) capability() attachmentCapability {
112		if t == nil {	100		if t == nil {
113	-	return attachmentConnectionToken{}	101	+	return attachmentCapability{}
114		}	102		}
115	-	token := t.token	103	+	return t.attachmentCapability
116	-	token.effect = t	104	+	}
117	-	return token	105	+
			106	+	func (t *attachmentEffect) current() bool {
			107	+	return t != nil && !t.ended.Load()
			108	+	}
			109	+
			110	+	func (t *attachmentEffect) currentSessionLocked() bool {
			111	+	return t.current()
118		}	112		}
119			113
120	-	func (t *attachmentEffectTicket) End() {	114	+	func (t *attachmentEffect) End() {
121	-	if t == nil \|\| t.gate == nil \|\| !t.ended.CompareAndSwap(false, true) {	115	+	if t == nil \|\| t.lifecycle == nil \|\| !t.ended.CompareAndSwap(false, true) {
122		return	116		return
123		}	117		}
124	-	g := t.gate	118	+	g := t.lifecycle
125		g.mu.Lock()	119		g.mu.Lock()
126		g.initLocked()	120		g.initLocked()
127		if g.inFlight == 0 {	121		if g.inFlight == 0 {
128		g.mu.Unlock()	122		g.mu.Unlock()
129	-	panic("daemon: attachment effect ticket ended without admission")	123	+	panic("daemon: attachment effect ended without admission")
130		}	124		}
131		delete(g.transportEffects, t)	125		delete(g.transportEffects, t)
132		g.inFlight--	126		g.inFlight--

@@ -137,7 +131,7 @@ func (t *attachmentEffectTicket) End() {
137		}	131		}
138		}	132		}
139			133
140	-	func (d Daemon) endActionAttachmentEffect(effect attachmentEffectTicket, _ string) {	134	+	func (d Daemon) endActionAttachmentEffect(effect attachmentEffect, _ string) {
141		if effect != nil {	135		if effect != nil {
142		effect.End()	136		effect.End()
143		}	137		}

@@ -146,11 +140,11 @@ func (d Daemon) endActionAttachmentEffect(effect attachmentEffectTicket, _ str
146		// beginTransportSend marks only the interval spent in an external transport	140		// beginTransportSend marks only the interval spent in an external transport
147		// send as interruptible. A replacement may close this exact published link to	141		// send as interruptible. A replacement may close this exact published link to
148		// release the send without retiring an idle healthy attachment.	142		// release the send without retiring an idle healthy attachment.
149	-	func (t *attachmentEffectTicket) beginTransportSend(expected transportSnapshot) bool {	143	+	func (t *attachmentEffect) beginTransportSend(expected transportSnapshot) bool {
150	-	if t == nil \|\| t.gate == nil \|\| t.ended.Load() \|\| expected.transport == nil {	144	+	if t == nil \|\| t.lifecycle == nil \|\| t.ended.Load() \|\| expected.transport == nil {
151		return false	145		return false
152		}	146		}
153	-	g := t.gate	147	+	g := t.lifecycle
154		g.mu.Lock()	148		g.mu.Lock()
155		g.initLocked()	149		g.initLocked()
156		if t.ended.Load() \|\| g.capability.transport.transport != expected.transport \|\|	150		if t.ended.Load() \|\| g.capability.transport.transport != expected.transport \|\|

@@ -159,7 +153,7 @@ func (t *attachmentEffectTicket) beginTransportSend(expected transportSnapshot)
159		return false	153		return false
160		}	154		}
161		if g.transportEffects == nil {	155		if g.transportEffects == nil {
162	-	g.transportEffects = make(map[*attachmentEffectTicket]transportSnapshot)	156	+	g.transportEffects = make(map[*attachmentEffect]transportSnapshot)
163		}	157		}
164		g.transportEffects[t] = expected	158		g.transportEffects[t] = expected
165		g.signalLocked()	159		g.signalLocked()

@@ -167,11 +161,11 @@ func (t *attachmentEffectTicket) beginTransportSend(expected transportSnapshot)
167		return true	161		return true
168		}	162		}
169			163
170	-	func (t *attachmentEffectTicket) reportTransportFailure(expected transportSnapshot) {	164	+	func (t *attachmentEffect) reportTransportFailure(expected transportSnapshot) {
171	-	if t == nil \|\| t.gate == nil \|\| expected.transport == nil {	165	+	if t == nil \|\| t.lifecycle == nil \|\| expected.transport == nil {
172		return	166		return
173		}	167		}
174	-	g := t.gate	168	+	g := t.lifecycle
175		g.mu.Lock()	169		g.mu.Lock()
176		if !t.ended.Load() && g.capability.transport.transport == expected.transport &&	170		if !t.ended.Load() && g.capability.transport.transport == expected.transport &&
177		g.capability.transport.incarnation == expected.incarnation {	171		g.capability.transport.incarnation == expected.incarnation {

@@ -181,11 +175,11 @@ func (t *attachmentEffectTicket) reportTransportFailure(expected transportSnapsh
181		g.mu.Unlock()	175		g.mu.Unlock()
182		}	176		}
183			177
184	-	func (t *attachmentEffectTicket) endTransportSend() {	178	+	func (t *attachmentEffect) endTransportSend() {
185	-	if t == nil \|\| t.gate == nil {	179	+	if t == nil \|\| t.lifecycle == nil {
186		return	180		return
187		}	181		}
188	-	g := t.gate	182	+	g := t.lifecycle
189		g.mu.Lock()	183		g.mu.Lock()
190		if _, exists := g.transportEffects[t]; exists {	184		if _, exists := g.transportEffects[t]; exists {
191		delete(g.transportEffects, t)	185		delete(g.transportEffects, t)

@@ -194,45 +188,57 @@ func (t *attachmentEffectTicket) endTransportSend() {
194		g.mu.Unlock()	188		g.mu.Unlock()
195		}	189		}
196			190
			191	+	func (t *attachmentEffect) sendControl(frame ports.Frame) error {
			192	+	if !t.current() \|\| t.ac == nil \|\| t.transport.transport == nil {
			193	+	return errAttachmentTransition
			194	+	}
			195	+	t.ac.sendMu.Lock()
			196	+	defer t.ac.sendMu.Unlock()
			197	+	if !t.current() \|\| !t.ac.transportSnapshotCurrent(t.transport) \|\| !t.beginTransportSend(t.transport) {
			198	+	return errAttachmentTransition
			199	+	}
			200	+	err := t.transport.transport.Send(frame)
			201	+	if err != nil {
			202	+	t.reportTransportFailure(t.transport)
			203	+	}
			204	+	t.endTransportSend()
			205	+	return err
			206	+	}
			207	+
197		// beginAttachmentEffect is the sole attachment-bound effect admission point. The gate is	208		// beginAttachmentEffect is the sole attachment-bound effect admission point. The gate is
198		// held only long enough to reserve the capability; the effect itself must run	209		// held only long enough to reserve the capability; the effect itself must run
199		// without the gate mutex.	210		// without the gate mutex.
200	-	func (ac attachedClient) beginAttachmentEffect(token attachmentConnectionToken) (attachmentEffectTicket, bool) {	211	+	func (ac attachedClient) beginAttachmentEffect(token attachmentCapability) (attachmentEffect, bool) {
201	-	if ac == nil \|\| token.ac != ac {	212	+	if ac == nil \|\| token.ac != ac \|\| !token.current() {
202		return nil, false	213		return nil, false
203		}	214		}
204	-	g := &ac.attachmentEffects	215	+	g := &ac.lifecycle
205		g.mu.Lock()	216		g.mu.Lock()
206		g.initLocked()	217		g.initLocked()
207	-	if g.phase != attachmentEffectsStable \|\| !g.capability.matches(token) {	218	+	if g.phase != attachmentEffectsStable \|\| !g.capability.sameIdentity(token) {
208		g.mu.Unlock()	219		g.mu.Unlock()
209		return nil, false	220		return nil, false
210		}	221		}
211		g.inFlight++	222		g.inFlight++
212		g.mu.Unlock()	223		g.mu.Unlock()
213	-	captured := token	224	+	return &attachmentEffect{attachmentCapability: token, lifecycle: g}, true
214	-	captured.effect = nil
215	-	return &attachmentEffectTicket{gate: g, token: captured}, true
216		}	225		}
217			226
218		// beginCurrentAttachmentEffect waits out a transition that already froze ac, then	227		// beginCurrentAttachmentEffect waits out a transition that already froze ac, then
219		// admits the capability derived from the session registry. Handshakes use it	228		// admits the capability derived from the session registry. Handshakes use it
220		// after Welcome has completed so a replacement blocked behind that send can	229		// after Welcome has completed so a replacement blocked behind that send can
221		// publish before readiness or first paint.	230		// publish before readiness or first paint.
222	-	func (ac attachedClient) beginCurrentAttachmentEffect(sess session, tr ports.Transport) (attachmentConnectionToken, *attachmentEffectTicket, bool) {	231	+	func (ac attachedClient) beginCurrentAttachmentEffect(sess session, tr ports.Transport) (attachmentCapability, *attachmentEffect, bool) {
223		//nolint:contextcheck // This compatibility wrapper deliberately delegates with a fresh context; cancellable callers use the context variant below.	232		//nolint:contextcheck // This compatibility wrapper deliberately delegates with a fresh context; cancellable callers use the context variant below.
224		return ac.beginCurrentAttachmentEffectContext(context.Background(), sess, tr)	233		return ac.beginCurrentAttachmentEffectContext(context.Background(), sess, tr)
225		}	234		}
226			235
227	-	func (ac attachedClient) beginCurrentAttachmentEffectContext(ctx context.Context, sess session, tr ports.Transport) (attachmentConnectionToken, *attachmentEffectTicket, bool) {	236	+	func (ac attachedClient) beginCurrentAttachmentEffectContext(ctx context.Context, sess session, tr ports.Transport) (attachmentCapability, *attachmentEffect, bool) {
228	-	if ctx == nil {	237	+	if ctx == nil \|\| ac == nil \|\| sess == nil \|\| tr == nil {
229	-	ctx = context.Background()	238	+	return attachmentCapability{}, nil, false
230	-	}
231	-	if ac == nil \|\| sess == nil \|\| tr == nil {
232	-	return attachmentConnectionToken{}, nil, false
233		}	239		}
234		for {	240		for {
235	-	token := sess.attachmentToken(ac, tr)	241	+	token := sess.captureAttachmentCapability(ac, tr)
236		if token.ac == nil {	242		if token.ac == nil {
237		return token, nil, false	243		return token, nil, false
238		}	244		}

@@ -240,7 +246,7 @@ func (ac *attachedClient) beginCurrentAttachmentEffectContext(ctx context.Contex
240		return token, ticket, true	246		return token, ticket, true
241		}	247		}
242			248
243	-	g := &ac.attachmentEffects	249	+	g := &ac.lifecycle
244		g.mu.Lock()	250		g.mu.Lock()
245		g.initLocked()	251		g.initLocked()
246		if g.phase == attachmentEffectsFrozen {	252		if g.phase == attachmentEffectsFrozen {

@@ -254,8 +260,8 @@ func (ac *attachedClient) beginCurrentAttachmentEffectContext(ctx context.Contex
254		}	260		}
255		}	261		}
256		g.mu.Unlock()	262		g.mu.Unlock()
257	-	// A stable mismatch is only recoverable when a publication raced token	263	+	// A stable mismatch is only recoverable when a publication raced capability
258	-	// capture; an already-stale token proves that happened. A current token	264	+	// capture; an already-stale capability proves that happened. A current capability
259		// with a stable mismatch violates the publication invariant, so fail	265		// with a stable mismatch violates the publication invariant, so fail
260		// closed instead of spinning forever.	266		// closed instead of spinning forever.
261		if token.current() {	267		if token.current() {

@@ -266,58 +272,59 @@ func (ac *attachedClient) beginCurrentAttachmentEffectContext(ctx context.Contex
266		}	272		}
267		}	273		}
268			274
269	-	// publishAttachmentCapability is used by direct/headless setup and by transition	275	+	// installInitialCapability publishes only an empty lifecycle owner. It supports
270	-	// publication while the gate is frozen. Production attachment changes publish only	276	+	// direct/headless construction without creating a second mutable publication.
271	-	// through publishFrozenAttachmentCapability.	277	+	func (g *attachmentLifecycle) installInitialCapability(capability attachmentCapability) {
272	-	func (ac *attachedClient) publishAttachmentCapability(token attachmentConnectionToken) {
273	-	if ac == nil {
274	-	return
275	-	}
276	-	g := &ac.attachmentEffects
277		g.mu.Lock()	278		g.mu.Lock()
278		g.initLocked()	279		g.initLocked()
279	-	g.capability = capabilityFromToken(token)	280	+	if g.phase == attachmentEffectsStable && g.capability.sess == nil {
280	-	g.failedTransport = transportSnapshot{}	281	+	g.capability = capability
			282	+	g.failedTransport = transportSnapshot{}
			283	+	}
281		g.mu.Unlock()	284		g.mu.Unlock()
282		}	285		}
283			286
284	-	// bootstrapAttachmentCapability supports direct/headless session construction. It	287	+	func (ac *attachedClient) publishFrozenAttachmentCapability(capability attachmentCapability) attachmentCapability {
285	-	// never changes an existing or frozen production publication.	288	+	g := &ac.lifecycle
286	-	func (ac *attachedClient) bootstrapAttachmentCapability(token attachmentConnectionToken) {
287	-	if ac == nil \|\| token.sess == nil \|\| token.ac != ac {
288	-	return
289	-	}
290	-	g := &ac.attachmentEffects
291		g.mu.Lock()	289		g.mu.Lock()
292		g.initLocked()	290		g.initLocked()
293	-	if g.phase == attachmentEffectsStable && g.capability.sess == nil {	291	+	if g.phase != attachmentEffectsFrozen {
294	-	g.capability = capabilityFromToken(token)	292	+	g.mu.Unlock()
295	-	g.failedTransport = transportSnapshot{}	293	+	panic("daemon: publishing attachment capability without transition freeze")
296		}	294		}
			295	+	capability.generation = g.generation.Add(1)
			296	+	g.capability = capability
			297	+	g.failedTransport = transportSnapshot{}
297		g.mu.Unlock()	298		g.mu.Unlock()
			299	+	return capability
298		}	300		}
299			301
300	-	func (ac *attachedClient) publishFrozenAttachmentCapability(token attachmentConnectionToken) {	302	+	// invalidateRetiredAttachmentCapability retires parked identity either while
301	-	g := &ac.attachmentEffects	303	+	// stable with no admitted effects or under a terminal teardown's existing
			304	+	// freeze. Live membership transitions use invalidateFrozenAttachmentCapability.
			305	+	func (ac *attachedClient) invalidateRetiredAttachmentCapability() {
			306	+	g := &ac.lifecycle
302		g.mu.Lock()	307		g.mu.Lock()
303		g.initLocked()	308		g.initLocked()
304	-	if g.phase != attachmentEffectsFrozen {	309	+	if g.phase != attachmentEffectsFrozen && (g.phase != attachmentEffectsStable \|\| g.inFlight != 0) {
305		g.mu.Unlock()	310		g.mu.Unlock()
306	-	panic("daemon: publishing attachment capability without transition freeze")	311	+	panic("daemon: invalidating an active attachment capability")
307		}	312		}
308	-	g.capability = capabilityFromToken(token)	313	+	g.generation.Add(1)
			314	+	g.capability = attachmentCapability{}
309		g.failedTransport = transportSnapshot{}	315		g.failedTransport = transportSnapshot{}
310		g.mu.Unlock()	316		g.mu.Unlock()
311		}	317		}
312			318
313		func (ac *attachedClient) invalidateFrozenAttachmentCapability() {	319		func (ac *attachedClient) invalidateFrozenAttachmentCapability() {
314	-	g := &ac.attachmentEffects	320	+	g := &ac.lifecycle
315		g.mu.Lock()	321		g.mu.Lock()
316		g.initLocked()	322		g.initLocked()
317		if g.phase != attachmentEffectsFrozen {	323		if g.phase != attachmentEffectsFrozen {
318		g.mu.Unlock()	324		g.mu.Unlock()
319		panic("daemon: invalidating attachment capability without transition freeze")	325		panic("daemon: invalidating attachment capability without transition freeze")
320		}	326		}
			327	+	g.generation.Add(1)
321		g.capability = attachmentCapability{}	328		g.capability = attachmentCapability{}
322		g.failedTransport = transportSnapshot{}	329		g.failedTransport = transportSnapshot{}
323		g.mu.Unlock()	330		g.mu.Unlock()

M internal/usecase/daemon/attachment_effect_gate_test.go +73 -61

 	}
 }
-func startBlockedAttachmentSend(t *testing.T, token attachmentConnectionToken) <-chan struct{} {
+func startBlockedAttachmentSend(t *testing.T, token attachmentCapability) <-chan struct{} {
 	t.Helper()
 	ticket, admitted := token.ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
 func requireAttachmentEffectGateRetired(t *testing.T, ac *attachedClient) {
 	t.Helper()
-	ac.attachmentEffects.mu.Lock()
+	ac.lifecycle.mu.Lock()
-	defer ac.attachmentEffects.mu.Unlock()
+	defer ac.lifecycle.mu.Unlock()
-	require.Equal(t, attachmentEffectsStable, ac.attachmentEffects.phase)
+	require.Equal(t, attachmentEffectsStable, ac.lifecycle.phase)
-	require.Zero(t, ac.attachmentEffects.inFlight)
+	require.Zero(t, ac.lifecycle.inFlight)
-	require.Empty(t, ac.attachmentEffects.transportEffects)
+	require.Empty(t, ac.lifecycle.transportEffects)
 }
 func TestBeginCurrentAttachmentEffectFailsClosedOnStableCapabilityMismatch(t *testing.T) {
 	_, sess, ac, _ := newManualSessionWithPTYs(t, newQuietPTY())
-	current := sess.attachmentToken(ac, ac.transport())
+	current := sess.captureAttachmentCapability(ac, ac.transport())
 	stale := current
 	stale.generation++
-	ac.publishAttachmentCapability(stale)
+	ac.installTestAttachmentCapability(stale)
 	result := make(chan bool, 1)
 	go func() {
 	}
 }
+func TestBeginCurrentAttachmentEffectContextRejectsNilContext(t *testing.T) {
+	_, sess, ac, _ := newManualSessionWithPTYs(t, newQuietPTY())
+	token, effect, admitted := ac.beginCurrentAttachmentEffectContext(nil, sess, ac.transport())
+	require.False(t, admitted)
+	require.Nil(t, effect)
+	require.Equal(t, attachmentCapability{}, token)
+}
 func TestBeginAttachmentLeaseEffectRejectsForeignLease(t *testing.T) {
 	d, sess, ac, _ := newManualSessionWithPTYs(t, newQuietPTY())
 	rc := d.attachCoordinator(sess, nil, ac, true)
 }
 func attachmentEffectGatePublicationSnapshot(ac *attachedClient) (attachmentEffectPhase, attachmentCapability) {
-	ac.attachmentEffects.mu.Lock()
+	ac.lifecycle.mu.Lock()
-	defer ac.attachmentEffects.mu.Unlock()
+	defer ac.lifecycle.mu.Unlock()
-	return ac.attachmentEffects.phase, ac.attachmentEffects.capability
+	return ac.lifecycle.phase, ac.lifecycle.capability
 }
 func TestKillSessionAcquisitionTimeoutDoesNotPublishPartialInvalidation(t *testing.T) {
 	sess.mu.Unlock()
 	rc := d.attachCoordinator(sess, nil, first, true)
-	firstToken := sess.attachmentToken(first, firstTransport)
+	firstToken := sess.captureAttachmentCapability(first, firstTransport)
 	firstToken.lease = rc.attachmentLease(first)
-	first.publishAttachmentCapability(firstToken)
+	first.installTestAttachmentCapability(firstToken)
-	blockedToken := sess.attachmentToken(blocked, blockedTransport)
+	blockedToken := sess.captureAttachmentCapability(blocked, blockedTransport)
-	blocked.publishAttachmentCapability(blockedToken)
+	blocked.installTestAttachmentCapability(blockedToken)
-	laterToken := sess.attachmentToken(later, laterTransport)
+	laterToken := sess.captureAttachmentCapability(later, laterTransport)
-	later.publishAttachmentCapability(laterToken)
+	later.installTestAttachmentCapability(laterToken)
 	// Fix the canonical order so teardown acquires first, waits behind the gate
 	// owned by this test, and never reaches the still-stable later participant.
-	first.attachmentEffects.immutableOrder()
+	first.lifecycle.immutableOrder()
-	blocked.attachmentEffects.immutableOrder()
+	blocked.lifecycle.immutableOrder()
-	later.attachmentEffects.immutableOrder()
+	later.lifecycle.immutableOrder()
-	require.Less(t, first.attachmentEffects.order.Load(), blocked.attachmentEffects.order.Load())
+	require.Less(t, first.lifecycle.order.Load(), blocked.lifecycle.order.Load())
-	require.Less(t, blocked.attachmentEffects.order.Load(), later.attachmentEffects.order.Load())
+	require.Less(t, blocked.lifecycle.order.Load(), later.lifecycle.order.Load())
 	blockedOwner := freezeAttachmentEffectGates(blocked)
 	blockedOwnerHeld := true
 	require.Equal(t, attachmentEffectsStable, firstPhase)
 	require.Equal(t, attachmentEffectsFrozen, blockedPhase)
 	require.Equal(t, attachmentEffectsStable, laterPhase)
-	firstGeneration := first.connectionGeneration.Load()
+	firstGeneration := first.lifecycle.generationValue()
-	blockedGeneration := blocked.connectionGeneration.Load()
+	blockedGeneration := blocked.lifecycle.generationValue()
-	laterGeneration := later.connectionGeneration.Load()
+	laterGeneration := later.lifecycle.generationValue()
 	firstSnapshot := first.transportSnapshot()
 	blockedSnapshot := blocked.transportSnapshot()
 	laterSnapshot := later.transportSnapshot()
 	for _, ac := range []*attachedClient{first, blocked, later} {
 		require.Same(t, sess, ac.currentSession(), "partial gate acquisition cleared attachment ownership")
 	}
-	require.Equal(t, firstGeneration, first.connectionGeneration.Load())
+	require.Equal(t, firstGeneration, first.lifecycle.generationValue())
-	require.Equal(t, blockedGeneration, blocked.connectionGeneration.Load())
+	require.Equal(t, blockedGeneration, blocked.lifecycle.generationValue())
-	require.Equal(t, laterGeneration, later.connectionGeneration.Load())
+	require.Equal(t, laterGeneration, later.lifecycle.generationValue())
 	require.True(t, first.transportSnapshotCurrent(firstSnapshot))
 	require.True(t, blocked.transportSnapshotCurrent(blockedSnapshot))
 	require.True(t, later.transportSnapshotCurrent(laterSnapshot))
 	require.True(t, complete.acquired, "rolled-back gate set could not be acquired again")
 	require.True(t, complete.drained)
 	complete.unfreeze()
-	for _, token := range []attachmentConnectionToken{firstToken, blockedToken, laterToken} {
+	for _, token := range []attachmentCapability{firstToken, blockedToken, laterToken} {
 		ticket, admitted := token.ac.beginAttachmentEffect(token)
 		require.True(t, admitted, "pre-publication abort changed an attachment capability")
 		ticket.End()
 	snatchedTransport := newTeardownBlockingTransport()
 	snatched.replaceTransport(snatchedTransport)
 	d.attachCoordinator(sess, nil, snatched, true)
-	snatched.publishAttachmentCapability(sess.attachmentToken(snatched, snatchedTransport))
+	snatched.installTestAttachmentCapability(sess.captureAttachmentCapability(snatched, snatchedTransport))
 	activeTransport := newTeardownBlockingTransport()
 	active := &attachedClient{tr: activeTransport, output: newOutputStateStream(), size: snatched.size}
 	d.mu.Unlock()
 	d.attachCoordinator(unrelated, nil, unrelatedClient, true)
-	snatchedToken := sess.attachmentToken(snatched, snatchedTransport)
+	snatchedToken := sess.captureAttachmentCapability(snatched, snatchedTransport)
-	activeToken := sess.attachmentToken(active, activeTransport)
+	activeToken := sess.captureAttachmentCapability(active, activeTransport)
 	snatchedDone := startBlockedAttachmentSend(t, snatchedToken)
 	activeDone := startBlockedAttachmentSend(t, activeToken)
 	awaitTestCompletion(t, snatchedTransport.sendEntered, "snatched send did not block")
 	stale := newTeardownBlockingTransport()
 	ac.replaceTransport(stale)
 	d.attachCoordinator(sess, nil, ac, true)
-	ac.publishAttachmentCapability(sess.attachmentToken(ac, stale))
+	ac.installTestAttachmentCapability(sess.captureAttachmentCapability(ac, stale))
-	token := sess.attachmentToken(ac, stale)
+	token := sess.captureAttachmentCapability(ac, stale)
 	sendDone := startBlockedAttachmentSend(t, token)
 	awaitTestCompletion(t, stale.sendEntered, "captured incarnation send did not block")
 	fresh := &closeTrackingTransport{}
 	transport := &closeTrackingTransport{}
 	active.replaceTransport(transport)
 	d.attachCoordinator(sess, nil, active, true)
-	active.publishAttachmentCapability(sess.attachmentToken(active, transport))
+	active.installTestAttachmentCapability(sess.captureAttachmentCapability(active, transport))
 	owner := freezeAttachmentEffectGates(active)
 	require.True(t, owner.acquired)
 	blocked := newTeardownBlockingTransport()
 	active.replaceTransport(blocked)
 	d.attachCoordinator(sess, nil, active, true)
-	active.publishAttachmentCapability(sess.attachmentToken(active, blocked))
+	active.installTestAttachmentCapability(sess.captureAttachmentCapability(active, blocked))
-	token := sess.attachmentToken(active, blocked)
+	token := sess.captureAttachmentCapability(active, blocked)
 	sendDone := startBlockedAttachmentSend(t, token)
 	awaitTestCompletion(t, blocked.sendEntered, "active send did not block")
 	transport := &closeTrackingTransport{}
 	ac.replaceTransport(transport)
 	rc := d.attachCoordinator(sess, nil, ac, true)
-	token := sess.attachmentToken(ac, transport)
+	token := sess.captureAttachmentCapability(ac, transport)
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	clock := &signalClock{timers: make(chan *signalTimer, 1)}
 	d.clock = clock
 	old.replaceTransport(oldTransport)
 	rc := d.attachCoordinator(sess, nil, old, true)
 	lease := rc.attachmentLease(old)
-	token := sess.attachmentToken(old, oldTransport)
+	token := sess.captureAttachmentCapability(old, oldTransport)
 	token.lease = lease
-	old.publishAttachmentCapability(token)
+	old.installTestAttachmentCapability(token)
 	paintDone := make(chan struct{})
 	go func() {
 	oldTransport := newDatagramTestTransport()
 	old.replaceTransport(oldTransport)
 	rc := d.attachCoordinator(sess, nil, old, true)
-	token := sess.attachmentToken(old, oldTransport)
+	token := sess.captureAttachmentCapability(old, oldTransport)
 	token.lease = rc.attachmentLease(old)
-	old.publishAttachmentCapability(token)
+	old.installTestAttachmentCapability(token)
 	ticket, ok := old.beginAttachmentEffect(token)
 	require.True(t, ok)
 			old.replaceTransport(oldTransport)
 			old.keys = keys.NewRouter(d.clock, daemonKeyHandler{d: d, ac: old}, &d.bindings)
 			rc := d.attachCoordinator(sess, nil, old, true)
-			token := sess.attachmentToken(old, oldTransport)
+			token := sess.captureAttachmentCapability(old, oldTransport)
 			token.lease = rc.attachmentLease(old)
+			old.installTestAttachmentCapability(token)
 			if tt.setup != nil {
 				tt.setup(d, sess, old, pty)
 			}
 			admitted := make(chan struct{})
 			release := make(chan struct{})
-			d.afterAttachmentEffectAdmitted = func(attachmentConnectionToken) {
+			d.afterAttachmentEffectAdmitted = func(attachmentCapability) {
 				close(admitted)
 				<-release
 			}
 	transport := &closeTrackingTransport{}
 	ac.replaceTransport(transport)
 	rc := d.attachCoordinator(source, nil, ac, true)
-	token := source.attachmentToken(ac, transport)
+	token := source.captureAttachmentCapability(ac, transport)
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	activeRef := ports.RouteRef{Key: 8, Generation: 4}
 	activeTarget := testRouteTarget(source.name, 8)
 	transport := &closeTrackingTransport{}
 	ac.replaceTransport(transport)
 	rc := d.attachCoordinator(source, nil, ac, true)
-	token := source.attachmentToken(ac, transport)
+	token := source.captureAttachmentCapability(ac, transport)
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	payload, err := ports.MarshalCommandRequest(ports.CommandRequest{
 		Version: ports.ProtocolVersion, RequestID: 1, Slug: "back-session", Attached: true,
 	})
 	d.sessions[target.id] = target
 	rc := d.attachCoordinator(source, nil, ac, true)
-	token := source.attachmentToken(ac, ac.transport())
+	token := source.captureAttachmentCapability(ac, ac.transport())
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	d.handleAttachmentClientFrame(token, frameInput([]byte("\x1ba")))
 	oldTransport := old.transport()
 	rc := d.attachCoordinator(sess, nil, old, true)
-	token := sess.attachmentToken(old, oldTransport)
+	token := sess.captureAttachmentCapability(old, oldTransport)
 	token.lease = rc.attachmentLease(old)
-	old.publishAttachmentCapability(token)
+	old.installTestAttachmentCapability(token)
 	admissionEnded := make(chan struct{})
 	releaseAction := make(chan struct{})
 	d, sess, ac, _ := newManualSessionWithPTYs(t, p)
 	d.enterPicker(sess, ac)
 	rc := d.attachCoordinator(sess, nil, ac, true)
-	token := sess.attachmentToken(ac, ac.transport())
+	token := sess.captureAttachmentCapability(ac, ac.transport())
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	d.handleAttachmentClientFrame(token, frameInput([]byte("x")))
 	oldTransport := newDatagramTestTransport()
 	old.replaceTransport(oldTransport)
 	rc := d.attachCoordinator(sess, nil, old, true)
-	token := sess.attachmentToken(old, oldTransport)
+	token := sess.captureAttachmentCapability(old, oldTransport)
 	token.lease = rc.attachmentLease(old)
+	old.installTestAttachmentCapability(token)
 	admitted := make(chan struct{})
 	release := make(chan struct{})
-	d.afterAttachmentEffectAdmitted = func(attachmentConnectionToken) {
+	d.afterAttachmentEffectAdmitted = func(attachmentCapability) {
 		close(admitted)
 		<-release
 	}
 	aTransport := newDatagramTestTransport()
 	a.replaceTransport(aTransport)
 	d.attachCoordinator(first, nil, a, true)
-	first.attachmentToken(a, aTransport)
+	first.captureAttachmentCapability(a, aTransport)
 	bTransport := newDatagramTestTransport()
 	b := &attachedClient{tr: bTransport, output: newOutputStateStream(), size: a.size}
 	d.sessions[second.id] = second
 	d.mu.Unlock()
 	d.attachCoordinator(second, nil, b, true)
-	second.attachmentToken(b, bTransport)
+	second.captureAttachmentCapability(b, bTransport)
 	start := make(chan struct{})
 	results := make(chan error, 2)
 	transport := newDatagramTestTransport()
 	ac.replaceTransport(transport)
 	rc := d.attachCoordinator(sess, nil, ac, true)
-	token := sess.attachmentToken(ac, transport)
+	token := sess.captureAttachmentCapability(ac, transport)
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	frozen := freezeAttachmentEffectGates(ac)
 	require.True(t, frozen.acquired)

