7907dde refactor: give broker observation, routing, daemon render/resume state, and picker interaction one owner each (#301) · vev

M docs/architecture.md +1 -0


@@ -146,6 +146,7 @@ client ──broker.sock──▶ broker ──daemonmux──▶ local daemon
146	What it owns:	146		What it owns:
147		147
148	- Hosts. `internal/usecase/broker.Registry` holds configured hosts and publishes one `ports.BrokerSnapshot`: the local daemon first, then remotes. Configured authority (endpoint, policy, rank) comes from membership; observed facts (identity, version, availability, session catalogue) come only from probes. Only remote observations are persisted.	148		- Hosts. `internal/usecase/broker.Registry` holds configured hosts and publishes one `ports.BrokerSnapshot`: the local daemon first, then remotes. Configured authority (endpoint, policy, rank) comes from membership; observed facts (identity, version, availability, session catalogue) come only from probes. Only remote observations are persisted.
		149	+	- Observation and routing. `broker.RemoteProbe` and `broker.LocalDaemonProbe` observe daemons over the pooled carriage with an existing-only observation stream. `broker.Routes` resolves remote dial targets from committed membership and re-authorizes each one immediately before dialing. `internal/app` only supplies carriages, codecs, and route address derivation.
149	- Connections. `broker.Pool` keys one physical connection by authenticated identity plus exact policy. Many logical streams share it. Display aliases and addresses are never keys. Idle connections stay warm (`warmTransports`, `warmIdleTimeout`).	150		- Connections. `broker.Pool` keys one physical connection by authenticated identity plus exact policy. Many logical streams share it. Display aliases and addresses are never keys. Idle connections stay warm (`warmTransports`, `warmIdleTimeout`).
150	- Daemon start. Every stream carries a `ports.BrokerDaemonStartMode`: `ExistingOnly` (observation, stop) or `StartIfNeeded` (attach, create). The mode can narrow the launch policy, never widen it. A running daemon is never restarted. The start path lives in `internal/app/broker_daemon_start.go` and uses the shared spawn election in `spawn.go`.	151		- Daemon start. Every stream carries a `ports.BrokerDaemonStartMode`: `ExistingOnly` (observation, stop) or `StartIfNeeded` (attach, create). The mode can narrow the launch policy, never widen it. A running daemon is never restarted. The start path lives in `internal/app/broker_daemon_start.go` and uses the shared spawn election in `spawn.go`.
151	- Wire. `internal/adapters/brokerwire` owns the broker's own Protobuf conversation (`schema/broker.proto`, client tags 101+, server tags 201+). It uses the same preamble, epoch, and exact `protocol.Version` as sessions. Streams carry the typed session protocol unchanged.	152		- Wire. `internal/adapters/brokerwire` owns the broker's own Protobuf conversation (`schema/broker.proto`, client tags 101+, server tags 201+). It uses the same preamble, epoch, and exact `protocol.Version` as sessions. Streams carry the typed session protocol unchanged.

M internal/adapters/brokerconfig/route.go +10 -0


@@ -332,6 +332,16 @@ func parseTrust(document *trustDocument) (TrustInputs, error) {
332	return trust, nil	332		return trust, nil
333	}	333		}
334		334
		335	+	// RouteSpecAddress returns the opaque pool address RouteFromSpec would give
		336	+	// the durable route.
		337	+	func RouteSpecAddress(spec ports.BrokerRouteSpec) (string, error) {
		338	+	route, err := RouteFromSpec(spec)
		339	+	if err != nil {
		340	+	return "", err
		341	+	}
		342	+	return route.Address(), nil
		343	+	}
		344	+
335	// RouteFromSpec materializes canonical durable routing authority. Runtime SSH	345		// RouteFromSpec materializes canonical durable routing authority. Runtime SSH
336	// trust is OpenSSH-owned; no startup configuration lookup participates.	346		// trust is OpenSSH-owned; no startup configuration lookup participates.
337	func RouteFromSpec(spec ports.BrokerRouteSpec) (Route, error) {	347		func RouteFromSpec(spec ports.BrokerRouteSpec) (Route, error) {

M internal/app/broker_offline.go +9 -9


@@ -305,7 +305,7 @@ func runBrokerServe(ctx context.Context, options brokerServeOptions, deps broker
305		defer startupLease.Release()	305		defer startupLease.Release()
306			306
307		// Membership is imported once, then only durable remote authority is used.	307		// Membership is imported once, then only durable remote authority is used.
308	-	resolver := &brokerRoutes{local: config.Resolver()}	308	+	resolver := newBrokerRoutes(config)
309		connector, err := brokerDynamicMuxConnector(config, resolver, log)	309		connector, err := brokerDynamicMuxConnector(config, resolver, log)
310		if err != nil {	310		if err != nil {
311		return err	311		return err

@@ -321,15 +321,15 @@ func runBrokerServe(ctx context.Context, options brokerServeOptions, deps broker
321		if err != nil {	321		if err != nil {
322		return err	322		return err
323		}	323		}
324	-	remoteProbe := &brokerRemoteProbe{epoch: epoch, routes: resolver, connector: connector, codec: sessionwire.BrokerCodec{}}	324	+	remoteProbe := &broker.RemoteProbe{Epoch: epoch, Routes: resolver, Connector: connector, Codec: sessionwire.BrokerCodec{}}
325		registry, err := broker.NewRegistryWithConfig(epoch, store, remoteProbe, clk, log, registryConfig)	325		registry, err := broker.NewRegistryWithConfig(epoch, store, remoteProbe, clk, log, registryConfig)
326		if err != nil {	326		if err != nil {
327		return err	327		return err
328		}	328		}
329	-	resolver.hosts = registry	329	+	resolver.Hosts = registry
330		binder := productionIdentityBinder{delegate: registry, stateDir: platform.StateDir(), policy: localDaemonPolicy()}	330		binder := productionIdentityBinder{delegate: registry, stateDir: platform.StateDir(), policy: localDaemonPolicy()}
331	-	remoteProbe.binder = binder	331	+	remoteProbe.Binder = binder
332	-	remoteProbe.hosts = registry	332	+	remoteProbe.Hosts = registry
333		// RegisterRunner starts immediately: finish the cyclic composition before	333		// RegisterRunner starts immediately: finish the cyclic composition before
334		// publishing it to any goroutine. Shutdown remains listener -> pool -> registry.	334		// publishing it to any goroutine. Shutdown remains listener -> pool -> registry.
335		if err := supervisor.RegisterRunner("registry", registry); err != nil {	335		if err := supervisor.RegisterRunner("registry", registry); err != nil {

@@ -340,10 +340,10 @@ func runBrokerServe(ctx context.Context, options brokerServeOptions, deps broker
340		return err	340		return err
341		}	341		}
342		// Observation borrows pooled transports rather than dialing its own.	342		// Observation borrows pooled transports rather than dialing its own.
343	-	remoteProbe.shared.share(pool)	343	+	remoteProbe.SharePool(pool)
344		if registryConfig.Local != nil {	344		if registryConfig.Local != nil {
345	-	if local, ok := registryConfig.Local.Probe.(*localRouteProbe); ok {	345	+	if local, ok := registryConfig.Local.Probe.(*broker.LocalDaemonProbe); ok {
346	-	local.shared.share(pool)	346	+	local.SharePool(pool)
347		}	347		}
348		}	348		}
349		if err := supervisor.RegisterCloseable("pool", pool); err != nil {	349		if err := supervisor.RegisterCloseable("pool", pool); err != nil {

@@ -454,7 +454,7 @@ func durableBrokerRoute(route brokerconfig.Route) (ports.BrokerRouteSpec, error)
454		// snapshot owner issues no probes, arms no timers, and never reconciles. The	454		// snapshot owner issues no probes, arms no timers, and never reconciles. The
455		// disabled fixture's membership mode follows the endpoints it was provisioned	455		// disabled fixture's membership mode follows the endpoints it was provisioned
456		// with, exactly as before.	456		// with, exactly as before.
457	-	func offlineRegistryConfig(config *brokerconfig.Config, epoch ports.BrokerEpoch, connector ports.BrokerEndpointConnector, loaders ...localIdentityLoader) (broker.RegistryConfig, error) {	457	+	func offlineRegistryConfig(config *brokerconfig.Config, epoch ports.BrokerEpoch, connector ports.BrokerEndpointConnector, loaders ...broker.LocalIdentityLoader) (broker.RegistryConfig, error) {
458		if config == nil {	458		if config == nil {
459		return broker.RegistryConfig{}, errors.New("vev: offline registry requires configuration")	459		return broker.RegistryConfig{}, errors.New("vev: offline registry requires configuration")
460		}	460		}

M internal/app/broker_offline_local.go +15 -163


@@ -8,74 +8,23 @@ import (
8		"github.com/bnema/vev/internal/adapters/brokerconfig"	8		"github.com/bnema/vev/internal/adapters/brokerconfig"
9		"github.com/bnema/vev/internal/adapters/daemonmux"	9		"github.com/bnema/vev/internal/adapters/daemonmux"
10		"github.com/bnema/vev/internal/adapters/sessionwire"	10		"github.com/bnema/vev/internal/adapters/sessionwire"
11	-	"github.com/bnema/vev/internal/domain"
12		"github.com/bnema/vev/internal/ports"	11		"github.com/bnema/vev/internal/ports"
13		"github.com/bnema/vev/internal/usecase/broker"	12		"github.com/bnema/vev/internal/usecase/broker"
14		)	13		)
15			14
16		// Broker-owned local observation composition.	15		// Broker-owned local observation composition.
17		//	16		//
18	-	// The offline broker observes its own machine daemon through the same daemonmux	17	+	// The broker observes its own machine daemon through the same daemonmux
19	-	// carriage a local logical stream is dialed over. The probe completes the	18	+	// carriage a local logical stream is dialed over. broker.LocalDaemonProbe owns
20	-	// authenticated physical preamble (identity, incarnation, and policy), opens	19	+	// the observation itself; this file only proves the configured route is a local
21	-	// exactly one logical BrokerStreamObservation stream, sends one typed	20	+	// Unix socket (so probing can never spawn a process) and wires the broker's
22	-	// remote-catalog control request, validates the catalogue the daemon answers,	21	+	// already owned endpoint connector and session codec into it.
23	-	// and closes the stream and carriage. It never sends a Hello, never claims a
24	-	// geometry, never requests an attachment admission, and never creates a
25	-	// session or a process, and it only ever dials an existing local Unix socket, so
26	-	// observing the local daemon never attaches to a session and never starts a
27	-	// stopped daemon.
28	-	//
29	-	// The composition is isolated from production state: it derives the probe from
30	-	// the sandbox configuration and never touches the production runtime or state
31	-	// directories. Remote and local observation share one semantic implementation
32	-	// (observeDaemonCatalogue) through the same daemonmux endpoint connector seam
33	-	// the broker already owns, so neither producer becomes a second transport
34	-	// owner and the two cannot drift apart.
35	-	//
36	-	// The hidden offline sandbox selects this producer whenever its strict config
37	-	// provisions a local binding. Ordinary production composition does not select
38	-	// it. The sandbox owns no remote membership, and probing remains no-spawn and
39	-	// attachment-free even though it runs on the registry's observation cadence.
40			22
41		// localCarrierDialer establishes one raw framed daemonmux carriage for one	23		// localCarrierDialer establishes one raw framed daemonmux carriage for one
42	-	// resolved dial target. It is the same seam the pooled mux connector uses, so	24	+	// resolved dial target. It is the same seam the pooled mux connector uses.
43	-	// the probe can never select a transport or an address of its own, and the
44	-	// target travels whole: the address selects the route while the start
45	-	// authorization, policy, and fence decide what the carriage owner may do.
46		type localCarrierDialer func(ctx context.Context, target ports.BrokerDialTarget) (daemonmux.RawFramedTransport, error)	25		type localCarrierDialer func(ctx context.Context, target ports.BrokerDialTarget) (daemonmux.RawFramedTransport, error)
47			26
48	-	// localRouteProbe is the broker-owned ports-independent local observation	27	+	func newDynamicLocalRouteProbe(route brokerconfig.Route, policy ports.BrokerPolicy, epoch ports.BrokerEpoch, connector ports.BrokerEndpointConnector, loadIdentity broker.LocalIdentityLoader) (*broker.LocalDaemonProbe, error) {
49	-	// probe. It holds the resolved local endpoint authority (identity, policy, and
50	-	// opaque address) and one daemonmux endpoint connector over the same dial and
51	-	// ceiling seam the pooled connector uses, and observes the daemon through it.
52	-	// Every probe dials one already authenticated local carriage, opens exactly one
53	-	// observation stream, and closes both; no logical attachment stream is ever
54	-	// opened and no daemon process is ever started.
55	-	type localIdentityLoader func() (ports.BrokerDaemonIdentity, error)
56	-
57	-	type localRouteProbe struct {
58	-	epoch ports.BrokerEpoch
59	-	route brokerconfig.Route
60	-	policy ports.BrokerPolicy
61	-	loadIdentity localIdentityLoader
62	-	connector ports.BrokerEndpointConnector
63	-	shared pooledPhysicals
64	-	codec ports.SessionCodec
65	-	}
66	-
67	-	var _ broker.LocalProbe = (*localRouteProbe)(nil)
68	-
69	-	func newDynamicLocalRouteProbe(route brokerconfig.Route, policy ports.BrokerPolicy, epoch ports.BrokerEpoch, connector ports.BrokerEndpointConnector, loadIdentity localIdentityLoader) (*localRouteProbe, error) {
70	-	if epoch == 0 {
71	-	return nil, errors.New("vev: broker local probe requires a broker epoch")
72	-	}
73	-	if connector == nil {
74	-	return nil, errors.New("vev: broker local probe requires a connector")
75	-	}
76	-	if loadIdentity == nil {
77	-	return nil, errors.New("vev: broker local probe requires an identity loader")
78	-	}
79		// Probing must never spawn a process, so only a Unix route this process	28		// Probing must never spawn a process, so only a Unix route this process
80		// dials directly is acceptable. brokerconfig refuses any other kind at load	29		// dials directly is acceptable. brokerconfig refuses any other kind at load
81		// time; this re-checks the exported binding a caller may have built itself,	30		// time; this re-checks the exported binding a caller may have built itself,

@@ -86,124 +35,27 @@ func newDynamicLocalRouteProbe(route brokerconfig.Route, policy ports.BrokerPoli
86		if err := route.Validate(); err != nil {	35		if err := route.Validate(); err != nil {
87		return nil, fmt.Errorf("vev: broker local probe: %w", err)	36		return nil, fmt.Errorf("vev: broker local probe: %w", err)
88		}	37		}
89	-	if err := policy.Validate(); err != nil {	38	+	return broker.NewLocalDaemonProbe(epoch, route.Address(), policy, connector, sessionwire.BrokerCodec{}, loadIdentity)
90	-	return nil, fmt.Errorf("vev: broker local probe: %w", err)
91	-	}
92	-	return &localRouteProbe{epoch: epoch, route: route, policy: policy, loadIdentity: loadIdentity, connector: connector, codec: sessionwire.BrokerCodec{}}, nil
93	-	}
94	-
95	-	// ProbeLocal observes the local daemon by authenticating the daemonmux physical
96	-	// preamble and then opening exactly one observation stream that asks the daemon
97	-	// for its own catalogue. A successful observation reports the authenticated
98	-	// identity, the daemon incarnation, the protocol version the catalogue schema
99	-	// negotiated, reachability, and the exact session inventory the daemon
100	-	// answered. Capabilities are not carried by the catalogue command, so they stay
101	-	// unknown (zero) rather than being invented, and every failure reports an
102	-	// explicit availability with zero observed identity: a probe never manufactures
103	-	// identity, version, or inventory it did not observe, and it never creates an
104	-	// attachment, a session, a process, or durable identity.
105	-	//
106	-	// The local daemon owns no configured membership, so the probe commits no
107	-	// durable identity binding: the binding's configured identity is the fence the
108	-	// physical preamble already verified.
109	-	func (p *localRouteProbe) ProbeLocal(ctx context.Context) (ports.BrokerDaemonObservation, error) {
110	-	if p == nil \|\| p.connector == nil {
111	-	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnreachable}, errors.New("vev: broker local probe is nil")
112	-	}
113	-	identity, err := p.loadIdentity()
114	-	if err != nil {
115	-	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnreachable}, err
116	-	}
117	-	if identity == "" {
118	-	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnknown}, nil
119	-	}
120	-	endpoint := ports.BrokerDialTarget{
121	-	Fence: ports.BrokerEndpointFence{Local: true}, Policy: p.policy, Address: p.route.Address(),
122	-	StartMode: ports.BrokerDaemonExistingOnly,
123	-	ExpectedIdentity: ports.BrokerExpectedIdentity{Identity: identity, Bound: true},
124	-	}
125	-	if err := endpoint.Validate(); err != nil {
126	-	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnreachable}, fmt.Errorf("vev: broker local probe: %w", err)
127	-	}
128	-	request, err := p.request()
129	-	if err != nil {
130	-	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnreachable}, err
131	-	}
132	-	if observation, handled, err := p.shared.observe(ctx, identity, p.policy, request, p.codec); handled {
133	-	if err != nil {
134	-	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnreachable}, err
135	-	}
136	-	return observation, nil
137	-	}
138	-	physical, err := p.connector.Connect(ctx, endpoint)
139	-	if err != nil {
140	-	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnreachable}, err
141	-	}
142	-	defer func() { _ = physical.Close() }()
143	-	// The endpoint stays authoritative: re-verify the accepted authority even
144	-	// though the connector already checked it, so a future connector change can
145	-	// never weaken what the probe publishes.
146	-	if physical.Identity() != endpoint.ExpectedIdentity.Identity \|\| !physical.Policy().Compatible(endpoint.Policy) {
147	-	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnreachable}, errors.New("vev: broker local probe authenticated binding mismatch")
148	-	}
149	-	observation, err := observeDaemonCatalogue(ctx, physical, request, p.codec)
150	-	if err != nil {
151	-	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnreachable}, err
152	-	}
153	-	return observation, nil
154	-	}
155	-
156	-	// request builds the one observation open this probe performs: a local
157	-	// observation stream that may never start the daemon. Connection and stream
158	-	// identities are fresh per attempt so a replayed or duplicated open is refused
159	-	// by the peer's anti-replay admission window. The request carries no endpoint,
160	-	// no registration, no admission, no session name, no exact target, and no
161	-	// environment: the stream asks the daemon for its own catalogue and nothing
162	-	// else.
163	-	func (p *localRouteProbe) request() (ports.BrokerOpenStreamRequest, error) {
164	-	connection, err := randomConnectionID()
165	-	if err != nil {
166	-	return ports.BrokerOpenStreamRequest{}, err
167	-	}
168	-	stream, err := randomNonzeroUint64()
169	-	if err != nil {
170	-	return ports.BrokerOpenStreamRequest{}, err
171	-	}
172	-	return ports.BrokerOpenStreamRequest{
173	-	Epoch: p.epoch,
174	-	Purpose: ports.BrokerStreamObservation,
175	-	Local: true,
176	-	Connection: connection,
177	-	Stream: ports.BrokerStreamID(stream),
178	-	Policy: p.policy,
179	-	// Observation never starts the target: an ExistingOnly authorization is
180	-	// what ports enforces for an observation stream, and a start-if-needed
181	-	// one would be refused rather than silently widened into a spawn.
182	-	StartMode: ports.BrokerDaemonExistingOnly,
183	-	}, nil
184		}	39		}
185			40
186		// brokerLocalProbe builds the broker-owned local probe over one validated	41		// brokerLocalProbe builds the broker-owned local probe over one validated
187	-	// offline configuration and the broker's already owned endpoint connector, so	42	+	// configuration and the broker's already owned endpoint connector.
188	-	// the probe composes the exact transport owner the pool does instead of	43	+	func brokerLocalProbe(config brokerconfig.Config, epoch ports.BrokerEpoch, connector ports.BrokerEndpointConnector, loaders ...broker.LocalIdentityLoader) (broker.LocalDaemonProbe, error) {
189	-	// creating a second one.
190	-	func brokerLocalProbe(config brokerconfig.Config, epoch ports.BrokerEpoch, connector ports.BrokerEndpointConnector, loaders ...localIdentityLoader) (localRouteProbe, error) {
191		binding, ok := config.LocalBinding()	44		binding, ok := config.LocalBinding()
192		if !ok {	45		if !ok {
193		return nil, errors.New("vev: broker local probe requires a provisioned local binding")	46		return nil, errors.New("vev: broker local probe requires a provisioned local binding")
194		}	47		}
195	-	loader := localIdentityLoader(func() (ports.BrokerDaemonIdentity, error) { return binding.Identity, nil })	48	+	loader := broker.LocalIdentityLoader(func() (ports.BrokerDaemonIdentity, error) { return binding.Identity, nil })
196		if len(loaders) != 0 {	49		if len(loaders) != 0 {
197		loader = loaders[0]	50		loader = loaders[0]
198		}	51		}
199		return newDynamicLocalRouteProbe(binding.Route, binding.Policy, epoch, connector, loader)	52		return newDynamicLocalRouteProbe(binding.Route, binding.Policy, epoch, connector, loader)
200		}	53		}
201			54
202	-	// brokerLocalObservation composes the registry's local producer from one	55	+	// brokerLocalObservation composes the registry's local producer: the
203	-	// validated offline configuration: the configured display origin and policy	56	+	// configured display origin and policy become the local entry's authority,
204	-	// become the local entry's authority, and the probe supplies observed state	57	+	// and the probe supplies observed state only.
205	-	// only. A configuration without a local binding provisions no local producer.	58	+	func brokerLocalObservation(config brokerconfig.Config, epoch ports.BrokerEpoch, connector ports.BrokerEndpointConnector, loaders ...broker.LocalIdentityLoader) (broker.LocalObservation, error) {
206	-	func brokerLocalObservation(config brokerconfig.Config, epoch ports.BrokerEpoch, connector ports.BrokerEndpointConnector, loaders ...localIdentityLoader) (broker.LocalObservation, error) {
207		binding, ok := config.LocalBinding()	59		binding, ok := config.LocalBinding()
208		if !ok {	60		if !ok {
209		return nil, errors.New("vev: broker local observation requires a provisioned local binding")	61		return nil, errors.New("vev: broker local observation requires a provisioned local binding")

M internal/app/broker_offline_local_attach_test.go +2 -1

 	"github.com/bnema/vev/internal/ports"
 	"github.com/bnema/vev/internal/protocol"
 	"github.com/bnema/vev/internal/protocol/catalogue"
+	"github.com/bnema/vev/internal/usecase/broker"
 	"github.com/bnema/vev/internal/usecase/daemon"
 )
 }
 // probe returns one probe over the fixture's real carriage.
-func (f *realLocalDaemonFixture) probe(t *testing.T) *localRouteProbe {
+func (f *realLocalDaemonFixture) probe(t *testing.T) *broker.LocalDaemonProbe {
 	t.Helper()
 	dial := func(ctx context.Context, target ports.BrokerDialTarget) (daemonmux.RawFramedTransport, error) {
 		require.Equal(t, f.binding.Route.Address(), target.Address, "the probe dials only its provisioned local address")

M internal/app/broker_offline_local_test.go +2 -53


@@ -259,41 +259,6 @@ func TestBrokerLocalProbeObservesAuthenticatedCatalogue(t *testing.T) {
259		require.EqualValues(t, 1, daemon.dials.Load())	259		require.EqualValues(t, 1, daemon.dials.Load())
260		}	260		}
261			261
262	-	// TestBrokerLocalProbeRequestIsObservationOnly proves the one open the local
263	-	// probe performs is a local observation that may never start the daemon: it
264	-	// carries no admission, no name, no target, no environment, no endpoint, and
265	-	// no registration, and it is refused outright when it authorizes a spawn.
266	-	func TestBrokerLocalProbeRequestIsObservationOnly(t *testing.T) {
267	-	_, binding := testLocalSandboxConfig(t)
268	-	probe, err := newLocalRouteProbe(binding, brokerLocalTestEpoch, func(context.Context, ports.BrokerDialTarget) (daemonmux.RawFramedTransport, error) {
269	-	return nil, nil
270	-	}, daemonmux.DefaultMuxCeilings())
271	-	require.NoError(t, err)
272	-
273	-	request, err := probe.request()
274	-	require.NoError(t, err)
275	-	require.NoError(t, request.Validate())
276	-	require.Equal(t, ports.BrokerStreamObservation, request.Purpose)
277	-	require.Equal(t, brokerLocalTestEpoch, request.Epoch)
278	-	require.True(t, request.Local)
279	-	require.Zero(t, request.Admission)
280	-	require.Empty(t, request.Name)
281	-	require.Empty(t, request.Endpoint)
282	-	require.Equal(t, domain.RemoteRegistration{}, request.Registration)
283	-	require.Empty(t, request.Env)
284	-	require.Equal(t, protocol.ExactSessionTarget{}, request.Target)
285	-	require.Equal(t, binding.Policy, request.Policy)
286	-	require.NotZero(t, request.Connection)
287	-	require.NotZero(t, request.Stream)
288	-	// Observation must never start the target: the request carries the
289	-	// existing-only authorization, and a spawn-capable one is refused rather
290	-	// than silently narrowed.
291	-	require.Equal(t, ports.BrokerDaemonExistingOnly, request.StartMode)
292	-	startable := request
293	-	startable.StartMode = ports.BrokerDaemonStartIfNeeded
294	-	require.Error(t, startable.Validate())
295	-	}
296	-
297		// TestBrokerLocalProbeFailsClosed proves an unavailable carriage yields zero	262		// TestBrokerLocalProbeFailsClosed proves an unavailable carriage yields zero
298		// observed identity, no inventory, and an explicit availability, never an	263		// observed identity, no inventory, and an explicit availability, never an
299		// invented one, and that the probe only dials the provisioned local address: it	264		// invented one, and that the probe only dials the provisioned local address: it

@@ -452,14 +417,8 @@ func TestBrokerLocalObservationComposition(t *testing.T) {
452		require.Equal(t, binding.DisplayOrigin, observation.DisplayOrigin)	417		require.Equal(t, binding.DisplayOrigin, observation.DisplayOrigin)
453		require.Equal(t, binding.Policy, observation.Policy)	418		require.Equal(t, binding.Policy, observation.Policy)
454		require.NotNil(t, observation.Probe)	419		require.NotNil(t, observation.Probe)
455	-	// Shared transport: the probe composes the exact connector the pool already	420	+	_, ok := observation.Probe.(*broker.LocalDaemonProbe)
456	-	// owns instead of dialing its own, so one broker process holds one transport
457	-	// owner per route.
458	-	probe, ok := observation.Probe.(*localRouteProbe)
459		require.True(t, ok)	421		require.True(t, ok)
460	-	require.Same(t, connector, probe.connector)
461	-	require.Equal(t, brokerLocalTestEpoch, probe.epoch)
462	-
463		}	422		}
464			423
465		// Production always composes local observation and mutable membership, even	424		// Production always composes local observation and mutable membership, even