A internal/usecase/daemon/attachment_lifecycle_test.go +117 -0

@@ -0,0 +1,117 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/stretchr/testify/require"
	7	+	)
	8	+
	9	+	func (ac *attachedClient) installTestAttachmentCapability(capability attachmentCapability) {
	10	+	ac.lifecycle.mu.Lock()
	11	+	defer ac.lifecycle.mu.Unlock()
	12	+	ac.lifecycle.initLocked()
	13	+	if ac.lifecycle.phase != attachmentEffectsStable \|\| ac.lifecycle.inFlight != 0 {
	14	+	panic("daemon: installing an active test attachment capability")
	15	+	}
	16	+	ac.lifecycle.capability = capability
	17	+	ac.lifecycle.failedTransport = transportSnapshot{}
	18	+	}
	19	+
	20	+	func (s session) detachIfCurrent(ac attachedClient) bool {
	21	+	s.mu.Lock()
	22	+	defer s.mu.Unlock()
	23	+	if !attachmentRegisteredLocked(s, ac) \|\| ac.currentAttachmentSession() != s {
	24	+	return false
	25	+	}
	26	+	s.unregisterAttachmentLocked(ac)
	27	+	ac.setSession(nil)
	28	+	ac.invalidateRetiredAttachmentCapability()
	29	+	return true
	30	+	}
	31	+
	32	+	func TestAttachmentCapabilityRejectsIndependentIdentityChanges(t *testing.T) {
	33	+	tests := []struct {
	34	+	name string
	35	+	change func(session, attachedClient, *renderCoordinator)
	36	+	}{
	37	+	{
	38	+	name: "session membership removal",
	39	+	change: func(sess session, ac attachedClient, _ *renderCoordinator) {
	40	+	sess.mu.Lock()
	41	+	delete(sess.attachments, ac)
	42	+	sess.mu.Unlock()
	43	+	},
	44	+	},
	45	+	{
	46	+	name: "attachment session replacement",
	47	+	change: func(_ session, ac attachedClient, _ *renderCoordinator) {
	48	+	ac.setSession(&session{})
	49	+	},
	50	+	},
	51	+	{
	52	+	name: "connection generation increment",
	53	+	change: func(_ session, ac attachedClient, _ *renderCoordinator) {
	54	+	ac.lifecycle.generation.Add(1)
	55	+	},
	56	+	},
	57	+	{
	58	+	name: "transport replacement",
	59	+	change: func(_ session, ac attachedClient, _ *renderCoordinator) {
	60	+	ac.replaceTransport(&closeTrackingTransport{})
	61	+	},
	62	+	},
	63	+	{
	64	+	name: "transport incarnation increment",
	65	+	change: func(_ session, ac attachedClient, _ *renderCoordinator) {
	66	+	ac.replaceTransport(ac.transport())
	67	+	},
	68	+	},
	69	+	{
	70	+	name: "render lease rebind",
	71	+	change: func(_ session, ac attachedClient, rc *renderCoordinator) {
	72	+	rc.mu.Lock()
	73	+	rc.rebindAttachmentWithReadinessLocked(ac, true)
	74	+	rc.mu.Unlock()
	75	+	},
	76	+	},
	77	+	}
	78	+
	79	+	for _, tt := range tests {
	80	+	t.Run(tt.name, func(t *testing.T) {
	81	+	d, sess, ac, _ := newManualSessionWithPTYs(t, newQuietPTY())
	82	+	transport := &closeTrackingTransport{}
	83	+	ac.replaceTransport(transport)
	84	+	rc := d.attachCoordinator(sess, nil, ac, true)
	85	+	capability := sess.captureAttachmentCapability(ac, transport)
	86	+	capability.lease = rc.attachmentLease(ac)
	87	+	ac.installTestAttachmentCapability(capability)
	88	+
	89	+	require.True(t, capability.current())
	90	+	tt.change(sess, ac, rc)
	91	+	require.False(t, capability.current())
	92	+	effect, admitted := ac.beginAttachmentEffect(capability)
	93	+	require.False(t, admitted)
	94	+	require.Nil(t, effect)
	95	+	})
	96	+	}
	97	+	}
	98	+
	99	+	func TestAttachmentCapabilityInvalidationRejectsNewEffects(t *testing.T) {
	100	+	d, sess, ac, _ := newManualSessionWithPTYs(t, newQuietPTY())
	101	+	transport := &closeTrackingTransport{}
	102	+	ac.replaceTransport(transport)
	103	+	rc := d.attachCoordinator(sess, nil, ac, true)
	104	+	capability := sess.captureAttachmentCapability(ac, transport)
	105	+	capability.lease = rc.attachmentLease(ac)
	106	+	ac.installTestAttachmentCapability(capability)
	107	+
	108	+	frozen := freezeAttachmentEffectGates(ac)
	109	+	require.True(t, frozen.acquired)
	110	+	require.True(t, frozen.drained)
	111	+	ac.invalidateFrozenAttachmentCapability()
	112	+	frozen.unfreeze()
	113	+
	114	+	require.False(t, capability.current())
	115	+	_, admitted := ac.beginAttachmentEffect(capability)
	116	+	require.False(t, admitted)
	117	+	}

M internal/usecase/daemon/attachment_output.go +2 -2


@@ -357,7 +357,7 @@ func (s *attachmentOutput) fenceLocked() (uint64, uint64, uint64) {
357		}	357		}
358		generation, revision := uint64(0), uint64(0)	358		generation, revision := uint64(0), uint64(0)
359		if s.attachment != nil {	359		if s.attachment != nil {
360	-	generation = s.attachment.connectionGeneration.Load()	360	+	generation = s.attachment.lifecycle.generationValue()
361		revision = s.attachment.view.revision	361		revision = s.attachment.view.revision
362		}	362		}
363		return generation, s.currentEpochLocked(), revision	363		return generation, s.currentEpochLocked(), revision

@@ -375,7 +375,7 @@ func (s *attachmentOutput) preparedCurrentLocked(generation, epoch, viewRevision
375			375
376		func (p *preparedOutput) currentLocked() bool {	376		func (p *preparedOutput) currentLocked() bool {
377		return p != nil && p.stream != nil && p.stream.preparedCurrentLocked(p.generation, p.epoch, p.viewRevision, p.base) &&	377		return p != nil && p.stream != nil && p.stream.preparedCurrentLocked(p.generation, p.epoch, p.viewRevision, p.base) &&
378	-	(p.stream.attachment == nil \|\| p.stream.attachment.connectionGeneration.Load() == p.connectionGeneration)	378	+	(p.stream.attachment == nil \|\| p.stream.attachment.lifecycle.generationValue() == p.connectionGeneration)
379		}	379		}
380			380
381		func marshalOutputState(data []byte, epoch, base, next, echoAck, viewRevision uint64, size domain.Size, full bool) (ports.Frame, error) {	381		func marshalOutputState(data []byte, epoch, base, next, echoAck, viewRevision uint64, size domain.Size, full bool) (ports.Frame, error) {

M internal/usecase/daemon/attachment_output_test.go +1 -1


@@ -188,7 +188,7 @@ func TestPreparedOutputDropsReplacedConnectionAndView(t *testing.T) {
188		name string	188		name string
189		change func(*attachedClient)	189		change func(*attachedClient)
190		}{	190		}{
191	-	{name: "connection generation", change: func(ac *attachedClient) { ac.connectionGeneration.Add(1) }},	191	+	{name: "connection generation", change: func(ac *attachedClient) { ac.lifecycle.generation.Add(1) }},
192		{name: "view revision", change: func(ac *attachedClient) {	192		{name: "view revision", change: func(ac *attachedClient) {
193		ac.viewMu.Lock()	193		ac.viewMu.Lock()
194		ac.view.revision++	194		ac.view.revision++

M internal/usecase/daemon/attachment_parking_test.go +2 -2


@@ -103,7 +103,7 @@ func TestResumeRotatesCredentialAndRejectsStaleTransport(t *testing.T) {
103		sess, ac, err := d.route(helloResumeCapable(ports.IntentNew, "work", 0), oldTransport)	103		sess, ac, err := d.route(helloResumeCapable(ports.IntentNew, "work", 0), oldTransport)
104		require.NoError(t, err)	104		require.NoError(t, err)
105		oldToken := ac.resumeToken	105		oldToken := ac.resumeToken
106	-	oldGeneration := ac.connectionGeneration.Load()	106	+	oldGeneration := ac.lifecycle.generationValue()
107		d.clientGone(sess, ac, oldTransport, false)	107		d.clientGone(sess, ac, oldTransport, false)
108			108
109		newTransport := &closeTrackingTransport{}	109		newTransport := &closeTrackingTransport{}

@@ -113,7 +113,7 @@ func TestResumeRotatesCredentialAndRejectsStaleTransport(t *testing.T) {
113		require.Same(t, sess, resumed)	113		require.Same(t, sess, resumed)
114		require.Same(t, ac, same)	114		require.Same(t, ac, same)
115		require.NotEqual(t, oldToken, ac.resumeToken)	115		require.NotEqual(t, oldToken, ac.resumeToken)
116	-	require.Greater(t, ac.connectionGeneration.Load(), oldGeneration)	116	+	require.Greater(t, ac.lifecycle.generationValue(), oldGeneration)
117		require.True(t, d.commitResumeClaim(ac))	117		require.True(t, d.commitResumeClaim(ac))
118		d.mu.Lock()	118		d.mu.Lock()
119		_, oldRetained := d.parked[oldToken]	119		_, oldRetained := d.parked[oldToken]

M internal/usecase/daemon/attachment_render_test.go +7 -7

 	rc := sess.renderCoordinator()
 	lease := rc.attachmentLease(second)
 	require.True(t, rc.markAttachmentReady(lease))
-	token := sess.attachmentToken(second, secondTransport)
+	token := sess.captureAttachmentCapability(second, secondTransport)
 	token.lease = lease
-	ticket, admitted := second.beginAttachmentEffect(token)
+	second.installTestAttachmentCapability(token)
+	effect, admitted := second.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = ticket
+	require.True(t, d.resizeAttachmentForLease(effect, domain.Size{Cols: 120, Rows: 50}))
-	require.True(t, d.resizeAttachmentForLease(token, domain.Size{Cols: 120, Rows: 50}))
+	effect.End()
-	ticket.End()
 	tb.mu.Lock()
 	require.Equal(t, domain.Size{Cols: 120, Rows: 48}, tb.size)
 	awaitTestCompletion(t, oldTransport.entered, "slow attachment did not begin its blocked output")
 	require.True(t, rc.markAttachmentReady(freshLease))
-	token := sess.attachmentToken(fresh, newTransport)
+	token := sess.captureAttachmentCapability(fresh, newTransport)
 	token.lease = freshLease
 	painted := make(chan bool, 1)
 	go func() { painted <- d.firstPaintForTransition(token) }()
 	require.True(t, rc.markAttachmentReady(firstLease))
 	require.True(t, rc.markAttachmentReady(secondLease))
 	resize := func(ac *attachedClient, tr ports.Transport, size domain.Size) {
-		token := sess.attachmentToken(ac, tr)
+		token := sess.captureAttachmentCapability(ac, tr)
 		d.handleAttachmentClientFrame(token, ports.Frame{
 			Type:    ports.MsgResize,
 			Payload: mustMarshalResize(ports.Resize{Size: size}),

M internal/usecase/daemon/attachment_route_identity_test.go +4 -4


@@ -25,9 +25,9 @@ func TestAttachmentTransitionPublishesCommittedRouteIdentity(t *testing.T) {
25		transport := &closeTrackingTransport{}	25		transport := &closeTrackingTransport{}
26		ac.replaceTransport(transport)	26		ac.replaceTransport(transport)
27		rc := d.attachCoordinator(source, nil, ac, true)	27		rc := d.attachCoordinator(source, nil, ac, true)
28	-	token := source.attachmentToken(ac, transport)	28	+	token := source.captureAttachmentCapability(ac, transport)
29		token.lease = rc.attachmentLease(ac)	29		token.lease = rc.attachmentLease(ac)
30	-	ac.publishAttachmentCapability(token)	30	+	ac.installTestAttachmentCapability(token)
31		ac.setRouteSnapshot(ports.RecentRouteSnapshot{Generation: 1})	31		ac.setRouteSnapshot(ports.RecentRouteSnapshot{Generation: 1})
32			32
33		target := &session{	33		target := &session{

@@ -75,9 +75,9 @@ func TestAttachmentTransitionTearsDownAfterCommittedIdentitySendFailure(t *testi
75		transport := &committedIdentityErrorTransport{}	75		transport := &committedIdentityErrorTransport{}
76		ac.replaceTransport(transport)	76		ac.replaceTransport(transport)
77		rc := d.attachCoordinator(source, nil, ac, true)	77		rc := d.attachCoordinator(source, nil, ac, true)
78	-	token := source.attachmentToken(ac, transport)	78	+	token := source.captureAttachmentCapability(ac, transport)
79		token.lease = rc.attachmentLease(ac)	79		token.lease = rc.attachmentLease(ac)
80	-	ac.publishAttachmentCapability(token)	80	+	ac.installTestAttachmentCapability(token)
81		ac.setRouteSnapshot(ports.RecentRouteSnapshot{Generation: 1})	81		ac.setRouteSnapshot(ports.RecentRouteSnapshot{Generation: 1})
82			82
83		target := &session{	83		target := &session{

M internal/usecase/daemon/attachment_transition.go +12 -36

 	target                *session
 	next                  *attachedClient
 	expectedTransport     transportSnapshot
-	sourceToken           *attachmentConnectionToken
+	sourceCapability      *attachmentCapability
+	sourceEffect          *attachmentEffect
 	action                string
 	activateTargetTab     bool
 	targetTabIndex        int
 	copySourceEnvironment bool
-	// preserveAttachment commits attachment-local navigation state without
+	// preserveAttachment commits Attachment-local navigation state without
-	// changing session membership. The initiating connection token remains the
+	// changing Session membership. The initiating capability remains the exact
-	// exact authority for this mutation.
+	// authority for this mutation.
 	preserveAttachment bool
 	expectedSourceTab  *tab
 	// transferExpectedSourceTab permits an installed visible floating pane only
 	attachmentEffectsFrozen   bool
 }
-func transitionSourceTokenMatchesRequest(token attachmentConnectionToken, source *session, req attachmentTransitionRequest) bool {
-	return source != nil && token.sess != nil && token.sess == source && token.ac == req.next &&
-		token.generation == req.next.connectionGeneration.Load() &&
-		token.transport.transport == req.expectedTransport.transport &&
-		token.transport.incarnation == req.expectedTransport.incarnation
-}
-// transitionSourceTokenCurrentLocked requires source.core().mu and, when a
-// lease exists, sourceCoordinator.mu. It is the canonical exact-connection
-// handoff check for client-originated navigation and lifecycle mutations.
-func transitionSourceTokenCurrentLocked(token attachmentConnectionToken, source *session, sourceCoordinator *renderCoordinator, req attachmentTransitionRequest) bool {
-	if token.sess != source || token.ac != req.next ||
-		token.generation != req.next.connectionGeneration.Load() ||
-		token.sess == nil || token.ac.currentAttachmentSession() != source ||
-		!attachmentRegisteredLocked(source, req.next) ||
-		!req.next.transportSnapshotCurrent(token.transport) {
-		return false
-	}
-	if token.lease == nil {
-		return true
-	}
-	return sourceCoordinator != nil && token.lease.attachment == req.next &&
-		sourceCoordinator.leaseCurrentLocked(token.lease, true)
-}
 type attachmentTransitionResult struct {
-	published             attachmentConnectionToken
+	published             attachmentCapability
 	cleanups              []renderLifecycleCleanup
 	sourceGeometrySession *session
 }
 		d.sessions[sourceCore.id] != source || req.target != nil && d.sessions[targetCore.id] != req.target {
 		return attachmentTransitionRequest{}, attachmentTransitionParticipants{}, errAttachmentTransition
 	}
-	if req.sourceToken != nil && !transitionSourceTokenMatchesRequest(*req.sourceToken, source, req) {
+	if req.sourceCapability != nil && !req.sourceCapability.matchesConnectionSnapshot(source, req.next, req.expectedTransport) {
 		return attachmentTransitionRequest{}, attachmentTransitionParticipants{}, errAttachmentTransition
 	}
 	req.preflighted = true
 // freezeAttachmentTransition drains the snapshotted connection without any
 // architecture lock held. The returned guard remains frozen through publication.
-func (d *Daemon) freezeAttachmentTransition(req attachmentTransitionRequest, participants attachmentTransitionParticipants) (frozenAttachmentEffectGates, error) {
+func (d *Daemon) freezeAttachmentTransition(req attachmentTransitionRequest, participants attachmentTransitionParticipants) (attachmentTransitionGuard, error) {
 	if d.afterAttachmentEffectParticipantsSnapshotted != nil {
 		d.afterAttachmentEffectParticipantsSnapshotted(req.action, participants.clients)
 	}
 }
 // publishAttachmentTransition revalidates the frozen source, creates an
-// optional target, and performs exact membership publication under d.mu.
+// optional target, and performs exact capability publication under d.mu.
 func (d *Daemon) publishAttachmentTransition(req attachmentTransitionRequest) (attachmentTransitionResult, error) {
 	d.mu.Lock()
 	defer d.mu.Unlock()
 	if err != nil {
 		return attachmentTransitionResult{}, err
 	}
-	if req.sourceToken != nil {
+	if req.sourceEffect != nil {
-		d.endActionAttachmentEffect(req.sourceToken.effect, req.action)
+		d.endActionAttachmentEffect(req.sourceEffect, req.action)
 	}
 	frozen, err := d.freezeAttachmentTransition(req, participants)
 	if req.ready && result.published.ac != nil && result.published.ac.routeSnapshotCopy().Generation != 0 {
 		identityErr := errAttachmentTransition
 		if effect, admitted := result.published.ac.beginAttachmentEffect(result.published); admitted {
-			identityErr = d.sendCommittedRouteIdentityForAttachment(effect.connectionToken())
+			identityErr = d.sendCommittedRouteIdentityForAttachment(effect)
 			effect.End()
 		}
 		if identityErr != nil {

M internal/usecase/daemon/attachment_transition_prelocked_test.go +2 -2


@@ -55,7 +55,7 @@ func TestValidateAttachmentTransitionPrelockedLeavesMembershipUntouchedOnFailure
55		require.Equal(t, false, target.attachmentRegistered(next))	55		require.Equal(t, false, target.attachmentRegistered(next))
56		require.Equal(t, true, target.attachmentRegistered(old))	56		require.Equal(t, true, target.attachmentRegistered(old))
57		require.Same(t, source, next.currentSession())	57		require.Same(t, source, next.currentSession())
58	-	require.Equal(t, uint64(0), next.connectionGeneration.Load())	58	+	require.Equal(t, uint64(0), next.lifecycle.generationValue())
59	-	require.Equal(t, uint64(0), old.connectionGeneration.Load())	59	+	require.Equal(t, uint64(0), old.lifecycle.generationValue())
60		require.Equal(t, 0, testAttachmentTabIndex(target))	60		require.Equal(t, 0, testAttachmentTabIndex(target))
61		}	61		}

M internal/usecase/daemon/attachment_transition_publish.go +12 -16

 // effect gate is frozen and d.mu is held. No target is created before this
 // succeeds.
 func (d *Daemon) transitionSourcePreflightLocked(req attachmentTransitionRequest) bool {
-	if req.sourceToken == nil || req.source == nil || req.source.core() == nil || d.sessions[req.source.core().id] != req.source {
+	if req.sourceCapability == nil || req.source == nil || req.source.core() == nil || d.sessions[req.source.core().id] != req.source {
 		return false
 	}
 	d.notices.routingMu.Lock()
 		coordinator.mu.Lock()
 		defer coordinator.mu.Unlock()
 	}
-	if !transitionSourceTokenCurrentLocked(*req.sourceToken, req.source, coordinator, req) {
+	if !req.sourceCapability.currentInSessionAndLeaseLocked(req.source, req.next, coordinator) {
 		return false
 	}
 	return transitionSourceTabCurrentLocked(req.source, req.expectedSourceTab)
 }
-func (d *Daemon) sourceAttachmentTokenCurrentFrozen(token attachmentConnectionToken) bool {
+func (d *Daemon) sourceAttachmentCapabilityCurrentFrozen(token attachmentCapability) bool {
 	if token.sess == nil || token.ac == nil {
 		return false
 	}
 		coordinator.mu.Lock()
 		defer coordinator.mu.Unlock()
 	}
-	req := attachmentTransitionRequest{source: token.sess, next: token.ac, expectedTransport: token.transport}
+	return token.currentInSessionAndLeaseLocked(token.sess, token.ac, coordinator)
-	return transitionSourceTokenCurrentLocked(token, token.sess, coordinator, req)
 }
 func transitionSourceTabCurrentLocked(source *session, expected *tab) bool {
 	targetCoordinator   *renderCoordinator
 	sourceCoordinator   *renderCoordinator
 	releaseCoordinators func()
-	nextGeneration      uint64
 }
 func (p *attachmentPublication) unlockCoordinators() {
 	if sourceCore == nil || targetCore == nil || !req.preflighted || !req.attachmentEffectsFrozen ||
 		req.next == nil || d.closing || d.sessions[sourceCore.id] != source || d.sessions[targetCore.id] != req.target ||
 		req.expectedTransport.transport == nil || !req.next.transportSnapshotCurrent(req.expectedTransport) ||
-		req.preserveAttachment && req.sourceToken == nil {
+		req.preserveAttachment && req.sourceCapability == nil {
 		return nil, errAttachmentTransition
 	}
 	sourceCoordinator := sourceCore.coordinator.Load()
 	targetCoordinator := d.ensureAttachmentRenderCoordinatorPrelocked(req.target)
-	// transitionSourceTokenCurrentLocked also reads the source lease. Hold the
+	// Capability validation also reads the source lease. Hold the
 	// source coordinator lock before calling it, following session -> coordinator
 	// ordering and preventing a lease rebind from racing validation.
 	releaseCoordinators := lockAttachmentCoordinators(source, sourceCoordinator, req.target, targetCoordinator)
 	if d.afterAttachmentTransitionCoordinatorsLocked != nil {
 		d.afterAttachmentTransitionCoordinatorsLocked()
 	}
-	if req.sourceToken != nil && !transitionSourceTokenCurrentLocked(*req.sourceToken, source, sourceCoordinator, req) {
+	if req.sourceCapability != nil && !req.sourceCapability.currentInSessionAndLeaseLocked(source, req.next, sourceCoordinator) {
 		releaseCoordinators()
 		return nil, errAttachmentTransition
 	}
 	}
 	if !attachmentLifecycleCurrentLocked(req.target, req.expectedTargetLifecycle) ||
 		req.activateTargetTab && !req.target.validTargetTabLocked(req.targetTabIndex) ||
-		req.sourceToken != nil && !transitionSourceTabCurrentForRequestLocked(source, req.expectedSourceTab, req.transferExpectedSourceTab) {
+		req.sourceCapability != nil && !transitionSourceTabCurrentForRequestLocked(source, req.expectedSourceTab, req.transferExpectedSourceTab) {
 		releaseCoordinators()
 		return nil, errAttachmentTransition
 	}
 		// attachment claim with the replacement transport's current size.
 		req.target.claimGeometryOwnerLocked(req.next, req.next.geometrySnapshot())
 	}
-	publication.nextGeneration = req.next.connectionGeneration.Add(1)
 	req.next.setSession(req.target)
 }
 			lease = publication.targetCoordinator.attachWithReadinessLocked(req.next, req.ready)
 		}
 	}
-	result.published = attachmentConnectionToken{
+	result.published = attachmentCapability{
 		sess: req.target, ac: req.next,
-		generation: publication.nextGeneration,
+		transport: req.expectedTransport, lease: lease,
-		transport:  req.expectedTransport, lease: lease,
 		rebase: publication.source != req.target,
 	}
 	if req.attachmentEffectsFrozen {
-		req.next.publishFrozenAttachmentCapability(result.published)
+		result.published = req.next.publishFrozenAttachmentCapability(result.published)
 	}
 	return result
 }
 func (d *Daemon) publishAttachmentTransitionPrelocked(publication *attachmentPublication) attachmentTransitionResult {
 	if publication.req.preserveAttachment {
 		d.applyTargetStateLocked(publication)
-		return attachmentTransitionResult{published: *publication.req.sourceToken}
+		return attachmentTransitionResult{published: *publication.req.sourceCapability}
 	}
 	publishAttachmentOwnershipLocked(publication)
 	d.applyTargetStateLocked(publication)

M internal/usecase/daemon/attention.go +9 -5

 // happened — it also covers "no target exists", which is routine and not an
 // error. Only a failure to reach a target that does exist is a genuine error.
 func (d *Daemon) jumpAttention(sess *session, ac *attachedClient) error {
-	return d.jumpAttentionForAttachment(sess, ac, attachmentConnectionToken{})
+	return d.jumpAttentionForAttachment(sess, ac, nil)
 }
-func (d *Daemon) jumpAttentionForAttachment(sess *session, ac *attachedClient, token attachmentConnectionToken) error {
+func (d *Daemon) jumpAttentionForAttachment(sess *session, ac *attachedClient, effect *attachmentEffect) error {
 	if sess == nil || ac == nil {
 		return nil
 	}
 	if idx, ok := oldestAttentionTab(sess); ok {
 		if sess.switchAttachmentTab(ac, idx) {
-			d.activateTabAfterResizeForLease(sess, sess.tabForAttachment(ac), false, ac, token.lease)
+			var lease *attachmentLease
+			if effect != nil {
+				lease = effect.lease
+			}
+			d.activateTabAfterResizeForLease(sess, sess.tabForAttachment(ac), false, ac, lease)
 			d.invalidateRender(sess, ac, true, "attention.go")
 		}
 		return nil
 		return nil
 	}
 	pickerTarget := picker.Target{Session: target.sessionID, TabIndex: target.tabIndex}
-	if token.ac == nil {
+	if effect == nil {
 		return d.switchToTarget(sess, ac, pickerTarget)
 	}
-	return d.switchActiveTargetForAttachment(token, pickerTarget)
+	return d.switchActiveTargetForAttachment(effect, pickerTarget)
 }
 func oldestAttentionTab(sess *session) (int, bool) {

M internal/usecase/daemon/client.go +58 -57

 	terminalCapabilities   ports.TerminalCapabilities
 	navigationCapabilities ports.NavigationCapabilities
 	startupOverlay         ports.StartupOverlay
-	// connectionGeneration is the wire-facing capability generation. attachmentEffects is
+	// lifecycle is the sole authority for attachment capability publication,
-	// the linearization gate for every attachment-bound observable operation. A role
+	// effect admission, transition freeze/drain, and connection generation.
-	// transition freezes and drains this gate before changing either generation
+	lifecycle     attachmentLifecycle
-	// or the session/coordinator registries.
+	resumeCapable bool
-	connectionGeneration atomic.Uint64
+	resumeToken   uint64
-	attachmentEffects    attachmentEffectGate
-	resumeCapable        bool
-	resumeToken          uint64
 	// resumeClaimToken is non-zero only between a parked resume claim and its
 	// successful Welcome. It lets a failed pre-claim handshake restore the old
 	// credential instead of consuming it.
 	// routeSessionPurge distinguishes a brand-new session from a restored
 	// stopped session when failed-handshake cleanup removes the live instance.
 	routeSessionPurge bool
-	// beforeAttachmentTokenValidation is a deterministic lifecycle-race seam
+	// beforeAttachmentCapabilityValidation is a deterministic lifecycle-race Seam
 	// used only by package tests.
-	beforeAttachmentTokenValidation func()
+	beforeAttachmentCapabilityValidation func()
 }
 type cursorOut struct {
 // attachment's current transport incarnation and admits ticket's interruptible
 // transport send. The caller must already hold ac.sendMu and, on success, owns
 // both the send and its matching ticket.endTransportSend.
-func (ac *attachedClient) beginExpectedTransportSendLocked(expected transportSnapshot, ticket *attachmentEffectTicket) error {
+func (ac *attachedClient) beginExpectedTransportSendLocked(expected transportSnapshot, ticket *attachmentEffect) error {
 	if expected.transport == nil || !ac.transportSnapshotCurrent(expected) {
 		return errTransportReplaced
 	}
 	return nil
 }
-func (ac *attachedClient) sendExpectedTransportForAttachment(expected transportSnapshot, f ports.Frame, ticket *attachmentEffectTicket) error {
+func (ac *attachedClient) sendExpectedTransportForAttachment(expected transportSnapshot, f ports.Frame, ticket *attachmentEffect) error {
 	ac.sendMu.Lock()
 	defer ac.sendMu.Unlock()
 	// A attachment-bound send requires a live ticket, and reports every rejection,
 // firstPaintForTransition is the only active post-transition paint entry
 // point. It rejects a stale attachment capability before rebasing output and carries
 // the exact coordinator lease through every resize and render effect.
-func (d *Daemon) firstPaintForTransition(token attachmentConnectionToken) bool {
+func (d *Daemon) firstPaintForTransition(capability attachmentCapability) bool {
-	if !token.attachmentCurrent() {
+	if !capability.current() {
 		return false
 	}
-	ticket, admitted := token.ac.beginAttachmentEffect(token)
+	effect, admitted := capability.ac.beginAttachmentEffect(capability)
 	if !admitted {
 		return false
 	}
-	token.effect = ticket
+	defer effect.End()
-	defer token.endAttachmentEffect()
 	if d.afterAttachmentEffectAdmitted != nil {
-		d.afterAttachmentEffectAdmitted(token)
+		d.afterAttachmentEffectAdmitted(effect.capability())
 	}
-	if token.rebase {
+	if effect.rebase {
 		if d.beforeFirstPaintSendWait != nil {
-			d.beforeFirstPaintSendWait(token)
+			d.beforeFirstPaintSendWait(effect.capability())
 		}
-		token.ac.sendMu.Lock()
+		effect.ac.sendMu.Lock()
-		if token.ac.renderStages.handoffRebase != nil {
+		if effect.ac.renderStages.handoffRebase != nil {
-			token.ac.renderStages.handoffRebase()
+			effect.ac.renderStages.handoffRebase()
 		}
-		token.ac.rebaseOutput()
+		effect.ac.rebaseOutput()
 		// Captures belong to the old session even when pane-local IDs happen
 		// to be reused by the destination.
-		token.ac.captureFrames = nil
+		effect.ac.captureFrames = nil
-		token.ac.sendMu.Unlock()
+		effect.ac.sendMu.Unlock()
 	}
-	if token.sess == nil {
+	if effect.sess == nil {
 		return false
 	}
-	d.firstPaintWithLease(token.sess, token.ac, token.lease, true)
+	d.firstPaintWithLease(effect.sess, effect.ac, effect.lease, true)
 	return true
 }
 	d.invalidateRender(sess, ac, true, "client.go")
 }
-func (d *Daemon) applyThemeForAttachment(token attachmentConnectionToken, msg ports.Theme) {
+func (d *Daemon) applyThemeForAttachment(effect *attachmentEffect, msg ports.Theme) {
-	if !token.attachmentEffectCurrent() {
+	if !effect.current() {
 		return
 	}
 	clientTheme := themeFromMessage(msg)
-	token.ac.setClientTheme(clientTheme)
+	effect.ac.setClientTheme(clientTheme)
-	sess := token.sess
+	sess := effect.sess
-	if sess == nil || !token.attachmentEffectCurrent() || !d.applyHostTheme(sess, token.ac, clientTheme, false) {
+	if sess == nil || !effect.current() || !d.applyHostTheme(sess, effect.ac, clientTheme, false) {
 		return
 	}
-	if !token.attachmentEffectCurrent() {
+	if !effect.current() {
 		return
 	}
 	rc := sess.renderCoordinator()
-	if token.lease == nil || rc == nil {
+	if effect.lease == nil || rc == nil {
-		d.invalidateRender(sess, token.ac, true, "client.go")
+		d.invalidateRender(sess, effect.ac, true, "client.go")
 		return
 	}
-	rc.invalidateForLease(token.ac, token.lease, renderInvalidation{class: invalidateUrgent, reset: true, producer: "client.go"})
+	rc.invalidateForLease(effect.ac, effect.lease, renderInvalidation{class: invalidateUrgent, reset: true, producer: "client.go"})
 }
 func (d *Daemon) resize(sess *session, ac *attachedClient, sz domain.Size) {
 // attachment the latest shared tab/PTY geometry claimant. Callers hold the
 // attachment effect admission; output state is rebased before any redraw so
 // every subsequent frame starts a new epoch.
-func (d *Daemon) resizeAttachmentForLease(token attachmentConnectionToken, size domain.Size) bool {
+func (d *Daemon) resizeAttachmentForLease(effect *attachmentEffect, size domain.Size) bool {
 	geometry := domain.Geometry{Size: size}
-	if token.ac != nil {
+	if effect != nil && effect.ac != nil {
 		// Direct size-only callers do not have a fresh pixel pair. Preserve the
 		// attachment's last complete pair instead of downgrading its claim to
 		// cell-only geometry.
-		geometry = token.ac.geometrySnapshot()
+		geometry = effect.ac.geometrySnapshot()
 		geometry.Size = size
 	}
-	return d.resizeAttachmentGeometryForLease(token, geometry)
+	return d.resizeAttachmentGeometryForLease(effect, geometry)
 }
-func (d *Daemon) resizeAttachmentGeometryForLease(token attachmentConnectionToken, geometry domain.Geometry) bool {
+func (d *Daemon) resizeAttachmentGeometryForLease(effect *attachmentEffect, geometry domain.Geometry) bool {
 	geometry = geometry.NormalizePixels()
-	if token.ac == nil || !geometry.Valid() || !token.attachmentEffectCurrent() {
+	if !effect.current() || effect.ac == nil || !geometry.Valid() {
 		return false
 	}
-	ac := token.ac
+	ac := effect.ac
 	ac.sendMu.Lock()
-	if !token.attachmentEffectCurrent() || !ac.transportSnapshotCurrent(token.transport) {
+	if !effect.current() || !ac.transportSnapshotCurrent(effect.transport) {
 		ac.sendMu.Unlock()
 		return false
 	}
 		d.registerPreviewForSelection(ac)
 	}
-	sess := token.sess
+	sess := effect.sess
 	if sess == nil {
 		return false
 	}
 	}
 	// Rendering is attachment-scoped. Schedule it through the coordinator so
 	// rapid resize frames coalesce under the attachment lease and deadline.
-	return rc.scheduleResizeForLease(geometry.Size, ac, token.lease, func(uint64) {
+	return rc.scheduleResizeForLease(geometry.Size, ac, effect.lease, func(uint64) {
-		go d.paint(sess, ac, true, token.lease)
+		go d.paint(sess, ac, true, effect.lease)
 	}) != 0
 }
 		return
 	}
 	tr := ac.transport()
-	token := sess.attachmentToken(ac, tr)
+	token := sess.captureAttachmentCapability(ac, tr)
 	if token.lease == nil {
 		// Direct test/headless callers retain pointer-based routing. Production
 		// client frames always carry the exact lease through the attachment path below.
 		d.handleClientNoticeDirect(sess, ac, notice)
 		return
 	}
-	d.handleClientNoticeForAttachment(token, notice)
+	effect, admitted := ac.beginAttachmentEffect(token)
+	if !admitted {
+		return
+	}
+	defer effect.End()
+	d.handleClientNoticeForAttachment(effect, notice)
 }
-func (d *Daemon) handleClientNoticeForAttachment(token attachmentConnectionToken, notice ports.ClientNotice) {
+func (d *Daemon) handleClientNoticeForAttachment(effect *attachmentEffect, notice ports.ClientNotice) {
 	d.notices.routingMu.Lock()
-	if !token.attachmentEffectCurrent() {
+	if !effect.current() {
 		d.notices.routingMu.Unlock()
 		return
 	}
 	if d.notices.beforeClientNoticeMutation != nil {
 		d.notices.beforeClientNoticeMutation()
 	}
-	if !token.attachmentEffectCurrent() {
+	if !effect.current() {
 		d.notices.routingMu.Unlock()
 		return
 	}
-	if token.sess == nil {
+	if effect.sess == nil {
 		d.notices.routingMu.Unlock()
 		return
 	}
-	repaint := d.mutateClientNotice(token.sess, token.ac, notice)
+	repaint := d.mutateClientNotice(effect.sess, effect.ac, notice)
 	d.notices.routingMu.Unlock()
-	if repaint && token.attachmentEffectCurrent() {
+	if repaint && effect.current() {
-		d.repaintForNotice(token.ac)
+		d.repaintForNotice(effect.ac)
 	}
 }