@@ -506,7 +465,7 @@ func TestBrokerLocalObservationWithoutIdentityPublishesLocalUnknown(t *testing.T
506		config, _ := productionLocalConfig(t)	465		config, _ := productionLocalConfig(t)
507		// The loader re-reads an absent identity on every attempt, so the probe is	466		// The loader re-reads an absent identity on every attempt, so the probe is
508		// dynamic: it never dials and never spawns while no identity exists.	467		// dynamic: it never dials and never spawns while no identity exists.
509	-	loader := localIdentityLoader(func() (ports.BrokerDaemonIdentity, error) { return "", nil })	468	+	loader := broker.LocalIdentityLoader(func() (ports.BrokerDaemonIdentity, error) { return "", nil })
510		var dials atomic.Int32	469		var dials atomic.Int32
511		connector := testLocalConnector(t, func(context.Context, ports.BrokerDialTarget) (daemonmux.RawFramedTransport, error) {	470		connector := testLocalConnector(t, func(context.Context, ports.BrokerDialTarget) (daemonmux.RawFramedTransport, error) {
512		dials.Add(1)	471		dials.Add(1)

@@ -830,16 +789,6 @@ func TestBrokerLocalProbeRefusesNonLocalRoute(t *testing.T) {
830		require.Contains(t, err.Error(), "local route")	789		require.Contains(t, err.Error(), "local route")
831		}	790		}
832			791
833	-	// TestBrokerLocalProbeNilReceiverFailsClosed proves a nil probe reports an
834	-	// explicit error and an observation whose availability is never zero.
835	-	func TestBrokerLocalProbeNilReceiverFailsClosed(t *testing.T) {
836	-	var probe *localRouteProbe
837	-	observation, err := probe.ProbeLocal(context.Background())
838	-	require.Error(t, err)
839	-	require.Equal(t, domain.RemoteAvailabilityUnreachable, observation.Availability)
840	-	require.NotZero(t, observation.Availability, "availability is never zero")
841	-	}
842	-
843		// startLocalRegistry runs one registry for the duration of a test.	792		// startLocalRegistry runs one registry for the duration of a test.
844		func startLocalRegistry(t testing.T, registry broker.Registry) {	793		func startLocalRegistry(t testing.T, registry broker.Registry) {
845		t.Helper()	794		t.Helper()

M internal/app/broker_offline_mux.go +19 -35

 	"github.com/bnema/vev/internal/domain"
 	"github.com/bnema/vev/internal/ports"
 	"github.com/bnema/vev/internal/protocol/wire"
+	"github.com/bnema/vev/internal/usecase/broker"
 )
 // Broker mux remote helper composition.
 	return command{kind: kind, brokerMux: options}, nil
 }
-// brokerDynamicMuxConnector keeps the configured local carriage, but remote
+// newBrokerRoutes composes the broker's route authorization policy over the
-// targets must still match committed registry authority at dial time.
+// configured local binding. Remote hosts are wired once the registry exists.
-func brokerDynamicMuxConnector(config *brokerconfig.Config, routes *brokerRoutes, log *slog.Logger) (*daemonmux.EndpointConnector, error) {
+func newBrokerRoutes(config *brokerconfig.Config) *broker.Routes {
+	return &broker.Routes{Local: config.Resolver(), Address: brokerconfig.RouteSpecAddress}
+}
+// brokerDynamicMuxConnector dials one authorized target. Remote targets are
+// re-authorized by broker.Routes against committed membership immediately
+// before dialing; the local target must still name the provisioned binding.
+func brokerDynamicMuxConnector(config *brokerconfig.Config, routes *broker.Routes, log *slog.Logger) (*daemonmux.EndpointConnector, error) {
 	return daemonmux.NewEndpointConnector(func(ctx context.Context, target ports.BrokerDialTarget) (daemonmux.RawFramedTransport, error) {
 		if !target.Fence.Local {
-			route, err := routes.remoteRoute(ctx, target)
+			spec, err := routes.AuthorizeRemoteDial(ctx, target)
+			if err != nil {
+				return nil, err
+			}
+			route, err := brokerconfig.RouteFromSpec(spec)
 			if err != nil {
 				return nil, err
 			}
 			return dialBrokerRoute(ctx, route, target, log)
 		}
-		if err := brokerRouteAuthorityMatches(config, target); err != nil {
-			return nil, err
-		}
-		route, ok := config.RouteByAddress(target.Address)
-		if !ok {
-			return nil, errors.New("vev: unknown local route")
-		}
-		return dialBrokerRoute(ctx, route, target, log)
-	}, daemonmux.DefaultMuxCeilings())
-}
-// brokerRouteAuthorityMatches re-verifies that the route the opaque address
-// selected is still the one the resolved target's authority names: the same
-// fence, and a policy the provisioned entry accepts. The pool and the daemonmux
-// preamble already check this; re-checking here keeps the dial decision and the
-// authentication decision on one authority instead of two that could drift.
-func brokerRouteAuthorityMatches(config *brokerconfig.Config, target ports.BrokerDialTarget) error {
-	if target.Fence.Local {
 		binding, ok := config.LocalBinding()
 		if !ok || binding.Route.Address() != target.Address || !binding.Policy.Compatible(target.Policy) {
-			return ports.BrokerError{Code: ports.BrokerErrorConflictingPolicy, Cause: errors.New("vev: broker mux: local route authority does not match the resolved target")}
+			return nil, ports.BrokerError{Code: ports.BrokerErrorConflictingPolicy, Cause: errors.New("vev: broker mux: local route authority does not match the resolved target")}
-		}
-		return nil
-	}
-	for _, endpoint := range config.Endpoints() {
-		registration, ok := config.Registration(endpoint)
-		if !ok || registration.Route.Address() != target.Address {
-			continue
-		}
-		if registration.Registration.Equal(target.Fence.Registration) && registration.Policy.Compatible(target.Policy) {
-			return nil
 		}
-	}
+		return dialBrokerRoute(ctx, binding.Route, target, log)
-	return ports.BrokerError{Code: ports.BrokerErrorConflictingPolicy, Cause: errors.New("vev: broker mux: route authority does not match the resolved target")}
+	}, daemonmux.DefaultMuxCeilings())
 }
 // dialBrokerRoute dials one provisioned route under one resolved target as an

D internal/app/broker_remote_probe.go +0 -288

@@ -1,288 +0,0 @@
1	-	package app
2	-
3	-	import (
4	-	"context"
5	-	"crypto/rand"
6	-	"encoding/binary"
7	-	"encoding/json"
8	-	"errors"
9	-	"fmt"
10	-	"sync/atomic"
11	-
12	-	"github.com/bnema/vev/internal/domain"
13	-	"github.com/bnema/vev/internal/ports"
14	-	"github.com/bnema/vev/internal/protocol"
15	-	"github.com/bnema/vev/internal/protocol/catalogue"
16	-	)
17	-
18	-	// Remote daemon observation composition.
19	-	//
20	-	// brokerRemoteProbe observes one configured daemon over the broker-owned
21	-	// multiplexed carriage. It opens an observation stream, never an attachment,
22	-	// and asks the daemon for its local catalogue through the existing typed
23	-	// command protocol. Authenticated daemon identity and process incarnation come
24	-	// from the physical handshake rather than from the configured hostname.
25	-	//
26	-	// Remote and local observation share one semantic implementation below:
27	-	// observeDaemonCatalogue is the single "observe an already authenticated
28	-	// daemon" path, so the two producers cannot drift apart and neither becomes a
29	-	// second owner of a transport. The broker-owned local probe composes the same
30	-	// daemonmux carriage and the same pooled connector the broker already owns
31	-	// rather than dialing or authenticating a daemon itself.
32	-	type brokerRemoteProbe struct {
33	-	epoch ports.BrokerEpoch
34	-	routes ports.BrokerRouteAuthority
35	-	binder ports.BrokerIdentityBinder
36	-	connector ports.BrokerEndpointConnector
37	-	hosts ports.BrokerHostAuthorityReader
38	-	shared pooledPhysicals
39	-	codec ports.SessionCodec
40	-	}
41	-
42	-	// sharedPhysicals lends the pooled transport of an attached or warm daemon.
43	-	type sharedPhysicals interface {
44	-	SharedPhysical(ports.BrokerDaemonIdentity, ports.BrokerPolicy) (ports.BrokerPhysicalConnection, bool)
45	-	AdoptPhysical(ports.BrokerPhysicalConnection, ports.BrokerPolicy) bool
46	-	}
47	-
48	-	// pooledPhysicals lets an observation probe borrow the broker pool's physical
49	-	// transport instead of dialing (and, for a remote, bootstrapping SSH/QUIC)
50	-	// again: the broker exists to share connections. The pool is published after
51	-	// composition because it binds identities through the registry that runs the
52	-	// probes. A probe dials only when nothing is pooled, or when the borrowed
53	-	// transport retired under it.
54	-	type pooledPhysicals struct{ pool atomic.Value }
55	-
56	-	func (s *pooledPhysicals) share(pool sharedPhysicals) { s.pool.Store(pool) }
57	-
58	-	func (s *pooledPhysicals) adopt(physical ports.BrokerPhysicalConnection, policy ports.BrokerPolicy) bool {
59	-	pool, _ := s.pool.Load().(sharedPhysicals)
60	-	return pool != nil && pool.AdoptPhysical(physical, policy)
61	-	}
62	-
63	-	// observe reports handled=false when the probe must dial its own transport.
64	-	func (s *pooledPhysicals) observe(ctx context.Context, identity ports.BrokerDaemonIdentity, policy ports.BrokerPolicy, request ports.BrokerOpenStreamRequest, codec ports.SessionCodec) (ports.BrokerDaemonObservation, bool, error) {
65	-	pool, _ := s.pool.Load().(sharedPhysicals)
66	-	if pool == nil \|\| identity == "" {
67	-	return ports.BrokerDaemonObservation{}, false, nil
68	-	}
69	-	physical, ok := pool.SharedPhysical(identity, policy)
70	-	if !ok {
71	-	return ports.BrokerDaemonObservation{}, false, nil
72	-	}
73	-	observation, err := observeDaemonCatalogue(ctx, physical, request, codec)
74	-	if err == nil \|\| ctx.Err() != nil {
75	-	return observation, true, err
76	-	}
77	-	select {
78	-	case <-physical.Done():
79	-	return ports.BrokerDaemonObservation{}, false, nil
80	-	default:
81	-	return observation, true, err
82	-	}
83	-	}
84	-
85	-	var _ ports.BrokerHostProbe = (*brokerRemoteProbe)(nil)
86	-
87	-	func (p *brokerRemoteProbe) Probe(ctx context.Context, registration domain.RemoteRegistration) (ports.BrokerDaemonObservation, error) {
88	-	if p == nil \|\| p.epoch == 0 \|\| p.routes == nil \|\| p.binder == nil \|\| p.connector == nil {
89	-	return ports.BrokerDaemonObservation{}, errors.New("vev: incomplete broker remote probe")
90	-	}
91	-	request, err := p.request(ctx, registration)
92	-	if err != nil {
93	-	return ports.BrokerDaemonObservation{}, err
94	-	}
95	-	endpoint, err := p.routes.ResolveDialTarget(ctx, request)
96	-	if err != nil {
97	-	return ports.BrokerDaemonObservation{}, err
98	-	}
99	-	// Borrow the pooled transport of an attached or warm daemon instead of
100	-	// bootstrapping SSH/QUIC again. A borrowed transport that retires mid-probe
101	-	// falls back to a fresh dial.
102	-	if endpoint.ExpectedIdentity.Bound {
103	-	if observation, handled, err := p.shared.observe(ctx, endpoint.ExpectedIdentity.Identity, endpoint.Policy, request, p.codec); handled {
104	-	return observation, err
105	-	}
106	-	}
107	-	physical, err := p.connector.Connect(ctx, endpoint)
108	-	if err != nil {
109	-	var brokerErr ports.BrokerError
110	-	if errors.As(err, &brokerErr) && brokerErr.Code == ports.BrokerErrorNoDaemon {
111	-	// This typed dial-time result means the SSH helper ran on the remote
112	-	// machine but its local daemon carriage was absent. Do not infer this
113	-	// from a later stream loss on an already authenticated connection.
114	-	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityNoDaemon}, nil
115	-	}
116	-	return ports.BrokerDaemonObservation{}, err
117	-	}
118	-	adopted := false
119	-	defer func() {
120	-	if !adopted {
121	-	_ = physical.Close()
122	-	}
123	-	}()
124	-	if (endpoint.ExpectedIdentity.Bound && physical.Identity() != endpoint.ExpectedIdentity.Identity) \|\| physical.Policy() != endpoint.Policy {
125	-	return ports.BrokerDaemonObservation{}, errors.New("vev: remote probe authenticated binding mismatch")
126	-	}
127	-	identity, err := p.binder.BindAuthenticatedIdentity(ctx, ports.BrokerIdentityBindingRequest{Fence: endpoint.Fence, Policy: endpoint.Policy, Identity: physical.Identity()})
128	-	if err != nil \|\| identity != physical.Identity() {
129	-	return ports.BrokerDaemonObservation{}, errors.New("vev: remote probe could not commit authenticated binding")
130	-	}
131	-	observation, err := observeDaemonCatalogue(ctx, physical, request, p.codec)
132	-	if err == nil && ctx.Err() == nil {
133	-	adopted = p.shared.adopt(physical, endpoint.Policy)
134	-	}
135	-	return observation, err
136	-	}
137	-
138	-	// observeDaemonCatalogue observes one already authenticated daemon over its
139	-	// physical connection by opening exactly one observation logical stream and
140	-	// asking the daemon for its own catalogue through the existing typed command
141	-	// protocol. It sends no Hello, claims no geometry, requests no admission, and
142	-	// creates no session or process: the only traffic on the stream is the
143	-	// observation open and the one correlated remote-catalog command. The observed
144	-	// identity and incarnation are the physical handshake's authenticated values,
145	-	// never a configured hostname.
146	-	//
147	-	// A refused open, an unmatched or invalid result, a failed outcome, a malformed
148	-	// catalogue, and a catalogue outside the exact current schema all fail closed:
149	-	// the caller receives an error and no observation it could publish, so a probe
150	-	// never invents inventory it did not observe.
151	-	func observeDaemonCatalogue(ctx context.Context, physical ports.BrokerPhysicalConnection, request ports.BrokerOpenStreamRequest, codec ports.SessionCodec) (ports.BrokerDaemonObservation, error) {
152	-	if physical == nil \|\| codec == nil \|\| request.Purpose != ports.BrokerStreamObservation {
153	-	return ports.BrokerDaemonObservation{}, errors.New("vev: invalid daemon observation request")
154	-	}
155	-	logical, err := physical.OpenStream(ctx, request)
156	-	if err != nil {
157	-	// A connection that completed the authenticated physical handshake had
158	-	// a daemon. Losing its logical stream is a transport failure, not proof
159	-	// that the daemon is absent; preserve the failure so pooled callers can
160	-	// discard a dead connection and retry with a fresh dial.
161	-	return ports.BrokerDaemonObservation{}, err
162	-	}
163	-	if logical == nil {
164	-	return ports.BrokerDaemonObservation{}, errors.New("vev: daemon observation opened no logical stream")
165	-	}
166	-	defer func() { _ = logical.Close() }()
167	-	commandID, err := randomNonzeroUint64()
168	-	if err != nil {
169	-	return ports.BrokerDaemonObservation{}, err
170	-	}
171	-	reply, err := exchangeObservationCommand(ctx, codec.Client(logical), logical, protocol.CommandRequest{RequestID: commandID, Version: protocol.Version, Slug: "remote-catalog", JSON: true})
172	-	if err != nil {
173	-	return ports.BrokerDaemonObservation{}, err
174	-	}
175	-	result, ok := reply.(protocol.CommandResult)
176	-	if !ok \|\| result.RequestID != commandID \|\| !result.Valid() {
177	-	return ports.BrokerDaemonObservation{}, errors.New("vev: invalid daemon observation result")
178	-	}
179	-	if result.Outcome != protocol.CommandSucceeded {
180	-	return ports.BrokerDaemonObservation{}, fmt.Errorf("vev: daemon observation failed: %s", result.Text)
181	-	}
182	-	var catalog catalogue.RemoteCatalog
183	-	if err := json.Unmarshal([]byte(result.Output), &catalog); err != nil {
184	-	return ports.BrokerDaemonObservation{}, fmt.Errorf("vev: decode daemon observation: %w", err)
185	-	}
186	-	if err := catalogue.ValidateRemoteCatalog(catalog); err != nil {
187	-	return ports.BrokerDaemonObservation{}, err
188	-	}
189	-	return ports.BrokerDaemonObservation{
190	-	Identity: physical.Identity(),
191	-	Incarnation: physical.Incarnation(),
192	-	ProtocolVersion: catalog.ProtocolVersion,
193	-	Availability: domain.RemoteAvailabilityReachable,
194	-	InventoryKnown: true,
195	-	Sessions: catalog.Sessions,
196	-	}, nil
197	-	}
198	-
199	-	// exchangeObservationCommand sends one typed command and waits for one reply
200	-	// under the caller's context. A cancelled or expired context closes exactly
201	-	// this logical stream, which unblocks the pending read, and the worker is
202	-	// joined before returning, so an observation always returns promptly once its
203	-	// attempt is retired instead of parking the daemon's reader (or a probe
204	-	// attempt) on a daemon that answers nothing.
205	-	func exchangeObservationCommand(ctx context.Context, typed ports.ClientConnection, logical ports.BrokerEnvelopeStream, command protocol.CommandRequest) (protocol.ServerMessage, error) {
206	-	if ctx == nil {
207	-	ctx = context.Background()
208	-	}
209	-	type outcome struct {
210	-	message protocol.ServerMessage
211	-	err error
212	-	}
213	-	done := make(chan outcome, 1)
214	-	go func() {
215	-	if err := typed.SendClient(command); err != nil {
216	-	done <- outcome{err: err}
217	-	return
218	-	}
219	-	message, err := typed.ReceiveServer()
220	-	done <- outcome{message: message, err: err}
221	-	}()
222	-	select {
223	-	case result := <-done:
224	-	if err := ctx.Err(); err != nil {
225	-	return nil, err
226	-	}
227	-	return result.message, result.err
228	-	case <-ctx.Done():
229	-	// Closing the stream unblocks the admitted read; the worker is joined so
230	-	// no observation goroutine outlives its attempt.
231	-	_ = logical.Close()
232	-	<-done
233	-	return nil, ctx.Err()
234	-	}
235	-	}
236	-
237	-	func (p *brokerRemoteProbe) request(ctx context.Context, registration domain.RemoteRegistration) (ports.BrokerOpenStreamRequest, error) {
238	-	if p.hosts == nil {
239	-	return ports.BrokerOpenStreamRequest{}, errors.New("vev: remote probe has no policy authority")
240	-	}
241	-	record, ok, err := p.hosts.LookupHost(ctx, registration.Endpoint)
242	-	if err != nil {
243	-	return ports.BrokerOpenStreamRequest{}, err
244	-	}
245	-	if !ok \|\| !record.Registration.Equal(registration) {
246	-	return ports.BrokerOpenStreamRequest{}, ports.BrokerError{Code: ports.BrokerErrorUnavailable, Text: "unknown or stale probe registration"}
247	-	}
248	-	policy := record.Policy
249	-	connection, err := randomConnectionID()
250	-	if err != nil {
251	-	return ports.BrokerOpenStreamRequest{}, err
252	-	}
253	-	stream, err := randomNonzeroUint64()
254	-	if err != nil {
255	-	return ports.BrokerOpenStreamRequest{}, err
256	-	}
257	-	return ports.BrokerOpenStreamRequest{
258	-	Epoch: p.epoch, Purpose: ports.BrokerStreamObservation,
259	-	Connection: connection, Stream: ports.BrokerStreamID(stream),
260	-	Endpoint: registration.Endpoint, Registration: registration, Policy: policy,
261	-	// Observation must never start a stopped daemon, so it always carries
262	-	// the existing-only authorization.
263	-	StartMode: ports.BrokerDaemonExistingOnly,
264	-	}, nil
265	-	}
266	-
267	-	func randomConnectionID() (ports.BrokerConnectionID, error) {
268	-	var id ports.BrokerConnectionID
269	-	if _, err := rand.Read(id[:]); err != nil {
270	-	return id, err
271	-	}
272	-	if err := id.Validate(); err != nil {
273	-	return randomConnectionID()
274	-	}
275	-	return id, nil
276	-	}
277	-
278	-	func randomNonzeroUint64() (uint64, error) {
279	-	var raw [8]byte
280	-	if _, err := rand.Read(raw[:]); err != nil {
281	-	return 0, err
282	-	}
283	-	value := binary.BigEndian.Uint64(raw[:])
284	-	if value == 0 {
285	-	return randomNonzeroUint64()
286	-	}
287	-	return value, nil
288	-	}

D internal/app/broker_remote_probe_test.go +0 -41

@@ -1,41 +0,0 @@
1	-	package app
2	-
3	-	import (
4	-	"context"
5	-	"testing"
6	-
7	-	"github.com/bnema/vev/internal/domain"
8	-	"github.com/bnema/vev/internal/ports"
9	-	"github.com/bnema/vev/internal/protocol"
10	-	"github.com/stretchr/testify/require"
11	-	)
12	-
13	-	func TestBrokerRemoteProbeRequestIsObservationOnly(t *testing.T) {
14	-	registration := domain.RemoteRegistration{Endpoint: "user@example.test", Incarnation: [16]byte{1}, Generation: 1}
15	-	policy := ports.BrokerPolicy{ProtocolVersion: protocol.Version, CatalogSchemaVersion: 3, Transport: "stdio", Trust: "ssh", Launch: "explicit", Isolation: "user", EnvironmentPolicy: protocol.EnvironmentPolicyDaemonOwned}
16	-	probe := &brokerRemoteProbe{
17	-	epoch: 7,
18	-	hosts: &routeTestHosts{record: ports.BrokerHostRecord{Registration: registration, Policy: policy}, found: true},
19	-	}
20	-
21	-	request, err := probe.request(context.Background(), registration)
22	-	require.NoError(t, err)
23	-	require.NoError(t, request.Validate())
24	-	require.Equal(t, ports.BrokerStreamObservation, request.Purpose)
25	-	require.Zero(t, request.Admission)
26	-	require.Empty(t, request.Env)
27	-	require.Equal(t, registration, request.Registration)
28	-	require.Equal(t, policy, request.Policy)
29	-	// Observation must never start the target: the request carries the
30	-	// existing-only authorization, and a spawn-capable one would be refused.
31	-	require.Equal(t, ports.BrokerDaemonExistingOnly, request.StartMode)
32	-	startable := request
33	-	startable.StartMode = ports.BrokerDaemonStartIfNeeded
34	-	require.Error(t, startable.Validate())
35	-	}
36	-
37	-	func TestBrokerRemoteProbeRejectsUnconfiguredEndpointBeforeDial(t *testing.T) {
38	-	probe := &brokerRemoteProbe{epoch: 7, hosts: &routeTestHosts{}}
39	-	_, err := probe.Probe(context.Background(), domain.RemoteRegistration{Endpoint: "user@example.test", Incarnation: [16]byte{1}, Generation: 1})
40	-	require.ErrorContains(t, err, "incomplete broker remote probe")
41	-	}

D internal/app/broker_routes.go +0 -65

@@ -1,65 +0,0 @@
1	-	package app
2	-
3	-	import (
4	-	"context"
5	-
6	-	"github.com/bnema/vev/internal/adapters/brokerconfig"
7	-	"github.com/bnema/vev/internal/ports"
8	-	)
9	-
10	-	// brokerRoutes splits authority deliberately: local routing is provisioned by
11	-	// composition; remote routing is read from committed registry membership, never
12	-	// from its advisory snapshot or the startup import. hosts is wired before Run.
13	-	type brokerRoutes struct {
14	-	local ports.BrokerRouteAuthority
15	-	hosts ports.BrokerHostAuthorityReader
16	-	}
17	-
18	-	func (r *brokerRoutes) ResolveDialTarget(ctx context.Context, request ports.BrokerOpenStreamRequest) (ports.BrokerDialTarget, error) {
19	-	if err := ctx.Err(); err != nil {
20	-	return ports.BrokerDialTarget{}, err
21	-	}
22	-	if request.Local {
23	-	return r.local.ResolveDialTarget(ctx, request)
24	-	}
25	-	record, found, err := r.hosts.LookupHost(ctx, request.Endpoint)
26	-	if err != nil {
27	-	return ports.BrokerDialTarget{}, err
28	-	}
29	-	if !found \|\| !record.Registration.Equal(request.Registration) {
30	-	return ports.BrokerDialTarget{}, ports.BrokerError{Code: ports.BrokerErrorUnavailable, Text: "unknown or stale registration"}
31	-	}
32	-	if !record.Policy.Compatible(request.Policy) {
33	-	return ports.BrokerDialTarget{}, ports.BrokerError{Code: ports.BrokerErrorConflictingPolicy}
34	-	}
35	-	route, err := brokerconfig.RouteFromSpec(record.Route)
36	-	if err != nil {
37	-	return ports.BrokerDialTarget{}, ports.BrokerError{Code: ports.BrokerErrorIncompatible, Cause: err}
38	-	}
39	-	target := ports.BrokerDialTarget{
40	-	Fence: ports.BrokerEndpointFence{Registration: record.Registration},
41	-	Policy: record.Policy, Address: route.Address(), StartMode: request.StartMode,
42	-	ExpectedIdentity: ports.BrokerExpectedIdentity{Identity: record.Identity, Bound: record.Identity != ""},
43	-	}
44	-	return target, target.Validate()
45	-	}
46	-
47	-	// remoteRoute rechecks the whole target immediately before dialing. A removed,
48	-	// replaced, rebound, or rerouted record cannot authorize a stale dial target.
49	-	func (r *brokerRoutes) remoteRoute(ctx context.Context, target ports.BrokerDialTarget) (brokerconfig.Route, error) {
50	-	record, found, err := r.hosts.LookupHost(ctx, target.Fence.Registration.Endpoint)
51	-	if err != nil {
52	-	return brokerconfig.Route{}, err
53	-	}
54	-	if !found \|\| !record.Registration.Equal(target.Fence.Registration) \|\| record.Policy != target.Policy \|\| record.Identity != target.ExpectedIdentity.Identity {
55	-	return brokerconfig.Route{}, ports.BrokerError{Code: ports.BrokerErrorUnavailable, Text: "route authority changed"}
56	-	}
57	-	route, err := brokerconfig.RouteFromSpec(record.Route)
58	-	if err != nil {
59	-	return brokerconfig.Route{}, err
60	-	}
61	-	if route.Address() != target.Address {
62	-	return brokerconfig.Route{}, ports.BrokerError{Code: ports.BrokerErrorUnavailable, Text: "route authority changed"}
63	-	}
64	-	return route, nil
65	-	}