M internal/usecase/daemon/client_frame_routing.go +67 -74

 // currentAttachmentConnection retries the lock-free session-to-role snapshot when a
 // handoff lands between those reads. The attachment gate still performs the final
 // mutation admission after this function returns.
-func (d *Daemon) currentAttachmentConnection(ac *attachedClient, tr ports.Transport) (*session, attachmentConnectionToken, bool) {
+func (d *Daemon) currentAttachmentConnection(ac *attachedClient, tr ports.Transport) (*session, attachmentCapability, bool) {
 	for range connectionSnapshotAttempts {
 		if !ac.currentTransportIs(tr) {
 			break
 		}
 		sess := ac.currentAttachmentSession()
 		if sess == nil {
-			return nil, attachmentConnectionToken{}, false
+			return nil, attachmentCapability{}, false
 		}
 		if d.afterConnectionSessionSnapshot != nil {
 			d.afterConnectionSessionSnapshot(sess)
 		}
-		token := attachmentToken(sess, ac, tr)
+		token := captureAttachmentCapability(sess, ac, tr)
 		if token.ac == nil || ac.currentAttachmentSession() != sess {
 			runtime.Gosched()
 			continue
 		}
 		return sess, token, true
 	}
-	return nil, attachmentConnectionToken{}, false
+	return nil, attachmentCapability{}, false
 }
 // runConnLoop is the per-connection input router: it pumps client messages
 }
 // handleAttachmentClientFrame owns the attached-client protocol.
-func (d *Daemon) handleAttachmentClientFrame(token attachmentConnectionToken, f ports.Frame) bool {
+func (d *Daemon) handleAttachmentClientFrame(capability attachmentCapability, f ports.Frame) bool {
-	if !token.attachmentEffectCurrent() {
+	if !capability.current() {
 		return false
 	}
 	if d.afterAttachmentFrameDispatch != nil {
-		d.afterAttachmentFrameDispatch(token)
+		d.afterAttachmentFrameDispatch(capability)
 	}
-	ticket, admitted := token.ac.beginAttachmentEffect(token)
+	effect, admitted := capability.ac.beginAttachmentEffect(capability)
 	if !admitted {
 		return false
 	}
-	token.effect = ticket
+	defer effect.End()
-	defer token.endAttachmentEffect()
 	if d.afterAttachmentEffectAdmitted != nil {
-		d.afterAttachmentEffectAdmitted(token)
+		d.afterAttachmentEffectAdmitted(effect.capability())
 	}
 	switch f.Type {
 	case ports.MsgInput:
 		if in, derr := ports.UnmarshalInput(f.Payload); derr == nil {
-			d.handleSequencedInputForAttachment(token, in.InputSeq, in.Data)
+			d.handleSequencedInputForAttachment(effect, in.InputSeq, in.Data)
 		}
 	case ports.MsgResize:
-		if rz, derr := ports.UnmarshalResize(f.Payload); derr == nil && token.attachmentEffectCurrent() {
+		if rz, derr := ports.UnmarshalResize(f.Payload); derr == nil && effect.current() {
-			d.resizeAttachmentGeometryForLease(token, rz.Geometry())
+			d.resizeAttachmentGeometryForLease(effect, rz.Geometry())
 		}
 	case ports.MsgTheme:
 		if th, derr := ports.UnmarshalTheme(f.Payload); derr == nil {
-			d.applyThemeForAttachment(token, th)
+			d.applyThemeForAttachment(effect, th)
 		}
 	case ports.MsgImagePush:
 		if ip, derr := ports.UnmarshalImagePush(f.Payload); derr == nil {
-			d.handleSequencedImagePushForAttachment(token, ip.InputSeq, ip)
+			d.handleSequencedImagePushForAttachment(effect, ip.InputSeq, ip)
 		}
 	case ports.MsgClientNotice:
 		if notice, derr := ports.UnmarshalClientNotice(f.Payload); derr == nil {
-			d.handleClientNoticeForAttachment(token, notice)
+			d.handleClientNoticeForAttachment(effect, notice)
 		} else {
 			d.log.Warn("malformed client notice", "err", derr)
 		}
 	case ports.MsgDetach:
-		if token.attachmentEffectCurrent() {
+		if effect.current() {
-			d.clientGoneForAttachment(token, true)
+			d.clientGoneForAttachment(effect, true)
 			return true
 		}
 	case ports.MsgAck:
 		if ack, derr := ports.UnmarshalAck(f.Payload); derr == nil {
-			d.ackOutput(token, ack.Epoch, ack.State)
+			d.ackOutput(effect, ack.Epoch, ack.State)
 		}
 	case ports.MsgOutputResetRequest:
 		if _, derr := ports.UnmarshalOutputResetRequest(f.Payload); derr == nil {
-			d.resetOutput(token)
+			d.resetOutput(effect)
 		}
 	case ports.MsgSamePeerSwitchRequest:
 		request, derr := ports.UnmarshalSamePeerSwitchRequest(f.Payload)
 			d.log.Warn("malformed same-peer switch request", "err", derr)
 			break
 		}
-		d.switchSamePeerForAttachment(token, request)
+		d.switchSamePeerForAttachment(effect, request)
 	case ports.MsgParkedRouteRequest:
 		request, derr := ports.UnmarshalParkedRouteRequest(f.Payload)
 		if derr != nil {
 			d.log.Warn("malformed parked-route request", "err", derr)
 			break
 		}
-		d.handleParkedRouteRequest(token, request)
+		d.handleParkedRouteRequest(effect, request)
 	case ports.MsgRecentRouteSnapshot:
 		snapshot, derr := ports.UnmarshalRecentRouteSnapshot(f.Payload)
 		if derr != nil {
 			d.log.Warn("malformed recent route snapshot", "err", derr)
 			break
 		}
-		replayIdentity := token.ac.setRouteSnapshot(snapshot)
+		replayIdentity := effect.ac.setRouteSnapshot(snapshot)
-		d.invalidateRender(token.sess, token.ac, false, "client_frame_routing.go:route-snapshot")
+		d.invalidateRender(effect.sess, effect.ac, false, "client_frame_routing.go:route-snapshot")
 		if !replayIdentity {
 			break
 		}
-		if err := d.sendCommittedRouteIdentityForAttachment(token); err != nil {
+		if err := d.sendCommittedRouteIdentityForAttachment(effect); err != nil {
-			d.detachOnAttachmentSendError(token, token.transport.transport)
+			d.detachOnAttachmentSendError(effect.capability(), effect.transport.transport)
 		}
 	case ports.MsgRouteAttentionSubscription:
 		subscription, derr := ports.UnmarshalRouteAttentionSubscription(f.Payload)
 			d.log.Warn("malformed route attention subscription", "err", derr)
 			break
 		}
-		token.ac.setRouteAttentionSubscription(subscription)
+		effect.ac.setRouteAttentionSubscription(subscription)
-		d.invalidateRender(token.sess, token.ac, false, "client_frame_routing.go:route-attention")
+		d.invalidateRender(effect.sess, effect.ac, false, "client_frame_routing.go:route-attention")
 	case ports.MsgRouteNavigationFailure:
 		failure, derr := ports.UnmarshalRouteNavigationFailure(f.Payload)
 		if derr != nil {
 		case ports.RouteFailureNoSuchRoute:
 			message = "that recent route no longer exists"
 		}
-		d.notify(token.sess, domain.NoticeWarn, domain.NoticeSessionUnavailable, message, nil)
+		d.notify(effect.sess, domain.NoticeWarn, domain.NoticeSessionUnavailable, message, nil)
 	case ports.MsgCommand:
 		request, derr := ports.UnmarshalCommandRequest(f.Payload)
 		if derr != nil {
 			return false
 		}
-		result := d.executeAttachedCommand(token, request)
+		result := d.executeAttachedCommand(effect, request)
-		resultToken, ok := d.commandResultToken(token)
+		resultEffect, ok := d.commandResultEffect(effect)
 		if !ok {
 			// A remote handoff or explicit detach deliberately retired the old
 			// attachment; it must not be treated as a stale-result send error.
 			return true
 		}
-		if err := resultToken.sendControl(frameCommandResult(result)); err != nil {
+		if err := resultEffect.sendControl(frameCommandResult(result)); err != nil {
-			resultToken.endAttachmentEffect()
+			resultEffect.End()
-			d.detachOnAttachmentSendError(resultToken, resultToken.transport.transport)
+			d.detachOnAttachmentSendError(resultEffect.capability(), resultEffect.transport.transport)
 			return true
 		}
-		resultToken.endAttachmentEffect()
+		resultEffect.End()
 	case ports.MsgPing:
-		if err := token.sendControl(framePong()); err != nil {
+		if err := effect.sendControl(framePong()); err != nil {
-			token.endAttachmentEffect()
+			effect.End()
-			d.detachOnAttachmentSendError(token, token.transport.transport)
+			d.detachOnAttachmentSendError(effect.capability(), effect.transport.transport)
 			return true
 		}
 	default:
 	return false
 }
-// commandResultToken renews the attachment effect after a local navigation
+// commandResultEffect renews admission after a local navigation transition
-// transition ends the command's initiating effect. A retired transport/session
+// ends the command's initiating effect. A retired Transport or Session means
-// means the command deliberately handed off or detached and has no result to
+// the command deliberately handed off or detached and has no result carriage.
-// send on the old carriage.
+func (d *Daemon) commandResultEffect(effect *attachmentEffect) (*attachmentEffect, bool) {
-func (d *Daemon) commandResultToken(token attachmentConnectionToken) (attachmentConnectionToken, bool) {
+	if effect == nil || effect.ac == nil || !effect.ac.currentTransportIs(effect.transport.transport) {
-	if token.ac == nil || !token.ac.currentTransportIs(token.transport.transport) {
+		return nil, false
-		return attachmentConnectionToken{}, false
 	}
-	sess := token.ac.currentAttachmentSession()
+	if effect.current() && effect.attachmentCapability.current() {
-	if sess == nil {
+		return effect, true
-		return attachmentConnectionToken{}, false
-	}
-	resultToken := attachmentToken(sess, token.ac, token.transport.transport)
-	if resultToken.ac == nil {
-		return attachmentConnectionToken{}, false
 	}
-	if token.effect != nil && !token.effect.ended.Load() && token.current() {
+	sess := effect.ac.currentAttachmentSession()
-		return token, true
+	if sess == nil {
+		return nil, false
 	}
-	ticket, admitted := token.ac.beginAttachmentEffect(resultToken)
+	capability := captureAttachmentCapability(sess, effect.ac, effect.transport.transport)
-	if !admitted {
+	if capability.ac == nil {
-		return attachmentConnectionToken{}, false
+		return nil, false
 	}
-	resultToken.effect = ticket
+	return effect.ac.beginAttachmentEffect(capability)
-	return resultToken, true
 }
-func (d *Daemon) executeAttachedCommand(token attachmentConnectionToken, request ports.CommandRequest) ports.CommandResult {
+func (d *Daemon) executeAttachedCommand(effect *attachmentEffect, request ports.CommandRequest) ports.CommandResult {
 	result := ports.CommandResult{RequestID: request.RequestID}
 	if request.Version != ports.ProtocolVersion {
 		result.Code = ports.ErrInvalidCommandArgs
 		result.Text = "attached commands cannot override their active session target"
 		return result
 	}
-	sess := token.sess
+	sess := effect.sess
-	if sess == nil || !token.attachmentEffectCurrent() {
+	if sess == nil || !effect.current() {
 		result.Code = ports.ErrNoSuchTarget
 		result.Text = "attached session is no longer active"
 		return result
 	// The frame's attachment token is the target capability. No registry/name lookup is
 	// performed, so the command cannot escape to another remote session.
 	err := sess.runMutation(func() error {
-		return cmd.Run(paletteExec{d: d, sess: sess, ac: token.ac, effect: token.effect}, request.Args)
+		return cmd.Run(paletteExec{d: d, sess: sess, ac: effect.ac, effect: effect}, request.Args)
 	})
 	if err == nil {
 		result.OK = true
 // resetOutput rebases only the exact attachment and transport admitted
 // by the frame router. sendMu serializes the rebase with every output send;
 // transport revalidation under that lock rejects a link replaced while waiting.
-func (d *Daemon) resetOutput(token attachmentConnectionToken) bool {
+func (d *Daemon) resetOutput(effect *attachmentEffect) bool {
-	ac := token.ac
+	if !effect.current() || effect.ac == nil {
-	if ac == nil || token.effect == nil || token.effect.ended.Load() {
 		return false
 	}
+	ac := effect.ac
 	ac.sendMu.Lock()
-	if token.effect.ended.Load() || !token.attachmentCurrent() || ac.output == nil {
+	if !effect.current() || ac.output == nil {
 		ac.sendMu.Unlock()
 		return false
 	}
 	ac.pipelineCache = composeCacheInput{}
 	ac.pipelineScratch = composeCacheInput{}
 	ac.sendMu.Unlock()
-	go d.paint(token.sess, ac, true, token.lease)
+	go d.paint(effect.sess, ac, true, effect.lease)
 	return true
 }
-func (d *Daemon) ackOutput(token attachmentConnectionToken, epoch, state uint64) bool {
+func (d *Daemon) ackOutput(effect *attachmentEffect, epoch, state uint64) bool {
-	ac := token.ac
+	if !effect.current() || effect.ac == nil {
-	if token.effect == nil || token.effect.ended.Load() {
 		return false
 	}
+	ac := effect.ac
 	ac.sendMu.Lock()
 	if ac.output == nil {
 		ac.sendMu.Unlock()
 	acknowledged := ac.output.ack(epoch, state)
 	ac.sendMu.Unlock()
 	if acknowledged {
-		if rc := token.sess.renderCoordinator(); rc != nil {
+		if rc := effect.sess.renderCoordinator(); rc != nil {
-			rc.notifyAckForLease(token.lease)
+			rc.notifyAckForLease(effect.lease)
 		}
 	}
 	return acknowledged

M internal/usecase/daemon/client_transport_errors.go +13 -12

 	d.finishClientGone(sess, ac, failed, explicit, notice)
 }
-func (d *Daemon) clientGoneForAttachment(token attachmentConnectionToken, explicit bool) bool {
+func (d *Daemon) clientGoneForAttachment(effect *attachmentEffect, explicit bool) bool {
-	if token.effect == nil {
+	if effect == nil {
 		return false
 	}
-	token.effect.bindActionEnd(d, "detach")
+	effect.bindActionEnd(d, "detach")
-	token.effect.End()
+	effect.End()
-	sess := token.sess
+	capability := effect.capability()
+	sess := capability.sess
 	if sess == nil {
 		return false
 	}
 	var parkingToken uint64
 	if !explicit {
-		parkingToken = d.markParkingInFlight(sess, token.ac)
+		parkingToken = d.markParkingInFlight(sess, capability.ac)
 	}
-	if !d.detachIfAttachmentCurrent(token) {
+	if !d.detachIfAttachmentCurrent(capability) {
-		d.clearParkingInFlightIfAbandoned(sess, token.ac, parkingToken)
+		d.clearParkingInFlightIfAbandoned(sess, capability.ac, parkingToken)
 		return false
 	}
-	d.finishClientGone(sess, token.ac, token.transport.transport, explicit, true)
+	d.finishClientGone(sess, capability.ac, capability.transport.transport, explicit, true)
 	return true
 }
 	d.clearParkingInFlightIfAbandoned(sess, ac, parkingToken)
 }
-func (d *Daemon) detachOnAttachmentSendError(token attachmentConnectionToken, failed ports.Transport) {
+func (d *Daemon) detachOnAttachmentSendError(token attachmentCapability, failed ports.Transport) {
 	d.detachOnAttachmentSendErrorUntil(token, failed, nil)
 }
-func (d *Daemon) detachOnAttachmentSendErrorUntil(token attachmentConnectionToken, failed ports.Transport, done func() <-chan struct{}) {
+func (d *Daemon) detachOnAttachmentSendErrorUntil(token attachmentCapability, failed ports.Transport, done func() <-chan struct{}) {
 	// A delayed sender may report after the client has rebound. Only the exact
 	// transport captured by this attachment is allowed to detach either lifecycle.
 	if failed == nil || failed != token.transport.transport {
 // reserveAttachmentSendErrorCleanup accounts for cleanup before End releases the
 // attachment gate. This closes the WaitGroup Add/Wait race with terminal teardown;
 // the returned launch function must be invoked immediately after ticket End.
-func (d *Daemon) reserveAttachmentSendErrorCleanup(token attachmentConnectionToken, failed ports.Transport) func() {
+func (d *Daemon) reserveAttachmentSendErrorCleanup(token attachmentCapability, failed ports.Transport) func() {
 	d.attachmentCleanupWg.Add(1)
 	return func() {
 		go func() {

M internal/usecase/daemon/clipboard.go +24 -24


@@ -26,27 +26,27 @@ var (
26		clipPasteCloseMarker = []byte("\x1b[201~")	26		clipPasteCloseMarker = []byte("\x1b[201~")
27		)	27		)
28			28
29	-	func (d *Daemon) handleSequencedImagePushForAttachment(token attachmentConnectionToken, _ uint64, ip ports.ImagePush) {	29	+	func (d Daemon) handleSequencedImagePushForAttachment(effect attachmentEffect, _ uint64, ip ports.ImagePush) {
30	-	if !token.attachmentEffectCurrent() {	30	+	if !effect.current() {
31		return	31		return
32		}	32		}
33	-	d.handleImagePushForAttachment(token, ip)	33	+	d.handleImagePushForAttachment(effect, ip)
34		}	34		}
35			35
36	-	func (d *Daemon) handleImagePushForAttachment(token attachmentConnectionToken, ip ports.ImagePush) {	36	+	func (d Daemon) handleImagePushForAttachment(effect attachmentEffect, ip ports.ImagePush) {
37	-	if len(ip.Data) == 0 \|\| len(ip.Data) > maxImagePushSize \|\| !token.attachmentEffectCurrent() {	37	+	if len(ip.Data) == 0 \|\| len(ip.Data) > maxImagePushSize \|\| !effect.current() {
38		return	38		return
39		}	39		}
40	-	path, err := d.writeClipboardImageForAttachment(token, ip)	40	+	path, err := d.writeClipboardImageForAttachment(effect, ip)
41		if err != nil {	41		if err != nil {
42		d.log.Error("writing clipboard image failed", "err", err)	42		d.log.Error("writing clipboard image failed", "err", err)
43		return	43		return
44		}	44		}
45	-	if !token.attachmentEffectCurrent() {	45	+	if !effect.current() {
46		_ = os.Remove(path)	46		_ = os.Remove(path)
47		return	47		return
48		}	48		}
49	-	d.injectClipboardPathForAttachment(token, path)	49	+	d.injectClipboardPathForAttachment(effect, path)
50		}	50		}
51			51
52		// handleImagePush writes an ImagePush's bytes to a temp file and injects the	52		// handleImagePush writes an ImagePush's bytes to a temp file and injects the

@@ -84,18 +84,18 @@ func (d Daemon) writeClipboardImage(sess session, ip ports.ImagePush) (string,
84		return path, nil	84		return path, nil
85		}	85		}
86			86
87	-	func (d *Daemon) writeClipboardImageForAttachment(token attachmentConnectionToken, ip ports.ImagePush) (string, error) {	87	+	func (d Daemon) writeClipboardImageForAttachment(effect attachmentEffect, ip ports.ImagePush) (string, error) {
88		path, err := d.createClipboardImage(ip)	88		path, err := d.createClipboardImage(ip)
89		if err != nil {	89		if err != nil {
90		return "", err	90		return "", err
91		}	91		}
92	-	sess := token.sess	92	+	sess := effect.sess
93		if sess == nil {	93		if sess == nil {
94		_ = os.Remove(path)	94		_ = os.Remove(path)
95		return "", errAttachmentTransition	95		return "", errAttachmentTransition
96		}	96		}
97		sess.mu.Lock()	97		sess.mu.Lock()
98	-	if !token.attachmentEffectCurrentSessionLocked() {	98	+	if !effect.currentSessionLocked() {
99		sess.mu.Unlock()	99		sess.mu.Unlock()
100		_ = os.Remove(path)	100		_ = os.Remove(path)
101		return "", errAttachmentTransition	101		return "", errAttachmentTransition

@@ -134,18 +134,18 @@ func (d Daemon) injectClipboardPath(sess session, path string) {
134		d.injectClipboardPathToTarget(sess, path, nil)	134		d.injectClipboardPathToTarget(sess, path, nil)
135		}	135		}
136			136
137	-	func (d *Daemon) injectClipboardPathForAttachment(token attachmentConnectionToken, path string) {	137	+	func (d Daemon) injectClipboardPathForAttachment(effect attachmentEffect, path string) {
138	-	sess := token.sess	138	+	sess := effect.sess
139	-	if sess == nil \|\| !token.attachmentEffectCurrent() {	139	+	if sess == nil \|\| !effect.current() {
140		return	140		return
141		}	141		}
142	-	d.injectClipboardPathToTarget(sess, path, &token)	142	+	d.injectClipboardPathToTarget(sess, path, effect)
143		}	143		}
144			144
145	-	func (d Daemon) injectClipboardPathToTarget(sess session, path string, token *attachmentConnectionToken) {	145	+	func (d Daemon) injectClipboardPathToTarget(sess session, path string, effect *attachmentEffect) {
146		var ac *attachedClient	146		var ac *attachedClient
147	-	if token != nil {	147	+	if effect != nil {
148	-	ac = token.ac	148	+	ac = effect.ac
149		}	149		}
150		var tb *tab	150		var tb *tab
151		if ac != nil {	151		if ac != nil {

@@ -175,7 +175,7 @@ func (d Daemon) injectClipboardPathToTarget(sess session, path string, token *
175		wrapped = append(wrapped, clipPasteCloseMarker...)	175		wrapped = append(wrapped, clipPasteCloseMarker...)
176		data = wrapped	176		data = wrapped
177		}	177		}
178	-	if token != nil && !token.attachmentEffectCurrent() {	178	+	if effect != nil && !effect.current() {
179		return	179		return
180		}	180		}
181		d.writeToPane(sess, p, data)	181		d.writeToPane(sess, p, data)

@@ -202,7 +202,7 @@ func clipboardExt(mime string) string {
202			202
203		type clipboardForward struct {	203		type clipboardForward struct {
204		owner paneEffectLease	204		owner paneEffectLease
205	-	token attachmentConnectionToken	205	+	token attachmentCapability
206		seq []byte	206		seq []byte
207		}	207		}
208			208

@@ -237,8 +237,8 @@ func (d *Daemon) forwardClipboardAsync(owner paneEffectLease, b64 string) {
237		items := make([]clipboardForward, 0, len(attachments))	237		items := make([]clipboardForward, 0, len(attachments))
238		for _, ac := range attachments {	238		for _, ac := range attachments {
239		transport := ac.transport()	239		transport := ac.transport()
240	-	token := sess.attachmentToken(ac, transport)	240	+	token := sess.captureAttachmentCapability(ac, transport)
241	-	if token.attachmentCurrent() {	241	+	if token.current() {
242		items = append(items, clipboardForward{owner: owner, token: token, seq: seq})	242		items = append(items, clipboardForward{owner: owner, token: token, seq: seq})
243		}	243		}
244		}	244		}

@@ -254,7 +254,7 @@ func (d *Daemon) forwardClipboardAsync(owner paneEffectLease, b64 string) {
254		sess.mu.Unlock()	254		sess.mu.Unlock()
255		}	255		}
256			256
257	-	func (d Daemon) boundedSendClipboardForward(item clipboardForward, ticket attachmentEffectTicket) (ports.Transport, error) {	257	+	func (d Daemon) boundedSendClipboardForward(item clipboardForward, ticket attachmentEffect) (ports.Transport, error) {
258		token := item.token	258		token := item.token
259		if token.ac == nil \|\| ticket == nil \|\| ticket.ended.Load() \|\| token.transport.transport == nil {	259		if token.ac == nil \|\| ticket == nil \|\| ticket.ended.Load() \|\| token.transport.transport == nil {
260		return token.transport.transport, errAttachmentTransition	260		return token.transport.transport, errAttachmentTransition

@@ -300,7 +300,7 @@ func (d Daemon) boundedSendClipboardForward(item clipboardForward, ticket atta
300		// admission and marks the transport interval while ownership publication is	300		// admission and marks the transport interval while ownership publication is
301		// excluded. Publication therefore orders either before this check (the send is	301		// excluded. Publication therefore orders either before this check (the send is
302		// dropped) or after transport admission (the send belongs to the old owner).	302		// dropped) or after transport admission (the send belongs to the old owner).
303	-	func beginClipboardOwnerSend(lease paneEffectLease, ticket *attachmentEffectTicket, expected transportSnapshot) bool {	303	+	func beginClipboardOwnerSend(lease paneEffectLease, ticket *attachmentEffect, expected transportSnapshot) bool {
304		if lease.pane == nil \|\| lease.owner == nil \|\| lease.owner.session == nil \|\| lease.owner.tab == nil {	304		if lease.pane == nil \|\| lease.owner == nil \|\| lease.owner.session == nil \|\| lease.owner.tab == nil {
305		return false	305		return false
306		}	306		}

M internal/usecase/daemon/clipboard_test.go +3 -3


@@ -204,9 +204,9 @@ func chunkReadPTY(t testing.T, chunks ...[]byte) portsmocks.MockPTY {
204			204
205		func publishActiveClipboardCapability(d Daemon, sess session, ac *attachedClient, tr ports.Transport) {	205		func publishActiveClipboardCapability(d Daemon, sess session, ac *attachedClient, tr ports.Transport) {
206		rc := d.attachCoordinator(sess, nil, ac, true)	206		rc := d.attachCoordinator(sess, nil, ac, true)
207	-	token := sess.attachmentToken(ac, tr)	207	+	token := sess.captureAttachmentCapability(ac, tr)
208		token.lease = rc.attachmentLease(ac)	208		token.lease = rc.attachmentLease(ac)
209	-	ac.publishAttachmentCapability(token)	209	+	ac.installTestAttachmentCapability(token)
210		}	210		}
211			211
212		func clipboardOwnerLease(t testing.T, sess session) paneEffectLease {	212		func clipboardOwnerLease(t testing.T, sess session) paneEffectLease {

@@ -419,7 +419,7 @@ func TestQueuedClipboardRevalidatesOwnerAfterWaitingForClientSendLock(t *testing
419		close(workerDone)	419		close(workerDone)
420		}()	420		}()
421		require.Eventually(t, func() bool {	421		require.Eventually(t, func() bool {
422	-	return ac.attachmentEffects.inFlightCount() == 1	422	+	return ac.lifecycle.inFlightCount() == 1
423		}, time.Second, time.Millisecond, "clipboard send was not admitted before waiting on sendMu")	423		}, time.Second, time.Millisecond, "clipboard send was not admitted before waiting on sendMu")
424			424
425		sourceTab := testAttachmentTab(sess)	425		sourceTab := testAttachmentTab(sess)

M internal/usecase/daemon/control.go +17 -17


@@ -300,7 +300,7 @@ type daemonActionTarget struct {
300		type daemonActionRequest struct {	300		type daemonActionRequest struct {
301		kind daemonActionKind	301		kind daemonActionKind
302		target daemonActionTarget	302		target daemonActionTarget
303	-	effect *attachmentEffectTicket	303	+	effect *attachmentEffect
304		direction layout.Direction	304		direction layout.Direction
305		axis layout.Axis	305		axis layout.Axis
306		delta int	306		delta int

@@ -513,21 +513,21 @@ func (e controlExec) MovePane(destinationSession, destinationTabID string) error
513		return errMovePaneInvalid	513		return errMovePaneInvalid
514		}	514		}
515		attachment := e.target.attachment	515		attachment := e.target.attachment
516	-	token := attachmentConnectionToken{}	516	+	token := attachmentCapability{}
517		if attachment != nil {	517		if attachment != nil {
518	-	token = e.sess.attachmentToken(attachment, attachment.transport())	518	+	token = e.sess.captureAttachmentCapability(attachment, attachment.transport())
519		if token.ac == nil {	519		if token.ac == nil {
520		return errMoveStaleTarget	520		return errMoveStaleTarget
521		}	521		}
522		}	522		}
523		return e.d.movePane(movePaneRequest{	523		return e.d.movePane(movePaneRequest{
524	-	Attachment: attachment,	524	+	Attachment: attachment,
525	-	AttachmentToken: token,	525	+	AttachmentCapability: token,
526	-	Source: sessionMoveLocator(e.sess),	526	+	Source: sessionMoveLocator(e.sess),
527	-	SourceTabID: domain.TabStableID(e.tab.stableID),	527	+	SourceTabID: domain.TabStableID(e.tab.stableID),
528	-	SourcePaneID: domain.PaneStableID(e.target.pane.stableID),	528	+	SourcePaneID: domain.PaneStableID(e.target.pane.stableID),
529	-	Destination: sessionMoveLocator(destination),	529	+	Destination: sessionMoveLocator(destination),
530	-	DestinationTabID: domain.TabStableID(destinationTabID),	530	+	DestinationTabID: domain.TabStableID(destinationTabID),
531		})	531		})
532		}	532		}
533			533

@@ -540,19 +540,19 @@ func (e controlExec) MoveTab(destinationSession string) error {
540		return errMovePaneInvalid	540		return errMovePaneInvalid
541		}	541		}
542		attachment := e.target.attachment	542		attachment := e.target.attachment
543	-	token := attachmentConnectionToken{}	543	+	token := attachmentCapability{}
544		if attachment != nil {	544		if attachment != nil {
545	-	token = e.sess.attachmentToken(attachment, attachment.transport())	545	+	token = e.sess.captureAttachmentCapability(attachment, attachment.transport())
546		if token.ac == nil {	546		if token.ac == nil {
547		return errMoveStaleTarget	547		return errMoveStaleTarget
548		}	548		}
549		}	549		}
550		return e.d.moveTab(moveTabRequest{	550		return e.d.moveTab(moveTabRequest{
551	-	Attachment: attachment,	551	+	Attachment: attachment,
552	-	AttachmentToken: token,	552	+	AttachmentCapability: token,
553	-	Source: sessionMoveLocator(e.sess),	553	+	Source: sessionMoveLocator(e.sess),
554	-	SourceTabID: domain.TabStableID(e.tab.stableID),	554	+	SourceTabID: domain.TabStableID(e.tab.stableID),
555	-	Destination: sessionMoveLocator(destination),	555	+	Destination: sessionMoveLocator(destination),
556		})	556		})
557		}	557		}
558			558

M internal/usecase/daemon/daemon.go +6 -6


@@ -161,7 +161,7 @@ type Daemon struct {
161		afterConnectionSessionSnapshot func(*session)	161		afterConnectionSessionSnapshot func(*session)
162		// afterAttachmentFrameDispatch is a deterministic test seam after the	162		// afterAttachmentFrameDispatch is a deterministic test seam after the
163		// connection loop snapshots a token and before a decoded frame takes effect.	163		// connection loop snapshots a token and before a decoded frame takes effect.
164	-	afterAttachmentFrameDispatch func(attachmentConnectionToken)	164	+	afterAttachmentFrameDispatch func(attachmentCapability)
165		// afterAttachmentEffectParticipantsSnapshotted observes immutable role-gate	165		// afterAttachmentEffectParticipantsSnapshotted observes immutable role-gate
166		// participants after architecture preflight locks are released and before	166		// participants after architecture preflight locks are released and before
167		// the globally ordered freeze begins.	167		// the globally ordered freeze begins.