M internal/app/broker_routes_test.go +12 -44

 	store, err := brokerstore.Open(brokerstore.Options{Dir: dir})
 	require.NoError(t, err)
 	defer func() { require.NoError(t, store.Close()) }()
-	routes := &brokerRoutes{}
+	routes := newBrokerRoutes(nil)
-	probe := &brokerRemoteProbe{epoch: 1, routes: routes}
+	probe := &broker.RemoteProbe{Epoch: 1, Routes: routes}
 	registry, err := broker.NewRegistryWithConfig(1, store, probe, clock.New(), nil, broker.RegistryConfig{MembershipMode: broker.MembershipMutable})
 	require.NoError(t, err)
-	routes.hosts = registry
+	routes.Hosts = registry
-	probe.hosts = registry
 	policy := remoteBrokerPolicy("stdio")
 	reg, err := registry.AddHost(ctx, "user@example.test", policy)
 	require.NoError(t, err)
-	request, err := probe.request(ctx, reg)
+	request := ports.BrokerOpenStreamRequest{Endpoint: reg.Endpoint, Registration: reg, Policy: policy, StartMode: ports.BrokerDaemonExistingOnly}
-	require.NoError(t, err)
 	target, err := routes.ResolveDialTarget(ctx, request)
 	require.NoError(t, err)
 	require.False(t, target.ExpectedIdentity.Bound)
-	route, err := routes.remoteRoute(ctx, target)
+	spec, err := routes.AuthorizeRemoteDial(ctx, target)
+	require.NoError(t, err)
+	route, err := brokerconfig.RouteFromSpec(spec)
 	require.NoError(t, err)
 	require.Equal(t, brokerconfig.RouteSSHStdio, route.Kind())
 	require.Equal(t, []string{"vev", brokerMuxStdioCommand, "--production"}, route.Argv())
 	identity, err := registry.BindAuthenticatedIdentity(ctx, ports.BrokerIdentityBindingRequest{Fence: target.Fence, Policy: policy, Identity: "daemon-test"})
 	require.NoError(t, err)
-	_, err = routes.remoteRoute(ctx, target)
+	_, err = routes.AuthorizeRemoteDial(ctx, target)
 	require.Error(t, err, "an unbound target cannot bypass a newly committed identity")
 	target, err = routes.ResolveDialTarget(ctx, request)
 	require.NoError(t, err)
 	require.NoError(t, err)
 	restarted, err := broker.NewRegistryWithConfig(2, store, probe, clock.New(), nil, broker.RegistryConfig{MembershipMode: broker.MembershipMutable})
 	require.NoError(t, err)
-	routes.hosts = restarted
+	routes.Hosts = restarted
 	recovered, err := routes.ResolveDialTarget(ctx, request)
 	require.NoError(t, err)
 	require.Equal(t, target, recovered)
 	restarted.Run(cancelled)
 }
-func TestBrokerRoutesRejectChangedAuthority(t *testing.T) {
-	reg := domain.RemoteRegistration{Endpoint: "user@example.test", Incarnation: [16]byte{1}, Generation: 1}
-	policy := remoteBrokerPolicy("stdio")
-	spec, err := ports.BrokerRouteForTransport(policy.Transport, reg.Endpoint)
-	require.NoError(t, err)
-	original := ports.BrokerHostRecord{Registration: reg, Policy: policy, Route: spec}
-	for _, tc := range []struct {
-		name   string
-		change func(*routeTestHosts)
-	}{
-		{"removed", func(h *routeTestHosts) { h.found = false }},
-		{"readded", func(h *routeTestHosts) { h.record.Registration.Incarnation[0]++ }},
-		{"policy", func(h *routeTestHosts) { h.record.Policy.Trust = "other" }},
-		{"route", func(h *routeTestHosts) { h.record.Route.Target = "other@example.test" }},
-		{"identity", func(h *routeTestHosts) { h.record.Identity = "other-daemon" }},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			hosts := &routeTestHosts{record: original, found: true}
-			routes := &brokerRoutes{hosts: hosts}
-			req := ports.BrokerOpenStreamRequest{Endpoint: reg.Endpoint, Registration: reg, Policy: policy, StartMode: ports.BrokerDaemonExistingOnly}
-			target, err := routes.ResolveDialTarget(context.Background(), req)
-			require.NoError(t, err)
-			tc.change(hosts)
-			_, err = routes.remoteRoute(context.Background(), target)
-			require.Error(t, err)
-		})
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	_, err = (&brokerRoutes{}).ResolveDialTarget(ctx, ports.BrokerOpenStreamRequest{})
-	require.ErrorIs(t, err, context.Canceled)
-}
 func TestCanonicalBrokerRoutesSelectProductionHelpers(t *testing.T) {
 	for _, transport := range []string{"ssh-stdio", "ssh-quic"} {
 		t.Run(transport, func(t *testing.T) {
 	hosts := &routeTestHosts{found: true, record: ports.BrokerHostRecord{
 		Registration: reg, Policy: policy, Route: ports.BrokerRouteSpec{Kind: ports.BrokerRouteUnix, Path: fixture.route},
 	}}
-	routes := &brokerRoutes{hosts: hosts}
+	routes := newBrokerRoutes(nil)
+	routes.Hosts = hosts
 	target, err := routes.ResolveDialTarget(context.Background(), ports.BrokerOpenStreamRequest{
 		Endpoint: reg.Endpoint, Registration: reg, Policy: policy, StartMode: ports.BrokerDaemonExistingOnly,
 	})
 func TestBrokerRoutesLocalRemainsConfigured(t *testing.T) {
 	config, binding := testLocalSandboxConfigForCarriage(t, filepath.Join(t.TempDir(), "daemon.sock"))
-	routes := &brokerRoutes{local: config.Resolver()} // no remote authority at all
+	routes := newBrokerRoutes(config) // no remote authority at all
 	request := ports.BrokerOpenStreamRequest{Local: true, Policy: binding.Policy, StartMode: ports.BrokerDaemonExistingOnly}
 	target, err := routes.ResolveDialTarget(context.Background(), request)
 	require.NoError(t, err)

M internal/app/local_route_probe_test_helpers_test.go +3 -2

 	"github.com/bnema/vev/internal/adapters/brokerconfig"
 	"github.com/bnema/vev/internal/adapters/daemonmux"
 	"github.com/bnema/vev/internal/ports"
+	"github.com/bnema/vev/internal/usecase/broker"
 )
 // newLocalRouteProbe fences one broker-owned local binding into a probe over a
 // its own endpoint connector; a caller that already owns the pooled connector
 // uses newLocalRouteProbeWithConnector instead, exactly as brokerLocalProbe
 // does in production.
-func newLocalRouteProbe(binding brokerconfig.LocalBinding, epoch ports.BrokerEpoch, dial localCarrierDialer, ceilings daemonmux.MuxCeilings) (*localRouteProbe, error) {
+func newLocalRouteProbe(binding brokerconfig.LocalBinding, epoch ports.BrokerEpoch, dial localCarrierDialer, ceilings daemonmux.MuxCeilings) (*broker.LocalDaemonProbe, error) {
 	if dial == nil {
 		return nil, errors.New("vev: broker local probe requires a dialer")
 	}
 // newLocalRouteProbeWithConnector fences one broker-owned local binding into a
 // probe over an existing connector, delegating to the same
 // newDynamicLocalRouteProbe production constructor brokerLocalProbe uses.
-func newLocalRouteProbeWithConnector(binding brokerconfig.LocalBinding, epoch ports.BrokerEpoch, connector ports.BrokerEndpointConnector) (*localRouteProbe, error) {
+func newLocalRouteProbeWithConnector(binding brokerconfig.LocalBinding, epoch ports.BrokerEpoch, connector ports.BrokerEndpointConnector) (*broker.LocalDaemonProbe, error) {
 	return newDynamicLocalRouteProbe(binding.Route, binding.Policy, epoch, connector, func() (ports.BrokerDaemonIdentity, error) {
 		return binding.Identity, nil
 	})

A internal/usecase/broker/observation.go +398 -0

@@ -0,0 +1,398 @@
	1	+	package broker
	2	+
	3	+	import (
	4	+	"context"
	5	+	"crypto/rand"
	6	+	"encoding/binary"
	7	+	"encoding/json"
	8	+	"errors"
	9	+	"fmt"
	10	+	"sync/atomic"
	11	+
	12	+	"github.com/bnema/vev/internal/domain"
	13	+	"github.com/bnema/vev/internal/ports"
	14	+	"github.com/bnema/vev/internal/protocol"
	15	+	"github.com/bnema/vev/internal/protocol/catalogue"
	16	+	)
	17	+
	18	+	// Daemon observation.
	19	+	//
	20	+	// RemoteProbe and LocalDaemonProbe observe one daemon over the broker-owned
	21	+	// multiplexed carriage. Both open an observation stream, never an attachment,
	22	+	// and ask the daemon for its own catalogue through the typed command protocol.
	23	+	// Authenticated identity and incarnation come from the physical handshake,
	24	+	// never from a configured hostname. Both share observeDaemonCatalogue, so the
	25	+	// two producers cannot drift apart, and both borrow the pool's transport
	26	+	// before dialing their own, so neither becomes a second transport owner.
	27	+
	28	+	// pooledPhysicals lets a probe borrow the broker pool's physical transport
	29	+	// instead of dialing (and, for a remote, bootstrapping SSH/QUIC) again. The
	30	+	// pool is published after composition because it binds identities through the
	31	+	// registry that runs the probes. A probe dials only when nothing is pooled, or
	32	+	// when the borrowed transport retired under it.
	33	+	type pooledPhysicals struct{ pool atomic.Pointer[Pool] }
	34	+
	35	+	func (s *pooledPhysicals) adopt(physical ports.BrokerPhysicalConnection, policy ports.BrokerPolicy) bool {
	36	+	pool := s.pool.Load()
	37	+	return pool != nil && pool.AdoptPhysical(physical, policy)
	38	+	}
	39	+
	40	+	// observe reports handled=false when the probe must dial its own transport.
	41	+	func (s *pooledPhysicals) observe(ctx context.Context, identity ports.BrokerDaemonIdentity, policy ports.BrokerPolicy, request ports.BrokerOpenStreamRequest, codec ports.SessionCodec) (ports.BrokerDaemonObservation, bool, error) {
	42	+	pool := s.pool.Load()
	43	+	if pool == nil \|\| identity == "" {
	44	+	return ports.BrokerDaemonObservation{}, false, nil
	45	+	}
	46	+	physical, ok := pool.SharedPhysical(identity, policy)
	47	+	if !ok {
	48	+	return ports.BrokerDaemonObservation{}, false, nil
	49	+	}
	50	+	observation, err := observeDaemonCatalogue(ctx, physical, request, codec)
	51	+	if err == nil \|\| ctx.Err() != nil {
	52	+	return observation, true, err
	53	+	}
	54	+	select {
	55	+	case <-physical.Done():
	56	+	return ports.BrokerDaemonObservation{}, false, nil
	57	+	default:
	58	+	return observation, true, err
	59	+	}
	60	+	}
	61	+
	62	+	// RemoteProbe observes one configured remote daemon. Routes, Binder, and Hosts
	63	+	// may be assigned after the registry that runs the probe is built, but before
	64	+	// the registry starts; composition is cyclic because the registry is both the
	65	+	// host authority and the probe's caller.
	66	+	type RemoteProbe struct {
	67	+	Epoch ports.BrokerEpoch
	68	+	Routes ports.BrokerRouteAuthority
	69	+	Binder ports.BrokerIdentityBinder
	70	+	Connector ports.BrokerEndpointConnector
	71	+	Hosts ports.BrokerHostAuthorityReader
	72	+	Codec ports.SessionCodec
	73	+
	74	+	shared pooledPhysicals
	75	+	}
	76	+
	77	+	var _ ports.BrokerHostProbe = (*RemoteProbe)(nil)
	78	+
	79	+	// SharePool lets later probes borrow the pool's attached or warm transports.
	80	+	func (p RemoteProbe) SharePool(pool Pool) { p.shared.pool.Store(pool) }
	81	+
	82	+	func (p *RemoteProbe) Probe(ctx context.Context, registration domain.RemoteRegistration) (ports.BrokerDaemonObservation, error) {
	83	+	if p == nil \|\| p.Epoch == 0 \|\| p.Routes == nil \|\| p.Binder == nil \|\| p.Connector == nil {
	84	+	return ports.BrokerDaemonObservation{}, errors.New("vev: incomplete broker remote probe")
	85	+	}
	86	+	request, err := p.request(ctx, registration)
	87	+	if err != nil {
	88	+	return ports.BrokerDaemonObservation{}, err
	89	+	}
	90	+	endpoint, err := p.Routes.ResolveDialTarget(ctx, request)
	91	+	if err != nil {
	92	+	return ports.BrokerDaemonObservation{}, err
	93	+	}
	94	+	// Borrow the pooled transport of an attached or warm daemon instead of
	95	+	// bootstrapping SSH/QUIC again. A borrowed transport that retires mid-probe
	96	+	// falls back to a fresh dial.
	97	+	if endpoint.ExpectedIdentity.Bound {
	98	+	if observation, handled, err := p.shared.observe(ctx, endpoint.ExpectedIdentity.Identity, endpoint.Policy, request, p.Codec); handled {
	99	+	return observation, err
	100	+	}
	101	+	}
	102	+	physical, err := p.Connector.Connect(ctx, endpoint)
	103	+	if err != nil {
	104	+	var brokerErr ports.BrokerError
	105	+	if errors.As(err, &brokerErr) && brokerErr.Code == ports.BrokerErrorNoDaemon {
	106	+	// This typed dial-time result means the SSH helper ran on the remote
	107	+	// machine but its local daemon carriage was absent. Do not infer this
	108	+	// from a later stream loss on an already authenticated connection.
	109	+	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityNoDaemon}, nil
	110	+	}
	111	+	return ports.BrokerDaemonObservation{}, err
	112	+	}
	113	+	adopted := false
	114	+	defer func() {
	115	+	if !adopted {
	116	+	_ = physical.Close()
	117	+	}
	118	+	}()
	119	+	if (endpoint.ExpectedIdentity.Bound && physical.Identity() != endpoint.ExpectedIdentity.Identity) \|\| physical.Policy() != endpoint.Policy {
	120	+	return ports.BrokerDaemonObservation{}, errors.New("vev: remote probe authenticated binding mismatch")
	121	+	}
	122	+	identity, err := p.Binder.BindAuthenticatedIdentity(ctx, ports.BrokerIdentityBindingRequest{Fence: endpoint.Fence, Policy: endpoint.Policy, Identity: physical.Identity()})
	123	+	if err != nil \|\| identity != physical.Identity() {
	124	+	return ports.BrokerDaemonObservation{}, errors.New("vev: remote probe could not commit authenticated binding")
	125	+	}
	126	+	observation, err := observeDaemonCatalogue(ctx, physical, request, p.Codec)
	127	+	if err == nil && ctx.Err() == nil {
	128	+	adopted = p.shared.adopt(physical, endpoint.Policy)
	129	+	}
	130	+	return observation, err
	131	+	}
	132	+
	133	+	func (p *RemoteProbe) request(ctx context.Context, registration domain.RemoteRegistration) (ports.BrokerOpenStreamRequest, error) {
	134	+	if p.Hosts == nil {
	135	+	return ports.BrokerOpenStreamRequest{}, errors.New("vev: remote probe has no policy authority")
	136	+	}
	137	+	record, ok, err := p.Hosts.LookupHost(ctx, registration.Endpoint)
	138	+	if err != nil {
	139	+	return ports.BrokerOpenStreamRequest{}, err
	140	+	}
	141	+	if !ok \|\| !record.Registration.Equal(registration) {
	142	+	return ports.BrokerOpenStreamRequest{}, ports.BrokerError{Code: ports.BrokerErrorUnavailable, Text: "unknown or stale probe registration"}
	143	+	}
	144	+	request, err := newObservationRequest(p.Epoch, record.Policy)
	145	+	if err != nil {
	146	+	return ports.BrokerOpenStreamRequest{}, err
	147	+	}
	148	+	request.Endpoint = registration.Endpoint
	149	+	request.Registration = registration
	150	+	return request, nil
	151	+	}
	152	+
	153	+	// LocalIdentityLoader returns the local daemon's persisted identity, or ""
	154	+	// when no daemon has ever published one.
	155	+	type LocalIdentityLoader func() (ports.BrokerDaemonIdentity, error)
	156	+
	157	+	// LocalDaemonProbe observes the broker's own machine daemon over one local
	158	+	// address. It commits no durable identity binding: the local daemon owns no
	159	+	// configured membership, and the identity the physical preamble verified is
	160	+	// the fence.
	161	+	type LocalDaemonProbe struct {
	162	+	epoch ports.BrokerEpoch
	163	+	address string
	164	+	policy ports.BrokerPolicy
	165	+	loadIdentity LocalIdentityLoader
	166	+	connector ports.BrokerEndpointConnector
	167	+	codec ports.SessionCodec
	168	+	shared pooledPhysicals
	169	+	}
	170	+
	171	+	var _ LocalProbe = (*LocalDaemonProbe)(nil)
	172	+
	173	+	// NewLocalDaemonProbe validates one local observation route. The caller must
	174	+	// have proven the address is a local socket this process dials directly:
	175	+	// probing must never spawn a process.
	176	+	func NewLocalDaemonProbe(epoch ports.BrokerEpoch, address string, policy ports.BrokerPolicy, connector ports.BrokerEndpointConnector, codec ports.SessionCodec, loadIdentity LocalIdentityLoader) (*LocalDaemonProbe, error) {
	177	+	if epoch == 0 {
	178	+	return nil, errors.New("vev: broker local probe requires a broker epoch")
	179	+	}
	180	+	if nilDependency(connector) {
	181	+	return nil, errors.New("vev: broker local probe requires a connector")
	182	+	}
	183	+	if nilDependency(codec) {
	184	+	return nil, errors.New("vev: broker local probe requires a codec")
	185	+	}
	186	+	if loadIdentity == nil {
	187	+	return nil, errors.New("vev: broker local probe requires an identity loader")
	188	+	}
	189	+	if address == "" {
	190	+	return nil, errors.New("vev: broker local probe requires an address")
	191	+	}
	192	+	if err := policy.Validate(); err != nil {
	193	+	return nil, fmt.Errorf("vev: broker local probe: %w", err)
	194	+	}
	195	+	return &LocalDaemonProbe{epoch: epoch, address: address, policy: policy, loadIdentity: loadIdentity, connector: connector, codec: codec}, nil
	196	+	}
	197	+
	198	+	// SharePool lets later probes borrow the pool's attached or warm transports.
	199	+	func (p LocalDaemonProbe) SharePool(pool Pool) { p.shared.pool.Store(pool) }
	200	+
	201	+	// ProbeLocal authenticates the daemonmux physical preamble and then opens
	202	+	// exactly one observation stream that asks the daemon for its own catalogue.
	203	+	// Capabilities are not carried by the catalogue command, so they stay zero.
	204	+	// Every failure reports an explicit availability with zero observed identity:
	205	+	// a probe never manufactures identity, version, or inventory it did not
	206	+	// observe, and it never creates an attachment, a session, or a process.
	207	+	func (p *LocalDaemonProbe) ProbeLocal(ctx context.Context) (ports.BrokerDaemonObservation, error) {
	208	+	unreachable := ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnreachable}
	209	+	if p == nil \|\| p.connector == nil {
	210	+	return unreachable, errors.New("vev: broker local probe is nil")
	211	+	}
	212	+	identity, err := p.loadIdentity()
	213	+	if err != nil {
	214	+	return unreachable, err
	215	+	}
	216	+	if identity == "" {
	217	+	return ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnknown}, nil
	218	+	}
	219	+	endpoint := ports.BrokerDialTarget{
	220	+	Fence: ports.BrokerEndpointFence{Local: true}, Policy: p.policy, Address: p.address,
	221	+	StartMode: ports.BrokerDaemonExistingOnly,
	222	+	ExpectedIdentity: ports.BrokerExpectedIdentity{Identity: identity, Bound: true},
	223	+	}
	224	+	if err := endpoint.Validate(); err != nil {
	225	+	return unreachable, fmt.Errorf("vev: broker local probe: %w", err)
	226	+	}
	227	+	request, err := p.request()
	228	+	if err != nil {
	229	+	return unreachable, err
	230	+	}
	231	+	if observation, handled, err := p.shared.observe(ctx, identity, p.policy, request, p.codec); handled {
	232	+	if err != nil {
	233	+	return unreachable, err
	234	+	}
	235	+	return observation, nil
	236	+	}
	237	+	physical, err := p.connector.Connect(ctx, endpoint)
	238	+	if err != nil {
	239	+	return unreachable, err
	240	+	}
	241	+	defer func() { _ = physical.Close() }()
	242	+	// The endpoint stays authoritative: re-verify the accepted authority even
	243	+	// though the connector already checked it, so a future connector change can
	244	+	// never weaken what the probe publishes.
	245	+	if physical.Identity() != endpoint.ExpectedIdentity.Identity \|\| !physical.Policy().Compatible(endpoint.Policy) {
	246	+	return unreachable, errors.New("vev: broker local probe authenticated binding mismatch")
	247	+	}
	248	+	observation, err := observeDaemonCatalogue(ctx, physical, request, p.codec)
	249	+	if err != nil {
	250	+	return unreachable, err
	251	+	}
	252	+	return observation, nil
	253	+	}
	254	+
	255	+	// request builds the one local observation open this probe performs. It
	256	+	// carries no endpoint, registration, admission, name, target, or environment.
	257	+	func (p *LocalDaemonProbe) request() (ports.BrokerOpenStreamRequest, error) {
	258	+	request, err := newObservationRequest(p.epoch, p.policy)
	259	+	if err != nil {
	260	+	return ports.BrokerOpenStreamRequest{}, err
	261	+	}
	262	+	request.Local = true
	263	+	return request, nil
	264	+	}
	265	+
	266	+	// newObservationRequest builds an observation open with fresh connection and
	267	+	// stream identities, so a replayed or duplicated open is refused by the peer's
	268	+	// anti-replay window. Observation never starts the target: it always carries
	269	+	// the existing-only authorization, and a start-if-needed one is refused by
	270	+	// validation rather than silently widened into a spawn.
	271	+	func newObservationRequest(epoch ports.BrokerEpoch, policy ports.BrokerPolicy) (ports.BrokerOpenStreamRequest, error) {
	272	+	connection, err := randomConnectionID()
	273	+	if err != nil {
	274	+	return ports.BrokerOpenStreamRequest{}, err
	275	+	}
	276	+	stream, err := randomNonzeroUint64()
	277	+	if err != nil {
	278	+	return ports.BrokerOpenStreamRequest{}, err
	279	+	}
	280	+	return ports.BrokerOpenStreamRequest{
	281	+	Epoch: epoch, Purpose: ports.BrokerStreamObservation,
	282	+	Connection: connection, Stream: ports.BrokerStreamID(stream),
	283	+	Policy: policy, StartMode: ports.BrokerDaemonExistingOnly,
	284	+	}, nil
	285	+	}
	286	+
	287	+	// observeDaemonCatalogue observes one already authenticated daemon by opening
	288	+	// exactly one observation logical stream and asking the daemon for its own
	289	+	// catalogue. It sends no Hello, claims no geometry, requests no admission, and
	290	+	// creates no session or process.
	291	+	//
	292	+	// A refused open, an unmatched or invalid result, a failed outcome, a malformed
	293	+	// catalogue, and a catalogue outside the exact current schema all fail closed:
	294	+	// the caller receives an error and no observation it could publish.
	295	+	func observeDaemonCatalogue(ctx context.Context, physical ports.BrokerPhysicalConnection, request ports.BrokerOpenStreamRequest, codec ports.SessionCodec) (ports.BrokerDaemonObservation, error) {
	296	+	if physical == nil \|\| codec == nil \|\| request.Purpose != ports.BrokerStreamObservation {
	297	+	return ports.BrokerDaemonObservation{}, errors.New("vev: invalid daemon observation request")
	298	+	}
	299	+	logical, err := physical.OpenStream(ctx, request)
	300	+	if err != nil {
	301	+	// A connection that completed the authenticated physical handshake had
	302	+	// a daemon. Losing its logical stream is a transport failure, not proof
	303	+	// that the daemon is absent; preserve the failure so pooled callers can
	304	+	// discard a dead connection and retry with a fresh dial.
	305	+	return ports.BrokerDaemonObservation{}, err
	306	+	}
	307	+	if logical == nil {
	308	+	return ports.BrokerDaemonObservation{}, errors.New("vev: daemon observation opened no logical stream")
	309	+	}
	310	+	defer func() { _ = logical.Close() }()
	311	+	commandID, err := randomNonzeroUint64()
	312	+	if err != nil {
	313	+	return ports.BrokerDaemonObservation{}, err
	314	+	}
	315	+	reply, err := exchangeObservationCommand(ctx, codec.Client(logical), logical, protocol.CommandRequest{RequestID: commandID, Version: protocol.Version, Slug: "remote-catalog", JSON: true})
	316	+	if err != nil {
	317	+	return ports.BrokerDaemonObservation{}, err
	318	+	}
	319	+	result, ok := reply.(protocol.CommandResult)
	320	+	if !ok \|\| result.RequestID != commandID \|\| !result.Valid() {
	321	+	return ports.BrokerDaemonObservation{}, errors.New("vev: invalid daemon observation result")
	322	+	}
	323	+	if result.Outcome != protocol.CommandSucceeded {
	324	+	return ports.BrokerDaemonObservation{}, fmt.Errorf("vev: daemon observation failed: %s", result.Text)
	325	+	}
	326	+	var catalog catalogue.RemoteCatalog
	327	+	if err := json.Unmarshal([]byte(result.Output), &catalog); err != nil {
	328	+	return ports.BrokerDaemonObservation{}, fmt.Errorf("vev: decode daemon observation: %w", err)
	329	+	}
	330	+	if err := catalogue.ValidateRemoteCatalog(catalog); err != nil {
	331	+	return ports.BrokerDaemonObservation{}, err
	332	+	}
	333	+	return ports.BrokerDaemonObservation{
	334	+	Identity: physical.Identity(),
	335	+	Incarnation: physical.Incarnation(),
	336	+	ProtocolVersion: catalog.ProtocolVersion,
	337	+	Availability: domain.RemoteAvailabilityReachable,
	338	+	InventoryKnown: true,
	339	+	Sessions: catalog.Sessions,
	340	+	}, nil
	341	+	}
	342	+
	343	+	// exchangeObservationCommand sends one typed command and waits for one reply
	344	+	// under the caller's context. A cancelled or expired context closes exactly
	345	+	// this logical stream, which unblocks the pending read, and the worker is
	346	+	// joined before returning, so no observation goroutine outlives its attempt.
	347	+	func exchangeObservationCommand(ctx context.Context, typed ports.ClientConnection, logical ports.BrokerEnvelopeStream, command protocol.CommandRequest) (protocol.ServerMessage, error) {
	348	+	if ctx == nil {
	349	+	ctx = context.Background()
	350	+	}
	351	+	type outcome struct {
	352	+	message protocol.ServerMessage
	353	+	err error
	354	+	}
	355	+	done := make(chan outcome, 1)
	356	+	go func() {
	357	+	if err := typed.SendClient(command); err != nil {
	358	+	done <- outcome{err: err}
	359	+	return
	360	+	}
	361	+	message, err := typed.ReceiveServer()
	362	+	done <- outcome{message: message, err: err}
	363	+	}()
	364	+	select {
	365	+	case result := <-done:
	366	+	if err := ctx.Err(); err != nil {
	367	+	return nil, err
	368	+	}
	369	+	return result.message, result.err
	370	+	case <-ctx.Done():
	371	+	_ = logical.Close()
	372	+	<-done
	373	+	return nil, ctx.Err()
	374	+	}
	375	+	}
	376	+
	377	+	func randomConnectionID() (ports.BrokerConnectionID, error) {
	378	+	var id ports.BrokerConnectionID
	379	+	if _, err := rand.Read(id[:]); err != nil {
	380	+	return id, err
	381	+	}
	382	+	if err := id.Validate(); err != nil {
	383	+	return randomConnectionID()
	384	+	}
	385	+	return id, nil
	386	+	}
	387	+
	388	+	func randomNonzeroUint64() (uint64, error) {
	389	+	var raw [8]byte
	390	+	if _, err := rand.Read(raw[:]); err != nil {
	391	+	return 0, err
	392	+	}
	393	+	value := binary.BigEndian.Uint64(raw[:])
	394	+	if value == 0 {
	395	+	return randomNonzeroUint64()
	396	+	}
	397	+	return value, nil
	398	+	}