@@ -214,10 +214,10 @@ type Daemon struct {
214		beforeResumeParkedSendMu func()	214		beforeResumeParkedSendMu func()
215		// afterAttachmentEffectAdmitted is a deterministic test seam after a frame/paint	215		// afterAttachmentEffectAdmitted is a deterministic test seam after a frame/paint
216		// reserves its exact capability and before its first observable mutation.	216		// reserves its exact capability and before its first observable mutation.
217	-	afterAttachmentEffectAdmitted func(attachmentConnectionToken)	217	+	afterAttachmentEffectAdmitted func(attachmentCapability)
218		// beforeFirstPaintSendWait is a test-only seam immediately before a	218		// beforeFirstPaintSendWait is a test-only seam immediately before a
219		// transition first paint waits for the attachment send lock.	219		// transition first paint waits for the attachment send lock.
220	-	beforeFirstPaintSendWait func(attachmentConnectionToken)	220	+	beforeFirstPaintSendWait func(attachmentCapability)
221		// afterDelayedKeyEffectAttempt observes whether a timer callback acquired a	221		// afterDelayedKeyEffectAttempt observes whether a timer callback acquired a
222		// fresh exact capability before producing PTY, action, or overlay effects.	222		// fresh exact capability before producing PTY, action, or overlay effects.
223		afterDelayedKeyEffectAttempt func(bool)	223		afterDelayedKeyEffectAttempt func(bool)

@@ -226,7 +226,7 @@ type Daemon struct {
226		afterActionAttachmentEffectEnded func(string)	226		afterActionAttachmentEffectEnded func(string)
227		// beforeAttachmentSendErrorCleanup pauses asynchronous render-failure retirement	227		// beforeAttachmentSendErrorCleanup pauses asynchronous render-failure retirement
228		// after the render ticket ends and before exact lifecycle validation.	228		// after the render ticket ends and before exact lifecycle validation.
229	-	beforeAttachmentSendErrorCleanup func(attachmentConnectionToken)	229	+	beforeAttachmentSendErrorCleanup func(attachmentCapability)
230		afterAttachmentSendErrorCleanup func()	230		afterAttachmentSendErrorCleanup func()
231		ptys ports.PTYFactory	231		ptys ports.PTYFactory
232		clock ports.Clock	232		clock ports.Clock

@@ -1217,7 +1217,7 @@ func (d *Daemon) handleHelloWithContext(handshakeCtx context.Context, timedOut <
1217		return	1217		return
1218		}	1218		}
1219		expected := ac.transportSnapshot()	1219		expected := ac.transportSnapshot()
1220	-	welcomeToken := sess.attachmentToken(ac, tr)	1220	+	welcomeToken := sess.captureAttachmentCapability(ac, tr)
1221		welcomeTicket, admitted := ac.beginAttachmentEffect(welcomeToken)	1221		welcomeTicket, admitted := ac.beginAttachmentEffect(welcomeToken)
1222		if expected.transport != tr \|\| !admitted \|\| welcomeToken.ac == nil {	1222		if expected.transport != tr \|\| !admitted \|\| welcomeToken.ac == nil {
1223		if admitted {	1223		if admitted {

@@ -1267,7 +1267,7 @@ func (d *Daemon) handleHelloWithContext(handshakeCtx context.Context, timedOut <
1267		failAttachment()	1267		failAttachment()
1268		return	1268		return
1269		}	1269		}
1270	-	paintToken := sess.attachmentToken(ac, tr)	1270	+	paintToken := sess.captureAttachmentCapability(ac, tr)
1271		painted := make(chan bool, 1)	1271		painted := make(chan bool, 1)
1272		paintDone, paintErr := boundedHandshakeOperationTracked(handshakeCtx, tr, func() error {	1272		paintDone, paintErr := boundedHandshakeOperationTracked(handshakeCtx, tr, func() error {
1273		//nolint:contextcheck // firstPaintForTransition is capability-bounded; the surrounding handshake operation owns cancellation.	1273		//nolint:contextcheck // firstPaintForTransition is capability-bounded; the surrounding handshake operation owns cancellation.

M internal/usecase/daemon/final_acceptance_test.go +18 -12

 	d.ptys = newFactory(t, newQuietPTY())
 	rc := d.attachCoordinator(sess, nil, first, true)
 	d.attachCoordinator(sess, nil, second, true)
-	firstToken := sess.attachmentToken(first, first.transport())
+	firstToken := sess.captureAttachmentCapability(first, first.transport())
 	firstToken.lease = rc.attachmentLease(first)
-	first.publishAttachmentCapability(firstToken)
+	first.installTestAttachmentCapability(firstToken)
-	secondToken := sess.attachmentToken(second, second.transport())
+	secondToken := sess.captureAttachmentCapability(second, second.transport())
 	secondToken.lease = rc.attachmentLease(second)
-	second.publishAttachmentCapability(secondToken)
+	second.installTestAttachmentCapability(secondToken)
 	firstView := first.viewSnapshot()
 	secondView := second.viewSnapshot()
 	first.sendMu.Lock()
 	firstEpoch := first.output.currentEpoch()
 	first.sendMu.Unlock()
-	require.True(t, d.resizeAttachmentForLease(secondToken, domain.Size{Cols: 120, Rows: 40}))
+	secondEffect, admitted := second.beginAttachmentEffect(secondToken)
+	require.True(t, admitted)
+	require.True(t, d.resizeAttachmentForLease(secondEffect, domain.Size{Cols: 120, Rows: 40}))
+	secondEffect.End()
 	d.enterPalette(sess, second)
 	d.handlePaletteInput(second, []byte("CNT\r"))
 	rc := d.attachCoordinator(sess, nil, first, true)
 	d.attachCoordinator(sess, nil, second, true)
-	firstToken := sess.attachmentToken(first, first.transport())
+	firstToken := sess.captureAttachmentCapability(first, first.transport())
 	firstToken.lease = rc.attachmentLease(first)
-	first.publishAttachmentCapability(firstToken)
+	first.installTestAttachmentCapability(firstToken)
-	secondToken := sess.attachmentToken(second, second.transport())
+	secondToken := sess.captureAttachmentCapability(second, second.transport())
 	secondToken.lease = rc.attachmentLease(second)
-	second.publishAttachmentCapability(secondToken)
+	second.installTestAttachmentCapability(secondToken)
 	firstEpoch := first.output.currentEpoch()
 	secondEpoch := second.output.currentEpoch()
 	require.Greater(t, second.output.currentEpoch(), secondEpoch)
 	require.Equal(t, firstEpoch, first.output.currentEpoch(), "peer output reset crossed attachment boundary")
-	require.True(t, d.resizeAttachmentForLease(secondToken, domain.Size{Cols: 120, Rows: 40}))
+	secondEffect, admitted := second.beginAttachmentEffect(secondToken)
+	require.True(t, admitted)
+	require.True(t, d.resizeAttachmentForLease(secondEffect, domain.Size{Cols: 120, Rows: 40}))
+	secondEffect.End()
 	require.Equal(t, domain.Size{Cols: 120, Rows: 40}, second.size)
 	require.Equal(t, domain.Size{Cols: 80, Rows: 24}, first.size, "peer resize crossed attachment boundary")
 	sess.mu.Lock()
 	d, sess, ac, _ := newManualSessionWithPTYs(t, newQuietPTY())
 	d.ptys = newFactory(t, newQuietPTY())
 	rc := d.attachCoordinator(sess, nil, ac, true)
-	token := sess.attachmentToken(ac, ac.transport())
+	token := sess.captureAttachmentCapability(ac, ac.transport())
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	d.enterPalette(sess, ac)
 	d.handlePaletteInput(ac, []byte("SPD\r"))

M internal/usecase/daemon/handshake_test.go +1 -1


@@ -117,7 +117,7 @@ func TestHandshakeFirstPaintCancellationDoesNotRacePaintResult(t *testing.T) {
117		paintStarted := make(chan struct{})	117		paintStarted := make(chan struct{})
118		releasePaint := make(chan struct{})	118		releasePaint := make(chan struct{})
119		paintDone := make(chan struct{})	119		paintDone := make(chan struct{})
120	-	d.afterAttachmentEffectAdmitted = func(attachmentConnectionToken) {	120	+	d.afterAttachmentEffectAdmitted = func(attachmentCapability) {
121		close(paintStarted)	121		close(paintStarted)
122		<-ctx.Done()	122		<-ctx.Done()
123		<-releasePaint	123		<-releasePaint

M internal/usecase/daemon/input.go +24 -29

 	d.handleInput(sess, ac, data)
 }
-func (d *Daemon) handleSequencedInputForAttachment(token attachmentConnectionToken, _ uint64, data []byte) {
+func (d *Daemon) handleSequencedInputForAttachment(effect *attachmentEffect, _ uint64, data []byte) {
-	if !token.attachmentEffectCurrent() {
+	if !effect.current() {
 		return
 	}
-	d.handleInputForAttachment(token, data)
+	d.handleInputForAttachment(effect, data)
 }
 func (d *Daemon) handleInput(_ *session, ac *attachedClient, data []byte) {
 	)
 }
-func (d *Daemon) handleInputForAttachment(token attachmentConnectionToken, data []byte) {
+func (d *Daemon) handleInputForAttachment(effect *attachmentEffect, data []byte) {
-	ac := token.ac
+	ac := effect.ac
 	ac.initOverlays()
 	ac.mouseScan.Scan(data,
 		func(ev mouse.Event) {
-			if token.attachmentEffectCurrent() {
+			if effect.current() {
 				d.handleMouse(ac, ev)
 			}
 		},
 		func(b []byte) {
-			if !token.attachmentEffectCurrent() {
+			if !effect.current() {
 				return
 			}
-			if ac.overlays.HandleInput(d, b, token.effect) {
+			if ac.overlays.HandleInput(d, b, effect) {
 				return
 			}
-			if !token.attachmentEffectCurrent() {
+			if !effect.current() {
 				return
 			}
-			ac.keys.RouteWithHandler(b, daemonKeyHandler{d: d, ac: ac, connectionToken: token})
+			ac.keys.RouteWithHandler(b, daemonKeyHandler{d: d, ac: ac, effect: effect})
 		},
 	)
 }
 }
 type daemonKeyHandler struct {
-	d               *Daemon
+	d       *Daemon
-	ac              *attachedClient
+	ac      *attachedClient
-	actions         daemonActionRunner
+	actions daemonActionRunner
-	connectionToken attachmentConnectionToken
+	effect  *attachmentEffect
 }
 // acquireAttachmentEffect preserves a synchronous frame's existing admission and
 // gives delayed router callbacks a fresh ticket for the exact captured attachment.
 // Direct/headless callers without an attachment token retain their existing behavior.
-func (h daemonKeyHandler) acquireAttachmentEffect() (*session, *attachmentEffectTicket, bool) {
+func (h daemonKeyHandler) acquireAttachmentEffect() (*session, *attachmentEffect, bool) {
-	if h.connectionToken.ac != nil {
+	if h.effect != nil && h.effect.ac != nil {
-		if effect := h.connectionToken.effect; effect != nil && !effect.ended.Load() {
+		if h.effect.current() {
-			return h.connectionToken.sess, effect, false
+			return h.effect.sess, h.effect, false
 		}
-		effect, admitted := h.connectionToken.ac.beginAttachmentEffect(h.connectionToken)
+		effect, admitted := h.effect.ac.beginAttachmentEffect(h.effect.capability())
 		if h.d.afterDelayedKeyEffectAttempt != nil {
 			h.d.afterDelayedKeyEffectAttempt(admitted)
 		}
 			return nil, nil, false
 		}
 		if h.d.afterAttachmentEffectAdmitted != nil {
-			token := h.connectionToken
+			h.d.afterAttachmentEffectAdmitted(effect.capability())
-			token.effect = effect
-			h.d.afterAttachmentEffectAdmitted(token)
 		}
-		// Keep this defensive check even though token admission normally requires a session.
+		if effect.sess == nil {
-		if h.connectionToken.sess == nil {
 			effect.End()
 			return nil, nil, false
 		}
-		return h.connectionToken.sess, effect, true
+		return effect.sess, effect, true
 	}
 	sess := h.ac.currentSession()
 	if sess == nil {
 			return
 		}
 		effect.bindActionEnd(h.d, "jump-attention")
-		token := h.connectionToken
+		if err := h.d.jumpAttentionForAttachment(sess, h.ac, effect); err != nil {
-		token.effect = effect
-		if err := h.d.jumpAttentionForAttachment(sess, h.ac, token); err != nil {
 			h.d.reportError(sess, err)
 		}
 	case keys.ActionToggleFloatingPane:
 	}
 }
-func (h daemonKeyHandler) focus(sess *session, dir layout.Direction, effect *attachmentEffectTicket) {
+func (h daemonKeyHandler) focus(sess *session, dir layout.Direction, effect *attachmentEffect) {
 	err := h.d.focusDir(sess, h.ac, dir, effect)
 	if err != nil && !errors.Is(err, errAttachmentTransition) && !errors.Is(err, errNoNeighbor) {
 		h.d.reportError(sess, err)

M internal/usecase/daemon/input_test.go +3 -4

 	defer releaseAll(releases)
 	transport := ac.transport()
 	rc := d.attachCoordinator(current, nil, ac, true)
-	token := current.attachmentToken(ac, transport)
+	token := current.captureAttachmentCapability(ac, transport)
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
 	defer effect.End()
-	token.effect = effect
 	ac.setRouteSnapshot(ports.RecentRouteSnapshot{
 		Generation: 3,
 		Active:     ports.RouteRef{Key: 3, Generation: 3},
 		Entries:    []ports.RecentRouteEntry{testRouteEntry(2, 2, "recent", 2, ports.RouteKindLocal)},
 	})
-	require.NoError(t, d.backSessionForAttachment(token))
+	require.NoError(t, d.backSessionForAttachment(effect))
 	frame := awaitFrame(t, sends, ports.MsgNavigateRecentRoute)
 	action, err := ports.UnmarshalRouteNavigationAction(frame.Payload)
 	require.NoError(t, err)

M internal/usecase/daemon/lifecycle_fence_test.go +6 -6


@@ -21,7 +21,7 @@ func TestValidateAttachmentTransitionLocksSourceCoordinatorBeforeLeaseValidation
21		sourceCoordinator := newRenderCoordinator(renderCoordinatorOptions{})	21		sourceCoordinator := newRenderCoordinator(renderCoordinatorOptions{})
22		source.installRenderCoordinator(sourceCoordinator)	22		source.installRenderCoordinator(sourceCoordinator)
23		sourceCoordinator.attach(ac)	23		sourceCoordinator.attach(ac)
24	-	token := source.attachmentToken(ac, transport)	24	+	token := source.captureAttachmentCapability(ac, transport)
25		require.NotNil(t, token.lease)	25		require.NotNil(t, token.lease)
26		d.sessions[source.id] = source	26		d.sessions[source.id] = source
27		d.sessions[target.id] = target	27		d.sessions[target.id] = target

@@ -37,7 +37,7 @@ func TestValidateAttachmentTransitionLocksSourceCoordinatorBeforeLeaseValidation
37		}	37		}
38		req := attachmentTransitionRequest{	38		req := attachmentTransitionRequest{
39		source: source, target: target, next: ac,	39		source: source, target: target, next: ac,
40	-	expectedTransport: ac.transportSnapshot(), sourceToken: &token,	40	+	expectedTransport: ac.transportSnapshot(), sourceCapability: &token,
41		preflighted: true, attachmentEffectsFrozen: true,	41		preflighted: true, attachmentEffectsFrozen: true,
42		}	42		}
43		d.mu.Lock()	43		d.mu.Lock()

@@ -56,7 +56,7 @@ func TestValidateAttachmentTransitionLocksSourceCoordinatorBeforeLeaseValidation
56		require.NotNil(t, publication)	56		require.NotNil(t, publication)
57		}	57		}
58			58
59	-	func TestAttachmentTokenRevalidatesTheCapturedTransportIncarnation(t *testing.T) {	59	+	func TestAttachmentCapabilityRevalidatesTheCapturedTransportIncarnation(t *testing.T) {
60		first := &closeTrackingTransport{}	60		first := &closeTrackingTransport{}
61		second := &closeTrackingTransport{}	61		second := &closeTrackingTransport{}
62		ac := &attachedClient{tr: first}	62		ac := &attachedClient{tr: first}

@@ -69,12 +69,12 @@ func TestAttachmentTokenRevalidatesTheCapturedTransportIncarnation(t *testing.T)
69			69
70		captured := make(chan struct{})	70		captured := make(chan struct{})
71		release := make(chan struct{})	71		release := make(chan struct{})
72	-	ac.beforeAttachmentTokenValidation = func() {	72	+	ac.beforeAttachmentCapabilityValidation = func() {
73		close(captured)	73		close(captured)
74		<-release	74		<-release
75		}	75		}
76	-	result := make(chan attachmentConnectionToken, 1)	76	+	result := make(chan attachmentCapability, 1)
77	-	go func() { result <- sess.attachmentToken(ac, first) }()	77	+	go func() { result <- sess.captureAttachmentCapability(ac, first) }()
78		<-captured	78		<-captured
79		ac.replaceTransport(second)	79		ac.replaceTransport(second)
80		close(release)	80		close(release)

M internal/usecase/daemon/move.go +13 -13


@@ -10,21 +10,21 @@ import (
10		// immutable identity. Session names are advisory; the ID and incarnation are	10		// immutable identity. Session names are advisory; the ID and incarnation are
11		// the commit-time authority.	11		// the commit-time authority.
12		type movePaneRequest struct {	12		type movePaneRequest struct {
13	-	Attachment *attachedClient	13	+	Attachment *attachedClient
14	-	AttachmentToken attachmentConnectionToken	14	+	AttachmentCapability attachmentCapability
15	-	Source moveSessionLocator	15	+	Source moveSessionLocator
16	-	SourceTabID domain.TabStableID	16	+	SourceTabID domain.TabStableID
17	-	SourcePaneID domain.PaneStableID	17	+	SourcePaneID domain.PaneStableID
18	-	Destination moveSessionLocator	18	+	Destination moveSessionLocator
19	-	DestinationTabID domain.TabStableID	19	+	DestinationTabID domain.TabStableID
20		}	20		}
21			21
22		type moveTabRequest struct {	22		type moveTabRequest struct {
23	-	Attachment *attachedClient	23	+	Attachment *attachedClient
24	-	AttachmentToken attachmentConnectionToken	24	+	AttachmentCapability attachmentCapability
25	-	Source moveSessionLocator	25	+	Source moveSessionLocator
26	-	SourceTabID domain.TabStableID	26	+	SourceTabID domain.TabStableID
27	-	Destination moveSessionLocator	27	+	Destination moveSessionLocator
28		}	28		}
29			29
30		// movePane resolves, reserves, validates, and commits one pane relocation. All	30		// movePane resolves, reserves, validates, and commits one pane relocation. All

@@ -115,7 +115,7 @@ func (d *Daemon) movePane(req movePaneRequest) (result error) {
115		// A final source tab is retired without transferring any attachment to the	115		// A final source tab is retired without transferring any attachment to the
116		// destination. Freeze every affected source connection before publication so	116		// destination. Freeze every affected source connection before publication so
117		// teardown invalidates exact generations rather than racing input or render.	117		// teardown invalidates exact generations rather than racing input or render.
118	-	var frozen frozenAttachmentEffectGates	118	+	var frozen attachmentTransitionGuard
119		var sourceEffectsFrozen bool	119		var sourceEffectsFrozen bool
120		if finalSourceTab && source != destination && len(admission.sourceAttachments) != 0 {	120		if finalSourceTab && source != destination && len(admission.sourceAttachments) != 0 {
121		interrupts := make([]attachmentTransportInterrupt, 0, len(admission.sourceAttachments))	121		interrupts := make([]attachmentTransportInterrupt, 0, len(admission.sourceAttachments))

M internal/usecase/daemon/move_attachments.go +0 -7

@@ -1,11 +1,5 @@
1		package daemon	1	package daemon
2			2
3	-	func moveAttachmentTokenCurrentLocked(token attachmentConnectionToken, sess *session) bool {
4	-	return token.sess == sess && token.ac != nil && token.generation == token.ac.connectionGeneration.Load() &&
5	-	token.ac.currentAttachmentSession() == sess && token.ac.transportSnapshotCurrent(token.transport) &&
6	-	attachmentRegisteredLocked(sess, token.ac)
7	-	}
8	-
9		// sameMoveAttachmentsLocked reports whether the source membership is unchanged	3	// sameMoveAttachmentsLocked reports whether the source membership is unchanged
10		// since admission. Caller holds the source session lock.	4	// since admission. Caller holds the source session lock.
11		func sameMoveAttachmentsLocked(sess session, admitted []attachedClient) bool {	5	func sameMoveAttachmentsLocked(sess session, admitted []attachedClient) bool {

@@ -33,7 +27,6 @@ func detachMoveAttachmentsLocked(sess session, transports map[attachedClient]t
33		retired := make([]detachedAttachmentSnapshot, 0, len(attachments))	27	retired := make([]detachedAttachmentSnapshot, 0, len(attachments))
34		for _, ac := range attachments {	28	for _, ac := range attachments {
35		retired = append(retired, detachedAttachmentSnapshot{ac: ac, transport: transports[ac]})	29	retired = append(retired, detachedAttachmentSnapshot{ac: ac, transport: transports[ac]})
36	-	ac.connectionGeneration.Add(1)
37		ac.setSession(nil)	30	ac.setSession(nil)
38		ac.invalidateFrozenAttachmentCapability()	31	ac.invalidateFrozenAttachmentCapability()
39		}	32	}

M internal/usecase/daemon/move_cleanup_test.go +1 -1


@@ -103,7 +103,7 @@ func TestMovePaneReleasesResizeFencesBeforeAttachmentCleanup(t *testing.T) {
103		require.False(t, awaitTestValue(t, resizeDone, "resize commit did not drop stale owner"))	103		require.False(t, awaitTestValue(t, resizeDone, "resize commit did not drop stale owner"))
104		}	104		}
105			105
106	-	func TestMovePaneCleanupUsesCommitPointSourceAttachmentToken(t *testing.T) {	106	+	func TestMovePaneCleanupUsesCapturedSourceAttachment(t *testing.T) {
107		movedPTY, releaseMoved := newBlockingPTY(t)	107		movedPTY, releaseMoved := newBlockingPTY(t)
108		remainingPTY, releaseRemaining := newBlockingPTY(t)	108		remainingPTY, releaseRemaining := newBlockingPTY(t)
109		destinationPTY, releaseDestination := newBlockingPTY(t)	109		destinationPTY, releaseDestination := newBlockingPTY(t)

M internal/usecase/daemon/move_gate_race_test.go +2 -2


@@ -194,11 +194,11 @@ func TestPaletteFinalCloseEndsCurrentEffectBeforeDrainingPeers(t *testing.T) {
194		sess.mu.Unlock()	194		sess.mu.Unlock()
195		d.attachCoordinator(sess, nil, other, true)	195		d.attachCoordinator(sess, nil, other, true)
196			196
197	-	currentToken := sess.attachmentToken(current, current.transport())	197	+	currentToken := sess.captureAttachmentCapability(current, current.transport())
198		currentEffect, admitted := current.beginAttachmentEffect(currentToken)	198		currentEffect, admitted := current.beginAttachmentEffect(currentToken)
199		require.True(t, admitted)	199		require.True(t, admitted)
200		t.Cleanup(currentEffect.End)	200		t.Cleanup(currentEffect.End)
201	-	otherToken := sess.attachmentToken(other, otherTransport)	201	+	otherToken := sess.captureAttachmentCapability(other, otherTransport)
202		otherEffect, admitted := other.beginAttachmentEffect(otherToken)	202		otherEffect, admitted := other.beginAttachmentEffect(otherToken)
203		require.True(t, admitted)	203		require.True(t, admitted)
204		t.Cleanup(otherEffect.End)	204		t.Cleanup(otherEffect.End)

M internal/usecase/daemon/move_pane_admission.go +1 -1


@@ -32,7 +32,7 @@ func (d *Daemon) snapshotMovePaneAdmission(req movePaneRequest, source, destinat
32		if req.Attachment != nil && !attachmentRegisteredLocked(source, req.Attachment) {	32		if req.Attachment != nil && !attachmentRegisteredLocked(source, req.Attachment) {
33		return nil, errMoveStaleTarget	33		return nil, errMoveStaleTarget
34		}	34		}
35	-	if req.AttachmentToken.ac != nil && (req.AttachmentToken.ac != req.Attachment \|\| !moveAttachmentTokenCurrentLocked(req.AttachmentToken, source)) {	35	+	if req.AttachmentCapability.ac != nil && (req.AttachmentCapability.ac != req.Attachment \|\| !req.AttachmentCapability.currentInSessionLocked(source)) {
36		return nil, errMoveStaleTarget	36		return nil, errMoveStaleTarget
37		}	37		}
38			38

M internal/usecase/daemon/move_pane_commit.go +2 -2


@@ -17,7 +17,7 @@ type movePaneCommit struct {
17		sourceTransports map[*attachedClient]transportSnapshot	17		sourceTransports map[*attachedClient]transportSnapshot
18		sourceGeneration uint64	18		sourceGeneration uint64
19		destinationGeneration uint64	19		destinationGeneration uint64
20	-	frozenEffects frozenAttachmentEffectGates	20	+	frozenEffects attachmentTransitionGuard
21		err error	21		err error
22			22
23		syncCleanup syncTimerCleanup	23		syncCleanup syncTimerCleanup

@@ -51,7 +51,7 @@ func (c movePaneCommit) publishLocked(d Daemon) bool {
51		if c.req.Attachment != nil && !attachmentRegisteredLocked(c.source, c.req.Attachment) {	51		if c.req.Attachment != nil && !attachmentRegisteredLocked(c.source, c.req.Attachment) {
52		return false	52		return false
53		}	53		}
54	-	if c.req.AttachmentToken.ac != nil && (c.req.AttachmentToken.ac != c.req.Attachment \|\| !moveAttachmentTokenCurrentLocked(c.req.AttachmentToken, c.source)) {	54	+	if c.req.AttachmentCapability.ac != nil && (c.req.AttachmentCapability.ac != c.req.Attachment \|\| !c.req.AttachmentCapability.currentInSessionLocked(c.source)) {
55		return false	55		return false
56		}	56		}
57			57

M internal/usecase/daemon/move_pane_postcommit.go +1 -1


@@ -29,7 +29,7 @@ type movePanePostcommitPlan struct {
29		operation string	29		operation string
30		sourceAttachments []*attachedClient	30		sourceAttachments []*attachedClient
31		syncCleanup syncTimerCleanup	31		syncCleanup syncTimerCleanup
32	-	frozenEffects frozenAttachmentEffectGates	32	+	frozenEffects attachmentTransitionGuard
33		effectsFrozen bool	33		effectsFrozen bool
34		unlockDispatch func()	34		unlockDispatch func()
35		reservation *moveLifecycleReservation	35		reservation *moveLifecycleReservation

M internal/usecase/daemon/move_picker.go +20 -20


@@ -16,7 +16,7 @@ func (d *Daemon) movePickerSourceError(source moveSourceLocator) error {
16		}	16		}
17		sess.mu.Lock()	17		sess.mu.Lock()
18		defer sess.mu.Unlock()	18		defer sess.mu.Unlock()
19	-	if source.AttachmentToken.ac != nil && !moveAttachmentTokenCurrentLocked(source.AttachmentToken, sess) {	19	+	if source.AttachmentCapability.ac != nil && !source.AttachmentCapability.currentInSessionLocked(sess) {
20		return domain.UserWarn(domain.NoticeSessionUnavailable, "Source attachment is no longer active.", errMovePaneInvalid)	20		return domain.UserWarn(domain.NoticeSessionUnavailable, "Source attachment is no longer active.", errMovePaneInvalid)
21		}	21		}
22		if source.Attachment != nil && !attachmentRegisteredLocked(sess, source.Attachment) {	22		if source.Attachment != nil && !attachmentRegisteredLocked(sess, source.Attachment) {

@@ -52,11 +52,11 @@ type moveSessionLocator struct {
52		}	52		}
53			53
54		type moveSourceLocator struct {	54		type moveSourceLocator struct {
55	-	Session moveSessionLocator	55	+	Session moveSessionLocator
56	-	TabID domain.TabStableID	56	+	TabID domain.TabStableID
57	-	PaneID domain.PaneStableID	57	+	PaneID domain.PaneStableID
58	-	Attachment *attachedClient	58	+	Attachment *attachedClient
59	-	AttachmentToken attachmentConnectionToken	59	+	AttachmentCapability attachmentCapability
60		}	60		}
61			61
62		// enterPickerForIntent returns errNoMoveDestination only for move intents.	62		// enterPickerForIntent returns errNoMoveDestination only for move intents.