R internal/app/broker_remote_probe_shared_test.go → internal/usecase/broker/observation_shared_test.go +14 -16 renamed, 88% similar

-package app
+package broker
 import (
 	"context"
 	"testing"
 	"time"
-	"github.com/bnema/vev/internal/adapters/clock"
 	"github.com/bnema/vev/internal/domain"
 	"github.com/bnema/vev/internal/ports"
 	portsmocks "github.com/bnema/vev/internal/ports/mocks"
 	"github.com/bnema/vev/internal/protocol"
-	"github.com/bnema/vev/internal/usecase/broker"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 // again, and redials only when the borrowed transport has retired.
 func TestBrokerRemoteProbeBorrowsWarmTransport(t *testing.T) {
 	registration := domain.RemoteRegistration{Endpoint: "user@example.test", Incarnation: [16]byte{1}, Generation: 1}
-	policy := remoteBrokerPolicy("quic")
+	policy := observationPolicy()
 	const identity ports.BrokerDaemonIdentity = "remote-daemon"
 	dialErr := errors.New("dial refused")
 	tests := []struct {
 						return nil
 					})
 					typed.EXPECT().ReceiveServer().RunAndReturn(func() (protocol.ServerMessage, error) {
-						return protocol.CommandResult{RequestID: sent.RequestID, Outcome: protocol.CommandSucceeded, Output: testLocalCatalogue(t)}, nil
+						return protocol.CommandResult{RequestID: sent.RequestID, Outcome: protocol.CommandSucceeded, Output: observationCatalogue(t)}, nil
 					})
 					logical.EXPECT().Close().Return(nil)
 					physical.EXPECT().OpenStream(mock.Anything, mock.Anything).Return(logical, nil)
 					physical.EXPECT().Incarnation().Return(ports.BrokerDaemonIncarnation{1})
 				}
 			}
-			probe := &brokerRemoteProbe{
+			probe := &RemoteProbe{
-				epoch: 7, routes: routes, binder: portsmocks.NewMockBrokerIdentityBinder(t), connector: connector,
+				Epoch: 7, Routes: routes, Binder: portsmocks.NewMockBrokerIdentityBinder(t), Connector: connector,
-				hosts: &routeTestHosts{record: record, found: true}, codec: codec,
+				Hosts: observationHosts(t, record), Codec: codec,
 			}
 			// Use the real pool for borrowing. Stateful pool retirement is
 			// covered with a fake physical in broker's worker tests.
-			pool, err := broker.NewPool(7, routes, probe.binder, connector, clock.New(), broker.PoolLimits{Physical: 1, Clients: 1, Streams: 2, StreamsPerClient: 2, Warm: 1})
+			pool, err := NewPool(7, routes, probe.Binder, connector, newManualClock(time.Unix(0, 0)), PoolLimits{Physical: 1, Clients: 1, Streams: 2, StreamsPerClient: 2, Warm: 1})
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, pool.Close()) })
 			if tt.shared && tt.bound && !tt.retired {
 				physical.EXPECT().Close().Return(nil).Maybe()
 				require.True(t, pool.AdoptPhysical(physical, policy))
 			}
-			probe.shared.share(pool)
+			probe.SharePool(pool)
 			observation, err := probe.Probe(context.Background(), registration)
 			switch {
 // abandoned for a redial just because one observation went unanswered.
 func TestBrokerRemoteProbeSilentBorrowedTransportNeverRedials(t *testing.T) {
 	registration := domain.RemoteRegistration{Endpoint: "user@example.test", Incarnation: [16]byte{1}, Generation: 1}
-	policy := remoteBrokerPolicy("quic")
+	policy := observationPolicy()
 	const identity ports.BrokerDaemonIdentity = "remote-daemon"
 	tests := []struct {
 		name string
 				logical.EXPECT().Close().RunAndReturn(func() error { once.Do(func() { close(closed) }); return nil })
 				physical.EXPECT().OpenStream(mock.Anything, mock.Anything).Return(logical, nil)
 			}
-			probe := &brokerRemoteProbe{
+			probe := &RemoteProbe{
-				epoch: 7, routes: routes, binder: portsmocks.NewMockBrokerIdentityBinder(t), connector: connector,
+				Epoch: 7, Routes: routes, Binder: portsmocks.NewMockBrokerIdentityBinder(t), Connector: connector,
-				hosts: &routeTestHosts{record: record, found: true}, codec: codec,
+				Hosts: observationHosts(t, record), Codec: codec,
 			}
-			pool, err := broker.NewPool(7, routes, probe.binder, connector, clock.New(), broker.PoolLimits{Physical: 1, Clients: 1, Streams: 2, StreamsPerClient: 2, Warm: 1})
+			pool, err := NewPool(7, routes, probe.Binder, connector, newManualClock(time.Unix(0, 0)), PoolLimits{Physical: 1, Clients: 1, Streams: 2, StreamsPerClient: 2, Warm: 1})
 			require.NoError(t, err)
 			t.Cleanup(func() { require.NoError(t, pool.Close()) })
 			require.True(t, pool.AdoptPhysical(physical, policy))
-			probe.shared.share(pool)
+			probe.SharePool(pool)
 			type outcome struct{ err error }
 			done := make(chan outcome, 1)

A internal/usecase/broker/observation_test.go +164 -0

@@ -0,0 +1,164 @@
	1	+	package broker
	2	+
	3	+	import (
	4	+	"context"
	5	+	"encoding/json"
	6	+	"testing"
	7	+
	8	+	"github.com/bnema/vev/internal/domain"
	9	+	"github.com/bnema/vev/internal/ports"
	10	+	portsmocks "github.com/bnema/vev/internal/ports/mocks"
	11	+	"github.com/bnema/vev/internal/protocol"
	12	+	"github.com/bnema/vev/internal/protocol/catalogue"
	13	+	"github.com/stretchr/testify/mock"
	14	+	"github.com/stretchr/testify/require"
	15	+	)
	16	+
	17	+	func observationPolicy() ports.BrokerPolicy {
	18	+	return ports.BrokerPolicy{
	19	+	ProtocolVersion: protocol.Version, CatalogSchemaVersion: catalogue.RemoteCatalogSchemaVersion,
	20	+	Transport: "ssh-quic", Trust: "ssh", Launch: "explicit", Isolation: "user",
	21	+	EnvironmentPolicy: protocol.EnvironmentPolicyDaemonOwned,
	22	+	}
	23	+	}
	24	+
	25	+	func observationCatalogue(t *testing.T) string {
	26	+	t.Helper()
	27	+	encoded, err := json.Marshal(catalogue.RemoteCatalog{ProtocolVersion: protocol.Version, SchemaVersion: catalogue.RemoteCatalogSchemaVersion, Sessions: []catalogue.RemoteCatalogSession{}})
	28	+	require.NoError(t, err)
	29	+	return string(encoded) + "\n"
	30	+	}
	31	+
	32	+	// observationHosts answers LookupHost for exactly one configured record.
	33	+	func observationHosts(t *testing.T, record ports.BrokerHostRecord) ports.BrokerHostAuthorityReader {
	34	+	hosts := portsmocks.NewMockBrokerHostAuthorityReader(t)
	35	+	hosts.EXPECT().LookupHost(mock.Anything, mock.Anything).RunAndReturn(func(ctx context.Context, endpoint string) (ports.BrokerHostRecord, bool, error) {
	36	+	return record, endpoint == record.Registration.Endpoint, ctx.Err()
	37	+	}).Maybe()
	38	+	return hosts
	39	+	}
	40	+
	41	+	func TestObservationRequestIsObservationOnly(t *testing.T) {
	42	+	registration := domain.RemoteRegistration{Endpoint: "user@example.test", Incarnation: [16]byte{1}, Generation: 1}
	43	+	policy := observationPolicy()
	44	+	tests := []struct {
	45	+	name string
	46	+	build func(t *testing.T) (ports.BrokerOpenStreamRequest, error)
	47	+	check func(t *testing.T, request ports.BrokerOpenStreamRequest)
	48	+	}{
	49	+	{
	50	+	name: "remote",
	51	+	build: func(t *testing.T) (ports.BrokerOpenStreamRequest, error) {
	52	+	probe := &RemoteProbe{Epoch: 7, Hosts: observationHosts(t, ports.BrokerHostRecord{Registration: registration, Policy: policy})}
	53	+	return probe.request(context.Background(), registration)
	54	+	},
	55	+	check: func(t *testing.T, request ports.BrokerOpenStreamRequest) {
	56	+	require.False(t, request.Local)
	57	+	require.Equal(t, registration, request.Registration)
	58	+	require.Equal(t, registration.Endpoint, request.Endpoint)
	59	+	},
	60	+	},
	61	+	{
	62	+	name: "local",
	63	+	build: func(t *testing.T) (ports.BrokerOpenStreamRequest, error) {
	64	+	probe, err := NewLocalDaemonProbe(7, "local-address", policy, portsmocks.NewMockBrokerEndpointConnector(t), portsmocks.NewMockSessionCodec(t), func() (ports.BrokerDaemonIdentity, error) { return "daemon", nil })
	65	+	require.NoError(t, err)
	66	+	return probe.request()
	67	+	},
	68	+	check: func(t *testing.T, request ports.BrokerOpenStreamRequest) {
	69	+	require.True(t, request.Local)
	70	+	require.Empty(t, request.Endpoint)
	71	+	require.Equal(t, domain.RemoteRegistration{}, request.Registration)
	72	+	},
	73	+	},
	74	+	}
	75	+	for _, tt := range tests {
	76	+	t.Run(tt.name, func(t *testing.T) {
	77	+	request, err := tt.build(t)
	78	+	require.NoError(t, err)
	79	+	require.NoError(t, request.Validate())
	80	+	require.Equal(t, ports.BrokerEpoch(7), request.Epoch)
	81	+	require.Equal(t, ports.BrokerStreamObservation, request.Purpose)
	82	+	require.Zero(t, request.Admission)
	83	+	require.Empty(t, request.Name)
	84	+	require.Empty(t, request.Env)
	85	+	require.Equal(t, protocol.ExactSessionTarget{}, request.Target)
	86	+	require.Equal(t, policy, request.Policy)
	87	+	require.NotZero(t, request.Connection)
	88	+	require.NotZero(t, request.Stream)
	89	+	tt.check(t, request)
	90	+	// Observation must never start the target: a spawn-capable request
	91	+	// is refused rather than silently narrowed.
	92	+	require.Equal(t, ports.BrokerDaemonExistingOnly, request.StartMode)
	93	+	startable := request
	94	+	startable.StartMode = ports.BrokerDaemonStartIfNeeded
	95	+	require.Error(t, startable.Validate())
	96	+	})
	97	+	}
	98	+	}
	99	+
	100	+	func TestRemoteProbeRejectsStaleRegistrationBeforeDial(t *testing.T) {
	101	+	registration := domain.RemoteRegistration{Endpoint: "user@example.test", Incarnation: [16]byte{1}, Generation: 1}
	102	+	tests := []struct {
	103	+	name string
	104	+	probe *RemoteProbe
	105	+	wantErr string
	106	+	}{
	107	+	{name: "incomplete composition", probe: &RemoteProbe{Epoch: 7}, wantErr: "incomplete broker remote probe"},
	108	+	{name: "unknown registration", probe: &RemoteProbe{
	109	+	Epoch: 7, Routes: portsmocks.NewMockBrokerRouteAuthority(t), Binder: portsmocks.NewMockBrokerIdentityBinder(t),
	110	+	Connector: portsmocks.NewMockBrokerEndpointConnector(t), Hosts: observationHosts(t, ports.BrokerHostRecord{}),
	111	+	}, wantErr: "unknown or stale probe registration"},
	112	+	}
	113	+	for _, tt := range tests {
	114	+	t.Run(tt.name, func(t *testing.T) {
	115	+	_, err := tt.probe.Probe(context.Background(), registration)
	116	+	require.ErrorContains(t, err, tt.wantErr)
	117	+	})
	118	+	}
	119	+	}
	120	+
	121	+	func TestNewLocalDaemonProbeRejectsIncompleteComposition(t *testing.T) {
	122	+	policy := observationPolicy()
	123	+	loader := func() (ports.BrokerDaemonIdentity, error) { return "daemon", nil }
	124	+	connector := portsmocks.NewMockBrokerEndpointConnector(t)
	125	+	codec := portsmocks.NewMockSessionCodec(t)
	126	+	tests := []struct {
	127	+	name string
	128	+	epoch ports.BrokerEpoch
	129	+	address string
	130	+	connector ports.BrokerEndpointConnector
	131	+	codec ports.SessionCodec
	132	+	loader LocalIdentityLoader
	133	+	wantErr string
	134	+	}{
	135	+	{name: "epoch", address: "a", connector: connector, codec: codec, loader: loader, wantErr: "epoch"},
	136	+	{name: "connector", epoch: 1, address: "a", codec: codec, loader: loader, wantErr: "connector"},
	137	+	{name: "codec", epoch: 1, address: "a", connector: connector, loader: loader, wantErr: "codec"},
	138	+	{name: "loader", epoch: 1, address: "a", connector: connector, codec: codec, wantErr: "identity loader"},
	139	+	{name: "address", epoch: 1, connector: connector, codec: codec, loader: loader, wantErr: "address"},
	140	+	}
	141	+	for _, tt := range tests {
	142	+	t.Run(tt.name, func(t *testing.T) {
	143	+	_, err := NewLocalDaemonProbe(tt.epoch, tt.address, policy, tt.connector, tt.codec, tt.loader)
	144	+	require.ErrorContains(t, err, tt.wantErr)
	145	+	})
	146	+	}
	147	+	}
	148	+
	149	+	func TestLocalDaemonProbeWithoutIdentityDoesNotDial(t *testing.T) {
	150	+	// No Connect expectation: any dial fails the mock.
	151	+	probe, err := NewLocalDaemonProbe(7, "local-address", observationPolicy(), portsmocks.NewMockBrokerEndpointConnector(t), portsmocks.NewMockSessionCodec(t), func() (ports.BrokerDaemonIdentity, error) { return "", nil })
	152	+	require.NoError(t, err)
	153	+	observation, err := probe.ProbeLocal(context.Background())
	154	+	require.NoError(t, err)
	155	+	require.Equal(t, domain.RemoteAvailabilityUnknown, observation.Availability)
	156	+	require.Zero(t, observation.Identity)
	157	+	}
	158	+
	159	+	func TestLocalDaemonProbeNilReceiverFailsClosed(t *testing.T) {
	160	+	var probe *LocalDaemonProbe
	161	+	observation, err := probe.ProbeLocal(context.Background())
	162	+	require.Error(t, err)
	163	+	require.Equal(t, domain.RemoteAvailabilityUnreachable, observation.Availability)
	164	+	}

A internal/usecase/broker/routes.go +92 -0

@@ -0,0 +1,92 @@
	1	+	package broker
	2	+
	3	+	import (
	4	+	"context"
	5	+	"errors"
	6	+
	7	+	"github.com/bnema/vev/internal/ports"
	8	+	)
	9	+
	10	+	// RouteAddress derives the opaque pool address of one durable route. The
	11	+	// carriage adapter owns the derivation; routing only compares its results.
	12	+	type RouteAddress func(ports.BrokerRouteSpec) (string, error)
	13	+
	14	+	// Routes is the broker's single route authorization policy. Local routing is
	15	+	// provisioned by composition; remote routing is read from committed registry
	16	+	// membership, never from an advisory snapshot or a startup import. A remote
	17	+	// target is authorized twice against the same committed record: once when it is
	18	+	// resolved, and again immediately before dialing, so a removed, replaced,
	19	+	// rebound, or rerouted host can never authorize a stale target.
	20	+	//
	21	+	// Hosts may be assigned after the registry is built, but before it runs.
	22	+	type Routes struct {
	23	+	Local ports.BrokerRouteAuthority
	24	+	Hosts ports.BrokerHostAuthorityReader
	25	+	Address RouteAddress
	26	+	}
	27	+
	28	+	var _ ports.BrokerRouteAuthority = (*Routes)(nil)
	29	+
	30	+	var errRouteAuthorityChanged = ports.BrokerError{Code: ports.BrokerErrorUnavailable, Text: "route authority changed"}
	31	+
	32	+	func (r *Routes) ResolveDialTarget(ctx context.Context, request ports.BrokerOpenStreamRequest) (ports.BrokerDialTarget, error) {
	33	+	if err := ctx.Err(); err != nil {
	34	+	return ports.BrokerDialTarget{}, err
	35	+	}
	36	+	if request.Local {
	37	+	if r.Local == nil {
	38	+	return ports.BrokerDialTarget{}, ports.BrokerError{Code: ports.BrokerErrorUnavailable, Text: "no local route"}
	39	+	}
	40	+	return r.Local.ResolveDialTarget(ctx, request)
	41	+	}
	42	+	if r.Hosts == nil \|\| r.Address == nil {
	43	+	return ports.BrokerDialTarget{}, errors.New("broker: incomplete route authority")
	44	+	}
	45	+	record, found, err := r.Hosts.LookupHost(ctx, request.Endpoint)
	46	+	if err != nil {
	47	+	return ports.BrokerDialTarget{}, err
	48	+	}
	49	+	if !found \|\| !record.Registration.Equal(request.Registration) {
	50	+	return ports.BrokerDialTarget{}, ports.BrokerError{Code: ports.BrokerErrorUnavailable, Text: "unknown or stale registration"}
	51	+	}
	52	+	if !record.Policy.Compatible(request.Policy) {
	53	+	return ports.BrokerDialTarget{}, ports.BrokerError{Code: ports.BrokerErrorConflictingPolicy}
	54	+	}
	55	+	address, err := r.Address(record.Route)
	56	+	if err != nil {
	57	+	return ports.BrokerDialTarget{}, ports.BrokerError{Code: ports.BrokerErrorIncompatible, Cause: err}
	58	+	}
	59	+	target := ports.BrokerDialTarget{
	60	+	Fence: ports.BrokerEndpointFence{Registration: record.Registration},
	61	+	Policy: record.Policy, Address: address, StartMode: request.StartMode,
	62	+	ExpectedIdentity: ports.BrokerExpectedIdentity{Identity: record.Identity, Bound: record.Identity != ""},
	63	+	}
	64	+	return target, target.Validate()
	65	+	}
	66	+
	67	+	// AuthorizeRemoteDial rechecks a resolved remote target against the committed
	68	+	// record immediately before dialing and returns the route to dial. Any change
	69	+	// to registration, policy, identity, or route since resolution refuses it.
	70	+	func (r *Routes) AuthorizeRemoteDial(ctx context.Context, target ports.BrokerDialTarget) (ports.BrokerRouteSpec, error) {
	71	+	if target.Fence.Local {
	72	+	return ports.BrokerRouteSpec{}, errors.New("broker: local target has no remote route")
	73	+	}
	74	+	if r.Hosts == nil \|\| r.Address == nil {
	75	+	return ports.BrokerRouteSpec{}, errors.New("broker: incomplete route authority")
	76	+	}
	77	+	record, found, err := r.Hosts.LookupHost(ctx, target.Fence.Registration.Endpoint)
	78	+	if err != nil {
	79	+	return ports.BrokerRouteSpec{}, err
	80	+	}
	81	+	if !found \|\| !record.Registration.Equal(target.Fence.Registration) \|\| record.Policy != target.Policy \|\| record.Identity != target.ExpectedIdentity.Identity {
	82	+	return ports.BrokerRouteSpec{}, errRouteAuthorityChanged
	83	+	}
	84	+	address, err := r.Address(record.Route)
	85	+	if err != nil {
	86	+	return ports.BrokerRouteSpec{}, err
	87	+	}
	88	+	if address != target.Address {
	89	+	return ports.BrokerRouteSpec{}, errRouteAuthorityChanged
	90	+	}
	91	+	return record.Route, nil
	92	+	}