@@ -64,8 +64,8 @@ func (d Daemon) enterPickerForIntent(sess session, ac *attachedClient, intent
64		if intent != pickerNavigate && !sess.capabilities().yieldsMoves() {	64		if intent != pickerNavigate && !sess.capabilities().yieldsMoves() {
65		return errSessionCannotYieldMoves	65		return errSessionCannotYieldMoves
66		}	66		}
67	-	if source.Attachment != nil && source.AttachmentToken.ac == nil {	67	+	if source.Attachment != nil && source.AttachmentCapability.ac == nil {
68	-	source.AttachmentToken = sess.attachmentToken(source.Attachment, source.Attachment.transport())	68	+	source.AttachmentCapability = sess.captureAttachmentCapability(source.Attachment, source.Attachment.transport())
69		}	69		}
70		model := d.newPickerModel(sess, ac, intent, source, picker.SourceFilter{})	70		model := d.newPickerModel(sess, ac, intent, source, picker.SourceFilter{})
71		if intent != pickerNavigate {	71		if intent != pickerNavigate {

@@ -97,21 +97,21 @@ func (d *Daemon) commitMovePickerSelection(intent pickerIntent, source moveSourc
97		return errMovePaneInvalid	97		return errMovePaneInvalid
98		}	98		}
99		return d.movePane(movePaneRequest{	99		return d.movePane(movePaneRequest{
100	-	Attachment: source.Attachment,	100	+	Attachment: source.Attachment,
101	-	AttachmentToken: source.AttachmentToken,	101	+	AttachmentCapability: source.AttachmentCapability,
102	-	Source: source.Session,	102	+	Source: source.Session,
103	-	SourceTabID: source.TabID,	103	+	SourceTabID: source.TabID,
104	-	SourcePaneID: source.PaneID,	104	+	SourcePaneID: source.PaneID,
105	-	Destination: destination,	105	+	Destination: destination,
106	-	DestinationTabID: target.TabID,	106	+	DestinationTabID: target.TabID,
107		})	107		})
108		case pickerMoveTab:	108		case pickerMoveTab:
109		return d.moveTab(moveTabRequest{	109		return d.moveTab(moveTabRequest{
110	-	Attachment: source.Attachment,	110	+	Attachment: source.Attachment,
111	-	AttachmentToken: source.AttachmentToken,	111	+	AttachmentCapability: source.AttachmentCapability,
112	-	Source: source.Session,	112	+	Source: source.Session,
113	-	SourceTabID: source.TabID,	113	+	SourceTabID: source.TabID,
114	-	Destination: destination,	114	+	Destination: destination,
115		})	115		})
116		default:	116		default:
117		return errMovePaneInvalid	117		return errMovePaneInvalid

M internal/usecase/daemon/move_tab.go +4 -4


@@ -28,7 +28,7 @@ type moveTabCommit struct {
28		destination *session	28		destination *session
29		admission moveTabAdmission	29		admission moveTabAdmission
30		sourceEffectsFrozen bool	30		sourceEffectsFrozen bool
31	-	frozenEffects frozenAttachmentEffectGates	31	+	frozenEffects attachmentTransitionGuard
32		syncCleanup syncTimerCleanup	32		syncCleanup syncTimerCleanup
33		oldTabCancel context.CancelFunc	33		oldTabCancel context.CancelFunc
34		sourceEmpty bool	34		sourceEmpty bool

@@ -110,7 +110,7 @@ func (d *Daemon) moveTab(req moveTabRequest) (result error) {
110		d.afterMoveTabSourceSnapshot()	110		d.afterMoveTabSourceSnapshot()
111		}	111		}
112		commit := moveTabCommit{req: req, source: source, destination: destination, admission: *admission}	112		commit := moveTabCommit{req: req, source: source, destination: destination, admission: *admission}
113	-	var frozen frozenAttachmentEffectGates	113	+	var frozen attachmentTransitionGuard
114		if admission.finalSource && len(admission.sourceAttachments) != 0 {	114		if admission.finalSource && len(admission.sourceAttachments) != 0 {
115		interrupts := make([]attachmentTransportInterrupt, 0, len(admission.sourceAttachments))	115		interrupts := make([]attachmentTransportInterrupt, 0, len(admission.sourceAttachments))
116		for _, ac := range admission.sourceAttachments {	116		for _, ac := range admission.sourceAttachments {

@@ -190,7 +190,7 @@ func (d *Daemon) snapshotMoveTabAdmission(req moveTabRequest, source, destinatio
190		if req.Attachment != nil && !attachmentRegisteredLocked(source, req.Attachment) {	190		if req.Attachment != nil && !attachmentRegisteredLocked(source, req.Attachment) {
191		return nil, errMoveStaleTarget	191		return nil, errMoveStaleTarget
192		}	192		}
193	-	if req.AttachmentToken.ac != nil && (req.AttachmentToken.ac != req.Attachment \|\| !moveAttachmentTokenCurrentLocked(req.AttachmentToken, source)) {	193	+	if req.AttachmentCapability.ac != nil && (req.AttachmentCapability.ac != req.Attachment \|\| !req.AttachmentCapability.currentInSessionLocked(source)) {
194		return nil, errMoveStaleTarget	194		return nil, errMoveStaleTarget
195		}	195		}
196		moved := findMoveTabLocked(source, req.SourceTabID)	196		moved := findMoveTabLocked(source, req.SourceTabID)

@@ -251,7 +251,7 @@ func (c moveTabCommit) publishLocked(d Daemon, fencedPanes []*pane) bool {
251		if c.req.Attachment != nil && !attachmentRegisteredLocked(c.source, c.req.Attachment) {	251		if c.req.Attachment != nil && !attachmentRegisteredLocked(c.source, c.req.Attachment) {
252		return false	252		return false
253		}	253		}
254	-	if c.req.AttachmentToken.ac != nil && (c.req.AttachmentToken.ac != c.req.Attachment \|\| !moveAttachmentTokenCurrentLocked(c.req.AttachmentToken, c.source)) {	254	+	if c.req.AttachmentCapability.ac != nil && (c.req.AttachmentCapability.ac != c.req.Attachment \|\| !c.req.AttachmentCapability.currentInSessionLocked(c.source)) {
255		return false	255		return false
256		}	256		}
257		moved := c.admission.tab	257		moved := c.admission.tab

M internal/usecase/daemon/move_tab_test.go +3 -3


@@ -408,12 +408,12 @@ func (r *moveTabPurgeRepository) DeleteIncarnation(_ context.Context, id domain.
408		sourceFenceUnlocked := r.source.layoutApplyMu.TryLock()	408		sourceFenceUnlocked := r.source.layoutApplyMu.TryLock()
409		destinationFenceUnlocked := r.destination.layoutApplyMu.TryLock()	409		destinationFenceUnlocked := r.destination.layoutApplyMu.TryLock()
410		tabFenceUnlocked := r.moved.layoutApplyMu.TryLock()	410		tabFenceUnlocked := r.moved.layoutApplyMu.TryLock()
411	-	roleUnlocked := r.client.attachmentEffects.mu.TryLock()	411	+	roleUnlocked := r.client.lifecycle.mu.TryLock()
412	-	roleStable := roleUnlocked && r.client.attachmentEffects.phase == attachmentEffectsStable	412	+	roleStable := roleUnlocked && r.client.lifecycle.phase == attachmentEffectsStable
413		r.outside = daemonUnlocked && routingUnlocked && sourceUnlocked && destinationUnlocked && tabUnlocked && paneUnlocked &&	413		r.outside = daemonUnlocked && routingUnlocked && sourceUnlocked && destinationUnlocked && tabUnlocked && paneUnlocked &&
414		sourceFenceUnlocked && destinationFenceUnlocked && tabFenceUnlocked && roleStable	414		sourceFenceUnlocked && destinationFenceUnlocked && tabFenceUnlocked && roleStable
415		if roleUnlocked {	415		if roleUnlocked {
416	-	r.client.attachmentEffects.mu.Unlock()	416	+	r.client.lifecycle.mu.Unlock()
417		}	417		}
418		if tabFenceUnlocked {	418		if tabFenceUnlocked {
419		r.moved.layoutApplyMu.Unlock()	419		r.moved.layoutApplyMu.Unlock()

M internal/usecase/daemon/navigation_attachment_handoff_test.go +15 -15


@@ -17,25 +17,25 @@ func TestNavigationHandoffsDropReplacedInitiatorWithoutMutation(t *testing.T) {
17		name string	17		name string
18		releasedAction string	18		releasedAction string
19		wantErr bool	19		wantErr bool
20	-	run func(Daemon, session, session, attachedClient, *attachmentEffectTicket) error	20	+	run func(Daemon, session, session, attachedClient, *attachmentEffect) error
21		check func(testing.T, Daemon, session, session)	21		check func(testing.T, Daemon, session, session)
22		}{	22		}{
23		{	23		{
24		name: "picker selection", releasedAction: "detach",	24		name: "picker selection", releasedAction: "detach",
25	-	run: func(d Daemon, source, target session, ac attachedClient, effect attachmentEffectTicket) error {	25	+	run: func(d Daemon, source, target session, ac attachedClient, effect attachmentEffect) error {
26		d.enterPicker(source, ac)	26		d.enterPicker(source, ac)
27	-	return d.switchToTargetForAttachment(effect.connectionToken(), picker.Target{Session: target.id, TabIndex: 1}, sessionHandoffGuard{}, "picker-select")	27	+	return d.switchToTargetForAttachment(effect, picker.Target{Session: target.id, TabIndex: 1}, sessionHandoffGuard{}, "picker-select")
28		},	28		},
29		},	29		},
30		{	30		{
31		name: "palette session", releasedAction: "detach",	31		name: "palette session", releasedAction: "detach",
32	-	run: func(d Daemon, _ session, target session, _ attachedClient, effect *attachmentEffectTicket) error {	32	+	run: func(d Daemon, _ session, target session, _ attachedClient, effect *attachmentEffect) error {
33	-	return d.switchToTargetForAttachment(effect.connectionToken(), picker.Target{Session: target.id, TabIndex: 1}, sessionHandoffGuard{}, "palette-session")	33	+	return d.switchToTargetForAttachment(effect, picker.Target{Session: target.id, TabIndex: 1}, sessionHandoffGuard{}, "palette-session")
34		},	34		},
35		},	35		},
36		{	36		{
37		name: "session overflow", releasedAction: "detach",	37		name: "session overflow", releasedAction: "detach",
38	-	run: func(d Daemon, source, target session, ac attachedClient, effect attachmentEffectTicket) error {	38	+	run: func(d Daemon, source, target session, ac attachedClient, effect attachmentEffect) error {
39		source.mu.Lock()	39		source.mu.Lock()
40		source.name = "alpha"	40		source.name = "alpha"
41		source.mu.Unlock()	41		source.mu.Unlock()

@@ -48,13 +48,13 @@ func TestNavigationHandoffsDropReplacedInitiatorWithoutMutation(t *testing.T) {
48		},	48		},
49		{	49		{
50		name: "stopped session resume", releasedAction: "detach",	50		name: "stopped session resume", releasedAction: "detach",
51	-	run: func(d Daemon, _ session, target session, _ attachedClient, effect *attachmentEffectTicket) error {	51	+	run: func(d Daemon, _ session, target session, _ attachedClient, effect *attachmentEffect) error {
52		d.mu.Lock()	52		d.mu.Lock()
53		delete(d.sessions, target.id)	53		delete(d.sessions, target.id)
54		d.inactive["stopped"] = inactiveSession{name: "stopped", cwd: "/tmp", createdAt: 9, incarnation: domain.IncarnationID{2}, state: ports.SessionDown}	54		d.inactive["stopped"] = inactiveSession{name: "stopped", cwd: "/tmp", createdAt: 9, incarnation: domain.IncarnationID{2}, state: ports.SessionDown}
55		d.mu.Unlock()	55		d.mu.Unlock()
56		expectedCreatedAt := int64(9)	56		expectedCreatedAt := int64(9)
57	-	return d.switchToTargetForAttachment(effect.connectionToken(), picker.Target{Name: "stopped", Stopped: true, ExpectedCreatedAt: &expectedCreatedAt}, sessionHandoffGuard{}, "stopped-session")	57	+	return d.switchToTargetForAttachment(effect, picker.Target{Name: "stopped", Stopped: true, ExpectedCreatedAt: &expectedCreatedAt}, sessionHandoffGuard{}, "stopped-session")
58		},	58		},
59		check: func(t testing.T, d Daemon, _, _ *session) {	59		check: func(t testing.T, d Daemon, _, _ *session) {
60		d.mu.Lock()	60		d.mu.Lock()

@@ -67,8 +67,8 @@ func TestNavigationHandoffsDropReplacedInitiatorWithoutMutation(t *testing.T) {
67		},	67		},
68		{	68		{
69		name: "transition prompt creation", releasedAction: "create-session", wantErr: true,	69		name: "transition prompt creation", releasedAction: "create-session", wantErr: true,
70	-	run: func(d Daemon, _ session, _ session, _ attachedClient, effect *attachmentEffectTicket) error {	70	+	run: func(d Daemon, _ session, _ session, _ attachedClient, effect *attachmentEffect) error {
71	-	return d.createSessionAndSwitchForAttachment(effect.connectionToken(), "created")	71	+	return d.createSessionAndSwitchForAttachment(effect, "created")
72		},	72		},
73		check: func(t testing.T, d Daemon, _, _ *session) {	73		check: func(t testing.T, d Daemon, _, _ *session) {
74		d.mu.Lock()	74		d.mu.Lock()

@@ -93,9 +93,9 @@ func TestNavigationHandoffsDropReplacedInitiatorWithoutMutation(t *testing.T) {
93		d.mu.Unlock()	93		d.mu.Unlock()
94			94
95		rc := d.attachCoordinator(source, nil, old, true)	95		rc := d.attachCoordinator(source, nil, old, true)
96	-	token := source.attachmentToken(old, old.transport())	96	+	token := source.captureAttachmentCapability(old, old.transport())
97		token.lease = rc.attachmentLease(old)	97		token.lease = rc.attachmentLease(old)
98	-	old.publishAttachmentCapability(token)	98	+	old.installTestAttachmentCapability(token)
99		effect, admitted := old.beginAttachmentEffect(token)	99		effect, admitted := old.beginAttachmentEffect(token)
100		require.True(t, admitted)	100		require.True(t, admitted)
101			101

@@ -153,9 +153,9 @@ func TestStoppedSessionHandoffDoesNotResumeAfterInitiatorReplacement(t *testing.
153		d.mu.Unlock()	153		d.mu.Unlock()
154			154
155		rc := d.attachCoordinator(source, nil, old, true)	155		rc := d.attachCoordinator(source, nil, old, true)
156	-	token := source.attachmentToken(old, old.transport())	156	+	token := source.captureAttachmentCapability(old, old.transport())
157		token.lease = rc.attachmentLease(old)	157		token.lease = rc.attachmentLease(old)
158	-	old.publishAttachmentCapability(token)	158	+	old.installTestAttachmentCapability(token)
159		effect, admitted := old.beginAttachmentEffect(token)	159		effect, admitted := old.beginAttachmentEffect(token)
160		require.True(t, admitted)	160		require.True(t, admitted)
161			161

@@ -171,7 +171,7 @@ func TestStoppedSessionHandoffDoesNotResumeAfterInitiatorReplacement(t *testing.
171		expectedCreatedAt := int64(7)	171		expectedCreatedAt := int64(7)
172		done := make(chan error, 1)	172		done := make(chan error, 1)
173		go func() {	173		go func() {
174	-	done <- d.switchToTargetForAttachment(effect.connectionToken(), picker.Target{Name: "stopped", Stopped: true, ExpectedCreatedAt: &expectedCreatedAt}, sessionHandoffGuard{}, "picker-stopped")	174	+	done <- d.switchToTargetForAttachment(effect, picker.Target{Name: "stopped", Stopped: true, ExpectedCreatedAt: &expectedCreatedAt}, sessionHandoffGuard{}, "picker-stopped")
175		}()	175		}()
176		select {	176		select {
177		case <-ended:	177		case <-ended:

M internal/usecase/daemon/navigation_attachment_incarnation_test.go +8 -8


@@ -19,9 +19,9 @@ func TestNavigationHandoffRejectsReplacedTargetLifecycleAtPublication(t *testing
19		d.mu.Unlock()	19		d.mu.Unlock()
20			20
21		rc := d.attachCoordinator(source, nil, ac, true)	21		rc := d.attachCoordinator(source, nil, ac, true)
22	-	token := source.attachmentToken(ac, ac.transport())	22	+	token := source.captureAttachmentCapability(ac, ac.transport())
23		token.lease = rc.attachmentLease(ac)	23		token.lease = rc.attachmentLease(ac)
24	-	ac.publishAttachmentCapability(token)	24	+	ac.installTestAttachmentCapability(token)
25		effect, admitted := ac.beginAttachmentEffect(token)	25		effect, admitted := ac.beginAttachmentEffect(token)
26		require.True(t, admitted)	26		require.True(t, admitted)
27			27

@@ -30,7 +30,7 @@ func TestNavigationHandoffRejectsReplacedTargetLifecycleAtPublication(t *testing
30		// transition's lifecycle fence is validated.	30		// transition's lifecycle fence is validated.
31		target.incarnation = domain.SessionLifecycleID{2}	31		target.incarnation = domain.SessionLifecycleID{2}
32		}	32		}
33	-	err := d.switchToTargetForAttachment(effect.connectionToken(), picker.Target{	33	+	err := d.switchToTargetForAttachment(effect, picker.Target{
34		Session: target.id,	34		Session: target.id,
35		Incarnation: domain.SessionLifecycleID{1},	35		Incarnation: domain.SessionLifecycleID{1},
36		TabID: domain.TabStableID(target.tabs[1].stableID),	36		TabID: domain.TabStableID(target.tabs[1].stableID),

@@ -69,9 +69,9 @@ func TestNavigationHandoffDoesNotMutateAfterInitiatorIncarnationChanges(t *testi
69		name: "transport incarnation rebound on same attachment",	69		name: "transport incarnation rebound on same attachment",
70		rebind: func(t testing.T, _ Daemon, source session, ac attachedClient) {	70		rebind: func(t testing.T, _ Daemon, source session, ac attachedClient) {
71		ac.replaceTransport(&closeTrackingTransport{})	71		ac.replaceTransport(&closeTrackingTransport{})
72	-	current := source.attachmentToken(ac, ac.transport())	72	+	current := source.captureAttachmentCapability(ac, ac.transport())
73		current.lease = source.renderCoordinator().attachmentLease(ac)	73		current.lease = source.renderCoordinator().attachmentLease(ac)
74	-	ac.publishAttachmentCapability(current)	74	+	ac.installTestAttachmentCapability(current)
75		},	75		},
76		},	76		},
77		}	77		}

@@ -88,9 +88,9 @@ func TestNavigationHandoffDoesNotMutateAfterInitiatorIncarnationChanges(t *testi
88		d.mu.Unlock()	88		d.mu.Unlock()
89			89
90		rc := d.attachCoordinator(source, nil, ac, true)	90		rc := d.attachCoordinator(source, nil, ac, true)
91	-	token := source.attachmentToken(ac, ac.transport())	91	+	token := source.captureAttachmentCapability(ac, ac.transport())
92		token.lease = rc.attachmentLease(ac)	92		token.lease = rc.attachmentLease(ac)
93	-	ac.publishAttachmentCapability(token)	93	+	ac.installTestAttachmentCapability(token)
94		effect, admitted := ac.beginAttachmentEffect(token)	94		effect, admitted := ac.beginAttachmentEffect(token)
95		require.True(t, admitted)	95		require.True(t, admitted)
96			96

@@ -104,7 +104,7 @@ func TestNavigationHandoffDoesNotMutateAfterInitiatorIncarnationChanges(t *testi
104		}	104		}
105		done := make(chan error, 1)	105		done := make(chan error, 1)
106		go func() {	106		go func() {
107	-	done <- d.switchToTargetForAttachment(effect.connectionToken(), picker.Target{Session: target.id, TabIndex: 1}, sessionHandoffGuard{}, "test-handoff")	107	+	done <- d.switchToTargetForAttachment(effect, picker.Target{Session: target.id, TabIndex: 1}, sessionHandoffGuard{}, "test-handoff")
108		}()	108		}()
109		awaitTestCompletion(t, ended, "test handoff did not release its role ticket")	109		awaitTestCompletion(t, ended, "test handoff did not release its role ticket")
110		tt.rebind(t, d, source, ac)	110		tt.rebind(t, d, source, ac)

M internal/usecase/daemon/overlay_runtime.go +3 -3


@@ -53,7 +53,7 @@ type overlayRuntime struct {
53		promptMu sync.Mutex	53		promptMu sync.Mutex
54		prompt *promptui.Model	54		prompt *promptui.Model
55		promptSubmit func(string) error	55		promptSubmit func(string) error
56	-	promptTransitionSubmit func(string, attachmentConnectionToken) error	56	+	promptTransitionSubmit func(string, *attachmentEffect) error
57		promptPending []byte	57		promptPending []byte
58			58
59		resizeMu sync.Mutex	59		resizeMu sync.Mutex

@@ -247,12 +247,12 @@ func (rt overlayRuntime) clearCopyModeForPane(p pane) bool {
247		return active \|\| prePublication	247		return active \|\| prePublication
248		}	248		}
249			249
250	-	func (rt overlayRuntime) HandleInput(d Daemon, data []byte, effects ...*attachmentEffectTicket) bool {	250	+	func (rt overlayRuntime) HandleInput(d Daemon, data []byte, effects ...*attachmentEffect) bool {
251		if rt == nil \|\| rt.ac == nil {	251		if rt == nil \|\| rt.ac == nil {
252		return false	252		return false
253		}	253		}
254		ac := rt.ac	254		ac := rt.ac
255	-	var effect *attachmentEffectTicket	255	+	var effect *attachmentEffect
256		if len(effects) != 0 {	256		if len(effects) != 0 {
257		effect = effects[0]	257		effect = effects[0]
258		}	258		}

M internal/usecase/daemon/palette.go +22 -16

 	d.paletteRecent = recent
 }
-func (d *Daemon) handlePaletteInput(ac *attachedClient, data []byte, effects ...*attachmentEffectTicket) {
+func (d *Daemon) handlePaletteInput(ac *attachedClient, data []byte, effects ...*attachmentEffect) {
 	entry := ac.currentAttachmentSession()
 	if entry == nil {
 		return
 	var rawQuery string
 	changed, cancel, execute := false, false, false
 	var closedDiscovery remoteDiscoveryInstance
-	var effect *attachmentEffectTicket
+	var effect *attachmentEffect
 	if len(effects) != 0 {
 		effect = effects[0]
 	}
 			RemoteKey: &remoteKey, RemoteTarget: &remoteTarget, RemoteHost: remoteKey.Host,
 			UnavailableReason: remoteUnavailableReason, TabIndex: -1,
 		}
-		err := d.switchToTargetForAttachment(effect.connectionToken(), target, sessionHandoffGuard{}, "palette-remote-session")
+		err := d.switchToTargetForAttachment(effect, target, sessionHandoffGuard{}, "palette-remote-session")
 		if err == nil {
 			d.closeExecutedPalette(ac, generation, rawQuery)
 			return
 		}
 		var err error
 		if effect != nil {
-			err = d.switchToTargetForAttachment(effect.connectionToken(), target, sessionHandoffGuard{allowSamePeer: true}, "palette-session")
+			err = d.switchToTargetForAttachment(effect, target, sessionHandoffGuard{allowSamePeer: true}, "palette-session")
 		} else {
 			err = d.switchToTarget(sess, ac, target)
 		}
 	sess.dispatchMu.Unlock()
 	if attachmentHandoff {
 		if current := ac.currentSession(); current != nil {
-			currentToken := current.attachmentToken(ac, ac.transport())
+			currentToken := current.captureAttachmentCapability(ac, ac.transport())
 			fresh, admitted := ac.beginAttachmentEffect(currentToken)
 			if d.closeExecutedPalette(ac, generation, rawQuery) {
 				d.invalidateRender(current, ac, true, "palette.go")
 	ac                  *attachedClient
 	routeSnapshot       ports.RecentRouteSnapshot
 	actions             daemonActionRunner
-	effect              *attachmentEffectTicket
+	effect              *attachmentEffect
 	redrawClosedPalette bool
 }
 	if entry == nil {
 		entry = e.sess
 	}
-	e.d.enterTransitionPrompt(entry, e.ac, " Create session ", "", func(name string, token attachmentConnectionToken) error {
+	e.d.enterTransitionPrompt(entry, e.ac, " Create session ", "", func(name string, effect *attachmentEffect) error {
-		if token.ac == nil {
+		if effect == nil || effect.ac == nil {
 			if e.sess == nil {
 				return errAttachmentTransition
 			}
 			return e.d.createSessionAndSwitch(e.sess, e.ac, name)
 		}
-		return e.d.createSessionAndSwitchForAttachment(token, name)
+		return e.d.createSessionAndSwitchForAttachment(effect, name)
 	})
 	return nil
 }
 	if e.effect == nil {
 		return e.d.createSessionAndSwitch(e.sess, e.ac, name)
 	}
-	return e.d.createSessionAndSwitchForAttachment(e.effect.connectionToken(), name)
+	return e.d.createSessionAndSwitchForAttachment(e.effect, name)
 }
 func (e paletteExec) CreateEphemeralSession() error {
 	if e.effect == nil {
 		return e.d.createEphemeralSessionAndSwitch(e.sess, e.ac)
 	}
-	return e.d.createEphemeralSessionAndSwitchForAttachment(e.effect.connectionToken())
+	return e.d.createEphemeralSessionAndSwitchForAttachment(e.effect)
 }
 func (e paletteExec) CloseTab() error {
 func (e paletteExec) BackSession() error {
 	if e.effect != nil {
-		return e.d.backSessionForAttachment(e.effect.connectionToken())
+		return e.d.backSessionForAttachment(e.effect)
 	}
 	e.d.backSession(e.sess, e.ac)
 	return nil
 func (e paletteExec) Detach() error {
 	if e.effect != nil {
-		if !e.d.clientGoneForAttachment(e.effect.connectionToken(), true) {
+		if !e.d.clientGoneForAttachment(e.effect, true) {
 			return errAttachmentTransition
 		}
 		return nil
 func (e paletteExec) OpenSessionPicker() error {
 	if e.ac != nil && e.ac.navigationCapabilities&ports.NavigationCapabilityHomePicker != 0 && e.effect != nil {
-		return e.d.sendNavigationActionForAttachment(e.effect.connectionToken(), ports.NavigationOpenHomePicker)
+		return e.d.sendNavigationActionForAttachment(e.effect, ports.NavigationOpenHomePicker)
 	}
 	e.d.enterPicker(e.sess, e.ac)
 	return nil
 		e.d.beforeRecentSessionHandoff()
 	}
 	if e.effect != nil {
-		return e.d.sendRecentRouteNavigationActionForAttachment(e.effect.connectionToken(), action)
+		return e.d.sendRecentRouteNavigationActionForAttachment(e.effect, action)
 	}
 	if e.ac == nil || e.attachment == nil {
 		return errAttachmentTransition
 	}
-	return e.d.sendRecentRouteNavigationActionForAttachment(e.attachment.attachmentToken(e.ac, e.ac.transport()), action)
+	capability := e.attachment.captureAttachmentCapability(e.ac, e.ac.transport())
+	effect, admitted := e.ac.beginAttachmentEffect(capability)
+	if !admitted {
+		return errAttachmentTransition
+	}
+	defer effect.End()
+	return e.d.sendRecentRouteNavigationActionForAttachment(effect, action)
 }
 func composePaletteClientFrame(model *palette.Model, base renderer.Frame, cfg domain.PaletteConfig, guidance string, styles ...themeui.Styles) (renderer.Frame, []renderer.Damage) {

M internal/usecase/daemon/palette_test.go +8 -9

 	}
 }
-func beginRecentRoutePaletteEffect(t *testing.T, d *Daemon, sess *session, ac *attachedClient) attachmentConnectionToken {
+func beginRecentRoutePaletteEffect(t *testing.T, d *Daemon, sess *session, ac *attachedClient) *attachmentEffect {
 	t.Helper()
 	transport := ac.transport()
 	rc := d.attachCoordinator(sess, nil, ac, true)
-	token := sess.attachmentToken(ac, transport)
+	token := sess.captureAttachmentCapability(ac, transport)
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
 	t.Cleanup(effect.End)
-	token.effect = effect
+	return effect
-	return token
 }
 func TestCaptureOverlayLayersPreservesPaletteDescriptionSurfaceAcrossFallbacks(t *testing.T) {
 	d.handleInput(current, ac, []byte("\x1b "))
 	awaitFrame(t, sends, ports.MsgOutput)
-	generation := ac.connectionGeneration.Load()
+	generation := ac.lifecycle.generationValue()
 	d.handleInput(current, ac, []byte("stopped\r"))
 	resumed := ac.currentSession()
 	require.Equal(t, "stopped", resumed.name)
 	require.Equal(t, int64(42), resumed.createdAt)
 	require.Equal(t, true, resumed.attachmentRegistered(ac))
-	require.Greater(t, ac.connectionGeneration.Load(), generation, "stopped-session handoff must publish through the attachment transition")
+	require.Greater(t, ac.lifecycle.generationValue(), generation, "stopped-session handoff must publish through the attachment transition")
 	require.False(t, ac.overlays.paletteActive())
 	firstPaint := awaitFrame(t, sends, ports.MsgOutput)
 	firstOutput, err := ports.UnmarshalOutput(firstPaint.Payload)
 	require.True(t, ac.overlays.promptActive())
 	require.Contains(t, string(promptOutput.Data), "Create session")
-	generation := ac.connectionGeneration.Load()
+	generation := ac.lifecycle.generationValue()
 	d.handleInput(sess, ac, []byte("scratch\r"))
 	// The submit first paints the newly attached session while the prompt is
 	// still open, then handlePromptInput closes the prompt and repaints the
 	require.False(t, newSess.ephemeral)
 	require.Contains(t, newSess.snapshotAttachments(), ac)
 	require.Equal(t, true, newSess.attachmentRegistered(ac))
-	require.Greater(t, ac.connectionGeneration.Load(), generation, "new-session handoff must publish through the attachment transition")
+	require.Greater(t, ac.lifecycle.generationValue(), generation, "new-session handoff must publish through the attachment transition")
 	require.Contains(t, string(finalOutput.Data), "scratch")
 	require.NotContains(t, string(finalOutput.Data), "Create session")
 }

M internal/usecase/daemon/pane_actions.go +3 -3


@@ -348,7 +348,7 @@ func (d Daemon) closePaneLocked(sess session, tb tab, id layout.PaneID, ac a
348		return d.closePaneLockedWithEffect(sess, tb, id, ac, repaint, nil)	348		return d.closePaneLockedWithEffect(sess, tb, id, ac, repaint, nil)
349		}	349		}
350			350
351	-	func (d Daemon) closePaneLockedWithEffect(sess session, tb tab, id layout.PaneID, ac attachedClient, repaint bool, effect *attachmentEffectTicket) error {	351	+	func (d Daemon) closePaneLockedWithEffect(sess session, tb tab, id layout.PaneID, ac attachedClient, repaint bool, effect *attachmentEffect) error {
352		if tb == nil {	352		if tb == nil {
353		return layout.ErrNotFound	353		return layout.ErrNotFound
354		}	354		}

@@ -406,7 +406,7 @@ func (d Daemon) closePaneLockedWithEffect(sess session, tb *tab, id layout.Pan
406		return nil	406		return nil
407		}	407		}
408			408
409	-	func (d Daemon) focusDir(sess session, ac attachedClient, dir layout.Direction, effect attachmentEffectTicket) error {	409	+	func (d Daemon) focusDir(sess session, ac attachedClient, dir layout.Direction, effect attachmentEffect) error {
410		target := resolveDaemonActionTargetForAttachment(sess, ac)	410		target := resolveDaemonActionTargetForAttachment(sess, ac)
411		oldFocus := layout.PaneID("")	411		oldFocus := layout.PaneID("")
412		if target.pane != nil {	412		if target.pane != nil {

@@ -434,7 +434,7 @@ func (d Daemon) focusDir(sess session, ac *attachedClient, dir layout.Directio
434		return errNoNeighbor	434		return errNoNeighbor
435		}	435		}
436		if effect != nil {	436		if effect != nil {
437	-	return d.switchToTargetForAttachment(effect.connectionToken(), sessionTarget, sessionHandoffGuard{expectedSource: target.tab}, "overflow-session")	437	+	return d.switchToTargetForAttachment(effect, sessionTarget, sessionHandoffGuard{expectedSource: target.tab}, "overflow-session")
438		}	438		}
439		return d.commitSessionOverflow(sess, ac, target.tab, sessionTarget)	439		return d.commitSessionOverflow(sess, ac, target.tab, sessionTarget)
440		}	440		}

M internal/usecase/daemon/parked_route.go +85 -60

 	}
 }
-func (d *Daemon) armParkedRoute(token attachmentConnectionToken) (ports.ParkedRouteLeaseID, error) {
+func (d *Daemon) armParkedRoute(effect *attachmentEffect) (ports.ParkedRouteLeaseID, error) {
-	ac := token.ac
+	if !effect.current() {
-	if ac == nil || !token.attachmentCurrent() || ac.navigationCapabilities&ports.NavigationCapabilityHomePicker == 0 {
+		return ports.ParkedRouteLeaseID{}, errAttachmentTransition
+	}
+	ac := effect.ac
+	if ac == nil || ac.navigationCapabilities&ports.NavigationCapabilityHomePicker == 0 {
 		return ports.ParkedRouteLeaseID{}, errAttachmentTransition
 	}
 	id, err := newParkedRouteLeaseID()
 		return ports.ParkedRouteLeaseID{}, err
 	}
 	lease := &parkedRouteLease{
-		id: id, generation: token.generation, transport: token.transport,
+		id: id, generation: effect.generation, transport: effect.transport,
 		expiresAt: d.clock.Now().Add(parkedRouteLeaseTTL),
 		timer:     d.clock.NewTimer(parkedRouteLeaseTTL), stop: make(chan struct{}),
 	}
 	ac.parkedRouteOutput.Store(false)
 	ac.parkedRouteFullPending.Store(false)
 	ac.parkedRouteMu.Unlock()
-	if ac.connectionGeneration.Load() == lease.generation && ac.transportSnapshotCurrent(lease.transport) {
+	if ac.lifecycle.generationValue() == lease.generation && ac.transportSnapshotCurrent(lease.transport) {
 		_ = ac.closeCapturedTransport(lease.transport.transport)
 	}
 }
 	ac.parkedRouteMu.Unlock()
 }
-func (ac *attachedClient) parkedRouteStatus(token attachmentConnectionToken, id ports.ParkedRouteLeaseID, now time.Time, suspended bool) ports.ParkedRouteStatus {
+func (ac *attachedClient) parkedRouteStatus(token attachmentCapability, id ports.ParkedRouteLeaseID, now time.Time, suspended bool) ports.ParkedRouteStatus {
-	if ac == nil || !token.attachmentCurrent() {
+	if ac == nil || !token.current() {
 		return ports.ParkedRouteRejected
 	}
 	ac.parkedRouteMu.Lock()
 	return 0
 }
-func (ac *attachedClient) prepareParkedRoute(token attachmentConnectionToken, id ports.ParkedRouteLeaseID, now time.Time) ports.ParkedRouteStatus {
+func (ac *attachedClient) prepareParkedRoute(token attachmentCapability, id ports.ParkedRouteLeaseID, now time.Time) ports.ParkedRouteStatus {
 	if status := ac.parkedRouteStatus(token, id, now, false); status != 0 {
 		return status
 	}
 	return 0
 }
-func (ac *attachedClient) consumeParkedRoute(token attachmentConnectionToken, id ports.ParkedRouteLeaseID, now time.Time) ports.ParkedRouteStatus {
+func (ac *attachedClient) consumeParkedRoute(token attachmentCapability, id ports.ParkedRouteLeaseID, now time.Time) ports.ParkedRouteStatus {
 	if status := ac.parkedRouteStatus(token, id, now, true); status != 0 {
 		return status
 	}
 	return 0
 }
-func (ac *attachedClient) beginParkedRouteSwitch(token attachmentConnectionToken, id ports.ParkedRouteLeaseID, now time.Time) ports.ParkedRouteStatus {
+func (ac *attachedClient) beginParkedRouteSwitch(token attachmentCapability, id ports.ParkedRouteLeaseID, now time.Time) ports.ParkedRouteStatus {
-	if ac == nil || !token.attachmentCurrent() {
+	if ac == nil || !token.current() {
 		return ports.ParkedRouteRejected
 	}
 	ac.parkedRouteMu.Lock()
 	return 0
 }
-func (ac *attachedClient) rejectParkedRouteSwitch(token attachmentConnectionToken, id ports.ParkedRouteLeaseID, now time.Time) ports.ParkedRouteStatus {
+func (ac *attachedClient) rejectParkedRouteSwitch(token attachmentCapability, id ports.ParkedRouteLeaseID, now time.Time) ports.ParkedRouteStatus {
 	if ac == nil {
 		return ports.ParkedRouteRejected
 	}
 	return 0
 }
-func (ac *attachedClient) consumePublishedParkedRoute(previous, published attachmentConnectionToken, id ports.ParkedRouteLeaseID) ports.ParkedRouteStatus {
+func (ac *attachedClient) consumePublishedParkedRoute(previous, published attachmentCapability, id ports.ParkedRouteLeaseID) ports.ParkedRouteStatus {
-	if ac == nil || published.ac != ac || !published.attachmentCurrent() {
+	if ac == nil || published.ac != ac || !published.current() {
 		return ports.ParkedRouteRejected
 	}
 	ac.parkedRouteMu.Lock()
 	return ports.Frame{Type: ports.MsgParkedRouteResponse, Payload: payload}, nil
 }
-func (d *Daemon) sendParkedRouteResponse(token attachmentConnectionToken, response ports.ParkedRouteResponse) error {
+func (d *Daemon) sendParkedRouteResponse(effect *attachmentEffect, response ports.ParkedRouteResponse) error {
 	frame, err := parkedRouteResponseFrame(response)
 	if err != nil {
 		return err
 	}
-	return token.sendControl(frame)
+	return effect.sendControl(frame)
 }
 // sendParkedRouteResponseLocked preserves response -> full-output ordering.
 	ac.parkedRouteOutput.Store(false)
 }
-func (d *Daemon) parkedRouteResponseFailed(token attachmentConnectionToken) {
+func (d *Daemon) parkedRouteResponseFailed(effect *attachmentEffect) {
-	if token.effect == nil || token.effect.ended.Load() {
+	if effect == nil {
 		return
 	}
-	launch := d.reserveAttachmentSendErrorCleanup(token, token.transport.transport)
+	capability := effect.capability()
-	token.effect.End()
+	launch := d.reserveAttachmentSendErrorCleanup(capability, capability.transport.transport)
+	effect.End()
 	launch()
 }
-func (d *Daemon) respondParkedRoute(token attachmentConnectionToken, response ports.ParkedRouteResponse) bool {
+func (d *Daemon) respondParkedRoute(effect *attachmentEffect, response ports.ParkedRouteResponse) bool {
-	if err := d.sendParkedRouteResponse(token, response); err != nil {
+	if effect == nil || effect.ac == nil {
-		d.parkedRouteResponseFailed(token)
+		return false
+	}
+	sender := effect
+	owned := false
+	if !sender.current() {
+		var admitted bool
+		sender, admitted = effect.ac.beginAttachmentEffect(effect.capability())
+		if !admitted {
+			return false
+		}
+		owned = true
+	}
+	if owned {
+		defer sender.End()
+	}
+	if err := d.sendParkedRouteResponse(sender, response); err != nil {
+		d.parkedRouteResponseFailed(sender)
 		return false
 	}
 	return true
 }
-func (d *Daemon) handleParkedRouteRequest(token attachmentConnectionToken, request ports.ParkedRouteRequest) {
+func (d *Daemon) handleParkedRouteRequest(effect *attachmentEffect, request ports.ParkedRouteRequest) {
-	if ports.ValidateParkedRouteRequest(request) != nil || token.ac == nil {
+	if ports.ValidateParkedRouteRequest(request) != nil || !effect.current() || effect.ac == nil {
 		return
 	}
+	capability := effect.capability()
 	switch request.Action {
 	case ports.ParkedRoutePrepare:
-		status := token.ac.prepareParkedRoute(token, request.LeaseID, d.clock.Now())
+		status := effect.ac.prepareParkedRoute(capability, request.LeaseID, d.clock.Now())
 		if status == 0 {
 			status = ports.ParkedRouteReady
 		}
-		d.respondParkedRoute(token, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: status})
+		d.respondParkedRoute(effect, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: status})
 	case ports.ParkedRouteResume:
-		d.resumeParkedRoute(token, request)
+		d.resumeParkedRoute(effect, request)
 	case ports.ParkedRouteSwitch:
-		d.switchParkedRoute(token, request)
+		d.switchParkedRoute(effect, request)
 	}
 }
-func (d *Daemon) resumeParkedRoute(token attachmentConnectionToken, request ports.ParkedRouteRequest) {
+func (d *Daemon) resumeParkedRoute(effect *attachmentEffect, request ports.ParkedRouteRequest) {
-	status := token.ac.consumeParkedRoute(token, request.LeaseID, d.clock.Now())
+	capability := effect.capability()
+	status := effect.ac.consumeParkedRoute(capability, request.LeaseID, d.clock.Now())
 	if status != 0 {
-		d.respondParkedRoute(token, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: status})
+		d.respondParkedRoute(effect, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: status})
 		return
 	}
-	ac := token.ac
+	ac := effect.ac
 	ac.sendMu.Lock()
-	err := d.sendParkedRouteResponseLocked(ac, token.transport, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: ports.ParkedRouteResumed})
+	err := d.sendParkedRouteResponseLocked(ac, effect.transport, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: ports.ParkedRouteResumed})
 	if err == nil {
 		ac.releaseParkedOutputLocked()
 	}
 	ac.sendMu.Unlock()
 	if err != nil {
-		d.parkedRouteResponseFailed(token)
+		d.parkedRouteResponseFailed(effect)
 		return
 	}
-	if token.sess != nil {
+	if effect.sess != nil {
-		d.firstPaintWithLease(token.sess, ac, token.lease, true)
+		d.firstPaintWithLease(effect.sess, ac, effect.lease, true)
 	}
 }
-func (d *Daemon) rejectParkedRouteSwitch(token attachmentConnectionToken, request ports.ParkedRouteRequest, fallback ports.ParkedRouteStatus) {
+func (d *Daemon) rejectParkedRouteSwitch(effect *attachmentEffect, request ports.ParkedRouteRequest, fallback ports.ParkedRouteStatus) {
-	status := token.ac.rejectParkedRouteSwitch(token, request.LeaseID, d.clock.Now())
+	capability := effect.capability()
+	status := effect.ac.rejectParkedRouteSwitch(capability, request.LeaseID, d.clock.Now())
 	if status == 0 {
 		status = fallback
 	}
-	if d.respondParkedRoute(token, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: status}) && status == ports.ParkedRouteExpired {
+	if d.respondParkedRoute(effect, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: status}) && status == ports.ParkedRouteExpired {
-		_ = token.ac.closeCapturedTransport(token.transport.transport)
+		_ = effect.ac.closeCapturedTransport(effect.transport.transport)
 	}
 }
-func (d *Daemon) switchParkedRoute(token attachmentConnectionToken, request ports.ParkedRouteRequest) {
+func (d *Daemon) switchParkedRoute(effect *attachmentEffect, request ports.ParkedRouteRequest) {
-	if status := token.ac.beginParkedRouteSwitch(token, request.LeaseID, d.clock.Now()); status != 0 {
+	capability := effect.capability()
-		if d.respondParkedRoute(token, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: status}) && status == ports.ParkedRouteExpired {
+	if status := effect.ac.beginParkedRouteSwitch(capability, request.LeaseID, d.clock.Now()); status != 0 {
-			_ = token.ac.closeCapturedTransport(token.transport.transport)
+		if d.respondParkedRoute(effect, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: status}) && status == ports.ParkedRouteExpired {
+			_ = effect.ac.closeCapturedTransport(effect.transport.transport)
 		}
 		return
 	}
 		ctx = context.Background()
 	}
 	if err := d.waitForParkedTargetRestore(ctx, target.SessionName); err != nil {
-		d.rejectParkedRouteSwitch(token, request, ports.ParkedRouteStaleTarget)
+		d.rejectParkedRouteSwitch(effect, request, ports.ParkedRouteStaleTarget)
 		return
 	}
-	transition, targetSession, err := d.transitionParkedRouteTarget(token, target)
+	transition, targetSession, err := d.transitionParkedRouteTarget(effect, target)
 	if err != nil {
-		d.rejectParkedRouteSwitch(token, request, ports.ParkedRouteStaleTarget)
+		d.rejectParkedRouteSwitch(effect, request, ports.ParkedRouteStaleTarget)
 		return
 	}
-	if status := token.ac.consumePublishedParkedRoute(token, transition.published, request.LeaseID); status != 0 {
+	if status := effect.ac.consumePublishedParkedRoute(capability, transition.published, request.LeaseID); status != 0 {
 		d.abortPublishedAttachmentTransition(transition)
 		return
 	}
-	fresh, admitted := token.ac.beginAttachmentEffect(transition.published)
+	fresh, admitted := effect.ac.beginAttachmentEffect(transition.published)
 	if !admitted {
 		d.abortPublishedAttachmentTransition(transition)
 		return
 	}
-	freshToken := fresh.connectionToken()
+	freshCapability := fresh.capability()
-	ac := token.ac
+	ac := effect.ac
 	ac.sendMu.Lock()
-	responseErr := d.sendParkedRouteResponseLocked(ac, freshToken.transport, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: ports.ParkedRouteSwitched})
+	responseErr := d.sendParkedRouteResponseLocked(ac, freshCapability.transport, ports.ParkedRouteResponse{RequestID: request.RequestID, Status: ports.ParkedRouteSwitched})
 	if responseErr == nil {
 		ac.releaseParkedOutputLocked()
 	}
 	ac.sendMu.Unlock()
 	if responseErr != nil {
-		launch := d.reserveAttachmentSendErrorCleanup(freshToken, freshToken.transport.transport)
+		launch := d.reserveAttachmentSendErrorCleanup(freshCapability, freshCapability.transport.transport)
 		fresh.End()
 		launch()
 		d.deferAttachmentTransitionCleanups(transition)
 	return err
 }
-func (d *Daemon) transitionParkedRouteTarget(token attachmentConnectionToken, target domain.RemoteSessionTarget) (attachmentTransitionResult, *session, error) {
+func (d *Daemon) transitionParkedRouteTarget(effect *attachmentEffect, target domain.RemoteSessionTarget) (attachmentTransitionResult, *session, error) {
+	capability := effect.capability()
 	d.mu.Lock()
 	if d.closing {
 		d.mu.Unlock()
 		live.mu.Unlock()
 		d.mu.Unlock()
 		transition, err := d.transitionAttachment(attachmentTransitionRequest{
-			source: token.sess, target: live, next: token.ac,
+			source: effect.sess, target: live, next: effect.ac,
-			expectedTransport: token.transport, sourceToken: &token, action: "parked-route-switch",
+			expectedTransport: effect.transport, sourceCapability: &capability, sourceEffect: effect, action: "parked-route-switch",
 			expectedTargetLifecycle: &attachmentLifecycleFence{
 				name: target.SessionName, incarnation: target.LifecycleID, checkIncarnation: true,
 				tabID: tabID, tabIndex: tabIndex, checkTab: true,
 	var created *session
 	transition, err := d.transitionAttachment(attachmentTransitionRequest{
-		source: token.sess, next: token.ac,
+		source: effect.sess, next: effect.ac,
-		expectedTransport: token.transport, sourceToken: &token, action: "parked-route-restore",
+		expectedTransport: effect.transport, sourceCapability: &capability, sourceEffect: effect, action: "parked-route-restore",
 		activateTargetTab: true, targetTabIndex: tabIndex, ready: true,
 		createTargetLocked: func() (*session, error) {
 			current, ok := d.inactive[target.SessionName]
 			env := copyEnvironment(d.baseEnv)
 			cwd := d.dirOrHome(current.cwd)
 			var createErr error
-			created, createErr = d.resumeRemoteInactiveSessionLocked(target, cwd, token.ac.geometrySnapshot(), env, current)
+			created, createErr = d.resumeRemoteInactiveSessionLocked(target, cwd, effect.ac.geometrySnapshot(), env, current)
 			return created, createErr
 		},
 	})

M internal/usecase/daemon/parked_route_test.go +18 -16

 func armAndPrepareParkedRoute(t *testing.T, d *Daemon, source *session, ac *attachedClient, sends chan ports.Frame) ports.ParkedRouteLeaseID {
 	t.Helper()
 	ac.navigationCapabilities |= ports.NavigationCapabilityHomePicker
-	token := source.attachmentToken(ac, ac.transport())
+	token := source.captureAttachmentCapability(ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
+	require.NoError(t, d.sendNavigationActionForAttachment(effect, ports.NavigationOpenHomePicker))
-	require.NoError(t, d.sendNavigationActionForAttachment(token, ports.NavigationOpenHomePicker))
 	effect.End()
 	directiveFrame := awaitFrame(t, sends, ports.MsgNavigationAction)
 	directive, err := ports.UnmarshalNavigationDirective(directiveFrame.Payload)
 	require.NoError(t, err)
 	prepare := ports.ParkedRouteRequest{RequestID: 1, LeaseID: directive.LeaseID, Action: ports.ParkedRoutePrepare}
-	require.False(t, d.handleAttachmentClientFrame(source.attachmentToken(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(prepare)}))
+	require.False(t, d.handleAttachmentClientFrame(source.captureAttachmentCapability(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(prepare)}))
 	readyFrame := awaitFrame(t, sends, ports.MsgParkedRouteResponse)
 	ready, err := ports.UnmarshalParkedRouteResponse(readyFrame.Payload)
 	require.NoError(t, err)
 		SessionName: "target", LiveTabID: domain.TabStableID(target.tabs[0].stableID),
 	}
 	switchRequest := ports.ParkedRouteRequest{RequestID: 2, LeaseID: leaseID, Action: ports.ParkedRouteSwitch, Target: &targetRequest}
-	require.False(t, d.handleAttachmentClientFrame(source.attachmentToken(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(switchRequest)}))
+	require.False(t, d.handleAttachmentClientFrame(source.captureAttachmentCapability(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(switchRequest)}))
 	require.Same(t, target, ac.currentAttachmentSession())
 	require.False(t, ac.parkedRouteOutput.Load())
 		SessionName: "target", LiveTabID: domain.TabStableID(target.tabs[0].stableID),
 	}
 	switchRequest := ports.ParkedRouteRequest{RequestID: 2, LeaseID: leaseID, Action: ports.ParkedRouteSwitch, Target: &targetRequest}
-	d.handleAttachmentClientFrame(source.attachmentToken(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(switchRequest)})
+	d.handleAttachmentClientFrame(source.captureAttachmentCapability(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(switchRequest)})
 	require.Same(t, target, ac.currentAttachmentSession())
 	responseFrame := awaitFrame(t, sends, ports.MsgParkedRouteResponse)
 		SessionName: "stopped", Stopped: true, StoppedTab: domain.NewStableTabSelector("tab-b"),
 	}
 	switchRequest := ports.ParkedRouteRequest{RequestID: 2, LeaseID: leaseID, Action: ports.ParkedRouteSwitch, Target: &target}
-	d.handleAttachmentClientFrame(source.attachmentToken(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(switchRequest)})
+	d.handleAttachmentClientFrame(source.captureAttachmentCapability(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(switchRequest)})
 	restored := ac.currentAttachmentSession()
 	require.NotNil(t, restored)
 		SessionName: "missing", LiveTabID: "tab-1",
 	}
 	switchRequest := ports.ParkedRouteRequest{RequestID: 2, LeaseID: leaseID, Action: ports.ParkedRouteSwitch, Target: &missing}
-	d.handleAttachmentClientFrame(source.attachmentToken(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(switchRequest)})
+	d.handleAttachmentClientFrame(source.captureAttachmentCapability(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(switchRequest)})
 	staleFrame := awaitFrame(t, sends, ports.MsgParkedRouteResponse)
 	stale, err := ports.UnmarshalParkedRouteResponse(staleFrame.Payload)
 	require.NoError(t, err)
 	require.True(t, ac.parkedRouteOutput.Load())
 	resume := ports.ParkedRouteRequest{RequestID: 3, LeaseID: leaseID, Action: ports.ParkedRouteResume}
-	d.handleAttachmentClientFrame(source.attachmentToken(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(resume)})
+	d.handleAttachmentClientFrame(source.captureAttachmentCapability(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(resume)})
 	resumedFrame := awaitFrame(t, sends, ports.MsgParkedRouteResponse)
 	resumed, err := ports.UnmarshalParkedRouteResponse(resumedFrame.Payload)
 	require.NoError(t, err)
 	}
 	resume := ports.ParkedRouteRequest{RequestID: 2, LeaseID: leaseID, Action: ports.ParkedRouteResume}
-	d.handleAttachmentClientFrame(source.attachmentToken(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(resume)})
+	d.handleAttachmentClientFrame(source.captureAttachmentCapability(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(resume)})
 	_ = awaitFrame(t, sends, ports.MsgParkedRouteResponse)
 	outputFrame := awaitFrame(t, sends, ports.MsgOutput)
 	output, err := ports.UnmarshalOutput(outputFrame.Payload)
 	ac.parkedRoute.expiresAt = d.clock.Now()
 	ac.parkedRouteMu.Unlock()
 	resume := ports.ParkedRouteRequest{RequestID: 2, LeaseID: leaseID, Action: ports.ParkedRouteResume}
-	d.handleAttachmentClientFrame(source.attachmentToken(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(resume)})
+	d.handleAttachmentClientFrame(source.captureAttachmentCapability(ac, ac.transport()), ports.Frame{Type: ports.MsgParkedRouteRequest, Payload: ports.MarshalParkedRouteRequest(resume)})
 	responseFrame := awaitFrame(t, sends, ports.MsgParkedRouteResponse)
 	response, err := ports.UnmarshalParkedRouteResponse(responseFrame.Payload)
 	require.NoError(t, err)
 	ac.parkedRouteMu.Lock()
 	ac.parkedRoute.inFlight = true
 	ac.parkedRouteMu.Unlock()
-	status := ac.consumeParkedRoute(source.attachmentToken(ac, ac.transport()), leaseID, d.clock.Now())
+	status := ac.consumeParkedRoute(source.captureAttachmentCapability(ac, ac.transport()), leaseID, d.clock.Now())
 	require.Equal(t, ports.ParkedRouteRejected, status)
 	ac.parkedRouteMu.Lock()
 		{RequestID: 2, Action: ports.ParkedRouteSwitch, Target: &domain.RemoteSessionTarget{}},
 		{RequestID: 3, LeaseID: leaseID, Action: 99},
 	} {
-		d.handleParkedRouteRequest(source.attachmentToken(ac, ac.transport()), request)
+		capability := source.captureAttachmentCapability(ac, ac.transport())
+		effect, admitted := ac.beginAttachmentEffect(capability)
+		require.True(t, admitted)
+		d.handleParkedRouteRequest(effect, request)
+		effect.End()
 	}
 	require.Same(t, source, ac.currentAttachmentSession())
 	select {
 	d, source, ac, _, releases := newManualTabSession(t, 1)
 	defer releaseAll(releases)
 	ac.replaceTransport(parkedRouteFailTransport{})
-	token := source.attachmentToken(ac, ac.transport())
+	token := source.captureAttachmentCapability(ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
 	result := make(chan bool, 1)
 	go func() {
-		result <- d.respondParkedRoute(token, ports.ParkedRouteResponse{RequestID: 1, Status: ports.ParkedRouteReady})
+		result <- d.respondParkedRoute(effect, ports.ParkedRouteResponse{RequestID: 1, Status: ports.ParkedRouteReady})
 	}()
 	require.False(t, awaitTestValue(t, result, "parked-route send failure cleanup"))
 	d.attachmentCleanupWg.Wait()

M internal/usecase/daemon/picker.go +83 -76

 	}
 }
-func (d *Daemon) handlePickerInput(ac *attachedClient, data []byte, effects ...*attachmentEffectTicket) {
+func (d *Daemon) handlePickerInput(ac *attachedClient, data []byte, effects ...*attachmentEffect) {
 	sess := ac.currentAttachmentSession()
 	if sess == nil {
 		return
 		return
 	}
 	if result.action == 'x' {
-		var effect *attachmentEffectTicket
+		var effect *attachmentEffect
 		if len(effects) != 0 {
 			effect = effects[0]
 		}
 			var err error
 			if effect != nil {
 				effect.bindActionEnd(d, "picker-delete")
-				err = d.killPickerTargetForAttachment(target, effect.connectionToken())
+				err = d.killPickerTargetForAttachment(target, effect)
 			} else {
 				err = d.killPickerTarget(target)
 			}
 				d.reportAttachmentError(sess, err)
 			}
 		}
-		if effect != nil && effect.ended.Load() {
+		if effect != nil && !effect.current() {
-			fresh, admitted := ac.beginAttachmentEffect(effect.token)
+			fresh, admitted := ac.beginAttachmentEffect(effect.capability())
 			if !admitted {
 				return
 			}
 	if result.exit && !committing {
 		back := ac.startupOverlay == ports.StartupOverlaySessionPicker && ac.navigationCapabilities&ports.NavigationCapabilityBack != 0
 		if back {
-			var token attachmentConnectionToken
+			if len(effects) == 0 || effects[0] == nil {
-			if len(effects) != 0 && effects[0] != nil {
+				d.invalidateRender(sess, ac, true, "picker.go")
-				token = effects[0].connectionToken()
+				return
-			} else {
-				var effect *attachmentEffectTicket
-				var admitted bool
-				token, effect, admitted = ac.beginCurrentAttachmentEffect(sess, ac.transport())
-				if !admitted {
-					d.invalidateRender(sess, ac, true, "picker.go")
-					return
-				}
-				defer effect.End()
 			}
-			if err := d.sendNavigationActionForAttachment(token, ports.NavigationBack); err != nil {
+			effect := effects[0]
+			if err := d.sendNavigationActionForAttachment(effect, ports.NavigationBack); err != nil {
 				d.reportAttachmentError(sess, err)
 				d.invalidateRender(sess, ac, true, "picker.go")
 				return
 		}
 		var err error
 		if len(effects) != 0 && effects[0] != nil {
-			err = d.switchToTargetForAttachment(effects[0].connectionToken(), target, sessionHandoffGuard{closePicker: true, allowSamePeer: true}, "picker-select")
+			err = d.switchToTargetForAttachment(effects[0], target, sessionHandoffGuard{closePicker: true, allowSamePeer: true}, "picker-select")
 		} else {
 			d.closePicker(ac)
 			err = d.switchToTarget(sess, ac, target)
 // centralized transition. The transition releases admission at its freeze seam
 // and revalidates the exact initiating token before changing target focus or
 // attachment ownership.
-func (d *Daemon) switchActiveTargetForAttachment(token attachmentConnectionToken, target picker.Target) error {
+func (d *Daemon) switchActiveTargetForAttachment(effect *attachmentEffect, target picker.Target) error {
-	return d.switchActiveTargetForAttachmentGuarded(token, target, sessionHandoffGuard{}, "jump-attention")
+	return d.switchActiveTargetForAttachmentGuarded(effect, target, sessionHandoffGuard{}, "jump-attention")
 }
 func pickerTargetLifecycleFence(target picker.Target) *attachmentLifecycleFence {
 	return fence
 }
-func (d *Daemon) switchActiveTargetForAttachmentGuarded(token attachmentConnectionToken, target picker.Target, guard sessionHandoffGuard, action string) error {
+func (d *Daemon) switchActiveTargetForAttachmentGuarded(effect *attachmentEffect, target picker.Target, guard sessionHandoffGuard, action string) error {
-	if token.sess == nil || token.ac == nil {
+	if !effect.current() || effect.sess == nil || effect.ac == nil {
 		return nil
 	}
 	d.mu.Lock()
 	targetSess := d.sessions[target.Session]
 	d.mu.Unlock()
 	if targetSess == nil {
-		if !token.attachmentCurrent() {
+		if !effect.current() {
 			return nil
 		}
-		d.invalidateRender(token.sess, token.ac, true, "picker.go")
+		d.invalidateRender(effect.sess, effect.ac, true, "picker.go")
 		return domain.UserErr(domain.NoticeSessionUnavailable, "couldn't switch to that session", nil)
 	}
-	if targetSess == token.sess {
+	if targetSess == effect.sess {
 		return nil
 	}
+	capability := effect.capability()
 	transition, err := d.transitionAttachment(attachmentTransitionRequest{
-		source: token.sess, target: targetSess, next: token.ac,
+		source: effect.sess, target: targetSess, next: effect.ac,
-		expectedTransport: token.transport, sourceToken: &token, action: action,
+		expectedTransport: effect.transport, sourceCapability: &capability, sourceEffect: effect, action: action,
 		expectedTargetLifecycle: pickerTargetLifecycleFence(target),
 		activateTargetTab:       true, targetTabIndex: target.TabIndex, copySourceEnvironment: true, ready: true,
 	})
 	if err != nil {
 		// Losing the exact source role is a benign stale action, not a notice for
 		// whichever attachment replaced the initiator.
-		if !token.attachmentCurrent() {
+		if !capability.current() {
 			return nil
 		}
 		return domain.UserErr(domain.NoticeSessionUnavailable, "couldn't switch to that session", err)
 	}
 	if guard.closePicker {
-		fresh, admitted := token.ac.beginAttachmentEffect(transition.published)
+		fresh, admitted := effect.ac.beginAttachmentEffect(transition.published)
 		if admitted {
-			d.closePicker(token.ac)
+			d.closePicker(effect.ac)
 			fresh.End()
 		}
 	}
 // intent captures the exact initiating capability before admission is released;
 // every active, stopped, and same-session target then uses transitionAttachment
 // for frozen, atomic source-token preflight.
-func (d *Daemon) switchToTargetForAttachment(token attachmentConnectionToken, target picker.Target, guard sessionHandoffGuard, action string) error {
+func (d *Daemon) switchToTargetForAttachment(effect *attachmentEffect, target picker.Target, guard sessionHandoffGuard, action string) error {
-	if token.sess == nil || token.ac == nil || token.effect == nil {
+	if !effect.current() || effect.sess == nil || effect.ac == nil {
 		return nil
 	}
 	if target.RemoteTarget != nil || target.RemoteKey != nil {
-		return d.sendRemoteAttachTargetForAttachment(token, target, guard, action)
+		return d.sendRemoteAttachTargetForAttachment(effect, target, guard, action)
 	}
-	return d.sendLocalAttachTargetForAttachment(token, target, guard, action)
+	return d.sendLocalAttachTargetForAttachment(effect, target, guard, action)
 }
 // sendLocalAttachTargetForAttachment offers an endpoint-empty, exact local
 // target on the current authenticated connection. A current client confirms it
 // with MsgSamePeerSwitchRequest; an interrupted or older client retains the
 // existing close-and-redial fallback without any daemon-origin inference.
-func (d *Daemon) sendLocalAttachTargetForAttachment(token attachmentConnectionToken, target picker.Target, guard sessionHandoffGuard, action string) error {
+func (d *Daemon) sendLocalAttachTargetForAttachment(effect *attachmentEffect, target picker.Target, guard sessionHandoffGuard, action string) error {
 	d.mu.Lock()
 	var targetSess *session
 	var sessionName string
 		targetSess.mu.Unlock()
 	}
 	d.mu.Unlock()
-	if !matches || !token.attachmentCurrent() {
+	if !matches || !effect.current() {
 		return errAttachmentTransition
 	}
 	if targetSess != nil && target.TabID != "" {
 		// An explicit tab row is a direct user choice, not route memory; retain
 		// the established daemon-side transition so it opens exactly that tab.
-		return d.switchToTargetGuardedForAttachment(token.sess, token.ac, target, guard, &token, action)
+		return d.switchToTargetGuardedForAttachment(effect.sess, effect.ac, target, guard, effect, action)
 	}
 	// An active session row with no explicit non-default tab is on the
 	// same-peer transition keeps the attachment and its namespace; the target
 	// scene diff deletes and replaces the source session's placements.
 	if !samePeerEligible {
-		if err := d.cleanupAttachmentOutput(token.ac); err != nil {
+		if err := d.cleanupAttachmentOutput(effect.ac); err != nil {
 			return domain.UserErr(domain.NoticeSessionUnavailable, "couldn't clean up attachment output before local handoff", err)
 		}
 	} else {
-		token.ac.offerSamePeerTarget(*exactTarget)
+		effect.ac.offerSamePeerTarget(*exactTarget)
 	}
-	if err := token.sendControl(ports.Frame{Type: ports.MsgAttachTarget, Payload: payload}); err != nil {
+	if err := effect.sendControl(ports.Frame{Type: ports.MsgAttachTarget, Payload: payload}); err != nil {
 		if samePeerEligible {
-			token.ac.clearSamePeerOffer()
+			effect.ac.clearSamePeerOffer()
 		}
 		return domain.UserErr(domain.NoticeSessionUnavailable, "couldn't offer local session switch", err)
 	}
 		// Keep the source link open until the client receives the ordered cleanup
 		// and handoff frames, then let the client's close drive ordinary parking.
 		if guard.closePicker {
-			d.closePicker(token.ac)
+			d.closePicker(effect.ac)
 		}
-		token.effect.bindActionEnd(d, "detach")
+		effect.bindActionEnd(d, "detach")
-		token.effect.End()
+		effect.End()
 	}
 	return nil
 }
 // endpoint to the thin client. The daemon owns no remote session shadow: after
 // the target is sent, the local attachment is detached and the client opens a
 // fresh connection to the owning daemon.
-func (d *Daemon) sendRemoteAttachTargetForAttachment(token attachmentConnectionToken, target picker.Target, guard sessionHandoffGuard, _ string) error {
+func (d *Daemon) sendRemoteAttachTargetForAttachment(effect *attachmentEffect, target picker.Target, guard sessionHandoffGuard, _ string) error {
 	failUnavailable := func() error {
-		if token.attachmentCurrent() {
+		if effect.current() {
-			d.notifyRemotePickerUnavailable(token.sess, target)
+			d.notifyRemotePickerUnavailable(effect.sess, target)
 		}
 		return errAttachmentTransition
 	}
 	if payload == nil {
 		return failUnavailable()
 	}
-	if err := token.sendControl(ports.Frame{Type: ports.MsgAttachTarget, Payload: payload}); err != nil {
+	if err := effect.sendControl(ports.Frame{Type: ports.MsgAttachTarget, Payload: payload}); err != nil {
 		return domain.UserErr(domain.NoticeSessionUnavailable, "couldn't attach to remote session", err)
 	}
 	if guard.closePicker {
-		d.closePicker(token.ac)
+		d.closePicker(effect.ac)
 	}
-	d.clientGoneForAttachment(token, false)
+	d.clientGoneForAttachment(effect, false)
 	return nil
 }
 	return d.switchToTargetGuardedForAttachment(from, ac, target, guard, nil, "")
 }
-func (d *Daemon) switchToTargetGuardedForAttachment(from *session, ac *attachedClient, target picker.Target, guard sessionHandoffGuard, sourceToken *attachmentConnectionToken, action string) error {
+func (d *Daemon) switchToTargetGuardedForAttachment(from *session, ac *attachedClient, target picker.Target, guard sessionHandoffGuard, sourceEffect *attachmentEffect, action string) error {
+	var sourceCapability *attachmentCapability
+	if sourceEffect != nil {
+		capability := sourceEffect.capability()
+		sourceCapability = &capability
+	}
 	if target.Name != "" {
 		ctx := d.serveCtx
 		if ctx == nil {
 			ctx = context.Background()
 		}
 		if err := d.waitForTargetRestore(ctx, target.Name); err != nil {
-			if sourceToken != nil && !sourceToken.attachmentCurrent() {
+			if sourceCapability != nil && !sourceCapability.current() {
 				return errAttachmentTransition
 			}
 			d.invalidateRender(from, ac, true, "picker.go")
 		active, stopped, isStopped, ok := d.resolveNamedLifecycleTargetLocked(target)
 		if ok {
 			if isStopped {
-				targetSess, transition, switched, cause = d.resumeStoppedAndSwitchLocked(from, ac, target, stopped, sourceToken, guard, action)
+				targetSess, transition, switched, cause = d.resumeStoppedAndSwitchLocked(from, ac, target, stopped, sourceEffect, guard, action)
 			} else {
 				// The snapshot ID may describe the stopped representation. The
 				// locked name/lifecycle resolver chose this active incarnation.
 				resolvedTarget := target
 				resolvedTarget.Session = active.id
-				targetSess, transition, switched = d.switchToActiveTargetLocked(from, ac, active, resolvedTarget, guard, sourceToken, action)
+				targetSess, transition, switched = d.switchToActiveTargetLocked(from, ac, active, resolvedTarget, guard, sourceEffect, action)
 			}
 		}
 	} else if active := d.sessions[target.Session]; active != nil {
-		targetSess, transition, switched = d.switchToActiveTargetLocked(from, ac, active, target, guard, sourceToken, action)
+		targetSess, transition, switched = d.switchToActiveTargetLocked(from, ac, active, target, guard, sourceEffect, action)
 	}
 	d.mu.Unlock()
 	if !switched {
-		if sourceToken != nil && !sourceToken.attachmentCurrent() {
+		if sourceCapability != nil && !sourceCapability.current() {
 			return errAttachmentTransition
 		}
 		if guard.expectedSource != nil {
 		return domain.UserErr(domain.NoticeSessionUnavailable, "couldn't switch to that session", cause)
 	}
 	if guard.closePicker {
-		if sourceToken != nil {
+		if sourceEffect != nil {
 			fresh, admitted := ac.beginAttachmentEffect(transition.published)
 			if admitted {
 				d.closePicker(ac)
 	}
 	d.deferAttachmentTransitionCleanups(transition)
 	if targetSess == from {
-		if sourceToken != nil {
+		if sourceEffect != nil {
 			fresh, admitted := ac.beginAttachmentEffect(transition.published)
 			if admitted {
 				d.activateTabAfterResizeForLease(from, from.tabForAttachment(ac), false, ac, transition.published.lease)
 // switchToActiveTargetLocked commits an active target handoff through the
 // centralized attachment transition. Caller holds d.mu.
-func (d *Daemon) switchToActiveTargetLocked(from *session, ac *attachedClient, targetSess *session, target picker.Target, guard sessionHandoffGuard, sourceToken *attachmentConnectionToken, action string) (*session, attachmentTransitionResult, bool) {
+func (d *Daemon) switchToActiveTargetLocked(from *session, ac *attachedClient, targetSess *session, target picker.Target, guard sessionHandoffGuard, sourceEffect *attachmentEffect, action string) (*session, attachmentTransitionResult, bool) {
+	var sourceCapability *attachmentCapability
+	if sourceEffect != nil {
+		capability := sourceEffect.capability()
+		sourceCapability = &capability
+	}
 	if d.sessions[target.Session] != targetSess {
 		return nil, attachmentTransitionResult{}, false
 	}
 	if targetSess == from {
-		if sourceToken == nil {
+		if sourceEffect == nil {
 			targetSess.mu.Lock()
 			defer targetSess.mu.Unlock()
 			_, attached := targetSess.attachments[ac]
 		transition, err := d.transitionAttachment(attachmentTransitionRequest{
 			source: from, target: targetSess, next: ac,
-			expectedTransport:       sourceToken.transport,
+			expectedTransport:       sourceCapability.transport,
-			sourceToken:             sourceToken,
+			sourceCapability:        sourceCapability,
+			sourceEffect:            sourceEffect,
 			action:                  action,
 			expectedTargetLifecycle: pickerTargetLifecycleFence(target),
 			activateTargetTab:       true,
 	// d.mu and revalidates both registered lifecycles for publication.
 	d.mu.Unlock()
 	expectedTransport := ac.transportSnapshot()
-	if sourceToken != nil {
+	if sourceCapability != nil {
-		expectedTransport = sourceToken.transport
+		expectedTransport = sourceCapability.transport
 	}
 	transition, err := d.transitionAttachment(attachmentTransitionRequest{
 		source: from,
 		next:   ac,
 		expectedTransport:       expectedTransport,
-		sourceToken:             sourceToken,
+		sourceCapability:        sourceCapability,
+		sourceEffect:            sourceEffect,
 		action:                  action,
 		expectedTargetLifecycle: pickerTargetLifecycleFence(target),
 		expectedSourceTab:       guard.expectedSource,
 // resumeStoppedAndSwitchLocked creates the stopped representation and commits
 // the handoff while d.mu is held. Creation failure leaves the source client
 // and stopped record untouched.
-func (d *Daemon) resumeStoppedAndSwitchLocked(from *session, ac *attachedClient, target picker.Target, stopped inactiveSession, sourceToken *attachmentConnectionToken, guard sessionHandoffGuard, action string) (*session, attachmentTransitionResult, bool, error) {
+func (d *Daemon) resumeStoppedAndSwitchLocked(from *session, ac *attachedClient, target picker.Target, stopped inactiveSession, sourceEffect *attachmentEffect, guard sessionHandoffGuard, action string) (*session, attachmentTransitionResult, bool, error) {
 	if stopped.broken() {
 		return nil, attachmentTransitionResult{}, false, &protoErr{ports.ErrInternal, "session durable state is broken: " + target.Name}
 	}
 		return nil, attachmentTransitionResult{}, false, errAttachmentTransition
 	}
-	if sourceToken != nil {
+	if sourceEffect != nil {
+		sourceCapability := sourceEffect.capability()
 		var targetSess *session
 		d.mu.Unlock()
 		transition, err := d.transitionAttachment(attachmentTransitionRequest{
 			source: from, next: ac,
-			expectedTransport: sourceToken.transport, sourceToken: sourceToken, action: action,
+			expectedTransport: sourceCapability.transport, sourceCapability: &sourceCapability, sourceEffect: sourceEffect, action: action,
 			expectedSourceTab: guard.expectedSource, copySourceEnvironment: true, ready: true,
 			createTargetLocked: func() (*session, error) {
 				current, ok := d.inactive[target.Name]
 	return true
 }
-func (d *Daemon) killPickerTargetForAttachment(target picker.Target, token attachmentConnectionToken) error {
+func (d *Daemon) killPickerTargetForAttachment(target picker.Target, effect *attachmentEffect) error {
-	if token.ac == nil {
+	if effect == nil || effect.ac == nil {
 		return d.killPickerTarget(target)
 	}
 	if target.RemoteKey != nil {
 		return nil
 	}
+	capability := effect.capability()
 	if target.Stopped {
-		token.effect.bindActionEnd(d, "picker-delete")
+		effect.bindActionEnd(d, "picker-delete")
-		token.effect.End()
+		effect.End()
-		frozen := freezeAttachmentEffectGates(token.ac)
+		frozen := freezeAttachmentEffectGates(effect.ac)
 		defer frozen.unfreeze()
-		if !d.sourceAttachmentTokenCurrentFrozen(token) {
+		if !d.sourceAttachmentCapabilityCurrentFrozen(capability) {
 			return nil
 		}
 		return d.killPickerTarget(target)
 	if targetSess == nil {
 		return nil
 	}
-	return d.killSessionForAttachment(targetSess, ports.ReasonSessionKilled, true, token, "picker-delete")
+	return d.killSessionForAttachment(targetSess, ports.ReasonSessionKilled, true, effect, "picker-delete")
 }
 func (d *Daemon) killPickerTarget(target picker.Target) error {