A internal/usecase/broker/routes_test.go +140 -0

@@ -0,0 +1,140 @@
	1	+	package broker
	2	+
	3	+	import (
	4	+	"context"
	5	+	"errors"
	6	+	"testing"
	7	+
	8	+	"github.com/bnema/vev/internal/domain"
	9	+	"github.com/bnema/vev/internal/ports"
	10	+	portsmocks "github.com/bnema/vev/internal/ports/mocks"
	11	+	"github.com/stretchr/testify/mock"
	12	+	"github.com/stretchr/testify/require"
	13	+	)
	14	+
	15	+	// routeHosts is a mutable committed-membership view, so a test can change the
	16	+	// record between resolution and dial.
	17	+	type routeHosts struct {
	18	+	record ports.BrokerHostRecord
	19	+	found bool
	20	+	}
	21	+
	22	+	func (h *routeHosts) LookupHost(ctx context.Context, endpoint string) (ports.BrokerHostRecord, bool, error) {
	23	+	return h.record, h.found && endpoint == h.record.Registration.Endpoint, ctx.Err()
	24	+	}
	25	+
	26	+	// testRouteAddress derives a stable address from the route contents.
	27	+	func testRouteAddress(spec ports.BrokerRouteSpec) (string, error) {
	28	+	if err := spec.Validate(); err != nil {
	29	+	return "", err
	30	+	}
	31	+	return "addr:" + string(spec.Kind) + ":" + spec.Path + spec.Target, nil
	32	+	}
	33	+
	34	+	func testRouteRecord(t *testing.T) ports.BrokerHostRecord {
	35	+	t.Helper()
	36	+	registration := domain.RemoteRegistration{Endpoint: "user@example.test", Incarnation: [16]byte{1}, Generation: 1}
	37	+	policy := observationPolicy()
	38	+	spec, err := ports.BrokerRouteForTransport(policy.Transport, registration.Endpoint)
	39	+	require.NoError(t, err)
	40	+	return ports.BrokerHostRecord{Registration: registration, Policy: policy, Route: spec, Identity: "daemon"}
	41	+	}
	42	+
	43	+	func testRouteRequest(record ports.BrokerHostRecord) ports.BrokerOpenStreamRequest {
	44	+	return ports.BrokerOpenStreamRequest{Endpoint: record.Registration.Endpoint, Registration: record.Registration, Policy: record.Policy, StartMode: ports.BrokerDaemonExistingOnly}
	45	+	}
	46	+
	47	+	func TestRoutesResolveRemoteTarget(t *testing.T) {
	48	+	record := testRouteRecord(t)
	49	+	tests := []struct {
	50	+	name string
	51	+	change func(routeHosts, ports.BrokerOpenStreamRequest)
	52	+	wantCode ports.BrokerErrorCode
	53	+	}{
	54	+	{name: "committed record resolves"},
	55	+	{name: "unknown host", change: func(h routeHosts, _ ports.BrokerOpenStreamRequest) { h.found = false }, wantCode: ports.BrokerErrorUnavailable},
	56	+	{name: "stale registration", change: func(_ routeHosts, r ports.BrokerOpenStreamRequest) { r.Registration.Generation++ }, wantCode: ports.BrokerErrorUnavailable},
	57	+	{name: "conflicting policy", change: func(_ routeHosts, r ports.BrokerOpenStreamRequest) { r.Policy.Trust = "other" }, wantCode: ports.BrokerErrorConflictingPolicy},
	58	+	{name: "invalid durable route", change: func(h routeHosts, _ ports.BrokerOpenStreamRequest) { h.record.Route = ports.BrokerRouteSpec{} }, wantCode: ports.BrokerErrorIncompatible},
	59	+	}
	60	+	for _, tt := range tests {
	61	+	t.Run(tt.name, func(t *testing.T) {
	62	+	hosts := &routeHosts{record: record, found: true}
	63	+	request := testRouteRequest(record)
	64	+	if tt.change != nil {
	65	+	tt.change(hosts, &request)
	66	+	}
	67	+	routes := &Routes{Hosts: hosts, Address: testRouteAddress}
	68	+	target, err := routes.ResolveDialTarget(context.Background(), request)
	69	+	if tt.wantCode != 0 {
	70	+	var brokerErr ports.BrokerError
	71	+	require.True(t, errors.As(err, &brokerErr), "error %v", err)
	72	+	require.Equal(t, tt.wantCode, brokerErr.Code)
	73	+	return
	74	+	}
	75	+	require.NoError(t, err)
	76	+	address, _ := testRouteAddress(record.Route)
	77	+	require.Equal(t, address, target.Address)
	78	+	require.Equal(t, record.Registration, target.Fence.Registration)
	79	+	require.Equal(t, ports.BrokerExpectedIdentity{Identity: "daemon", Bound: true}, target.ExpectedIdentity)
	80	+	require.Equal(t, request.StartMode, target.StartMode)
	81	+	})
	82	+	}
	83	+	}
	84	+
	85	+	// A resolved remote target is re-authorized against committed membership
	86	+	// immediately before dialing: any change since resolution refuses the dial.
	87	+	func TestRoutesAuthorizeRemoteDialRejectsChangedAuthority(t *testing.T) {
	88	+	record := testRouteRecord(t)
	89	+	tests := []struct {
	90	+	name string
	91	+	change func(*routeHosts)
	92	+	wantErr bool
	93	+	}{
	94	+	{name: "unchanged", change: func(*routeHosts) {}},
	95	+	{name: "removed", change: func(h *routeHosts) { h.found = false }, wantErr: true},
	96	+	{name: "readded", change: func(h *routeHosts) { h.record.Registration.Incarnation[0]++ }, wantErr: true},
	97	+	{name: "policy", change: func(h *routeHosts) { h.record.Policy.Trust = "other" }, wantErr: true},
	98	+	{name: "route", change: func(h *routeHosts) { h.record.Route.Target = "other@example.test" }, wantErr: true},
	99	+	{name: "identity", change: func(h *routeHosts) { h.record.Identity = "other-daemon" }, wantErr: true},
	100	+	}
	101	+	for _, tt := range tests {
	102	+	t.Run(tt.name, func(t *testing.T) {
	103	+	hosts := &routeHosts{record: record, found: true}
	104	+	routes := &Routes{Hosts: hosts, Address: testRouteAddress}
	105	+	target, err := routes.ResolveDialTarget(context.Background(), testRouteRequest(record))
	106	+	require.NoError(t, err)
	107	+	tt.change(hosts)
	108	+	spec, err := routes.AuthorizeRemoteDial(context.Background(), target)
	109	+	if tt.wantErr {
	110	+	require.Error(t, err)
	111	+	return
	112	+	}
	113	+	require.NoError(t, err)
	114	+	require.Equal(t, record.Route, spec)
	115	+	})
	116	+	}
	117	+	}
	118	+
	119	+	func TestRoutesLocalDelegatesAndFailsClosed(t *testing.T) {
	120	+	request := ports.BrokerOpenStreamRequest{Local: true, Policy: observationPolicy(), StartMode: ports.BrokerDaemonExistingOnly}
	121	+	want := ports.BrokerDialTarget{Fence: ports.BrokerEndpointFence{Local: true}, Address: "local"}
	122	+	local := portsmocks.NewMockBrokerRouteAuthority(t)
	123	+	local.EXPECT().ResolveDialTarget(mock.Anything, request).Return(want, nil)
	124	+
	125	+	got, err := (&Routes{Local: local}).ResolveDialTarget(context.Background(), request)
	126	+	require.NoError(t, err)
	127	+	require.Equal(t, want, got)
	128	+
	129	+	_, err = (&Routes{}).ResolveDialTarget(context.Background(), request)
	130	+	require.Error(t, err, "no local binding authorizes no local dial")
	131	+	_, err = (&Routes{}).ResolveDialTarget(context.Background(), testRouteRequest(testRouteRecord(t)))
	132	+	require.Error(t, err, "no committed membership authorizes no remote dial")
	133	+	_, err = (&Routes{Hosts: &routeHosts{}, Address: testRouteAddress}).AuthorizeRemoteDial(context.Background(), want)
	134	+	require.Error(t, err, "a local target never selects a remote route")
	135	+
	136	+	cancelled, cancel := context.WithCancel(context.Background())
	137	+	cancel()
	138	+	_, err = (&Routes{}).ResolveDialTarget(cancelled, request)
	139	+	require.ErrorIs(t, err, context.Canceled)
	140	+	}

M internal/usecase/client/move_picker_overlay.go +2 -2


@@ -118,7 +118,7 @@ func (m *movePickerOverlay) apply(outcome pickerConsumeOutcome, consumed bool) (
118		if !consumed \|\| m.loop == nil \|\| !outcome.acceptOutcome(m.namespace.interaction, movePickerInputGeneration) {	118		if !consumed \|\| m.loop == nil \|\| !outcome.acceptOutcome(m.namespace.interaction, movePickerInputGeneration) {
119		return pickerOp{}, false	119		return pickerOp{}, false
120		}	120		}
121	-	return applyPickerBatch(m.loop, outcome.events)	121	+	return m.loop.apply(outcome.events)
122		}	122		}
123			123
124		// selection builds the typed move for the cursor row, refusing rows the daemon	124		// selection builds the typed move for the cursor row, refusing rows the daemon

@@ -128,7 +128,7 @@ func (m *movePickerOverlay) selection(causeActionID uint64) (protocol.PickerSele
128		if !ok \|\| action != protocol.PickerActionMove {	128		if !ok \|\| action != protocol.PickerActionMove {
129		return protocol.PickerSelection{}, false	129		return protocol.PickerSelection{}, false
130		}	130		}
131	-	return commitSelection(m.loop, action, causeActionID)	131	+	return m.loop.selection(action, causeActionID)
132		}	132		}
133			133
134		// render composes the box for one terminal size.	134		// render composes the box for one terminal size.

M internal/usecase/client/picker_controller.go +89 -92


@@ -109,12 +109,8 @@ type pickerController struct {
109		sort pickerusecase.SortMode	109		sort pickerusecase.SortMode
110		ownsInput bool	110		ownsInput bool
111		opsReady chan struct{}	111		opsReady chan struct{}
112	-	lastOp pickerOp	112	+	// pending is the decision accumulated since the last TakeOp.
113	-	// lastCommitKey is the catalogue key captured with the pending commit	113	+	pending pickerDecision
114	-	// decision, so TakeOp can hand a driver the exact committed row.
115	-	lastCommitKey string
116	-	// lastKillKey is the catalogue key captured with a pending kill decision.
117	-	lastKillKey string
118		// hostHealth is the last remote host state seen, so each host transition	114		// hostHealth is the last remote host state seen, so each host transition
119		// is judged once by domain.RemoteHealthNotice.	115		// is judged once by domain.RemoteHealthNotice.
120		hostHealth map[string]domain.RemoteHealth	116		hostHealth map[string]domain.RemoteHealth

@@ -206,61 +202,74 @@ func (p *pickerController) ConsumeTerminalRead(data []byte) bool {
206		return p.handleRead(data)	202		return p.handleRead(data)
207		}	203		}
208			204
209	-	// recordOpLocked accumulates one read's presentation decision. A commit also	205	+	// pickerDecision accumulates the presentation decisions of one or more reads
210	-	// captures the committed row key under the same lock, so the key and the	206	+	// together with the row keys each decision selected when it was recorded, so
211	-	// decision can never disagree.	207	+	// a key and its decision can never disagree.
212	-	func (p *pickerController) recordOpLocked(op pickerOp) {	208	+	type pickerDecision struct {
			209	+	op pickerOp
			210	+	commitKey string
			211	+	killKey string
			212	+	}
			213	+
			214	+	// record merges op, capturing the cursor row for a commit or a kill.
			215	+	func (d pickerDecision) record(op pickerOp, loop pickerLoop) {
213		if op.commit {	216		if op.commit {
214	-	p.lastCommitKey = p.commitKeyLocked()	217	+	d.commitKey = loop.selectionKey(protocol.PickerActionNavigate)
215		}	218		}
216		if op.kill {	219		if op.kill {
217	-	p.lastKillKey = p.killKeyLocked()	220	+	d.killKey = loop.selectionKey(protocol.PickerActionKill)
218	-	}
219	-	p.lastOp = mergePickerOps(p.lastOp, op)
220	-	if p.lastOp.commit \|\| p.lastOp.close \|\| p.lastOp.kill {
221	-	// Coalesce exactly one wakeup: a driver that has not yet run TakeOp
222	-	// re-reads the accumulated decision, so a dropped signal is harmless.
223	-	select {
224	-	case p.opsReady <- struct{}{}:
225	-	default:
226	-	}
227		}	221		}
			222	+	d.op = mergePickerOps(d.op, op)
228		}	223		}
229			224
230	-	// OpsReady wakes the supervisor when a commit or close was recorded. It is a	225	+	// actionable reports whether the decision asks the driver to act.
231	-	// capacity-one coalescing signal; TakeOp remains the authority on what was	226	+	func (d pickerDecision) actionable() bool { return d.op.commit \|\| d.op.close \|\| d.op.kill }
232	-	// decided, so a driver never infers the decision from the wakeup alone.	227	+
233	-	func (p *pickerController) OpsReady() <-chan struct{} {	228	+	// key is the row the decision acts on. A commit wins over a kill in the same
234	-	if p == nil {	229	+	// read because it leaves the picker anyway.
235	-	return nil	230	+	func (d pickerDecision) key() string {
			231	+	if d.op.commit {
			232	+	return d.commitKey
236		}	233		}
237	-	return p.opsReady	234	+	return d.killKey
238		}	235		}
239			236
240	-	// commitKeyLocked returns the opaque catalogue key of the row under the cursor	237	+	// recordOpLocked accumulates one read's presentation decision and wakes the
241	-	// for a commit, or the empty string when no committable row is selected.	238	+	// driver once when it became actionable. Callers hold p.mu.
242	-	func (p *pickerController) commitKeyLocked() string {	239	+	func (p *pickerController) recordOpLocked(op pickerOp) {
243	-	if p.loop == nil {	240	+	p.pending.record(op, p.loop)
244	-	return ""	241	+	if p.pending.actionable() {
			242	+	p.wakeLocked()
245		}	243		}
246	-	selection, ok := commitSelection(p.loop, protocol.PickerActionNavigate, 0)	244	+	}
247	-	if !ok {	245	+
248	-	return ""	246	+	// wakeLocked coalesces exactly one wakeup: a driver that has not yet run
			247	+	// TakeOp re-reads the accumulated decision, so a dropped signal is harmless.
			248	+	func (p *pickerController) wakeLocked() {
			249	+	select {
			250	+	case p.opsReady <- struct{}{}:
			251	+	default:
249		}	252		}
250	-	return selection.Key
251		}	253		}
252			254
253	-	// killKeyLocked returns the opaque catalogue key of the row under the cursor	255	+	// applyEventsLocked applies one decoded batch to the open loop and records
254	-	// when it authorises destruction, or the empty string.	256	+	// its decision. Callers hold p.mu.
255	-	func (p *pickerController) killKeyLocked() string {	257	+	func (p *pickerController) applyEventsLocked(events []pickerEvent) {
256	-	if p.loop == nil {	258	+	op, changed := p.loop.apply(events)
257	-	return ""	259	+	p.recordOpLocked(op)
			260	+	if changed {
			261	+	p.wakeLocked()
258		}	262		}
259	-	selection, ok := killSelection(p.loop, 0)	263	+	}
260	-	if !ok {	264	+
261	-	return ""	265	+	// OpsReady wakes the supervisor when a commit or close was recorded. It is a
			266	+	// capacity-one coalescing signal; TakeOp remains the authority on what was
			267	+	// decided, so a driver never infers the decision from the wakeup alone.
			268	+	func (p *pickerController) OpsReady() <-chan struct{} {
			269	+	if p == nil {
			270	+	return nil
262		}	271		}
263	-	return selection.Key	272	+	return p.opsReady
264		}	273		}
265			274
266		// TakeOp returns and clears the accumulated presentation decision since the	275		// TakeOp returns and clears the accumulated presentation decision since the

@@ -275,17 +284,9 @@ func (p *pickerController) TakeOp() (pickerOp, string) {
275		}	284		}
276		p.mu.Lock()	285		p.mu.Lock()
277		defer p.mu.Unlock()	286		defer p.mu.Unlock()
278	-	op := p.lastOp	287	+	decision := p.pending
279	-	key := p.lastCommitKey	288	+	p.pending = pickerDecision{}
280	-	if !op.commit {	289	+	return decision.op, decision.key()
281	-	// A kill carries its own captured row; a commit in the same read wins
282	-	// because it leaves the picker anyway.
283	-	key = p.lastKillKey
284	-	}
285	-	p.lastOp = pickerOp{}
286	-	p.lastCommitKey = ""
287	-	p.lastKillKey = ""
288	-	return op, key
289		}	290		}
290			291
291		// FlushPending resolves a withheld escape or UTF-8 prefix once its	292		// FlushPending resolves a withheld escape or UTF-8 prefix once its

@@ -307,14 +308,7 @@ func (p *pickerController) FlushPending() {
307		if outcome.interaction != pickerGeneration \|\| outcome.generation != pickerGeneration {	308		if outcome.interaction != pickerGeneration \|\| outcome.generation != pickerGeneration {
308		return	309		return
309		}	310		}
310	-	op, changed := applyPickerBatch(p.loop, outcome.events)	311	+	p.applyEventsLocked(outcome.events)
311	-	p.recordOpLocked(op)
312	-	if changed {
313	-	select {
314	-	case p.opsReady <- struct{}{}:
315	-	default:
316	-	}
317	-	}
318		}	312		}
319			313
320		// armFlushLocked bounds a withheld escape or UTF-8 prefix with the picker's	314		// armFlushLocked bounds a withheld escape or UTF-8 prefix with the picker's

@@ -555,6 +549,30 @@ func (p *pickerController) noticeDeadline() (time.Time, bool) {
555		return p.notices.NextDeadline()	549		return p.notices.NextDeadline()
556		}	550		}
557			551
			552	+	// pickerState is a consistent read of the controller's interactive state.
			553	+	type pickerState struct {
			554	+	hasModel bool
			555	+	query string
			556	+	searchActive bool
			557	+	notices []string
			558	+	}
			559	+
			560	+	// state reads the interactive state under one lock.
			561	+	func (p *pickerController) state() pickerState {
			562	+	p.mu.Lock()
			563	+	defer p.mu.Unlock()
			564	+	var state pickerState
			565	+	if p.loop != nil && p.loop.model != nil {
			566	+	state.hasModel = true
			567	+	state.query = p.loop.model.Query()
			568	+	state.searchActive = p.loop.model.SearchActive()
			569	+	}
			570	+	for _, toast := range p.notices.Visible(p.clock.Now()) {
			571	+	state.notices = append(state.notices, toast.Value.Message)
			572	+	}
			573	+	return state
			574	+	}
			575	+
558		// CursorKey reports the opaque key of the row under the cursor, or false when	576		// CursorKey reports the opaque key of the row under the cursor, or false when
559		// nothing qualifies. It is the selection displayed now; a commit decision is	577		// nothing qualifies. It is the selection displayed now; a commit decision is
560		// captured with TakeOp instead so a concurrent publication cannot move it.	578		// captured with TakeOp instead so a concurrent publication cannot move it.

@@ -564,11 +582,8 @@ func (p *pickerController) CursorKey() (string, bool) {
564		}	582		}
565		p.mu.Lock()	583		p.mu.Lock()
566		defer p.mu.Unlock()	584		defer p.mu.Unlock()
567	-	key := p.commitKeyLocked()	585	+	key := p.loop.selectionKey(protocol.PickerActionNavigate)
568	-	if key == "" {	586	+	return key, key != ""
569	-	return "", false
570	-	}
571	-	return key, true
572		}	587		}
573			588
574		// Resolve revalidates the row displayed now and returns the exact broker	589		// Resolve revalidates the row displayed now and returns the exact broker

@@ -655,8 +670,8 @@ func (p *pickerController) SetCurrent(current pickerCurrent) {
655		// rememberSortLocked keeps the sort the user chose in the closing	670		// rememberSortLocked keeps the sort the user chose in the closing
656		// presentation for the next one.	671		// presentation for the next one.
657		func (p *pickerController) rememberSortLocked() {	672		func (p *pickerController) rememberSortLocked() {
658	-	if p.loop != nil && p.loop.model != nil {	673	+	if sort, ok := p.loop.sortMode(); ok {
659	-	p.sort = p.loop.model.SortMode()	674	+	p.sort = sort
660		}	675		}
661		}	676		}
662			677

@@ -675,18 +690,7 @@ func pickerRefusalNotice(err error) domain.Notification {
675		func (p *pickerController) displayedKey() (string, bool) {	690		func (p *pickerController) displayedKey() (string, bool) {
676		p.mu.Lock()	691		p.mu.Lock()
677		defer p.mu.Unlock()	692		defer p.mu.Unlock()
678	-	if p.loop == nil \|\| p.loop.model == nil {	693	+	return p.loop.displayedKey()
679	-	return "", false
680	-	}
681	-	line, ok := p.loop.model.Cursor()
682	-	if !ok {
683	-	return "", false
684	-	}
685	-	identity, ok := p.loop.rows[line.Key]
686	-	if !ok {
687	-	return "", false
688	-	}
689	-	return identity.key, true
690		}	694		}
691			695
692		func (p *pickerController) handleRead(data []byte) bool {	696		func (p *pickerController) handleRead(data []byte) bool {

@@ -717,14 +721,7 @@ func (p *pickerController) handleRead(data []byte) bool {
717		}	721		}
718		return true	722		return true
719		}	723		}
720	-	op, changed := applyPickerBatch(p.loop, outcome.events)	724	+	p.applyEventsLocked(outcome.events)
721	-	p.recordOpLocked(op)
722	-	if changed {
723	-	select {
724	-	case p.opsReady <- struct{}{}:
725	-	default:
726	-	}
727	-	}
728		return true	725		return true
729		}	726		}
730			727

M internal/usecase/client/picker_controller_test.go +12 -18

 	return key
 }
+func (p *pickerController) modelState(t *testing.T) pickerState {
+	t.Helper()
+	state := p.state()
+	require.True(t, state.hasModel, "the picker must have a model")
+	return state
+}
 func (p *pickerController) modelQuery(t *testing.T) string {
 	t.Helper()
-	p.mu.Lock()
+	return p.modelState(t).query
-	defer p.mu.Unlock()
-	require.NotNil(t, p.loop)
-	return p.loop.model.Query()
 }
 func (p *pickerController) modelSearchActive(t *testing.T) bool {
 	t.Helper()
-	p.mu.Lock()
+	return p.modelState(t).searchActive
-	defer p.mu.Unlock()
-	require.NotNil(t, p.loop)
-	return p.loop.model.SearchActive()
 }
 func TestPickerControllerRendersLatestSnapshotImmediately(t *testing.T) {
 	require.Equal(t, before, controller.Catalogue().Lines(), "the previous projection is kept")
 	require.Equal(t, ports.BrokerRevision(1), controller.Catalogue().Revision())
-	controller.mu.Lock()
+	active := controller.state().notices
-	active := controller.notices.Visible(clock.Now())
+	require.Equal(t, []string{"broker catalogue update rejected"}, active)
-	controller.mu.Unlock()
-	require.Len(t, active, 1)
-	require.Equal(t, "broker catalogue update rejected", active[0].Value.Message)
-	require.NotContains(t, active[0].Value.Message, "user@")
 }
 // TestPickerControllerUnobservedDaemonIsRefreshingNotVersionMismatch pins the
 	unobserved := pickerTestUnobservedObservation(clock.Now())
 	controller.ApplySnapshot(ports.BrokerSnapshot{Epoch: 3, Revision: 1, Daemons: []ports.BrokerDaemonObservation{unobserved}})
-	controller.mu.Lock()
+	require.Empty(t, controller.state().notices)
-	active := controller.notices.Visible(clock.Now())
-	controller.mu.Unlock()
-	require.Empty(t, active)
 	lines := controller.Catalogue().Lines()
 	host, ok := pickerHostLine(lines)
 	require.True(t, ok)

M internal/usecase/client/picker_interaction.go +40 -33


@@ -454,24 +454,25 @@ func copyFrameRect(dst renderer.Frame, target domain.Rect, src renderer.Frame) {
454		}	454		}
455		}	455		}
456			456
457	-	// commitSelection builds the typed commit for the row under the cursor at the	457	+	// selection builds the typed selection for the row under the cursor at the
458		// displayed source revision. Zero picker bytes travel toward the PTY: the	458		// displayed source revision. Zero picker bytes travel toward the PTY: the
459		// opaque key plus revision ride a PickerSelection on the ordered control	459		// opaque key plus revision ride a PickerSelection on the ordered control
460	-	// channel and the owning source resolves them.	460	+	// channel and the owning source resolves them. A kill additionally requires
461	-	func commitSelection(loop *pickerLoop, action protocol.PickerAction, causeActionID uint64) (protocol.PickerSelection, bool) {	461	+	// the row to authorise destruction, so the source can verify it again.
462	-	if loop == nil \|\| loop.model == nil {	462	+	func (l *pickerLoop) selection(action protocol.PickerAction, causeActionID uint64) (protocol.PickerSelection, bool) {
			463	+	if l == nil \|\| l.model == nil {
463		return protocol.PickerSelection{}, false	464		return protocol.PickerSelection{}, false
464		}	465		}
465	-	line, ok := loop.model.Selected()	466	+	line, ok := l.model.Selected()
466	-	if !ok {	467	+	if !ok \|\| (action == protocol.PickerActionKill && line.Actions&protocol.PickerCanKill == 0) {
467		return protocol.PickerSelection{}, false	468		return protocol.PickerSelection{}, false
468		}	469		}
469	-	identity, ok := loop.rows[line.Key]	470	+	identity, ok := l.rows[line.Key]
470		if !ok {	471		if !ok {
471		return protocol.PickerSelection{}, false	472		return protocol.PickerSelection{}, false
472		}	473		}
473		selection := protocol.PickerSelection{	474		selection := protocol.PickerSelection{
474	-	CauseActionID: causeActionID, InteractionID: loop.interaction,	475	+	CauseActionID: causeActionID, InteractionID: l.interaction,
475		SourceID: identity.sourceID, SourceRevision: identity.sourceRevision,	476		SourceID: identity.sourceID, SourceRevision: identity.sourceRevision,
476		Key: identity.key, Action: action,	477		Key: identity.key, Action: action,
477		}	478		}

@@ -481,30 +482,36 @@ func commitSelection(loop *pickerLoop, action protocol.PickerAction, causeAction
481		return selection, true	482		return selection, true
482		}	483		}
483			484
484	-	// killSelection builds the typed kill for the row under the cursor. It is a	485	+	// selectionKey returns the source key a selection of action would carry, or
485	-	// distinct commit so the source can verify the row still authorises	486	+	// the empty string when the cursor row does not admit it.
486	-	// destruction.	487	+	func (l *pickerLoop) selectionKey(action protocol.PickerAction) string {
487	-	func killSelection(loop *pickerLoop, causeActionID uint64) (protocol.PickerSelection, bool) {	488	+	selection, ok := l.selection(action, 0)
488	-	if loop == nil \|\| loop.model == nil {	489	+	if !ok {
489	-	return protocol.PickerSelection{}, false	490	+	return ""
490		}	491		}
491	-	line, ok := loop.model.Selected()	492	+	return selection.Key
492	-	if !ok \|\| line.Actions&protocol.PickerCanKill == 0 {	493	+	}
493	-	return protocol.PickerSelection{}, false	494	+
			495	+	// displayedKey names the source key of the row under the cursor, whether or
			496	+	// not it admits an action.
			497	+	func (l *pickerLoop) displayedKey() (string, bool) {
			498	+	if l == nil \|\| l.model == nil {
			499	+	return "", false
494		}	500		}
495	-	identity, ok := loop.rows[line.Key]	501	+	line, ok := l.model.Cursor()
496		if !ok {	502		if !ok {
497	-	return protocol.PickerSelection{}, false	503	+	return "", false
498	-	}
499	-	selection := protocol.PickerSelection{
500	-	CauseActionID: causeActionID, InteractionID: loop.interaction,
501	-	SourceID: identity.sourceID, SourceRevision: identity.sourceRevision,
502	-	Key: identity.key, Action: protocol.PickerActionKill,
503		}	504		}
504	-	if protocol.ValidatePickerSelection(selection) != nil {	505	+	identity, ok := l.rows[line.Key]
505	-	return protocol.PickerSelection{}, false	506	+	return identity.key, ok
			507	+	}
			508	+
			509	+	// sortMode reports the loop's current ordering, or ok=false without a model.
			510	+	func (l *pickerLoop) sortMode() (picker.SortMode, bool) {
			511	+	if l == nil \|\| l.model == nil {
			512	+	return 0, false
506		}	513		}
507	-	return selection, true	514	+	return l.model.SortMode(), true
508		}	515		}
509			516
510		// pickerOp is the presentation decision one driver operation asks the attach	517		// pickerOp is the presentation decision one driver operation asks the attach

@@ -520,14 +527,14 @@ type pickerOp struct {
520		exit bool	527		exit bool
521		}	528		}
522			529
523	-	// pickerDriverOp is one ui-driver operation applied to an open loop. Keys	530	+	// drive applies one ui-driver operation to an open loop. Keys
524		// drive cursor/search/exit: arrows and j/k move in normal mode (j/k are	531		// drive cursor/search/exit: arrows and j/k move in normal mode (j/k are
525		// literal in search), `/` enters search, `s` reorders locally, `x` asks to	532		// literal in search), `/` enters search, `s` reorders locally, `x` asks to
526		// destroy the cursor row, `q`/Ctrl-C/Escape close in normal mode (Escape	533		// destroy the cursor row, `q`/Ctrl-C/Escape close in normal mode (Escape
527		// exits search first), Backspace edits the query. Text runes insert only	534		// exits search first), Backspace edits the query. Text runes insert only
528		// while search is active; normal-mode typing is ignored exactly like the	535		// while search is active; normal-mode typing is ignored exactly like the
529		// overlay.	536		// overlay.
530	-	func pickerDriverOp(loop *pickerLoop, keys []string, text string) (op pickerOp, changed bool) {	537	+	func (loop *pickerLoop) drive(keys []string, text string) (op pickerOp, changed bool) {
531		if loop == nil \|\| loop.model == nil {	538		if loop == nil \|\| loop.model == nil {
532		return pickerOp{}, false	539		return pickerOp{}, false
533		}	540		}