M internal/usecase/daemon/picker_test.go +5 -6

 	ac.overlays.pickerMu.Unlock()
 	rc := d.attachCoordinator(sess, nil, ac, true)
-	token := sess.attachmentToken(ac, tr)
+	token := sess.captureAttachmentCapability(ac, tr)
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
 	defer effect.End()
-	token.effect = effect
 	d.handlePickerInput(ac, []byte("\r"), effect)
 	require.True(t, ac.overlays.pickerActive(), "failed navigation send must leave the picker open")
 	case <-time.After(2 * time.Second):
 		t.Fatal("session switch waited for in-flight transport send")
 	}
-	require.True(t, result.published.attachmentCurrent())
+	require.True(t, result.published.current())
 	select {
 	case <-handoffAtSendMu:
 		t.Fatal("output rebase ran during architecture publication")
 	require.True(t, ok)
 	require.Equal(t, target.id, selected.Session)
-	token := current.attachmentToken(ac, ac.transport())
+	token := current.captureAttachmentCapability(ac, ac.transport())
 	token.lease = current.renderCoordinator().attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
 	d.handlePickerInput(ac, []byte("x"), effect)

M internal/usecase/daemon/prompt.go +7 -7


@@ -23,7 +23,7 @@ func (d Daemon) enterPrompt(sess session, ac *attachedClient, title, initial s
23		d.invalidateRender(sess, ac, true, "prompt.go")	23		d.invalidateRender(sess, ac, true, "prompt.go")
24		}	24		}
25			25
26	-	func (d Daemon) enterTransitionPrompt(sess session, ac *attachedClient, title, initial string, submit func(string, attachmentConnectionToken) error) {	26	+	func (d Daemon) enterTransitionPrompt(sess session, ac attachedClient, title, initial string, submit func(string, attachmentEffect) error) {
27		d.closePrompt(ac)	27		d.closePrompt(ac)
28		ac.overlays.promptMu.Lock()	28		ac.overlays.promptMu.Lock()
29		ac.overlays.prompt = promptui.New(title, initial)	29		ac.overlays.prompt = promptui.New(title, initial)

@@ -50,7 +50,7 @@ func promptValidationError(err error) bool {
50		errors.Is(err, errSessionNameInUse)	50		errors.Is(err, errSessionNameInUse)
51		}	51		}
52			52
53	-	func (d Daemon) handlePromptInput(ac attachedClient, data []byte, effects ...*attachmentEffectTicket) {	53	+	func (d Daemon) handlePromptInput(ac attachedClient, data []byte, effects ...*attachmentEffect) {
54		sess := ac.currentAttachmentSession()	54		sess := ac.currentAttachmentSession()
55		if sess == nil {	55		if sess == nil {
56		return	56		return

@@ -66,7 +66,7 @@ func (d Daemon) handlePromptInput(ac attachedClient, data []byte, effects ...*
66		changed := false	66		changed := false
67		exit := false	67		exit := false
68		var submit func(string) error	68		var submit func(string) error
69	-	var transitionSubmit func(string, attachmentConnectionToken) error	69	+	var transitionSubmit func(string, *attachmentEffect) error
70		var submittedPrompt *promptui.Model	70		var submittedPrompt *promptui.Model
71		var value string	71		var value string
72			72

@@ -94,11 +94,11 @@ func (d Daemon) handlePromptInput(ac attachedClient, data []byte, effects ...*
94		if submit != nil \|\| transitionSubmit != nil {	94		if submit != nil \|\| transitionSubmit != nil {
95		var err error	95		var err error
96		if transitionSubmit != nil {	96		if transitionSubmit != nil {
97	-	var token attachmentConnectionToken	97	+	var effect *attachmentEffect
98	-	if len(effects) != 0 && effects[0] != nil {	98	+	if len(effects) != 0 {
99	-	token = effects[0].connectionToken()	99	+	effect = effects[0]
100		}	100		}
101	-	err = transitionSubmit(value, token)	101	+	err = transitionSubmit(value, effect)
102		} else {	102		} else {
103		err = submit(value)	103		err = submit(value)
104		}	104		}

M internal/usecase/daemon/recent_route_snapshot_test.go +4 -5

 func TestRecentRouteSnapshotRepaintsWithoutDeferredIdentity(t *testing.T) {
 	d, sess, ac, sends := newManualSessionWithPTYs(t, nil)
-	token := sess.attachmentToken(ac, ac.transport())
+	token := sess.captureAttachmentCapability(ac, ac.transport())
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	ac.setRouteSnapshot(ports.RecentRouteSnapshot{Generation: 1})
 	payload, err := ports.MarshalRecentRouteSnapshot(ports.RecentRouteSnapshot{Generation: 2})
 	transport := &closeTrackingTransport{}
 	ac.replaceTransport(transport)
 	rc := d.attachCoordinator(source, nil, ac, true)
-	token := source.attachmentToken(ac, transport)
+	token := source.captureAttachmentCapability(ac, transport)
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
 	defer effect.End()
-	token.effect = effect
 	exec := paletteExec{
 		d: d, sess: source, attachment: source, ac: ac,

M internal/usecase/daemon/remote_attach.go +13 -13


@@ -102,11 +102,11 @@ func (d *Daemon) resumeRemoteInactiveSessionLocked(target domain.RemoteSessionTa
102		return d.createSessionLockedWithModeAndInactiveFence(target.SessionName, false, cwd, geometry, env, &expected, validate, expected.tabNames)	102		return d.createSessionLockedWithModeAndInactiveFence(target.SessionName, false, cwd, geometry, env, &expected, validate, expected.tabNames)
103		}	103		}
104			104
105	-	func (d *Daemon) sendNavigationActionForAttachment(token attachmentConnectionToken, action ports.NavigationAction) error {	105	+	func (d Daemon) sendNavigationActionForAttachment(effect attachmentEffect, action ports.NavigationAction) error {
106		directive := ports.NavigationDirective{Action: action}	106		directive := ports.NavigationDirective{Action: action}
107		armed := false	107		armed := false
108		if action == ports.NavigationOpenHomePicker {	108		if action == ports.NavigationOpenHomePicker {
109	-	leaseID, err := d.armParkedRoute(token)	109	+	leaseID, err := d.armParkedRoute(effect)
110		if err != nil {	110		if err != nil {
111		return err	111		return err
112		}	112		}

@@ -115,7 +115,7 @@ func (d *Daemon) sendNavigationActionForAttachment(token attachmentConnectionTok
115		}	115		}
116		rollback := func() {	116		rollback := func() {
117		if armed {	117		if armed {
118	-	token.ac.clearParkedRoute()	118	+	effect.ac.clearParkedRoute()
119		}	119		}
120		}	120		}
121		payload := ports.MarshalNavigationDirective(directive)	121		payload := ports.MarshalNavigationDirective(directive)

@@ -123,36 +123,36 @@ func (d *Daemon) sendNavigationActionForAttachment(token attachmentConnectionTok
123		rollback()	123		rollback()
124		return errAttachmentTransition	124		return errAttachmentTransition
125		}	125		}
126	-	if err := token.sendControl(ports.Frame{Type: ports.MsgNavigationAction, Payload: payload}); err != nil {	126	+	if err := effect.sendControl(ports.Frame{Type: ports.MsgNavigationAction, Payload: payload}); err != nil {
127		rollback()	127		rollback()
128		return err	128		return err
129		}	129		}
130		return nil	130		return nil
131		}	131		}
132			132
133	-	func (d *Daemon) sendRecentRouteNavigationActionForAttachment(token attachmentConnectionToken, action ports.RouteNavigationAction) error {	133	+	func (d Daemon) sendRecentRouteNavigationActionForAttachment(effect attachmentEffect, action ports.RouteNavigationAction) error {
134		payload, err := ports.MarshalRouteNavigationAction(action)	134		payload, err := ports.MarshalRouteNavigationAction(action)
135		if err != nil {	135		if err != nil {
136		return errAttachmentTransition	136		return errAttachmentTransition
137		}	137		}
138	-	return token.sendControl(ports.Frame{Type: ports.MsgNavigateRecentRoute, Payload: payload})	138	+	return effect.sendControl(ports.Frame{Type: ports.MsgNavigateRecentRoute, Payload: payload})
139		}	139		}
140			140
141	-	func (d *Daemon) sendCommittedRouteIdentityForAttachment(token attachmentConnectionToken) error {	141	+	func (d Daemon) sendCommittedRouteIdentityForAttachment(effect attachmentEffect) error {
142	-	if token.sess == nil {	142	+	if !effect.current() \|\| effect.sess == nil {
143		return errAttachmentTransition	143		return errAttachmentTransition
144		}	144		}
145	-	token.sess.mu.Lock()	145	+	effect.sess.mu.Lock()
146		identity := ports.CommittedRouteIdentity{	146		identity := ports.CommittedRouteIdentity{
147	-	Target: ports.ExactSessionTarget{LifecycleID: token.sess.incarnation, SessionName: token.sess.name},	147	+	Target: ports.ExactSessionTarget{LifecycleID: effect.sess.incarnation, SessionName: effect.sess.name},
148	-	Ephemeral: token.sess.ephemeral,	148	+	Ephemeral: effect.sess.ephemeral,
149		}	149		}
150	-	token.sess.mu.Unlock()	150	+	effect.sess.mu.Unlock()
151		payload, err := ports.MarshalCommittedRouteIdentity(identity)	151		payload, err := ports.MarshalCommittedRouteIdentity(identity)
152		if err != nil {	152		if err != nil {
153		return errAttachmentTransition	153		return errAttachmentTransition
154		}	154		}
155	-	return token.sendControl(ports.Frame{Type: ports.MsgCommittedRouteIdentity, Payload: payload})	155	+	return effect.sendControl(ports.Frame{Type: ports.MsgCommittedRouteIdentity, Payload: payload})
156		}	156		}
157			157
158		func (d Daemon) finishRouteAttach(sess session, tr ports.Transport, sz domain.Size, h ports.Hello, routeCreated, purge bool) (*attachedClient, error) {	158		func (d Daemon) finishRouteAttach(sess session, tr ports.Transport, sz domain.Size, h ports.Hello, routeCreated, purge bool) (*attachedClient, error) {

M internal/usecase/daemon/remote_attach_test.go +10 -15

 	source, ac, sends := addRemoteRefreshPickerOwner(t, d, "source")
 	target, _, _ := addRemoteRefreshPickerOwner(t, d, "target")
 	target.incarnation = remoteLifecycleForTest()
-	token := source.attachmentToken(ac, ac.transport())
+	token := source.captureAttachmentCapability(ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
 	defer effect.End()
-	require.NoError(t, d.switchToTargetForAttachment(token, picker.Target{Session: target.id}, sessionHandoffGuard{allowSamePeer: true}, "picker-select"))
+	require.NoError(t, d.switchToTargetForAttachment(effect, picker.Target{Session: target.id}, sessionHandoffGuard{allowSamePeer: true}, "picker-select"))
 	frame := receiveRemotePicker(t, sends, "local attach target")
 	got, err := ports.UnmarshalAttachTarget(frame.Payload)
 	require.NoError(t, err)
 	graphics.mayHaveEmitted = true
 	ac.output.graphicsOutput = graphics
-	token := source.attachmentToken(ac, ac.transport())
+	token := source.captureAttachmentCapability(ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
 	defer effect.End()
-	require.NoError(t, d.switchToTargetForAttachment(token, picker.Target{
+	require.NoError(t, d.switchToTargetForAttachment(effect, picker.Target{
 		Name: "stopped", Incarnation: lifecycle,
 	}, sessionHandoffGuard{closePicker: true, allowSamePeer: true}, "picker-select"))
 	d.remoteCatalog.status["arch"] = remoteHostFresh
 	d.remoteCatalog.mu.Unlock()
 	sess, ac, sends := addRemoteRefreshPickerOwner(t, d, "local")
-	token := sess.attachmentToken(ac, ac.transport())
+	token := sess.captureAttachmentCapability(ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
 	defer effect.End()
 	key := domain.RemoteSessionKey{Host: "arch", Name: "work", LifecycleID: lifecycle, DisplayOrigin: "arch"}
 	remoteTarget := domain.RemoteSessionTarget{Endpoint: "arch", DisplayOrigin: "arch", LifecycleID: lifecycle, SessionName: "work", LiveTabID: "tab-1"}
 	target := picker.Target{Session: key.ID(), RemoteKey: &key, RemoteTarget: &remoteTarget, TabID: "tab-1"}
-	require.NoError(t, d.sendRemoteAttachTargetForAttachment(token, target, sessionHandoffGuard{closePicker: true}, "picker-select"))
+	require.NoError(t, d.sendRemoteAttachTargetForAttachment(effect, target, sessionHandoffGuard{closePicker: true}, "picker-select"))
 	frame := receiveRemotePicker(t, sends, "rich attach target")
 	got, err := ports.UnmarshalAttachTarget(frame.Payload)
 	require.NoError(t, err)
 			d.remoteCatalog.status["arch"] = remoteHostFresh
 			d.remoteCatalog.mu.Unlock()
 			sess, ac, sends := addRemoteRefreshPickerOwner(t, d, "local")
-			token := sess.attachmentToken(ac, ac.transport())
+			token := sess.captureAttachmentCapability(ac, ac.transport())
 			effect, admitted := ac.beginAttachmentEffect(token)
 			require.True(t, admitted)
-			token.effect = effect
 			defer effect.End()
 			key := domain.RemoteSessionKey{Host: "arch", Name: "work", LifecycleID: lifecycle, DisplayOrigin: "arch"}
 			target := picker.Target{Session: key.ID(), RemoteKey: &key, RemoteTarget: &remoteTarget, TabID: "tab-1"}
 			test.mutate(&target)
-			require.ErrorIs(t, d.sendRemoteAttachTargetForAttachment(token, target, sessionHandoffGuard{}, "picker-select"), errAttachmentTransition)
+			require.ErrorIs(t, d.sendRemoteAttachTargetForAttachment(effect, target, sessionHandoffGuard{}, "picker-select"), errAttachmentTransition)
 			for {
 				select {
 				case frame := <-sends:
 	d.remoteCatalog.status["arch"] = remoteHostFresh
 	d.remoteCatalog.mu.Unlock()
 	sess, ac, sends := addRemoteRefreshPickerOwner(t, d, "local")
-	token := sess.attachmentToken(ac, ac.transport())
+	token := sess.captureAttachmentCapability(ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
 	defer effect.End()
 	key := domain.RemoteSessionKey{Host: "arch", Name: "work", LifecycleID: lifecycle, DisplayOrigin: "arch"}
 	remoteTarget := domain.RemoteSessionTarget{Endpoint: "arch", DisplayOrigin: "arch", LifecycleID: lifecycle, SessionName: "work", LiveTabID: "tab-1"}
 	target := picker.Target{Session: key.ID(), RemoteKey: &key, RemoteTarget: &remoteTarget, TabID: "tab-1"}
-	require.ErrorIs(t, d.sendRemoteAttachTargetForAttachment(token, target, sessionHandoffGuard{}, "picker-select"), errAttachmentTransition)
+	require.ErrorIs(t, d.sendRemoteAttachTargetForAttachment(effect, target, sessionHandoffGuard{}, "picker-select"), errAttachmentTransition)
 	for {
 		select {
 		case frame := <-sends:

M internal/usecase/daemon/remote_picker_test.go +11 -15

 	d.remoteCatalog.status["arch"] = remoteHostFresh
 	d.remoteCatalog.mu.Unlock()
 	sess, ac, sends := addRemoteRefreshPickerOwner(t, d, "local")
-	token := sess.attachmentToken(ac, ac.transport())
+	token := sess.captureAttachmentCapability(ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
 	key := domain.RemoteSessionKey{Host: "arch", Name: "work", LifecycleID: lifecycle, DisplayOrigin: "arch"}
 	remoteTarget := domain.RemoteSessionTarget{Endpoint: "arch", DisplayOrigin: "arch", LifecycleID: lifecycle, SessionName: "work", LiveTabID: "tab-1"}
 	target := picker.Target{Session: key.ID(), RemoteKey: &key, RemoteTarget: &remoteTarget, TabID: "tab-1"}
-	require.NoError(t, d.sendRemoteAttachTargetForAttachment(token, target, sessionHandoffGuard{closePicker: true}, "picker-select"))
+	require.NoError(t, d.sendRemoteAttachTargetForAttachment(effect, target, sessionHandoffGuard{closePicker: true}, "picker-select"))
 	frame := receiveRemotePicker(t, sends, "attach target")
 	require.Equal(t, ports.MsgAttachTarget, frame.Type)
 	local.remoteCatalog.status["arch"] = remoteHostFresh
 	local.remoteCatalog.mu.Unlock()
 	localSession, localAttachment, sends := addRemoteRefreshPickerOwner(t, local, "local")
-	token := localSession.attachmentToken(localAttachment, localAttachment.transport())
+	token := localSession.captureAttachmentCapability(localAttachment, localAttachment.transport())
 	effect, admitted := localAttachment.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
+	require.NoError(t, local.sendRemoteAttachTargetForAttachment(effect, selected, sessionHandoffGuard{closePicker: true}, "picker-select"))
-	require.NoError(t, local.sendRemoteAttachTargetForAttachment(token, selected, sessionHandoffGuard{closePicker: true}, "picker-select"))
 	frame := receiveRemotePicker(t, sends, "stopped remote target")
 	handoff, err := ports.UnmarshalAttachTarget(frame.Payload)
 	local.remoteCatalog.status["arch"] = remoteHostFresh
 	local.remoteCatalog.mu.Unlock()
 	localSession, localAttachment, sends := addRemoteRefreshPickerOwner(t, local, "local")
-	token := localSession.attachmentToken(localAttachment, localAttachment.transport())
+	token := localSession.captureAttachmentCapability(localAttachment, localAttachment.transport())
 	effect, admitted := localAttachment.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
+	require.NoError(t, local.sendRemoteAttachTargetForAttachment(effect, selected, sessionHandoffGuard{closePicker: true}, "picker-select"))
-	require.NoError(t, local.sendRemoteAttachTargetForAttachment(token, selected, sessionHandoffGuard{closePicker: true}, "picker-select"))
 	frame := receiveRemotePicker(t, sends, "stopped remote target without tab metadata")
 	handoff, err := ports.UnmarshalAttachTarget(frame.Payload)
 			if tt.action == ports.NavigationOpenHomePicker {
 				ac.navigationCapabilities = ports.NavigationCapabilityHomePicker
 			}
-			token := sess.attachmentToken(ac, ac.transport())
+			token := sess.captureAttachmentCapability(ac, ac.transport())
 			effect, admitted := ac.beginAttachmentEffect(token)
 			require.True(t, admitted)
-			token.effect = effect
+			defer effect.End()
-			require.NoError(t, d.sendNavigationActionForAttachment(token, tt.action))
+			require.NoError(t, d.sendNavigationActionForAttachment(effect, tt.action))
 			frame := receiveRemotePicker(t, sends, "navigation action")
 			require.Equal(t, ports.MsgNavigationAction, frame.Type)
 			directive, err := ports.UnmarshalNavigationDirective(frame.Payload)
 	gone := make(chan struct{})
 	d.afterClientGoneDetach = func() { close(gone) }
-	token := sess.attachmentToken(ac, tr)
+	token := sess.captureAttachmentCapability(ac, tr)
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
 	defer effect.End()
 	key := domain.RemoteSessionKey{Host: "arch", Name: "work", LifecycleID: lifecycle, DisplayOrigin: "arch"}
 	remoteTarget := domain.RemoteSessionTarget{Endpoint: "arch", DisplayOrigin: "arch", LifecycleID: lifecycle, SessionName: "work", LiveTabID: "tab-1"}
 	target := picker.Target{Session: key.ID(), RemoteKey: &key, RemoteTarget: &remoteTarget, TabID: "tab-1"}
-	err := d.sendRemoteAttachTargetForAttachment(token, target, sessionHandoffGuard{closePicker: true}, "picker-select")
+	err := d.sendRemoteAttachTargetForAttachment(effect, target, sessionHandoffGuard{closePicker: true}, "picker-select")
 	var userErr *domain.UserError
 	require.ErrorAs(t, err, &userErr)
 	require.Equal(t, "couldn't attach to remote session", userErr.Msg)

M internal/usecase/daemon/remote_preview_cache_test.go +2 -3

 	client.release = nil
 	client.startedSignal = false
 	client.mu.Unlock()
-	token := sess.attachmentToken(ac, ac.transport())
+	token := sess.captureAttachmentCapability(ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
 	defer effect.End()
-	require.True(t, d.resizeAttachmentForLease(token, domain.Size{Cols: 100, Rows: 30}))
+	require.True(t, d.resizeAttachmentForLease(effect, domain.Size{Cols: 100, Rows: 30}))
 	<-secondStarted
 	wantWidth, wantHeight := remotePickerPreviewSize(domain.Size{Cols: 100, Rows: 30})
 	gotWidth, gotHeight := client.LastSize()

M internal/usecase/daemon/render.go +19 -18

 type runtimeMarkBatch struct {
 	observer         ports.RuntimeObserver
 	marks            []ports.RuntimeMark
-	attachmentEffect *attachmentEffectTicket
+	attachmentEffect *attachmentEffect
 }
 func (d *Daemon) newRuntimeMarkBatch() runtimeMarkBatch {
 	sess := entry
 	local := sess != nil
 	marks := d.newRuntimeMarkBatch()
+	var paintEffect *attachmentEffect
 	if lease != nil {
-		token := attachmentToken(entry, ac, ac.transport())
+		token := captureAttachmentCapability(entry, ac, ac.transport())
 		token.lease = lease
 		ticket, admitted := ac.beginAttachmentEffect(token)
 		if !admitted {
 			return paintRejected
 		}
+		paintEffect = ticket
 		marks.attachmentEffect = ticket
 		defer ticket.End()
 	}
 	}
 	ac.sendMu.Lock()
-	// sendMu is the attachment ownership boundary. Check the session's
+	if paintEffect != nil {
-	// published identity while holding it so a deadline captured before an
+		if !paintEffect.current() || ac.parkedRouteOutput.Load() {
-	// attach/replace cannot emit on either the old or new output chain.
-	entry.core().mu.Lock()
-	_, owned := entry.core().attachments[ac]
-	entry.core().mu.Unlock()
-	if !owned || ac.currentAttachmentSession() != entry || ac.parkedRouteOutput.Load() {
-		ac.sendMu.Unlock()
-		return paintRejected
-	}
-	if ac.parkedRouteFullPending.Load() {
-		reset = true
-	}
-	if lease != nil {
-		rc := attachmentRenderCoordinator(entry)
-		if rc == nil || lease.attachment != ac || !rc.leaseCurrent(lease, true) {
 			ac.sendMu.Unlock()
 			return paintRejected
 		}
+	} else {
+		// Direct/headless rendering has no Attachment effect and retains its
+		// membership-only fixture path.
+		entry.core().mu.Lock()
+		_, owned := entry.core().attachments[ac]
+		entry.core().mu.Unlock()
+		if !owned || ac.currentAttachmentSession() != entry || ac.parkedRouteOutput.Load() {
+			ac.sendMu.Unlock()
+			return paintRejected
+		}
+	}
+	if ac.parkedRouteFullPending.Load() {
+		reset = true
 	}
 	// Capacity is checked before any destructive capture. Refresh the atomic
 	// readiness snapshot while sendMu is held so direct test/setup mutations of

M internal/usecase/daemon/render_pipeline.go +16 -9

 		ActiveTabID: state.view.tabID,
 	}
 	entry.core().mu.Unlock()
-	if !owned || state.attachment != ac || ac.currentAttachmentSession() != entry {
+	if marks.attachmentEffect != nil {
-		ac.sendMu.Unlock()
+		if !marks.attachmentEffect.current() || state.attachment != ac {
-		return false
+			ac.sendMu.Unlock()
-	}
+			return false
-	if state.lease != nil {
+		}
-		rc := attachmentRenderCoordinator(entry)
+	} else {
-		if rc == nil || state.lease.attachment != ac || !rc.leaseCurrent(state.lease, true) {
+		if !owned || state.attachment != ac || ac.currentAttachmentSession() != entry {
 			ac.sendMu.Unlock()
 			return false
 		}
+		if state.lease != nil {
+			rc := attachmentRenderCoordinator(entry)
+			if rc == nil || state.lease.attachment != ac || !rc.leaseCurrent(state.lease, true) {
+				ac.sendMu.Unlock()
+				return false
+			}
+		}
 	}
 	endDiff := marks.span(ports.RuntimeDiffStart, ports.RuntimeDiffEnd, 0)
 	prepared, err := ac.output.prepareFrame(d, state, composed.frame, composed.damage, composed.reset, composed.cursor)
 			// Capture the exact admitted capability, including its coordinator
 			// lease, before End permits a new attachment publication. Reserve
 			// cleanup accounting before End so terminal Wait cannot race a later Add.
-			token := marks.attachmentEffect.connectionToken()
+			capability := marks.attachmentEffect.capability()
-			launchCleanup := d.reserveAttachmentSendErrorCleanup(token, sendTr)
+			launchCleanup := d.reserveAttachmentSendErrorCleanup(capability, sendTr)
 			marks.attachmentEffect.End()
 			launchCleanup()
 		}

M internal/usecase/daemon/render_pipeline_test.go +4 -4


@@ -686,12 +686,12 @@ func TestNoticeStylesFromMapsWarnToDedicatedRoleDistinctFromInfo(t *testing.T) {
686			686
687		func TestEmitFrameSkipsTransportSendWhenAttachmentEffectFenceRejects(t *testing.T) {	687		func TestEmitFrameSkipsTransportSendWhenAttachmentEffectFenceRejects(t *testing.T) {
688		d, sess, ac, sends := newManualSessionWithPTYs(t, nil)	688		d, sess, ac, sends := newManualSessionWithPTYs(t, nil)
689	-	token := sess.attachmentToken(ac, ac.transport())	689	+	token := sess.captureAttachmentCapability(ac, ac.transport())
690		effect, admitted := ac.beginAttachmentEffect(token)	690		effect, admitted := ac.beginAttachmentEffect(token)
691		require.True(t, admitted)	691		require.True(t, admitted)
692	-	ac.attachmentEffects.mu.Lock()	692	+	ac.lifecycle.mu.Lock()
693	-	ac.attachmentEffects.capability.transport = transportSnapshot{}	693	+	ac.lifecycle.capability.transport = transportSnapshot{}
694	-	ac.attachmentEffects.mu.Unlock()	694	+	ac.lifecycle.mu.Unlock()
695			695
696		state := cacheState("stale", 1)	696		state := cacheState("stale", 1)
697		state.attachment = ac	697		state.attachment = ac

M internal/usecase/daemon/resize_publication.go +8 -14

 	attachment  *attachedClient
 	lease       *attachmentLease
 	epoch       uint64
-	connection  attachmentConnectionToken
+	effect      *attachmentEffect
 	coordinator *renderCoordinator
 	observer    ports.RuntimeObserver
 	mark        ports.RuntimeMark
 	if p.attachment == nil {
 		return true
 	}
-	// Attached resize publication is admitted only through a live attachment effect ticket.
+	// Attached resize publication retains the exact admitted effect; lifecycle
-	if p.connection.effect == nil {
+	// identity cannot change until that effect ends.
+	if !p.effect.current() || p.effect.sess != p.session ||
+		p.effect.ac != p.attachment || p.effect.lease != p.lease || p.coordinator == nil {
 		return false
 	}
-	if p.connection.effect.ended.Load() || p.connection.sess != p.session ||
+	return p.coordinator.resizeCurrentForLease(p.epoch, p.attachment, p.lease, false)
-		p.connection.ac != p.attachment || p.connection.lease != p.lease ||
-		p.connection.generation != p.attachment.connectionGeneration.Load() ||
-		!p.attachment.transportSnapshotCurrent(p.connection.transport) ||
-		p.attachment.currentSession() != p.session || p.coordinator == nil {
-		return false
-	}
-	registered := attachmentRegistered(p.session, p.attachment)
-	return registered && p.coordinator.resizeCurrentForLease(p.epoch, p.attachment, p.lease, false)
 }
 // emit performs observer work only after every resize-owner fence and
 // reservation with pane ownership. sendMu is acquired before resize fences, so
 // the canonical rule never acquires an attachment lock while a pane fence is
 // held. Observer callbacks run only after both lock families are released.
-func (d *Daemon) publishResizeCommit(members []resizeMember, sess *session, ac *attachedClient, lease *attachmentLease, epoch uint64, ticket *attachmentEffectTicket, size domain.Size) bool {
+func (d *Daemon) publishResizeCommit(members []resizeMember, sess *session, ac *attachedClient, lease *attachmentLease, epoch uint64, ticket *attachmentEffect, size domain.Size) bool {
 	if ac != nil && ticket == nil {
 		return false
 	}
 		mark:       ports.NewRuntimeMark("daemon", ports.RuntimeResizeCommitted, 0, true),
 	}
 	if ticket != nil {
-		publication.connection = ticket.connectionToken()
+		publication.effect = ticket
 		publication.coordinator = sess.renderCoordinator()
 	}
 	if !publication.current() {

M internal/usecase/daemon/resume.go +18 -3

 		d.mu.Unlock()
 		return false
 	}
+	d.mu.Unlock()
+	// A successful claim may already have published active membership. Freeze
+	// and drain without architecture locks before restoring parked identity.
+	frozen := freezeAttachmentEffectGates(ac)
+	defer frozen.unfreeze()
+	d.mu.Lock()
+	if d.parked[token] != parked || !parked.claimed || ac.resumeClaimToken != token {
+		d.mu.Unlock()
+		return false
+	}
 	parked.claimed = false
 	ac.resumeClaimToken = 0
 	ac.resumeToken = token
 	ac.parked = true
-	ac.connectionGeneration.Add(1)
 	sess := parked.sess
 	if sess != nil {
 		sess.mu.Lock()
 		sess.unregisterAttachmentLocked(ac)
+		ac.setSession(nil)
+		ac.invalidateFrozenAttachmentCapability()
 		sess.mu.Unlock()
+	} else {
+		ac.setSession(nil)
+		ac.invalidateFrozenAttachmentCapability()
 	}
 	// Recreate the parked entry and its watcher instead of restoring a timer
 	// that may already have fired while the claim held the old entry. This also
 	}
 	d.parked[token] = rearmed
 	captured := ac.transportSnapshot().transport
-	ac.setSession(nil)
 	d.mu.Unlock()
 	if sess != nil {
 		d.recalculateSessionGeometryAndInvalidate(sess, nil, "resume.go")
 	d.discardAttachmentOutputLocked(parked.ac)
 	parked.ac.resumeToken = 0
 	parked.ac.parked = false
-	parked.ac.connectionGeneration.Add(1)
 	parked.ac.setSession(nil)
+	parked.ac.invalidateRetiredAttachmentCapability()
 	return parkedAttachmentRetirement{
 		parked:            parked,
 		pickerGeneration:  parked.pickerGeneration,

M internal/usecase/daemon/resume_test.go +2 -2


@@ -1150,7 +1150,7 @@ func TestResumeCloseCapturedOldTransportDoesNotCloseReboundTransport(t *testing.
1150		token := ac.resumeToken	1150		token := ac.resumeToken
1151		require.True(t, sess.detachIfCurrent(ac))	1151		require.True(t, sess.detachIfCurrent(ac))
1152		require.True(t, d.parkAttachment(sess, ac))	1152		require.True(t, d.parkAttachment(sess, ac))
1153	-	generation := ac.connectionGeneration.Load()	1153	+	generation := ac.lifecycle.generationValue()
1154			1154
1155		newTr := &closeTrackingTransport{}	1155		newTr := &closeTrackingTransport{}
1156		resumedSess, resumedAC, ok, err := d.resumeParked(helloResumeCapable(ports.IntentResume, "work", token), newTr, domain.Size{Cols: 80, Rows: 24})	1156		resumedSess, resumedAC, ok, err := d.resumeParked(helloResumeCapable(ports.IntentResume, "work", token), newTr, domain.Size{Cols: 80, Rows: 24})

@@ -1158,7 +1158,7 @@ func TestResumeCloseCapturedOldTransportDoesNotCloseReboundTransport(t *testing.
1158		require.True(t, ok)	1158		require.True(t, ok)
1159		require.Same(t, sess, resumedSess)	1159		require.Same(t, sess, resumedSess)
1160		require.Same(t, ac, resumedAC)	1160		require.Same(t, ac, resumedAC)
1161	-	require.Greater(t, ac.connectionGeneration.Load(), generation, "resume must publish active ownership through the attachment transition")	1161	+	require.Greater(t, ac.lifecycle.generationValue(), generation, "resume must publish active ownership through the attachment transition")
1162			1162
1163		_ = ac.closeCapturedTransport(oldTr)	1163		_ = ac.closeCapturedTransport(oldTr)
1164		require.True(t, oldTr.Closed(), "old transport is closed")	1164		require.True(t, oldTr.Closed(), "old transport is closed")

M internal/usecase/daemon/resume_wake_incarnation_test.go +2 -2


@@ -88,7 +88,7 @@ func TestSameAttachmentRebindRejectsQueuedWakeAndFansOutFreshGeneration(t *testi
88		}()	88		}()
89		<-wakeDispatched	89		<-wakeDispatched
90			90
91	-	oldGeneration := ac.connectionGeneration.Load()	91	+	oldGeneration := ac.lifecycle.generationValue()
92		result, err := d.transitionAttachment(attachmentTransitionRequest{	92		result, err := d.transitionAttachment(attachmentTransitionRequest{
93		source: sess, target: sess, next: ac,	93		source: sess, target: sess, next: ac,
94			94

@@ -96,7 +96,7 @@ func TestSameAttachmentRebindRejectsQueuedWakeAndFansOutFreshGeneration(t *testi
96		})	96		})
97		require.NoError(t, err)	97		require.NoError(t, err)
98		d.deferAttachmentTransitionCleanups(result)	98		d.deferAttachmentTransitionCleanups(result)
99	-	require.Greater(t, ac.connectionGeneration.Load(), oldGeneration)	99	+	require.Greater(t, ac.lifecycle.generationValue(), oldGeneration)
100		freshLease := rc.attachmentLease(ac)	100		freshLease := rc.attachmentLease(ac)
101		require.NotSame(t, oldLease, freshLease)	101		require.NotSame(t, oldLease, freshLease)
102			102

M internal/usecase/daemon/route_position_test.go +1 -1


@@ -89,7 +89,7 @@ func TestPaintPublishesChangedAttachmentRoutePosition(t *testing.T) {
89		require.True(t, rc.markAttachmentReady(rc.attachmentLease(ac)))	89		require.True(t, rc.markAttachmentReady(rc.attachmentLease(ac)))
90		sess.repairAttachmentView(ac)	90		sess.repairAttachmentView(ac)
91			91
92	-	require.True(t, d.firstPaintForTransition(sess.attachmentToken(ac, tr)))	92	+	require.True(t, d.firstPaintForTransition(sess.captureAttachmentCapability(ac, tr)))
93		sess.selectAttachmentTab(ac, "tab-2")	93		sess.selectAttachmentTab(ac, "tab-2")
94		d.paint(sess, ac, false, nil)	94		d.paint(sess, ac, false, nil)
95			95

M internal/usecase/daemon/same_peer_switch.go +28 -17

 // switchSamePeerForAttachment commits one client-confirmed endpoint-empty
 // target. The request never names an endpoint: its authority is the current
 // authenticated attachment plus the target's exact lifecycle identity.
-func (d *Daemon) switchSamePeerForAttachment(token attachmentConnectionToken, request ports.SamePeerSwitchRequest) {
+func (d *Daemon) switchSamePeerForAttachment(effect *attachmentEffect, request ports.SamePeerSwitchRequest) {
-	if err := request.Validate(); err != nil || token.sess == nil || token.ac == nil {
+	if err := request.Validate(); err != nil || !effect.current() || effect.sess == nil || effect.ac == nil {
 		return
 	}
-	if !token.ac.consumeSamePeerOffer(request.Target) {
+	if !effect.ac.consumeSamePeerOffer(request.Target) {
-		d.sendSamePeerSwitchFailure(token, request.RequestID, ports.SamePeerSwitchStaleTarget)
+		d.sendSamePeerSwitchFailure(effect, request.RequestID, ports.SamePeerSwitchStaleTarget)
 		return
 	}
 	target, targetTabIndex, ok := d.samePeerTarget(request)
-	if !ok || target == token.sess {
+	if !ok || target == effect.sess {
-		d.sendSamePeerSwitchFailure(token, request.RequestID, ports.SamePeerSwitchStaleTarget)
+		d.sendSamePeerSwitchFailure(effect, request.RequestID, ports.SamePeerSwitchStaleTarget)
 		return
 	}
+	capability := effect.capability()
 	transition, err := d.transitionAttachment(attachmentTransitionRequest{
-		source:            token.sess,
+		source:            effect.sess,
 		target:            target,
-		next:              token.ac,
+		next:              effect.ac,
-		expectedTransport: token.transport,
+		expectedTransport: effect.transport,
-		sourceToken:       &token,
+		sourceCapability:  &capability,
+		sourceEffect:      effect,
 		action:            "same-peer-switch",
 		expectedTargetLifecycle: &attachmentLifecycleFence{
 			name:             request.Target.SessionName,
 		ready:             true,
 	})
 	if err != nil {
-		d.sendSamePeerSwitchFailure(token, request.RequestID, ports.SamePeerSwitchStaleTarget)
+		d.sendSamePeerSwitchFailure(effect, request.RequestID, ports.SamePeerSwitchStaleTarget)
 		return
 	}
-	if fresh, admitted := token.ac.beginAttachmentEffect(transition.published); admitted {
+	if fresh, admitted := effect.ac.beginAttachmentEffect(transition.published); admitted {
-		d.closePicker(token.ac)
+		d.closePicker(effect.ac)
 		fresh.End()
 	}
 	d.touchMRU(target)
 	return target, tabIndex, true
 }
-func (d *Daemon) sendSamePeerSwitchFailure(token attachmentConnectionToken, requestID uint64, code ports.SamePeerSwitchFailureCode) {
+func (d *Daemon) sendSamePeerSwitchFailure(effect *attachmentEffect, requestID uint64, code ports.SamePeerSwitchFailureCode) {
-	if !token.attachmentCurrent() {
+	if effect == nil || effect.ac == nil {
 		return
 	}
+	sender := effect
+	if !sender.current() {
+		var admitted bool
+		sender, admitted = effect.ac.beginAttachmentEffect(effect.capability())
+		if !admitted {
+			return
+		}
+		defer sender.End()
+	}
 	payload, err := ports.MarshalSamePeerSwitchFailure(ports.SamePeerSwitchFailure{RequestID: requestID, Code: code})
 	if err != nil {
 		return
 	}
-	if err := token.sendControl(ports.Frame{Type: ports.MsgSamePeerSwitchFailure, Payload: payload}); err != nil {
+	if err := sender.sendControl(ports.Frame{Type: ports.MsgSamePeerSwitchFailure, Payload: payload}); err != nil {
-		d.detachOnAttachmentSendError(token, token.transport.transport)
+		d.detachOnAttachmentSendError(sender.capability(), sender.transport.transport)
 	}
 }

M internal/usecase/daemon/same_peer_switch_test.go +4 -6

 	d.mu.Unlock()
 	ac.setRouteSnapshot(ports.RecentRouteSnapshot{Generation: 1})
-	token := source.attachmentToken(ac, ac.transport())
+	token := source.captureAttachmentCapability(ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
 	defer effect.End()
 	requestTarget := ports.ExactSessionTarget{LifecycleID: lifecycle, SessionName: "target"}
 	ac.offerSamePeerTarget(requestTarget)
-	d.switchSamePeerForAttachment(token, ports.SamePeerSwitchRequest{
+	d.switchSamePeerForAttachment(effect, ports.SamePeerSwitchRequest{
 		RequestID:      1,
 		Target:         requestTarget,
 		PreferredTabID: domain.TabStableID(target.tabs[1].stableID),
 	defer releaseAll(releases)
 	ac.setRouteSnapshot(ports.RecentRouteSnapshot{Generation: 1})
-	token := source.attachmentToken(ac, ac.transport())
+	token := source.captureAttachmentCapability(ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
-	token.effect = effect
 	defer effect.End()
-	d.switchSamePeerForAttachment(token, ports.SamePeerSwitchRequest{
+	d.switchSamePeerForAttachment(effect, ports.SamePeerSwitchRequest{
 		RequestID: 1,
 		Target:    ports.ExactSessionTarget{LifecycleID: domain.SessionLifecycleID{9}, SessionName: "missing"},
 	})

M internal/usecase/daemon/session.go +45 -59

 // createSessionAndSwitchForAttachment creates no target until the initiating role
 // ticket has ended and the exact source capability is frozen and revalidated.
-func (d *Daemon) createSessionAndSwitchForAttachment(token attachmentConnectionToken, name string) error {
+func (d *Daemon) createSessionAndSwitchForAttachment(effect *attachmentEffect, name string) error {
 	if name == "" {
 		return errSessionNameRequired
 	}
 	if err := domain.ValidateSessionName(name); err != nil {
 		return err
 	}
-	if token.sess == nil || token.ac == nil || token.effect == nil {
+	if effect == nil || effect.sess == nil || effect.ac == nil {
 		return errAttachmentTransition
 	}
-	token.effect.bindActionEnd(d, "create-session")
+	effect.bindActionEnd(d, "create-session")
-	token.effect.End()
+	effect.End()
+	capability := effect.capability()
 	var created *session
 	transition, err := d.transitionAttachment(attachmentTransitionRequest{
-		source: token.sess, next: token.ac,
+		source: capability.sess, next: capability.ac,
-		expectedTransport: token.transport, sourceToken: &token, action: "create-session",
+		expectedTransport: capability.transport, sourceCapability: &capability, sourceEffect: effect, action: "create-session",
 		copySourceEnvironment: true, ready: true,
 		createTargetLocked: func() (*session, error) {
-			source := token.sess
+			source := capability.sess
 			if source == nil {
 				return nil, errAttachmentTransition
 			}
 			cwd, env := source.cwd, copyEnvironment(source.env)
 			source.mu.Unlock()
 			var createErr error
-			created, createErr = d.createSessionLockedWithMode(name, false, cwd, token.ac.geometrySnapshot(), env)
+			created, createErr = d.createSessionLockedWithMode(name, false, cwd, capability.ac.geometrySnapshot(), env)
 			return created, createErr
 		},
 	})
 	}
 	d.touchMRU(created)
-	d.log.Info("client attached", "session", created.name, "resume", token.ac.resumeCapable)
+	d.log.Info("client attached", "session", created.name, "resume", capability.ac.resumeCapable)
 	d.deferAttachmentTransitionCleanups(transition)
 	d.firstPaintForTransition(transition.published)
 	return nil
 	return nil
 }
-func (d *Daemon) createEphemeralSessionAndSwitchForAttachment(token attachmentConnectionToken) error {
+func (d *Daemon) createEphemeralSessionAndSwitchForAttachment(effect *attachmentEffect) error {
-	if token.sess == nil || token.ac == nil || token.effect == nil {
+	if effect == nil || effect.sess == nil || effect.ac == nil {
 		return errAttachmentTransition
 	}
-	token.effect.bindActionEnd(d, "create-ephemeral-session")
+	effect.bindActionEnd(d, "create-ephemeral-session")
-	token.effect.End()
+	effect.End()
+	capability := effect.capability()
 	var created *session
 	transition, err := d.transitionAttachment(attachmentTransitionRequest{
-		source: token.sess, next: token.ac,
+		source: capability.sess, next: capability.ac,
-		expectedTransport: token.transport, sourceToken: &token, action: "create-ephemeral-session",
+		expectedTransport: capability.transport, sourceCapability: &capability, sourceEffect: effect, action: "create-ephemeral-session",
 		copySourceEnvironment: true, ready: true,
 		createTargetLocked: func() (*session, error) {
-			if token.sess == nil || d.closing {
+			if capability.sess == nil || d.closing {
 				return nil, errAttachmentTransition
 			}
-			source := token.sess
+			source := capability.sess
 			source.mu.Lock()
 			cwd, env := source.cwd, copyEnvironment(source.env)
 			source.mu.Unlock()
 			name := d.allocEphemeralNameLocked()
 			var createErr error
-			created, createErr = d.createSessionLockedWithMode(name, true, cwd, token.ac.geometrySnapshot(), env)
+			created, createErr = d.createSessionLockedWithMode(name, true, cwd, capability.ac.geometrySnapshot(), env)
 			return created, createErr
 		},
 	})
 		return err
 	}
 	d.touchMRU(created)
-	d.log.Info("client attached", "session", created.name, "resume", token.ac.resumeCapable)
+	d.log.Info("client attached", "session", created.name, "resume", capability.ac.resumeCapable)
 	d.deferAttachmentTransitionCleanups(transition)
 	d.firstPaintForTransition(transition.published)
 	return nil
 	go d.readPanePTY(p)
 }
-func (s *session) detachIfCurrent(ac *attachedClient) bool {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if !attachmentRegisteredLocked(s, ac) || ac.currentAttachmentSession() != s {
-		return false
-	}
-	s.unregisterAttachmentLocked(ac)
-	ac.setSession(nil)
-	return true
-}
 // detachIfCurrent publishes terminal attachment invalidation through the attachment
 // gate. Freeze/drain happens before routing or session locks are acquired.
 func (d *Daemon) detachIfCurrent(sess *session, ac *attachedClient) bool {
 	}
 	if current {
 		sess.unregisterAttachmentLocked(ac)
-		ac.connectionGeneration.Add(1)
 		ac.setSession(nil)
 		ac.invalidateFrozenAttachmentCapability()
 	}
 // detachIfAttachmentCurrent invalidates only the exact attachment generation and transport
 // whose admitted send failed. A queued stale error cannot detach a later
 // attachment publication or a rebound transport on the same attachment object.
-func (d *Daemon) detachIfAttachmentCurrent(token attachmentConnectionToken) bool {
+func (d *Daemon) detachIfAttachmentCurrent(token attachmentCapability) bool {
 	return d.detachIfAttachmentCurrentUntil(token, nil)
 }
-func (d *Daemon) detachIfAttachmentCurrentUntil(token attachmentConnectionToken, done func() <-chan struct{}) bool {
+func (d *Daemon) detachIfAttachmentCurrentUntil(token attachmentCapability, done func() <-chan struct{}) bool {
 	if token.sess == nil || token.ac == nil || token.transport.transport == nil {
 		return false
 	}
 	if coordinator != nil {
 		coordinator.mu.Lock()
 	}
-	req := attachmentTransitionRequest{
+	current := coordinator != nil && token.currentInSessionAndLeaseLocked(token.sess, token.ac, coordinator)
-		source: token.sess, next: token.ac, expectedTransport: token.transport,
-	}
-	current := coordinator != nil && transitionSourceTokenCurrentLocked(token, token.sess, coordinator, req)
 	if current {
 		unregisterAttachmentSessionLocked(token.sess, token.ac)
-		token.ac.connectionGeneration.Add(1)
 		token.ac.setSession(nil)
 		token.ac.invalidateFrozenAttachmentCapability()
 	}
 		if ac.deferRouteIdentityUntilSnapshot() {
 			continue
 		}
-		token := sess.attachmentToken(ac, ac.transport())
+		token := sess.captureAttachmentCapability(ac, ac.transport())
 		if token.ac == nil {
 			continue
 		}
 		if !admitted {
 			continue
 		}
-		token = effect.connectionToken()
+		err := d.sendCommittedRouteIdentityForAttachment(effect)
-		err := d.sendCommittedRouteIdentityForAttachment(token)
+		capability := effect.capability()
 		effect.End()
 		if err != nil {
-			d.detachOnAttachmentSendError(token, token.transport.transport)
+			d.detachOnAttachmentSendError(capability, capability.transport.transport)
 		}
 	}
 }
 	return d.closeTabLockedWithEffect(sess, tb, repaint, nil)
 }
-func (d *Daemon) closeTabLockedWithEffect(sess *session, tb *tab, repaint bool, effect *attachmentEffectTicket) error {
+func (d *Daemon) closeTabLockedWithEffect(sess *session, tb *tab, repaint bool, effect *attachmentEffect) error {
 	if sess == nil || tb == nil {
 		return layout.ErrNotFound
 	}
 		var err error
 		if effect != nil {
 			effect.bindActionEnd(d, "close-tab")
-			err = d.killSessionForAttachment(sess, ports.ReasonSessionKilled, false, effect.connectionToken(), "close-tab")
+			err = d.killSessionForAttachment(sess, ports.ReasonSessionKilled, false, effect, "close-tab")
 		} else {
 			err = d.killSession(sess, ports.ReasonSessionKilled, false)
 		}
 }
 type sessionKillAdmission struct {
-	token  attachmentConnectionToken
+	capability attachmentCapability
-	action string
+	effect     *attachmentEffect
+	action     string
 }
 type sessionKillParticipants struct {
 	effectGates []*attachedClient
 	interrupts  []attachmentTransportInterrupt
 	source      *session
-	sourceToken *attachmentConnectionToken
+	sourceToken *attachmentCapability
 	target      *session
 }
-func (d *Daemon) killSessionForAttachment(sess *session, reason uint8, purge bool, token attachmentConnectionToken, action string) error {
+func (d *Daemon) killSessionForAttachment(sess *session, reason uint8, purge bool, effect *attachmentEffect, action string) error {
-	return d.killSessionWithSnapshotDeadline(sess, reason, purge, nil, &sessionKillAdmission{token: token, action: action})
+	if effect == nil {
+		return errAttachmentTransition
+	}
+	return d.killSessionWithSnapshotDeadline(sess, reason, purge, nil, &sessionKillAdmission{capability: effect.capability(), effect: effect, action: action})
 }
 // snapshotSessionKillParticipants captures attachment membership under the canonical
 func (d *Daemon) snapshotSessionKillParticipants(target *session, admission *sessionKillAdmission, requireEmpty bool) (sessionKillParticipants, bool) {
 	snapshot := sessionKillParticipants{target: target}
 	if admission != nil {
-		token := admission.token
+		token := admission.capability
 		if token.sess == nil || token.ac == nil || token.transport.transport == nil {
 			return sessionKillParticipants{}, false
 		}
 		if snapshot.source == nil {
 			return sessionKillParticipants{}, false
 		}
-		snapshot.sourceToken = &admission.token
+		snapshot.sourceToken = &admission.capability
 	}
 	d.mu.Lock()
 		snapshot.effectGates = append(snapshot.effectGates, ac)
 	}
 	if admission != nil {
-		add(admission.token.ac)
+		add(admission.capability.ac)
 	}
 	for ac := range snapshot.attachments {
 		add(ac)
 		return true
 	}
 	token := *snapshot.sourceToken
-	req := attachmentTransitionRequest{
+	return token.currentInSessionAndLeaseLocked(token.sess, token.ac, sourceCoordinator)
-		source: token.sess, next: token.ac, expectedTransport: token.transport,
-	}
-	return transitionSourceTokenCurrentLocked(token, token.sess, sourceCoordinator, req)
 }
 // stopInMemoryLifecycle cancels every session producer and closes every PTY
 		return nil
 	}
 	if admission != nil {
-		d.endActionAttachmentEffect(admission.token.effect, admission.action)
+		d.endActionAttachmentEffect(admission.effect, admission.action)
 	}
 	action := ""
 	if admission != nil {
 			return
 		}
 		attachments = append(attachments, detachedAttachmentSnapshot{ac: attached, transport: participants.transports[attached]})
-		attached.connectionGeneration.Add(1)
 		attached.setSession(nil)
 		attached.invalidateFrozenAttachmentCapability()
 	}
 	d.mu.Unlock()
 	d.finishParkedAttachmentRetirements(parkedRetirements)
 	frozen.unfreeze()
-	frozen = frozenAttachmentEffectGates{}
+	frozen = attachmentTransitionGuard{}
 	d.log.Info("session closed", "session", stoppedName, "id", sess.id, "ephemeral", ephemeral, "purge", purge, "reason", reason)
 	var purgeErr error

M internal/usecase/daemon/session_back.go +6 -7

 // backSessionForAttachment delegates previous-route ownership to the client
 // once it has published a complete route snapshot. There is no daemon-local
 // previous-session fallback after the global-history cutover.
-func (d *Daemon) backSessionForAttachment(token attachmentConnectionToken) error {
+func (d *Daemon) backSessionForAttachment(effect *attachmentEffect) error {
-	if d == nil || token.sess == nil || token.ac == nil {
+	if d == nil || !effect.current() || effect.sess == nil || effect.ac == nil {
 		return nil
 	}
-	snapshot := token.ac.routeSnapshotCopy()
+	snapshot := effect.ac.routeSnapshotCopy()
 	if snapshot.Generation == 0 {
 		if d.log != nil {
 			d.log.Debug("back-session skipped: attachment has no published route snapshot")
 	if snapshot.Previous.Key == 0 || snapshot.Previous.Generation == 0 {
 		return nil
 	}
-	return d.sendRecentRouteNavigationActionForAttachment(token, ports.RouteNavigationAction{
+	return d.sendRecentRouteNavigationActionForAttachment(effect, ports.RouteNavigationAction{
 		SnapshotGeneration: snapshot.Generation,
 		Key:                snapshot.Previous.Key,
 		Generation:         snapshot.Previous.Generation,
 	if d == nil || current == nil || ac == nil {
 		return
 	}
-	token := attachmentToken(current, ac, ac.transport())
+	token := captureAttachmentCapability(current, ac, ac.transport())
 	effect, admitted := ac.beginAttachmentEffect(token)
 	if !admitted {
 		d.reportError(current, domain.UserErr(domain.NoticeSessionUnavailable, "couldn't switch to that session", errAttachmentTransition))
 		return
 	}
-	token.effect = effect
 	defer effect.End()
-	if err := d.backSessionForAttachment(token); err != nil {
+	if err := d.backSessionForAttachment(effect); err != nil {
 		d.reportError(current, err)
 	}
 }

M internal/usecase/daemon/session_back_route_test.go +3 -4

 	transport := &closeTrackingTransport{}
 	ac.replaceTransport(transport)
 	rc := d.attachCoordinator(source, nil, ac, true)
-	token := source.attachmentToken(ac, transport)
+	token := source.captureAttachmentCapability(ac, transport)
 	token.lease = rc.attachmentLease(ac)
-	ac.publishAttachmentCapability(token)
+	ac.installTestAttachmentCapability(token)
 	effect, admitted := ac.beginAttachmentEffect(token)
 	require.True(t, admitted)
 	defer effect.End()
-	token.effect = effect
 	ac.setRouteSnapshot(ports.RecentRouteSnapshot{
 		Generation: 5,
 		Active:     ports.RouteRef{Key: 9, Generation: 5},
 		Entries:    []ports.RecentRouteEntry{testRouteEntry(7, 3, "previous", 7, ports.RouteKindLocal)},
 	})
-	require.NoError(t, d.backSessionForAttachment(token))
+	require.NoError(t, d.backSessionForAttachment(effect))
 	frames := transport.Sends()
 	require.NotEmpty(t, frames)
 	var action ports.RouteNavigationAction

M internal/usecase/daemon/session_rename_purge_test.go +4 -4


@@ -17,8 +17,8 @@ func TestRenamePublishesCommittedRouteIdentityToAttachedClients(t *testing.T) {
17		sess.ephemeral = true	17		sess.ephemeral = true
18		sess.incarnation = domain.IncarnationID{1}	18		sess.incarnation = domain.IncarnationID{1}
19		sess.mu.Unlock()	19		sess.mu.Unlock()
20	-	token := sess.attachmentToken(ac, ac.transport())	20	+	token := sess.captureAttachmentCapability(ac, ac.transport())
21	-	ac.publishAttachmentCapability(token)	21	+	ac.installTestAttachmentCapability(token)
22		ac.setRouteSnapshot(ports.RecentRouteSnapshot{Generation: 1})	22		ac.setRouteSnapshot(ports.RecentRouteSnapshot{Generation: 1})
23			23
24		require.NoError(t, d.renameSession(sess, "vps-infra"))	24		require.NoError(t, d.renameSession(sess, "vps-infra"))

@@ -40,8 +40,8 @@ func TestRenameDefersCommittedRouteIdentityUntilFirstRouteSnapshot(t *testing.T)
40		sess.ephemeral = true	40		sess.ephemeral = true
41		sess.incarnation = domain.IncarnationID{1}	41		sess.incarnation = domain.IncarnationID{1}
42		sess.mu.Unlock()	42		sess.mu.Unlock()
43	-	token := sess.attachmentToken(ac, ac.transport())	43	+	token := sess.captureAttachmentCapability(ac, ac.transport())
44	-	ac.publishAttachmentCapability(token)	44	+	ac.installTestAttachmentCapability(token)
45			45
46		require.NoError(t, d.renameSession(sess, "vps-infra"))	46		require.NoError(t, d.renameSession(sess, "vps-infra"))
47		require.Empty(t, sends, "the route ledger must be published before its identity can be updated")	47		require.Empty(t, sends, "the route ledger must be published before its identity can be updated")

M internal/usecase/daemon/transactional_resize.go +6 -5

 			return false
 		}
 	}
-	connectionGeneration := ac.connectionGeneration.Load()
+	effect, admitted := beginAttachmentLeaseEffect(sess, ac, lease)
-	connection := ac.transportSnapshot()
+	if !admitted {
+		return false
+	}
+	defer effect.End()
 	current := func() bool {
-		return ac.connectionGeneration.Load() == connectionGeneration &&
+		return effect.current() && sess.geometryClaimTokenCurrent(ac, geometryClaim) &&
-			ac.transportSnapshotCurrent(connection) &&
-			sess.geometryClaimTokenCurrent(ac, geometryClaim) &&
 			rc.resizeCurrentForLease(epoch, ac, lease, false)
 	}
 	if !current() {