@@ -558,7 +565,7 @@ func pickerDriverOp(loop *pickerLoop, keys []string, text string) (op pickerOp,
558		loop.up()	565		loop.up()
559		}	566		}
560		case "Enter":	567		case "Enter":
561	-	// Commit is typed at the call site via commitSelection; the	568	+	// Commit is typed at the call site via selection; the
562		// key itself sends zero bytes toward the PTY.	569		// key itself sends zero bytes toward the PTY.
563		op.commit = true	570		op.commit = true
564		case "Escape":	571		case "Escape":

@@ -641,12 +648,12 @@ func (o pickerConsumeOutcome) acceptOutcome(interaction, generation uint64) bool
641		return o.consumed && o.interaction != 0 && o.interaction == interaction && o.generation == generation	648		return o.consumed && o.interaction != 0 && o.interaction == interaction && o.generation == generation
642		}	649		}
643			650
644	-	// applyPickerBatch applies one decoded batch in arrival order. Every event	651	+	// apply applies one decoded batch in arrival order. Every event
645		// is applied: a terminal read can legitimately carry several keystrokes, so	652		// is applied: a terminal read can legitimately carry several keystrokes, so
646		// batch size never decides whether input is a command. Paste protection is	653		// batch size never decides whether input is a command. Paste protection is
647		// the decoder's paste state, not a heuristic here: a bracketed paste's	654		// the decoder's paste state, not a heuristic here: a bracketed paste's
648		// content never reaches this function.	655		// content never reaches this function.
649	-	func applyPickerBatch(loop *pickerLoop, events []pickerEvent) (op pickerOp, changed bool) {	656	+	func (loop *pickerLoop) apply(events []pickerEvent) (op pickerOp, changed bool) {
650		if loop == nil \|\| loop.model == nil \|\| len(events) == 0 {	657		if loop == nil \|\| loop.model == nil \|\| len(events) == 0 {
651		return pickerOp{}, false	658		return pickerOp{}, false
652		}	659		}

@@ -658,7 +665,7 @@ func applyPickerBatch(loop *pickerLoop, events []pickerEvent) (op pickerOp, chan
658		}	665		}
659		continue	666		continue
660		}	667		}
661	-	eventOp, eventChanged := pickerDriverOp(loop, []string{event.key}, "")	668	+	eventOp, eventChanged := loop.drive([]string{event.key}, "")
662		changed = changed \|\| eventChanged	669		changed = changed \|\| eventChanged
663		if eventOp.close {	670		if eventOp.close {
664		return pickerOp{close: true, exit: eventOp.exit}, changed	671		return pickerOp{close: true, exit: eventOp.exit}, changed

M internal/usecase/client/picker_interaction_test.go +45 -12

 func pickedKey(t *testing.T, loop *pickerLoop) string {
 	t.Helper()
-	selection, ok := commitSelection(loop, protocol.PickerActionNavigate, 0)
+	selection, ok := loop.selection(protocol.PickerActionNavigate, 0)
 	require.True(t, ok)
 	return selection.Key
 }
 	loop.replaceLines(remote)
 	loop.down()
-	selection, ok := commitSelection(loop, protocol.PickerActionNavigate, 9)
+	selection, ok := loop.selection(protocol.PickerActionNavigate, 9)
 	require.True(t, ok)
 	require.Equal(t, "authority/remote-a", selection.SourceID)
 	require.Equal(t, uint64(1), selection.SourceRevision)
 	local.SourceRevision++
 	local.Lines[0].Detail = "refreshed"
 	loop.replaceLines(local)
-	selection, ok := commitSelection(loop, protocol.PickerActionNavigate, 0)
+	selection, ok := loop.selection(protocol.PickerActionNavigate, 0)
 	require.True(t, ok)
 	require.Equal(t, "authority/remote-a", selection.SourceID)
 	require.Equal(t, uint64(1), selection.SourceRevision)
 	// The first row authorises destruction; its typed kill carries the
 	// displayed source revision and the fatal action.
-	selection, ok := killSelection(loop, 0)
+	selection, ok := loop.selection(protocol.PickerActionKill, 0)
 	require.True(t, ok)
 	require.Equal(t, protocol.PickerActionKill, selection.Action)
 	require.Equal(t, "aa/work", selection.Key)
 	// The stopped row is navigable but not destructible from here.
 	loop.down()
 	require.Equal(t, "bb/perso", pickedKey(t, loop))
-	_, ok = killSelection(loop, 0)
+	_, ok = loop.selection(protocol.PickerActionKill, 0)
 	require.False(t, ok, "a row without the kill action must not be destroyed")
 }
+// TestPickerDecisionCapturesRowWithDecision proves the key handed to a driver
+// is the row selected when the decision was recorded, and that a commit wins
+// over a kill in the same accumulated decision.
+func TestPickerDecisionCapturesRowWithDecision(t *testing.T) {
+	tests := []struct {
+		name       string
+		ops        []pickerOp
+		moveAfter  bool
+		wantKey    string
+		wantAction bool
+	}{
+		{name: "no decision", ops: []pickerOp{{}}},
+		{name: "commit captures cursor row", ops: []pickerOp{{commit: true}}, moveAfter: true, wantKey: "aa/work", wantAction: true},
+		{name: "kill captures cursor row", ops: []pickerOp{{kill: true}}, moveAfter: true, wantKey: "aa/work", wantAction: true},
+		{name: "close carries no row", ops: []pickerOp{{close: true}}, wantAction: true},
+		{name: "commit wins over kill", ops: []pickerOp{{kill: true}, {commit: true}}, wantKey: "aa/work", wantAction: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			loop := pickerLoopFixture(t)
+			var decision pickerDecision
+			for _, op := range tt.ops {
+				decision.record(op, loop)
+			}
+			if tt.moveAfter {
+				loop.down()
+			}
+			require.Equal(t, tt.wantAction, decision.actionable())
+			require.Equal(t, tt.wantKey, decision.key())
+		})
+	}
+}
 func TestPickerLoopKeepsPublishedLineOrderAndKeys(t *testing.T) {
 	snapshot := pickerSnapshotFixture()
 	loop := pickerLoopFromSnapshot(snapshot, protocol.PickerIntentNavigation, picker.SortRecent)
 	loop := pickerLoopFixture(t)
 	// Normal mode: arrows and j/k move; Enter asks to commit; x asks to kill.
-	op, changed := pickerDriverOp(loop, []string{"Down"}, "")
+	op, changed := loop.drive([]string{"Down"}, "")
 	require.False(t, op.commit)
 	require.False(t, op.close)
 	require.True(t, changed)
 	require.Equal(t, "bb/perso", pickedKey(t, loop))
-	op, _ = pickerDriverOp(loop, []string{"k"}, "")
+	op, _ = loop.drive([]string{"k"}, "")
 	require.False(t, op.commit)
 	require.Equal(t, "aa/work", pickedKey(t, loop))
-	op, _ = pickerDriverOp(loop, []string{"Enter"}, "")
+	op, _ = loop.drive([]string{"Enter"}, "")
 	require.True(t, op.commit)
-	op, _ = pickerDriverOp(loop, []string{"x"}, "")
+	op, _ = loop.drive([]string{"x"}, "")
 	require.True(t, op.kill)
 	require.False(t, op.close)
 	// q and Ctrl+C close in normal mode.
 	for _, key := range []string{"q", "Ctrl+C"} {
-		op, _ = pickerDriverOp(loop, []string{key}, "")
+		op, _ = loop.drive([]string{key}, "")
 		require.True(t, op.close, "%s must close the picker", key)
 	}
 	// s reorders locally without asking the daemon, and keeps the selection.
-	op, changed = pickerDriverOp(loop, []string{"s"}, "")
+	op, changed = loop.drive([]string{"s"}, "")
 	require.False(t, op.commit)
 	require.False(t, op.kill)
 	require.False(t, op.close)
 	// While searching, Enter still commits and printable keys are text.
 	loop.insert('w')
-	_, changed = pickerDriverOp(loop, []string{"o", "r"}, "")
+	_, changed = loop.drive([]string{"o", "r"}, "")
 	require.True(t, changed)
 	require.Equal(t, "wor", loop.model.Query())
 }

M internal/usecase/client/picker_parity_test.go +1 -6

 	up.FailureEpisode = 1
 	controller.ApplySnapshot(ports.BrokerSnapshot{Epoch: 3, Revision: 2, Daemons: []ports.BrokerDaemonObservation{up, other}})
-	controller.mu.Lock()
+	messages := controller.state().notices
-	defer controller.mu.Unlock()
-	messages := make([]string, 0)
-	for _, toast := range controller.notices.Visible(clock.Now()) {
-		messages = append(messages, toast.Value.Message)
-	}
 	require.Len(t, messages, 2, "each host keeps one toast")
 	require.Contains(t, messages, "Remote host reconnected: user@arch")
 	for _, message := range messages {

M internal/usecase/daemon/attachment_parking_test.go +11 -11


@@ -34,7 +34,7 @@ func TestAttachmentLossParksOnlyThatAttachment(t *testing.T) {
34		d.clientGone(sess, first, firstTransport, false)	34		d.clientGone(sess, first, firstTransport, false)
35			35
36		d.mu.Lock()	36		d.mu.Lock()
37	-	parked := d.parked[first.resumeToken]	37	+	parked := d.resume.parked[first.resumeToken]
38		d.mu.Unlock()	38		d.mu.Unlock()
39		require.NotNil(t, parked)	39		require.NotNil(t, parked)
40		sess.mu.Lock()	40		sess.mu.Lock()

@@ -62,7 +62,7 @@ func TestTwoAttachmentsParkIndependently(t *testing.T) {
62		d.clientGone(sess, first, firstTransport, false)	62		d.clientGone(sess, first, firstTransport, false)
63		d.clientGone(sess, second, secondTransport, false)	63		d.clientGone(sess, second, secondTransport, false)
64		d.mu.Lock()	64		d.mu.Lock()
65	-	firstParked, secondParked := d.parked[firstToken], d.parked[secondToken]	65	+	firstParked, secondParked := d.resume.parked[firstToken], d.resume.parked[secondToken]
66		d.mu.Unlock()	66		d.mu.Unlock()
67		require.NotNil(t, firstParked)	67		require.NotNil(t, firstParked)
68		require.NotNil(t, secondParked)	68		require.NotNil(t, secondParked)

@@ -86,12 +86,12 @@ func TestParkExpiryRemovesOnlyOneAttachment(t *testing.T) {
86		d.clientGone(sess, second, secondTransport, false)	86		d.clientGone(sess, second, secondTransport, false)
87		firstToken, secondToken := first.resumeToken, second.resumeToken	87		firstToken, secondToken := first.resumeToken, second.resumeToken
88		d.mu.Lock()	88		d.mu.Lock()
89	-	firstParked := d.parked[firstToken]	89	+	firstParked := d.resume.parked[firstToken]
90		d.mu.Unlock()	90		d.mu.Unlock()
91		d.expireParked(firstToken, firstParked)	91		d.expireParked(firstToken, firstParked)
92		d.mu.Lock()	92		d.mu.Lock()
93	-	_, firstRetained := d.parked[firstToken]	93	+	_, firstRetained := d.resume.parked[firstToken]
94	-	_, secondRetained := d.parked[secondToken]	94	+	_, secondRetained := d.resume.parked[secondToken]
95		d.mu.Unlock()	95		d.mu.Unlock()
96		require.False(t, firstRetained)	96		require.False(t, firstRetained)
97		require.True(t, secondRetained)	97		require.True(t, secondRetained)

@@ -118,7 +118,7 @@ func TestResumeRotatesCredentialAndRejectsStaleTransport(t *testing.T) {
118		require.Greater(t, ac.lifecycle.generationValue(), oldGeneration)	118		require.Greater(t, ac.lifecycle.generationValue(), oldGeneration)
119		require.True(t, d.commitResumeClaim(ac))	119		require.True(t, d.commitResumeClaim(ac))
120		d.mu.Lock()	120		d.mu.Lock()
121	-	_, oldRetained := d.parked[oldToken]	121	+	_, oldRetained := d.resume.parked[oldToken]
122		d.mu.Unlock()	122		d.mu.Unlock()
123		require.False(t, oldRetained)	123		require.False(t, oldRetained)
124			124

@@ -126,7 +126,7 @@ func TestResumeRotatesCredentialAndRejectsStaleTransport(t *testing.T) {
126		d.clientGone(sess, ac, oldTransport, false)	126		d.clientGone(sess, ac, oldTransport, false)
127		require.Equal(t, before, ac.resumeToken)	127		require.Equal(t, before, ac.resumeToken)
128		d.mu.Lock()	128		d.mu.Lock()
129	-	_, staleParked := d.parked[oldToken]	129	+	_, staleParked := d.resume.parked[oldToken]
130		d.mu.Unlock()	130		d.mu.Unlock()
131		require.False(t, staleParked)	131		require.False(t, staleParked)
132		}	132		}

@@ -147,8 +147,8 @@ func TestSuccessfulResumeRejectsOldCredentialAfterWelcome(t *testing.T) {
147		newToken := ac.resumeToken	147		newToken := ac.resumeToken
148		require.NotEqual(t, oldToken, newToken)	148		require.NotEqual(t, oldToken, newToken)
149		d.mu.Lock()	149		d.mu.Lock()
150	-	_, oldRetained := d.parked[oldToken]	150	+	_, oldRetained := d.resume.parked[oldToken]
151	-	newParked := d.parked[newToken]	151	+	newParked := d.resume.parked[newToken]
152		d.mu.Unlock()	152		d.mu.Unlock()
153		require.False(t, oldRetained)	153		require.False(t, oldRetained)
154		require.NotNil(t, newParked)	154		require.NotNil(t, newParked)

@@ -170,7 +170,7 @@ func TestFailedResumeHandshakeKeepsParkedCredential(t *testing.T) {
170		d.handleHello(failed, helloResumeCapable(protocol.IntentResume, "work", token))	170		d.handleHello(failed, helloResumeCapable(protocol.IntentResume, "work", token))
171		require.Nil(t, ac.transport())	171		require.Nil(t, ac.transport())
172		d.mu.Lock()	172		d.mu.Lock()
173	-	parked := d.parked[token]	173	+	parked := d.resume.parked[token]
174		claimed := parked != nil && parked.claimed	174		claimed := parked != nil && parked.claimed
175		d.mu.Unlock()	175		d.mu.Unlock()
176		require.NotNil(t, parked)	176		require.NotNil(t, parked)

@@ -237,7 +237,7 @@ func TestKillSessionClosesEveryAttachmentAndParkedCredential(t *testing.T) {
237		require.True(t, secondTransport.Closed())	237		require.True(t, secondTransport.Closed())
238		require.True(t, parkedTransport.Closed())	238		require.True(t, parkedTransport.Closed())
239		d.mu.Lock()	239		d.mu.Lock()
240	-	_, retained := d.parked[parkedToken]	240	+	_, retained := d.resume.parked[parkedToken]
241		d.mu.Unlock()	241		d.mu.Unlock()
242		require.False(t, retained)	242		require.False(t, retained)
243		}	243		}

A internal/usecase/daemon/attachment_render_state.go +54 -0

@@ -0,0 +1,54 @@
	1	+	package daemon
	2	+
	3	+	// attachmentRenderState is one attachment's composition state: what the last
	4	+	// emitted frame looked like and the per-pane captures it was built from. The
	5	+	// paint transaction owns it through attachedClient.sendMu; every other path
	6	+	// changes it only through the transitions below, so the rules for when a
	7	+	// composition or a pane snapshot may be reused live in one place.
	8	+	type attachmentRenderState struct {
	9	+	// cache is the last successfully emitted composition. spare is its
	10	+	// alternate buffer; the two must never share mutable backing storage.
	11	+	cache composeCacheInput
	12	+	spare composeCacheInput
	13	+	// capture is reusable scratch for one capture pass.
	14	+	capture renderCaptureScratch
	15	+	// panes is keyed by pane ownership, not the tab-local PaneID, so snapshots
	16	+	// cannot leak when an attachment switches tabs or sessions.
	17	+	panes map[*pane]capturedPaneRenderState
	18	+	}
	19	+
	20	+	// commitComposition records a successfully emitted composition and recycles
	21	+	// the previous one as the next spare buffer.
	22	+	func (r *attachmentRenderState) commitComposition(composed composeCacheInput) {
	23	+	r.spare = r.cache
	24	+	r.cache = composed
	25	+	}
	26	+
	27	+	// forgetComposition forces the next frame to be composed from scratch.
	28	+	func (r *attachmentRenderState) forgetComposition() {
	29	+	r.cache = composeCacheInput{}
	30	+	r.spare = composeCacheInput{}
	31	+	}
	32	+
	33	+	// forgetAllPanes drops every pane capture snapshot.
	34	+	func (r *attachmentRenderState) forgetAllPanes() { r.panes = nil }
	35	+
	36	+	// forgetPanes drops the capture snapshots of panes that left this attachment.
	37	+	func (r attachmentRenderState) forgetPanes(panes ...pane) {
	38	+	for _, p := range panes {
	39	+	delete(r.panes, p)
	40	+	}
	41	+	}
	42	+
	43	+	// paneSnapshot returns the previous capture of p, if any.
	44	+	func (r attachmentRenderState) paneSnapshot(p pane) capturedPaneRenderState {
	45	+	return r.panes[p]
	46	+	}
	47	+
	48	+	// storePaneSnapshot retains the latest capture of p for the next pass.
	49	+	func (r attachmentRenderState) storePaneSnapshot(p pane, captured capturedPaneRenderState) {
	50	+	if r.panes == nil {
	51	+	r.panes = make(map[*pane]capturedPaneRenderState)
	52	+	}
	53	+	r.panes[p] = captured
	54	+	}

A internal/usecase/daemon/attachment_render_state_test.go +39 -0

@@ -0,0 +1,39 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/stretchr/testify/require"
	7	+	)
	8	+
	9	+	func TestAttachmentRenderStateTransitions(t *testing.T) {
	10	+	kept, dropped := &pane{}, &pane{}
	11	+	emitted := composeCacheInput{valid: true}
	12	+	tests := []struct {
	13	+	name string
	14	+	apply func(*attachmentRenderState)
	15	+	wantCache bool
	16	+	wantSpare bool
	17	+	wantPanes []*pane
	18	+	}{
	19	+	{name: "commit keeps previous as spare", apply: func(r attachmentRenderState) { r.commitComposition(emitted) }, wantCache: true, wantSpare: true, wantPanes: []pane{kept, dropped}},
	20	+	{name: "forget composition keeps panes", apply: (attachmentRenderState).forgetComposition, wantPanes: []pane{kept, dropped}},
	21	+	{name: "forget one pane", apply: func(r attachmentRenderState) { r.forgetPanes(dropped) }, wantCache: true, wantPanes: []pane{kept}},
	22	+	{name: "forget all panes keeps composition", apply: (*attachmentRenderState).forgetAllPanes, wantCache: true},
	23	+	}
	24	+	for _, tt := range tests {
	25	+	t.Run(tt.name, func(t *testing.T) {
	26	+	var state attachmentRenderState
	27	+	state.commitComposition(emitted)
	28	+	state.storePaneSnapshot(kept, capturedPaneRenderState{})
	29	+	state.storePaneSnapshot(dropped, capturedPaneRenderState{})
	30	+	tt.apply(&state)
	31	+	require.Equal(t, tt.wantCache, state.cache.valid)
	32	+	require.Equal(t, tt.wantSpare, state.spare.valid)
	33	+	require.Len(t, state.panes, len(tt.wantPanes))
	34	+	for _, p := range tt.wantPanes {
	35	+	require.Contains(t, state.panes, p)
	36	+	}
	37	+	})
	38	+	}
	39	+	}

M internal/usecase/daemon/attachment_suspension.go +1 -10


@@ -124,16 +124,7 @@ func (d Daemon) activateAttachment(ac attachedClient, expected transportSnapsh
124		d.mu.Unlock()	124		d.mu.Unlock()
125		sess.geometry.reconcileAndInvalidate(d, sess, nil, "attachment_suspension.go")	125		sess.geometry.reconcileAndInvalidate(d, sess, nil, "attachment_suspension.go")
126		ac.sendMu.Lock()	126		ac.sendMu.Lock()
127	-	view := ac.viewSnapshot()	127	+	ac.publishWindowLocked(request.Size.Rows, true)
128	-	view.windowRows = request.Size.Rows
129	-	view.windowSet = true
130	-	view.windowTop = 0
131	-	view.revision++
132	-	ac.publishView(view)
133	-	ac.rebaseOutput()
134	-	ac.pipelineCache = composeCacheInput{}
135	-	ac.pipelineScratch = composeCacheInput{}
136	-	ac.captureFrames = nil
137		ac.sendMu.Unlock()	128		ac.sendMu.Unlock()
138		paintDone := make(chan struct{})	129		paintDone := make(chan struct{})
139		paintTimer := d.clock.NewTimer(detachNotifyTimeout)	130		paintTimer := d.clock.NewTimer(detachNotifyTimeout)

M internal/usecase/daemon/attachment_suspension_expiry_test.go +1 -1


@@ -130,7 +130,7 @@ func TestSuspendedAttachmentSafetyExpiryEvictsAfterTimer(t *testing.T) {
130		require.True(t, tr.Closed(), "expiry closes the retained transport")	130		require.True(t, tr.Closed(), "expiry closes the retained transport")
131		d.mu.Lock()	131		d.mu.Lock()
132		_, retained := d.suspended[ac]	132		_, retained := d.suspended[ac]
133	-	parked := d.parked[123]	133	+	parked := d.resume.parked[123]
134		d.mu.Unlock()	134		d.mu.Unlock()
135		require.False(t, retained)	135		require.False(t, retained)
136		require.Nil(t, parked, "expiry must not park a resume credential")	136		require.Nil(t, parked, "expiry must not park a resume credential")

M internal/usecase/daemon/attachment_suspension_test.go +3 -3


@@ -132,7 +132,7 @@ func TestAttachmentSuspensionCloseDoesNotPark(t *testing.T) {
132		require.NoError(t, d.suspendAttachment(token, protocol.SuspendAttachment{RequestID: 1}))	132		require.NoError(t, d.suspendAttachment(token, protocol.SuspendAttachment{RequestID: 1}))
133		d.clientGone(sess, ac, token.transport.transport, false)	133		d.clientGone(sess, ac, token.transport.transport, false)
134		require.Nil(t, ac.currentAttachmentSession())	134		require.Nil(t, ac.currentAttachmentSession())
135	-	require.Empty(t, d.parked)	135	+	require.Empty(t, d.resume.parked)
136		require.False(t, ac.parked)	136		require.False(t, ac.parked)
137		}	137		}
138			138

@@ -187,7 +187,7 @@ func TestAttachmentSuspensionReaderKeepsControlAlive(t *testing.T) {
187		require.IsType(t, protocol.Pong{}, messages[1])	187		require.IsType(t, protocol.Pong{}, messages[1])
188		require.Zero(t, ac.echoAck.Load())	188		require.Zero(t, ac.echoAck.Load())
189		require.Nil(t, ac.currentAttachmentSession())	189		require.Nil(t, ac.currentAttachmentSession())
190	-	require.Empty(t, d.parked)	190	+	require.Empty(t, d.resume.parked)
191		}	191		}
192			192
193		func TestAttachmentActivationCloseDuringFullPublication(t *testing.T) {	193		func TestAttachmentActivationCloseDuringFullPublication(t *testing.T) {

@@ -215,5 +215,5 @@ func TestAttachmentActivationCloseDuringFullPublication(t *testing.T) {
215		d.attachmentCleanupWg.Wait()	215		d.attachmentCleanupWg.Wait()
216		require.False(t, activated)	216		require.False(t, activated)
217		require.Nil(t, ac.currentAttachmentSession())	217		require.Nil(t, ac.currentAttachmentSession())
218	-	require.Empty(t, d.parked)	218	+	require.Empty(t, d.resume.parked)
219		}	219		}

M internal/usecase/daemon/client.go +35 -27

 	// reporting the same failed prepare through its notice repaint. It is only
 	// needed while no render coordinator is installed.
 	prepareFailureFallback atomic.Bool
-	// pipelineCache is the last successfully emitted composition. pipelineScratch
+	// render is the attachment's composition state. Only touched under sendMu.
-	// is its attachment-owned alternate buffer; both are only touched under
+	render attachmentRenderState
-	// sendMu and must never share mutable backing storage.
-	pipelineCache   composeCacheInput
-	pipelineScratch composeCacheInput
-	renderScratch   renderCaptureScratch // only touched while sendMu is held
-	// captureFrames is keyed by pane ownership, not the tab-local PaneID, so
-	// snapshots cannot leak when an attachment switches tabs or sessions.
-	captureFrames map[*pane]capturedPaneRenderState // only touched while sendMu is held
 	// sizeMu lets shared-geometry snapshots read attachment windows without
 	// waiting behind a blocked transport send.
 	sizeMu   sync.RWMutex
 		return
 	}
 	ac.sendMu.Lock()
-	for _, p := range panes {
+	ac.render.forgetPanes(panes...)
-		delete(ac.captureFrames, p)
-	}
 	ac.sendMu.Unlock()
 }
 		return
 	}
 	ac.sendMu.Lock()
-	ac.captureFrames = nil
+	ac.render.forgetAllPanes()
 	ac.sendMu.Unlock()
 }
 	return protocol.RouteAttentionTarget{}, false
 }
-func (ac *attachedClient) ackOutputState(epoch, state uint64) {
+// ackOutputState applies one cumulative output ACK under the send boundary and
+// reports whether it advanced the paint window.
+func (ac *attachedClient) ackOutputState(epoch, state uint64) bool {
 	ac.sendMu.Lock()
 	defer ac.sendMu.Unlock()
-	if ac.output != nil {
+	return ac.output != nil && ac.output.ack(epoch, state)
-		ac.output.ack(epoch, state)
-	}
 }
 // rebaseOutput resets only this attachment's output representations. Callers
 	ac.output.rebaseAttachment()
 }
+// restartOutputLocked starts a new output epoch and drops the composition it
+// would otherwise diff against, so the next paint is a complete frame.
+// dropPanes also drops per-pane capture snapshots, which is required when the
+// panes may belong to another session or a different window size. Caller
+// holds sendMu.
+func (ac *attachedClient) restartOutputLocked(dropPanes bool) {
+	ac.rebaseOutput()
+	ac.render.forgetComposition()
+	if dropPanes {
+		ac.render.forgetAllPanes()
+	}
+}
+// publishWindowLocked publishes a new window height to the attachment view and
+// restarts output for it. Caller holds sendMu.
+func (ac *attachedClient) publishWindowLocked(rows int, dropPanes bool) {
+	view := ac.viewSnapshot()
+	view.windowRows = rows
+	view.windowSet = true
+	view.windowTop = 0
+	view.revision++
+	ac.publishView(view)
+	ac.restartOutputLocked(dropPanes)
+}
 var errTransportReplaced = errors.New("client transport was replaced")
 // sendExpectedTransport writes only when expected is still the attachment's
 		effect.ac.rebaseOutput()
 		// Captures belong to the old session even when pane-local IDs happen
 		// to be reused by the destination.
-		effect.ac.captureFrames = nil
+		effect.ac.render.forgetAllPanes()
 		effect.ac.sendMu.Unlock()
 	}
 	if effect.sess == nil {
 		ac.setGeometry(geometry)
 	}
 	if !sameSize {
-		view := ac.viewSnapshot()
+		ac.publishWindowLocked(geometry.Rows, false)
-		view.windowRows = geometry.Rows
-		view.windowSet = true
-		view.windowTop = 0
-		view.revision++
-		ac.publishView(view)
-		ac.rebaseOutput()
-		ac.pipelineCache = composeCacheInput{}
-		ac.pipelineScratch = composeCacheInput{}
 	}
 	ac.sendMu.Unlock()

M internal/usecase/daemon/client_frame_routing.go +2 -11

 		ac.sendMu.Unlock()
 		return false
 	}
-	ac.rebaseOutput()
+	ac.restartOutputLocked(false)
-	ac.pipelineCache = composeCacheInput{}
-	ac.pipelineScratch = composeCacheInput{}
 	ac.sendMu.Unlock()
 	go d.paint(effect.sess, ac, true, effect.lease)
 	return true
 	if !effect.current() || effect.ac == nil {
 		return false
 	}
-	ac := effect.ac
+	acknowledged := effect.ac.ackOutputState(epoch, state)
-	ac.sendMu.Lock()
-	if ac.output == nil {
-		ac.sendMu.Unlock()
-		return false
-	}
-	acknowledged := ac.output.ack(epoch, state)
-	ac.sendMu.Unlock()
 	if acknowledged {
 		if rc := effect.sess.renderCoordinator(); rc != nil {
 			rc.notifyAckForLease(effect.lease)

M internal/usecase/daemon/copy_scroll_delta_test.go +1 -1


@@ -17,7 +17,7 @@ func TestCopyWheelPreservesOutputEpoch(t *testing.T) {
17		require.Equal(t, epoch, f.ac.output.currentEpoch(), "ordinary scrolling must not reset the output dependency chain")	17		require.Equal(t, epoch, f.ac.output.currentEpoch(), "ordinary scrolling must not reset the output dependency chain")
18		f.ac.ackOutputState(f.ac.output.currentEpoch(), f.ac.output.next)	18		f.ac.ackOutputState(f.ac.output.currentEpoch(), f.ac.output.next)
19		}	19		}
20	-	viewport := f.ac.pipelineCache.copyViewport	20	+	viewport := f.ac.render.cache.copyViewport
21		require.NotNil(t, viewport.document)	21		require.NotNil(t, viewport.document)
22		require.Equal(t, viewport.document.Height(), viewport.target.Height)	22		require.Equal(t, viewport.document.Height(), viewport.target.Height)
23		require.Equal(t, viewport.document.Width(), viewport.target.Width)	23		require.Equal(t, viewport.document.Width(), viewport.target.Width)

M internal/usecase/daemon/copy_scroll_ownership_test.go +18 -18


@@ -22,13 +22,13 @@ func TestCopyCacheFailedPublicationAndRetry(t *testing.T) {
22		}	22		}
23		committed := composeFrame(state, composeCacheInput{})	23		committed := composeFrame(state, composeCacheInput{})
24		require.True(t, committed.cache.valid)	24		require.True(t, committed.cache.valid)
25	-	ac.pipelineCache = committed.cache	25	+	ac.render.cache = committed.cache
26	-	before := cloneComposeCache(ac.pipelineCache)	26	+	before := cloneComposeCache(ac.render.cache)
27		state.bars.topRight = "retry"	27		state.bars.topRight = "retry"
28		state.attachment = ac	28		state.attachment = ac
29		state.route.Target = protocol.ExactSessionTarget{LifecycleID: sess.incarnation, SessionName: sess.name}	29		state.route.Target = protocol.ExactSessionTarget{LifecycleID: sess.incarnation, SessionName: sess.name}
30		state.view.revision = ac.viewSnapshot().revision	30		state.view.revision = ac.viewSnapshot().revision
31	-	pending := composeFrame(state, ac.pipelineCache, ac.pipelineScratch)	31	+	pending := composeFrame(state, ac.render.cache, ac.render.spare)
32		if failure == "prepare" {	32		if failure == "prepare" {
33		pending.frame = renderer.Frame{Width: 1}	33		pending.frame = renderer.Frame{Width: 1}
34		} else {	34		} else {

@@ -36,7 +36,7 @@ func TestCopyCacheFailedPublicationAndRetry(t *testing.T) {
36		}	36		}
37		ac.sendMu.Lock()	37		ac.sendMu.Lock()
38		require.True(t, d.publishCapturedFrameForTest(sess, ac, &state, pending))	38		require.True(t, d.publishCapturedFrameForTest(sess, ac, &state, pending))
39	-	require.Equal(t, before, cloneComposeCache(ac.pipelineCache))	39	+	require.Equal(t, before, cloneComposeCache(ac.render.cache))
40		require.Zero(t, ac.output.next)	40		require.Zero(t, ac.output.next)
41		if failure == "send" {	41		if failure == "send" {
42		sess.mu.Lock()	42		sess.mu.Lock()

@@ -45,12 +45,12 @@ func TestCopyCacheFailedPublicationAndRetry(t *testing.T) {
45		ac.setSession(sess)	45		ac.setSession(sess)
46		ac.replaceTransport(healthy)	46		ac.replaceTransport(healthy)
47		}	47		}
48	-	pending = composeFrame(state, ac.pipelineCache, ac.pipelineScratch)	48	+	pending = composeFrame(state, ac.render.cache, ac.render.spare)
49		state.view.revision = ac.viewSnapshot().revision	49		state.view.revision = ac.viewSnapshot().revision
50		ac.sendMu.Lock()	50		ac.sendMu.Lock()
51		require.True(t, d.publishCapturedFrameForTest(sess, ac, &state, pending))	51		require.True(t, d.publishCapturedFrameForTest(sess, ac, &state, pending))
52	-	require.Equal(t, pending.cache, ac.pipelineCache)	52	+	require.Equal(t, pending.cache, ac.render.cache)
53	-	require.NotContains(t, frameText(ac.pipelineCache.frame), "COPY")	53	+	require.NotContains(t, frameText(ac.render.cache.frame), "COPY")
54		output := unmarshalTestOutput(t, (<-sends).Payload)	54		output := unmarshalTestOutput(t, (<-sends).Payload)
55		terminal := renderer.NewScreen(pending.frame.Width, pending.frame.Height)	55		terminal := renderer.NewScreen(pending.frame.Width, pending.frame.Height)
56		terminal.Write(output.Data)	56		terminal.Write(output.Data)

@@ -69,19 +69,19 @@ func TestCopyCacheSearchTransition(t *testing.T) {
69		}	69		}
70		d.enterCopyMode(sess, ac)	70		d.enterCopyMode(sess, ac)
71		ack()	71		ack()
72	-	require.True(t, ac.pipelineCache.valid)	72	+	require.True(t, ac.render.cache.valid)
73	-	base := captureTestFrame(ac.pipelineCache.frame)	73	+	base := captureTestFrame(ac.render.cache.frame)
74		d.handleInput(sess, ac, []byte("/"))	74		d.handleInput(sess, ac, []byte("/"))
75		ack()	75		ack()
76		require.NotNil(t, ac.overlays.copySearch)	76		require.NotNil(t, ac.overlays.copySearch)
77	-	require.False(t, ac.pipelineCache.valid)	77	+	require.False(t, ac.render.cache.valid)
78	-	require.Equal(t, base, captureTestFrame(ac.pipelineCache.frame), "search modal must not contaminate the live base")	78	+	require.Equal(t, base, captureTestFrame(ac.render.cache.frame), "search modal must not contaminate the live base")
79		d.handleInput(sess, ac, []byte("\x1b"))	79		d.handleInput(sess, ac, []byte("\x1b"))
80		ack()	80		ack()
81		require.Nil(t, ac.overlays.copySearch)	81		require.Nil(t, ac.overlays.copySearch)
82		require.NotNil(t, ac.overlays.copyMode)	82		require.NotNil(t, ac.overlays.copyMode)
83	-	require.True(t, ac.pipelineCache.valid)	83	+	require.True(t, ac.render.cache.valid)
84	-	require.Equal(t, base, captureTestFrame(ac.pipelineCache.frame))	84	+	require.Equal(t, base, captureTestFrame(ac.render.cache.frame))
85		}	85		}
86			86
87		func TestCopyExitRefreshesAfterOtherAttachmentConsumesDamage(t *testing.T) {	87		func TestCopyExitRefreshesAfterOtherAttachmentConsumesDamage(t *testing.T) {

@@ -91,7 +91,7 @@ func TestCopyExitRefreshesAfterOtherAttachmentConsumesDamage(t *testing.T) {
91		d.enterCopyMode(sess, ac)	91		d.enterCopyMode(sess, ac)
92		mustOutputData(t, sends)	92		mustOutputData(t, sends)
93		ac.ackOutputState(ac.output.currentEpoch(), ac.output.next)	93		ac.ackOutputState(ac.output.currentEpoch(), ac.output.next)
94	-	copyBefore := captureTestFrame(ac.pipelineCache.frame)	94	+	copyBefore := captureTestFrame(ac.render.cache.frame)
95			95
96		tr, peerSends := newCapturingTransport(t)	96		tr, peerSends := newCapturingTransport(t)
97		peer := &attachedClient{tr: tr, output: newOutputStateStream(), size: ac.size}	97		peer := &attachedClient{tr: tr, output: newOutputStateStream(), size: ac.size}

@@ -110,14 +110,14 @@ func TestCopyExitRefreshesAfterOtherAttachmentConsumesDamage(t *testing.T) {
110		p.mu.Lock()	110		p.mu.Lock()
111		require.Empty(t, p.screen.Damage())	111		require.Empty(t, p.screen.Damage())
112		p.mu.Unlock()	112		p.mu.Unlock()
113	-	require.Contains(t, frameText(peer.pipelineCache.frame), "after-peer")	113	+	require.Contains(t, frameText(peer.render.cache.frame), "after-peer")
114	-	require.Equal(t, copyBefore, captureTestFrame(ac.pipelineCache.frame), "peer publication cannot mutate another attachment's cache")	114	+	require.Equal(t, copyBefore, captureTestFrame(ac.render.cache.frame), "peer publication cannot mutate another attachment's cache")
115			115
116		// The copy document is still frozen, but leaving it must recapture live	116		// The copy document is still frozen, but leaving it must recapture live
117		// cells even though the other attachment already acknowledged the damage.	117		// cells even though the other attachment already acknowledged the damage.
118		d.copyWheel(sess, ac, 1)	118		d.copyWheel(sess, ac, 1)
119		mustOutputData(t, sends)	119		mustOutputData(t, sends)
120		require.Nil(t, ac.overlays.copyMode)	120		require.Nil(t, ac.overlays.copyMode)
121	-	require.Contains(t, frameText(ac.pipelineCache.frame), "after-peer")	121	+	require.Contains(t, frameText(ac.render.cache.frame), "after-peer")
122	-	require.NoError(t, ac.pipelineCache.frame.CheckInvariants())	122	+	require.NoError(t, ac.render.cache.frame.CheckInvariants())
123		}	123		}

M internal/usecase/daemon/copy_scroll_render_test.go +8 -8


@@ -61,14 +61,14 @@ func TestCopyScrollKeepsBaseUnadornedAndExitRefreshesLiveState(t *testing.T) {
61		ack := func() { f.ac.ackOutputState(f.ac.output.currentEpoch(), f.ac.output.next) }	61		ack := func() { f.ac.ackOutputState(f.ac.output.currentEpoch(), f.ac.output.next) }
62		f.d.enterCopyMode(f.sess, f.ac)	62		f.d.enterCopyMode(f.sess, f.ac)
63		ack()	63		ack()
64	-	require.True(t, f.ac.pipelineCache.valid)	64	+	require.True(t, f.ac.render.cache.valid)
65	-	committed := f.ac.pipelineCache.frame	65	+	committed := f.ac.render.cache.frame
66		before := captureTestFrame(committed)	66		before := captureTestFrame(committed)
67		f.d.copyWheel(f.sess, f.ac, -30)	67		f.d.copyWheel(f.sess, f.ac, -30)
68		ack()	68		ack()
69	-	require.True(t, f.ac.pipelineCache.valid)	69	+	require.True(t, f.ac.render.cache.valid)
70		require.Equal(t, before, captureTestFrame(committed), "scroll must not mutate the committed buffer")	70		require.Equal(t, before, captureTestFrame(committed), "scroll must not mutate the committed buffer")
71	-	require.NotContains(t, frameText(f.ac.pipelineCache.frame), "[SCROLL]")	71	+	require.NotContains(t, frameText(f.ac.render.cache.frame), "[SCROLL]")
72			72
73		// Live damage still updates the base behind the immutable history viewport.	73		// Live damage still updates the base behind the immutable history viewport.
74		f.activePane.mu.Lock()	74		f.activePane.mu.Lock()

@@ -76,12 +76,12 @@ func TestCopyScrollKeepsBaseUnadornedAndExitRefreshesLiveState(t *testing.T) {
76		f.activePane.mu.Unlock()	76		f.activePane.mu.Unlock()
77		f.d.copyWheel(f.sess, f.ac, -3)	77		f.d.copyWheel(f.sess, f.ac, -3)
78		ack()	78		ack()
79	-	require.Contains(t, frameText(f.ac.pipelineCache.frame), "LIVE-UPDATED")	79	+	require.Contains(t, frameText(f.ac.render.cache.frame), "LIVE-UPDATED")
80	-	require.NotContains(t, frameText(f.ac.pipelineCache.frame), "[SCROLL]")	80	+	require.NotContains(t, frameText(f.ac.render.cache.frame), "[SCROLL]")
81			81
82		f.d.copyWheel(f.sess, f.ac, 1000)	82		f.d.copyWheel(f.sess, f.ac, 1000)
83		ack()	83		ack()
84		require.Nil(t, f.ac.overlays.copyMode)	84		require.Nil(t, f.ac.overlays.copyMode)
85	-	require.Contains(t, frameText(f.ac.pipelineCache.frame), "LIVE-UPDATED")	85	+	require.Contains(t, frameText(f.ac.render.cache.frame), "LIVE-UPDATED")
86	-	require.NoError(t, f.ac.pipelineCache.frame.CheckInvariants())	86	+	require.NoError(t, f.ac.render.cache.frame.CheckInvariants())
87		}	87		}

M internal/usecase/daemon/copy_scroll_replay_test.go +3 -3


@@ -15,7 +15,7 @@ func TestCopyWheelReplayMatchesFullComposition(t *testing.T) {
15		t.Run(fmt.Sprint(panes), func(t *testing.T) {	15		t.Run(fmt.Sprint(panes), func(t *testing.T) {
16		f := newPerformanceFixture(t, performanceConfig{size: domain.Size{Cols: 120, Rows: 40}, panes: panes, historyRows: 200})	16		f := newPerformanceFixture(t, performanceConfig{size: domain.Size{Cols: 120, Rows: 40}, panes: panes, historyRows: 200})
17		f.d.enterCopyMode(f.sess, f.ac)	17		f.d.enterCopyMode(f.sess, f.ac)
18	-	base := f.ac.pipelineCache.frame	18	+	base := f.ac.render.cache.frame
19		terminal := vt.NewScreen(base.Width, base.Height)	19		terminal := vt.NewScreen(base.Width, base.Height)
20		replay := func() []byte {	20		replay := func() []byte {
21		output := unmarshalTestOutput(t, f.output.lastPayload())	21		output := unmarshalTestOutput(t, f.output.lastPayload())

@@ -25,7 +25,7 @@ func TestCopyWheelReplayMatchesFullComposition(t *testing.T) {
25		}	25		}
26		replay()	26		replay()
27		for i, delta := range []int{-30, -3, 3, -1, 1, -60, 3, 1} {	27		for i, delta := range []int{-30, -3, 3, -1, 1, -60, 3, 1} {
28	-	previous := f.ac.pipelineCache.copyViewport.frame	28	+	previous := f.ac.render.cache.copyViewport.frame
29		var before vt.Frame	29		var before vt.Frame
30		if previous.Width > 0 {	30		if previous.Width > 0 {
31		before = captureTestFrame(previous)	31		before = captureTestFrame(previous)

@@ -40,7 +40,7 @@ func TestCopyWheelReplayMatchesFullComposition(t *testing.T) {
40		if before.Width > 0 {	40		if before.Width > 0 {
41		require.Equal(t, before, captureTestFrame(previous))	41		require.Equal(t, before, captureTestFrame(previous))
42		}	42		}
43	-	cache := f.ac.pipelineCache	43	+	cache := f.ac.render.cache
44		mode := f.ac.overlays.copyMode	44		mode := f.ac.overlays.copyMode
45		require.NotNil(t, mode)	45		require.NotNil(t, mode)
46		target := cache.copyViewport.target	46		target := cache.copyViewport.target

M internal/usecase/daemon/daemon.go +4 -9

 	// Serve may be waiting, and WaitGroup forbids Add-from-zero concurrent
 	// with Wait.
 	notifies []chan struct{}
-	parked   map[uint64]*parkedAttachment
+	// resume owns parked and in-flight parking resume credentials. Guarded by mu.
+	resume resumeCredentials
 	// suspended retains one daemon-owned safety expiry per suspended
 	// attachment. Expiry is exact: the record carries the suspension's
 	// lifecycle generation and transport incarnation, so a later activation,
 	// are hashed. Kitty IDs are terminal-global, so a restarted or neighboring
 	// daemon must not deterministically reopen the previous daemon's block.
 	graphicsNamespaceSalt uint64
-	// parking tracks resume-capable attachments from before detach clears the
-	// live seat until parkAttachment publishes the token into parked.
-	// IntentResume waits on the matching entry instead of treating the live
-	// credential as unknown across that gap.
-	parking map[uint64]*parkingAttachment
 	attnMu    sync.Mutex
 	animFrame int
 		sessions:                     make(map[domain.SessionID]*session),
 		inactive:                     make(map[string]inactiveSession),
 		creating:                     make(map[string]struct{}),
-		parked:                       make(map[uint64]*parkedAttachment),
+		resume:                       newResumeCredentials(),
 		suspended:                    make(map[*attachedClient]*suspendedAttachmentRetention),
 		graphicsNamespaces:           make(map[uint64]struct{}),
 		graphicsNamespaceFences:      make(map[uint64]uint64),
 		graphicsNamespaceQuarantines: make(map[uint64]*graphicsNamespaceQuarantine),
 		graphicsNamespaceSalt:        newGraphicsNamespaceSalt(),
-		parking:                      make(map[uint64]*parkingAttachment),
 		paneProcessCtx:               paneProcessCtx,
 		paneProcessCancel:            paneProcessCancel,
 		ptys:                         ptys,
 	// for the requested session; hand that into the park/resume lifecycle.
 	if h.ResumeToken != 0 {
 		d.mu.Lock()
-		parkedAtStart := d.parked[h.ResumeToken]
+		parkedAtStart := d.resume.parkedFor(h.ResumeToken)
 		d.mu.Unlock()
 		if parkedAtStart == nil {
 			if sess, ac, ok, err := d.resumeLiveAttachment(h, tr, sz); err != nil {

M internal/usecase/daemon/daemon_test.go +2 -2


@@ -621,7 +621,7 @@ func TestRouteRejectsInvalidTerminalSizeBeforeResumeMutation(t *testing.T) {
621		d.clientGone(sess, ac, transport, false)	621		d.clientGone(sess, ac, transport, false)
622			622
623		d.mu.Lock()	623		d.mu.Lock()
624	-	parked := d.parked[token]	624	+	parked := d.resume.parked[token]
625		d.mu.Unlock()	625		d.mu.Unlock()
626		require.NotNil(t, parked)	626		require.NotNil(t, parked)
627			627

@@ -633,7 +633,7 @@ func TestRouteRejectsInvalidTerminalSizeBeforeResumeMutation(t *testing.T) {
633		require.Equal(t, protocol.ErrInternal, protocolErr.code)	633		require.Equal(t, protocol.ErrInternal, protocolErr.code)
634			634
635		d.mu.Lock()	635		d.mu.Lock()
636	-	require.Same(t, parked, d.parked[token], "invalid resume must not consume the parked attachment")	636	+	require.Same(t, parked, d.resume.parked[token], "invalid resume must not consume the parked attachment")
637		d.mu.Unlock()	637		d.mu.Unlock()
638		require.Same(t, transport, ac.transport(), "invalid resume must not bind a replacement transport")	638		require.Same(t, transport, ac.transport(), "invalid resume must not bind a replacement transport")
639		})	639		})

M internal/usecase/daemon/ephemeral_close.go +1 -11


@@ -35,15 +35,5 @@ func (d Daemon) reapAbandonedEphemeral(sess session) {
35		// in-flight parking attachment that a reconnecting client may resume. Caller	35		// in-flight parking attachment that a reconnecting client may resume. Caller
36		// holds d.mu.	36		// holds d.mu.
37		func (d Daemon) sessionHasPendingResumeLocked(sess session) bool {	37		func (d Daemon) sessionHasPendingResumeLocked(sess session) bool {
38	-	for _, parked := range d.parked {	38	+	return d.resume.retainsSession(sess)
39	-	if parked.sess == sess {
40	-	return true
41	-	}
42	-	}
43	-	for _, parking := range d.parking {
44	-	if parking.sess == sess {
45	-	return true
46	-	}
47	-	}
48	-	return false
49		}	39		}

M internal/usecase/daemon/ephemeral_close_test.go +1 -1


@@ -87,7 +87,7 @@ func TestEphemeralCloseOnExitWaitsForParkExpiry(t *testing.T) {
87		require.True(t, d.sessionRegistered(sess), "parked attachment keeps the ephemeral session")	87		require.True(t, d.sessionRegistered(sess), "parked attachment keeps the ephemeral session")
88			88
89		d.mu.Lock()	89		d.mu.Lock()
90	-	parked := d.parked[token]	90	+	parked := d.resume.parked[token]
91		d.mu.Unlock()	91		d.mu.Unlock()
92		require.NotNil(t, parked)	92		require.NotNil(t, parked)
93		// Expire directly instead of firing the timer, so no watcher	93		// Expire directly instead of firing the timer, so no watcher

M internal/usecase/daemon/floating_test.go +4 -4


@@ -404,9 +404,9 @@ func TestFloatingExitUsesCurrentOwnerAfterTabTransfer(t *testing.T) {
404		floating.mu.Unlock()	404		floating.mu.Unlock()
405		tb.mu.Unlock()	405		tb.mu.Unlock()
406			406
407	-	sourceClient := &attachedClient{captureFrames: map[*pane]capturedPaneRenderState{floating: {}}}	407	+	sourceClient := &attachedClient{render: attachmentRenderState{panes: map[*pane]capturedPaneRenderState{floating: {}}}}
408		sourceClient.initOverlays()	408		sourceClient.initOverlays()
409	-	destinationClient := &attachedClient{captureFrames: map[*pane]capturedPaneRenderState{floating: {}}}	409	+	destinationClient := &attachedClient{render: attachmentRenderState{panes: map[*pane]capturedPaneRenderState{floating: {}}}}
410		destinationClient.initOverlays()	410		destinationClient.initOverlays()
411		source.registerAttachment(sourceClient)	411		source.registerAttachment(sourceClient)
412		destination.registerAttachment(destinationClient)	412		destination.registerAttachment(destinationClient)

@@ -419,10 +419,10 @@ func TestFloatingExitUsesCurrentOwnerAfterTabTransfer(t *testing.T) {
419		require.Nil(t, tb.floating.pane)	419		require.Nil(t, tb.floating.pane)
420		tb.mu.Unlock()	420		tb.mu.Unlock()
421		sourceClient.sendMu.Lock()	421		sourceClient.sendMu.Lock()
422	-	_, sourceRetained := sourceClient.captureFrames[floating]	422	+	_, sourceRetained := sourceClient.render.panes[floating]
423		sourceClient.sendMu.Unlock()	423		sourceClient.sendMu.Unlock()
424		destinationClient.sendMu.Lock()	424		destinationClient.sendMu.Lock()
425	-	_, destinationRetained := destinationClient.captureFrames[floating]	425	+	_, destinationRetained := destinationClient.render.panes[floating]
426		destinationClient.sendMu.Unlock()	426		destinationClient.sendMu.Unlock()
427		require.True(t, sourceRetained, "exit must not clean up the retired source owner")	427		require.True(t, sourceRetained, "exit must not clean up the retired source owner")
428		require.False(t, destinationRetained, "exit must clean up the current destination owner")	428		require.False(t, destinationRetained, "exit must clean up the current destination owner")

M internal/usecase/daemon/graphics_output_test.go +2 -2


@@ -399,7 +399,7 @@ func TestGraphicsNamespaceQuarantinesOnParkExpiryAndFailedCleanup(t *testing.T)
399		}	399		}
400		d.mu.Lock()	400		d.mu.Lock()
401		d.graphicsNamespaces[block] = struct{}{}	401		d.graphicsNamespaces[block] = struct{}{}
402	-	d.parked[1] = parked	402	+	d.resume.parked[1] = parked
403		d.mu.Unlock()	403		d.mu.Unlock()
404		d.expireParked(1, parked)	404		d.expireParked(1, parked)
405		require.Nil(t, parked.ac.output.graphicsOutput)	405		require.Nil(t, parked.ac.output.graphicsOutput)

@@ -486,7 +486,7 @@ func TestGraphicsNamespaceStaysQuarantinedAfterFinalDeleteAndParkExpiry(t *testi
486		done: make(chan struct{}),	486		done: make(chan struct{}),
487		}	487		}
488		d.mu.Lock()	488		d.mu.Lock()
489	-	d.parked[1] = parked	489	+	d.resume.parked[1] = parked
490		d.mu.Unlock()	490		d.mu.Unlock()
491		d.expireParked(1, parked)	491		d.expireParked(1, parked)
492			492

M internal/usecase/daemon/handshake_deadline_test.go +3 -3


@@ -125,7 +125,7 @@ func TestAcceptedHandshakeDeadlineSpansFirstFrameThroughWelcome(t *testing.T) {
125		requireClosedHandshakeTransport(t, conn.handshakeBlockingTransport)	125		requireClosedHandshakeTransport(t, conn.handshakeBlockingTransport)
126		d.mu.Lock()	126		d.mu.Lock()
127		require.Empty(t, d.sessions, "a budget-expired newly-created handshake must not leave an empty session")	127		require.Empty(t, d.sessions, "a budget-expired newly-created handshake must not leave an empty session")
128	-	require.Empty(t, d.parked)	128	+	require.Empty(t, d.resume.parked)
129		d.mu.Unlock()	129		d.mu.Unlock()
130		}	130		}
131			131

@@ -155,7 +155,7 @@ func TestExpiredAcceptedHandshakeDeadlineClosesConn(t *testing.T) {
155		}	155		}
156		d.mu.Lock()	156		d.mu.Lock()
157		require.Empty(t, d.sessions)	157		require.Empty(t, d.sessions)
158	-	require.Empty(t, d.parked)	158	+	require.Empty(t, d.resume.parked)
159		d.mu.Unlock()	159		d.mu.Unlock()
160		}	160		}
161			161

@@ -190,6 +190,6 @@ func TestHandleHelloAdoptsExpiredAcceptedDeadline(t *testing.T) {
190		}	190		}
191		d.mu.Lock()	191		d.mu.Lock()
192		require.Empty(t, d.sessions)	192		require.Empty(t, d.sessions)
193	-	require.Empty(t, d.parked)	193	+	require.Empty(t, d.resume.parked)
194		d.mu.Unlock()	194		d.mu.Unlock()
195		}	195		}

M internal/usecase/daemon/handshake_test.go +5 -5


@@ -187,7 +187,7 @@ func TestHandshakeTimeoutClosesBlockedReceive(t *testing.T) {
187		requireClosedHandshakeTransport(t, tr)	187		requireClosedHandshakeTransport(t, tr)
188		d.mu.Lock()	188		d.mu.Lock()
189		require.Empty(t, d.sessions)	189		require.Empty(t, d.sessions)
190	-	require.Empty(t, d.parked)	190	+	require.Empty(t, d.resume.parked)
191		d.mu.Unlock()	191		d.mu.Unlock()
192		}	192		}
193			193

@@ -218,7 +218,7 @@ func TestFailedResumeHandshakeRestoresParkedCredential(t *testing.T) {
218		awaitTestCompletion(t, done, "failed resume handshake did not finish")	218		awaitTestCompletion(t, done, "failed resume handshake did not finish")
219		requireClosedHandshakeTransport(t, resumeTransport)	219		requireClosedHandshakeTransport(t, resumeTransport)
220		d.mu.Lock()	220		d.mu.Lock()
221	-	parked := d.parked[token]	221	+	parked := d.resume.parked[token]
222		d.mu.Unlock()	222		d.mu.Unlock()
223		require.NotNil(t, parked, "failed pre-claim resume must restore the parked credential")	223		require.NotNil(t, parked, "failed pre-claim resume must restore the parked credential")
224		require.Same(t, ac, parked.ac)	224		require.Same(t, ac, parked.ac)

@@ -247,7 +247,7 @@ func TestHandshakeTimeoutClosesBlockedWelcomeSend(t *testing.T) {
247		requireClosedHandshakeTransport(t, tr)	247		requireClosedHandshakeTransport(t, tr)
248		d.mu.Lock()	248		d.mu.Lock()
249		require.Empty(t, d.sessions, "a timed-out newly-created handshake must not leave an empty session")	249		require.Empty(t, d.sessions, "a timed-out newly-created handshake must not leave an empty session")
250	-	require.Empty(t, d.parked)	250	+	require.Empty(t, d.resume.parked)
251		d.mu.Unlock()	251		d.mu.Unlock()
252		}	252		}
253			253

@@ -282,7 +282,7 @@ func TestHandshakeTimeoutCancelsRouteRestoreWait(t *testing.T) {
282		requireClosedHandshakeTransport(t, tr)	282		requireClosedHandshakeTransport(t, tr)
283		d.mu.Lock()	283		d.mu.Lock()
284		require.Empty(t, d.sessions)	284		require.Empty(t, d.sessions)
285	-	require.Empty(t, d.parked)	285	+	require.Empty(t, d.resume.parked)
286		d.mu.Unlock()	286		d.mu.Unlock()
287		}	287		}
288			288

@@ -344,7 +344,7 @@ func TestHandshakeTimeoutPreservesUnrelatedAttachment(t *testing.T) {
344		require.Equal(t, []*attachedClient{old}, sess.snapshotAttachments())	344		require.Equal(t, []*attachedClient{old}, sess.snapshotAttachments())
345		d.mu.Lock()	345		d.mu.Lock()
346		require.Len(t, d.sessions, 1)	346		require.Len(t, d.sessions, 1)
347	-	require.Empty(t, d.parked)	347	+	require.Empty(t, d.resume.parked)
348		d.mu.Unlock()	348		d.mu.Unlock()
349		_ = d.killSession(sess, protocol.ReasonServerShutdown, false)	349		_ = d.killSession(sess, protocol.ReasonServerShutdown, false)
350		}	350		}

M internal/usecase/daemon/input_test.go +6 -6


@@ -222,14 +222,14 @@ func TestClosePanePrunesAttachedCaptureFrameAndKeepsSurvivor(t *testing.T) {
222		tb.mu.Unlock()	222		tb.mu.Unlock()
223			223
224		cachedSurvivor := capturedPaneRenderState{title: "survivor"}	224		cachedSurvivor := capturedPaneRenderState{title: "survivor"}
225	-	ac.captureFrames = map[*pane]capturedPaneRenderState{	225	+	ac.render.panes = map[*pane]capturedPaneRenderState{
226		survivor: cachedSurvivor,	226		survivor: cachedSurvivor,
227		closed: {title: "closed"},	227		closed: {title: "closed"},
228		}	228		}
229			229
230		require.NoError(t, d.closePane(sess, tb, closed.id, ac, false))	230		require.NoError(t, d.closePane(sess, tb, closed.id, ac, false))
231	-	require.NotContains(t, ac.captureFrames, closed, "closed pane must not remain strongly retained by its attachment")	231	+	require.NotContains(t, ac.render.panes, closed, "closed pane must not remain strongly retained by its attachment")
232	-	require.Equal(t, cachedSurvivor, ac.captureFrames[survivor], "surviving pane keeps its incremental capture")	232	+	require.Equal(t, cachedSurvivor, ac.render.panes[survivor], "surviving pane keeps its incremental capture")
233		}	233		}
234			234
235		func TestCloseTabPrunesAttachedCaptureFrames(t *testing.T) {	235		func TestCloseTabPrunesAttachedCaptureFrames(t *testing.T) {

@@ -238,14 +238,14 @@ func TestCloseTabPrunesAttachedCaptureFrames(t *testing.T) {
238		closed := closedTab.panes["pane-1"]	238		closed := closedTab.panes["pane-1"]
239		survivor := survivorTab.panes["pane-1"]	239		survivor := survivorTab.panes["pane-1"]
240		cachedSurvivor := capturedPaneRenderState{title: "survivor"}	240		cachedSurvivor := capturedPaneRenderState{title: "survivor"}
241	-	ac.captureFrames = map[*pane]capturedPaneRenderState{	241	+	ac.render.panes = map[*pane]capturedPaneRenderState{
242		closed: {title: "closed"},	242		closed: {title: "closed"},
243		survivor: cachedSurvivor,	243		survivor: cachedSurvivor,
244		}	244		}
245			245
246		require.NoError(t, d.closeTab(sess, closedTab, false))	246		require.NoError(t, d.closeTab(sess, closedTab, false))
247	-	require.NotContains(t, ac.captureFrames, closed, "closed tab panes must not remain strongly retained by its attachment")	247	+	require.NotContains(t, ac.render.panes, closed, "closed tab panes must not remain strongly retained by its attachment")
248	-	require.Equal(t, cachedSurvivor, ac.captureFrames[survivor], "surviving tab pane keeps its incremental capture")	248	+	require.Equal(t, cachedSurvivor, ac.render.panes[survivor], "surviving tab pane keeps its incremental capture")
249		}	249		}
250			250
251		func TestAltCForwardsToPTY(t *testing.T) {	251		func TestAltCForwardsToPTY(t *testing.T) {

M internal/usecase/daemon/move_cleanup_test.go +4 -4


@@ -57,7 +57,7 @@ func TestMovePaneCleanupUsesCapturedSourceAttachment(t *testing.T) {
57		displaced.overlays.copyMode = &scopy.Mode{}	57		displaced.overlays.copyMode = &scopy.Mode{}
58		displaced.overlays.copyMu.Unlock()	58		displaced.overlays.copyMu.Unlock()
59		displaced.sendMu.Lock()	59		displaced.sendMu.Lock()
60	-	displaced.captureFrames = map[*pane]capturedPaneRenderState{moved: {}}	60	+	displaced.render.panes = map[*pane]capturedPaneRenderState{moved: {}}
61		displaced.sendMu.Unlock()	61		displaced.sendMu.Unlock()
62			62
63		replacementTransport, _ := newCapturingTransport(t)	63		replacementTransport, _ := newCapturingTransport(t)

@@ -71,7 +71,7 @@ func TestMovePaneCleanupUsesCapturedSourceAttachment(t *testing.T) {
71		replacement.overlays.copyMode = &scopy.Mode{}	71		replacement.overlays.copyMode = &scopy.Mode{}
72		replacement.overlays.copyMu.Unlock()	72		replacement.overlays.copyMu.Unlock()
73		replacement.sendMu.Lock()	73		replacement.sendMu.Lock()
74	-	replacement.captureFrames = map[*pane]capturedPaneRenderState{moved: {}}	74	+	replacement.render.panes = map[*pane]capturedPaneRenderState{moved: {}}
75		replacement.sendMu.Unlock()	75		replacement.sendMu.Unlock()
76			76
77		// Keep the source layout fence occupied while the move has captured its	77		// Keep the source layout fence occupied while the move has captured its

@@ -110,7 +110,7 @@ func TestMovePaneCleanupUsesCapturedSourceAttachment(t *testing.T) {
110		require.Nil(t, displaced.overlays.copyPane)	110		require.Nil(t, displaced.overlays.copyPane)
111		displaced.overlays.copyMu.Unlock()	111		displaced.overlays.copyMu.Unlock()
112		displaced.sendMu.Lock()	112		displaced.sendMu.Lock()
113	-	_, displacedCaptured := displaced.captureFrames[moved]	113	+	_, displacedCaptured := displaced.render.panes[moved]
114		displaced.sendMu.Unlock()	114		displaced.sendMu.Unlock()
115		require.False(t, displacedCaptured, "moved attachment capture was not pruned")	115		require.False(t, displacedCaptured, "moved attachment capture was not pruned")
116			116

@@ -119,7 +119,7 @@ func TestMovePaneCleanupUsesCapturedSourceAttachment(t *testing.T) {
119		require.Same(t, moved, replacement.overlays.copyPane)	119		require.Same(t, moved, replacement.overlays.copyPane)
120		replacement.overlays.copyMu.Unlock()	120		replacement.overlays.copyMu.Unlock()
121		replacement.sendMu.Lock()	121		replacement.sendMu.Lock()
122	-	_, replacementCaptured := replacement.captureFrames[moved]	122	+	_, replacementCaptured := replacement.render.panes[moved]
123		replacement.sendMu.Unlock()	123		replacement.sendMu.Unlock()
124		require.True(t, replacementCaptured, "independent attachment capture was pruned")	124		require.True(t, replacementCaptured, "independent attachment capture was pruned")
125		}	125		}

M internal/usecase/daemon/move_test.go +1 -1


@@ -160,7 +160,7 @@ func TestMovePaneRetiresSourceParkedClients(t *testing.T) {
160		DestinationTabID: domain.TabStableID(destination.tabs[0].stableID),	160		DestinationTabID: domain.TabStableID(destination.tabs[0].stableID),
161		}))	161		}))
162		d.mu.Lock()	162		d.mu.Lock()
163	-	require.Empty(t, d.parked, "retired source parked clients must leave the daemon registry")	163	+	require.Empty(t, d.resume.parked, "retired source parked clients must leave the daemon registry")
164		d.mu.Unlock()	164		d.mu.Unlock()
165		require.True(t, transport.Closed(), "retired source parked transport was not closed")	165		require.True(t, transport.Closed(), "retired source parked transport was not closed")
166		}	166		}

M internal/usecase/daemon/notify_test.go +1 -1


@@ -904,7 +904,7 @@ func TestToastExpiresOnFakeClock(t *testing.T) {
904		expiredOutput := unmarshalTestOutput(t, expired.Payload)	904		expiredOutput := unmarshalTestOutput(t, expired.Payload)
905		terminal.Write(expiredOutput.Data)	905		terminal.Write(expiredOutput.Data)
906		ac.sendMu.Lock()	906		ac.sendMu.Lock()
907	-	base := ac.pipelineCache.frame.Clone()	907	+	base := ac.render.cache.frame.Clone()
908		ac.sendMu.Unlock()	908		ac.sendMu.Unlock()
909		require.Equal(t, frameRows(base), frameRows(terminal), "fake-clock expiry must restore every old toast cell")	909		require.Equal(t, frameRows(base), frameRows(terminal), "fake-clock expiry must restore every old toast cell")
910		}	910		}

M internal/usecase/daemon/render.go +3 -3


@@ -443,11 +443,11 @@ func (d Daemon) paintLocked(entry session, ac attachedClient, tb tab, reset
443		// boundary and outside tab/pane ownership locks.	443		// boundary and outside tab/pane ownership locks.
444		if local {	444		if local {
445		tb.mu.Lock()	445		tb.mu.Lock()
446	-	titleIDs := ac.renderScratch.titleIDs[:0]	446	+	titleIDs := ac.render.capture.titleIDs[:0]
447		if tb.tree != nil {	447		if tb.tree != nil {
448		titleIDs = appendStackPaneIDs(titleIDs, tb.tree.Root)	448		titleIDs = appendStackPaneIDs(titleIDs, tb.tree.Root)
449		}	449		}
450	-	ac.renderScratch.titleIDs = titleIDs	450	+	ac.render.capture.titleIDs = titleIDs
451		floating := tb.floating.pane	451		floating := tb.floating.pane
452		hasFloating := tb.floating.state == floatingVisible && floating != nil	452		hasFloating := tb.floating.state == floatingVisible && floating != nil
453		tb.mu.Unlock()	453		tb.mu.Unlock()

@@ -485,7 +485,7 @@ func (d Daemon) paintLocked(entry session, ac attachedClient, tb tab, reset
485		state.frameCapture = frameCapture	485		state.frameCapture = frameCapture
486		captureOverlayLayers(state, overlays, paletteCfg)	486		captureOverlayLayers(state, overlays, paletteCfg)
487		endCompose := marks.span(ports.RuntimeComposeStart, ports.RuntimeComposeEnd, 0)	487		endCompose := marks.span(ports.RuntimeComposeStart, ports.RuntimeComposeEnd, 0)
488	-	composed := composeFrame(*state, ac.pipelineCache, ac.pipelineScratch)	488	+	composed := composeFrame(*state, ac.render.cache, ac.render.spare)
489		endCompose(0, true)	489		endCompose(0, true)
490		if ac.renderStages.compose != nil {	490		if ac.renderStages.compose != nil {
491		ac.renderStages.compose()	491		ac.renderStages.compose()

M internal/usecase/daemon/render_capture.go +6 -9

 	// this capture runs, so retaining this attachment's prior pane snapshots
 	// would compose an old frame with a fresh reset epoch.
 	if reset {
-		ac.captureFrames = nil
+		ac.render.forgetAllPanes()
 	}
-	scratch := &ac.renderScratch
+	scratch := &ac.render.capture
 	scratch.statusTabs = append(scratch.statusTabs[:0], bars.status.tabs...)
 	bars.status.tabs = scratch.statusTabs
 	scratch.mru = append(scratch.mru[:0], bars.mru...)
 	}
 	state.panes = scratch.panes[:0]
 	state.tabGeneration = uint64(len(layoutSnap.fingerprint))
-	if ac.captureFrames == nil {
-		ac.captureFrames = make(map[*pane]capturedPaneRenderState)
-	}
 	for _, placement := range layoutSnap.placements {
 		p := tb.panes[placement.ID]
 		if p == nil {
 			visible = domain.Rect{}
 		}
 		p.mu.Lock()
-		captured := capturePaneRenderStateLockedInto(p, visible, ac.captureFrames[p])
+		captured := capturePaneRenderStateLockedInto(p, visible, ac.render.paneSnapshot(p))
 		if !ac.terminalCapabilities.SupportsKittyGraphics() {
 			if captured.graphics != nil && captured.graphics.Usage().Placements != 0 {
 				state.suppressedGraphics = true
 			translated = append(translated, translatePaneDamage(damage, placement.Content, layoutSnap.area)...)
 		}
 		captured.rawDamage, captured.damage = captured.damage, translated
-		ac.captureFrames[p] = captured
+		ac.render.storePaneSnapshot(p, captured)
 		state.panes = append(state.panes, captured)
 	}
 	scratch.panes = state.panes
 		p := tb.floating.pane
 		p.mu.Lock()
 		geometry := p.committedFloatingGeometryLocked(calculateContentFloatingGeometry(domain.Size{Cols: layoutSnap.area.Width, Rows: layoutSnap.area.Height}, floatingCfg))
-		captured := capturePaneRenderStateLockedInto(p, geometry.Inner, ac.captureFrames[p])
+		captured := capturePaneRenderStateLockedInto(p, geometry.Inner, ac.render.paneSnapshot(p))
 		if !ac.terminalCapabilities.SupportsKittyGraphics() {
 			if captured.graphics != nil && captured.graphics.Usage().Placements != 0 {
 				state.suppressedGraphics = true
 		if !seen {
 			state.receipts = append(state.receipts, damageReceipt{pane: p, generation: captured.damageGeneration})
 		}
-		ac.captureFrames[p] = captured
+		ac.render.storePaneSnapshot(p, captured)
 		// A visible floating pane is the terminal input target, so its structural
 		// border carries the focused semantic role independently of its content.
 		state.floating = capturedFloatingRenderState{visible: true, focused: true, pane: captured, geometry: geometry, title: captured.title, generation: tb.floating.generation, titleGeneration: captured.titleGeneration}

M internal/usecase/daemon/render_damage_receipt_test.go +3 -3


@@ -45,7 +45,7 @@ func TestPrimaryCaptureAloneRecordsDamageReceipts(t *testing.T) {
45		p.screen.Write([]byte("preview-safe"))	45		p.screen.Write([]byte("preview-safe"))
46		p.mu.Unlock()	46		p.mu.Unlock()
47			47
48	-	require.Empty(t, ac.renderScratch.receipts, "no receipt exists before any capture runs")	48	+	require.Empty(t, ac.render.capture.receipts, "no receipt exists before any capture runs")
49			49
50		ac.sendMu.Lock()	50		ac.sendMu.Lock()
51		state, ok := captureRenderState(sess, ac, renderCaptureRequest{	51		state, ok := captureRenderState(sess, ac, renderCaptureRequest{

@@ -89,7 +89,7 @@ func TestCaptureComposeEmitAcknowledgesCollapsedPaneDamageOnlyAfterEmission(t *t
89		}	89		}
90		require.True(t, collapsedReceipt, "capture must retain a receipt for the collapsed pane")	90		require.True(t, collapsedReceipt, "capture must retain a receipt for the collapsed pane")
91		require.NotEmpty(t, collapsed.screen.Damage(), "capture alone must not acknowledge collapsed-pane damage")	91		require.NotEmpty(t, collapsed.screen.Damage(), "capture alone must not acknowledge collapsed-pane damage")
92	-	composed := composeFrame(*state, ac.pipelineCache, ac.pipelineScratch)	92	+	composed := composeFrame(*state, ac.render.cache, ac.render.spare)
93		require.True(t, d.publishCapturedFrameForTest(sess, ac, state, composed))	93		require.True(t, d.publishCapturedFrameForTest(sess, ac, state, composed))
94			94
95		<-sends	95		<-sends

@@ -250,5 +250,5 @@ func captureComposeForReceiptTest(t testing.T, sess session, ac *attachedClien
250		lease: nil,	250		lease: nil,
251		})	251		})
252		require.True(t, ok)	252		require.True(t, ok)
253	-	return state, composeFrame(*state, ac.pipelineCache, ac.pipelineScratch)	253	+	return state, composeFrame(*state, ac.render.cache, ac.render.spare)
254		}	254		}

M internal/usecase/daemon/render_pipeline.go +1 -2


@@ -571,8 +571,7 @@ func (d Daemon) publishFrameLocked(entry session, ac attachedClient, state c
571		// succeed. A cross-session transition may publish concurrently, but its	571		// succeed. A cross-session transition may publish concurrently, but its
572		// mandatory first-paint rebase waits for sendMu and therefore follows this	572		// mandatory first-paint rebase waits for sendMu and therefore follows this
573		// completed output transaction.	573		// completed output transaction.
574	-	ac.pipelineScratch = ac.pipelineCache	574	+	ac.render.commitComposition(composed.cache)
575	-	ac.pipelineCache = composed.cache
576			575
577		// A successful no-byte emission also commits: its renderer shadow still	576		// A successful no-byte emission also commits: its renderer shadow still
578		// represents the captured frame. Lock panes only under sendMu and with no	577		// represents the captured frame. Lock panes only under sendMu and with no

M internal/usecase/daemon/render_pipeline_cache_test.go +6 -6


@@ -43,9 +43,9 @@ func TestPipelineCachePublishesOnlyAfterEmission(t *testing.T) {
43		d, sess, ac, sends := newManualSessionWithPTYs(t)	43		d, sess, ac, sends := newManualSessionWithPTYs(t)
44		healthy := ac.transport()	44		healthy := ac.transport()
45		committed := composeFrame(cacheState("committed", 1), composeCacheInput{})	45		committed := composeFrame(cacheState("committed", 1), composeCacheInput{})
46	-	ac.pipelineCache = committed.cache	46	+	ac.render.cache = committed.cache
47	-	before := cloneComposeCache(ac.pipelineCache)	47	+	before := cloneComposeCache(ac.render.cache)
48	-	pending := composeFrame(cacheState("next", 2), ac.pipelineCache, ac.pipelineScratch)	48	+	pending := composeFrame(cacheState("next", 2), ac.render.cache, ac.render.spare)
49		failure.apply(&pending, ac)	49		failure.apply(&pending, ac)
50			50
51		state := cacheState("next", 2)	51		state := cacheState("next", 2)

@@ -54,7 +54,7 @@ func TestPipelineCachePublishesOnlyAfterEmission(t *testing.T) {
54		state.view.revision = ac.viewSnapshot().revision	54		state.view.revision = ac.viewSnapshot().revision
55		ac.sendMu.Lock()	55		ac.sendMu.Lock()
56		require.True(t, d.publishCapturedFrameForTest(sess, ac, &state, pending))	56		require.True(t, d.publishCapturedFrameForTest(sess, ac, &state, pending))
57	-	require.Equal(t, before, cloneComposeCache(ac.pipelineCache), "failed emission must not publish any composed cache backing storage")	57	+	require.Equal(t, before, cloneComposeCache(ac.render.cache), "failed emission must not publish any composed cache backing storage")
58			58
59		// A send error detaches the failed link. Re-own this test attachment with	59		// A send error detaches the failed link. Re-own this test attachment with
60		// its original healthy transport, then retry the pending state.	60		// its original healthy transport, then retry the pending state.

@@ -65,14 +65,14 @@ func TestPipelineCachePublishesOnlyAfterEmission(t *testing.T) {
65		ac.setSession(sess)	65		ac.setSession(sess)
66		ac.replaceTransport(healthy)	66		ac.replaceTransport(healthy)
67		}	67		}
68	-	pending = composeFrame(cacheState("next", 2), ac.pipelineCache, ac.pipelineScratch)	68	+	pending = composeFrame(cacheState("next", 2), ac.render.cache, ac.render.spare)
69		state = cacheState("next", 2)	69		state = cacheState("next", 2)
70		state.attachment = ac	70		state.attachment = ac
71		state.route.Target = protocol.ExactSessionTarget{LifecycleID: sess.incarnation, SessionName: sess.name}	71		state.route.Target = protocol.ExactSessionTarget{LifecycleID: sess.incarnation, SessionName: sess.name}
72		state.view.revision = ac.viewSnapshot().revision	72		state.view.revision = ac.viewSnapshot().revision
73		ac.sendMu.Lock()	73		ac.sendMu.Lock()
74		require.True(t, d.publishCapturedFrameForTest(sess, ac, &state, pending))	74		require.True(t, d.publishCapturedFrameForTest(sess, ac, &state, pending))
75	-	require.Equal(t, pending.cache, ac.pipelineCache)	75	+	require.Equal(t, pending.cache, ac.render.cache)
76		frame := <-sends	76		frame := <-sends
77		output := unmarshalTestOutput(t, frame.Payload)	77		output := unmarshalTestOutput(t, frame.Payload)
78		require.Contains(t, string(output.Data), "next", "the retry must emit state retained after the failed emission")	78		require.Contains(t, string(output.Data), "next", "the retry must emit state retained after the failed emission")

M internal/usecase/daemon/render_pipeline_test.go +3 -3


@@ -229,7 +229,7 @@ func TestPublishFrameFailedSendDoesNotPublishCursorOrOutputState(t *testing.T) {
229		ac.replaceTransport(cacheFailTransport{})	229		ac.replaceTransport(cacheFailTransport{})
230		state := cacheState("failed", 1)	230		state := cacheState("failed", 1)
231		state.attachment = ac	231		state.attachment = ac
232	-	composed := composeFrame(state, ac.pipelineCache, ac.pipelineScratch)	232	+	composed := composeFrame(state, ac.render.cache, ac.render.spare)
233		composed.cursor = cursorOut{row: 3, col: 4, style: 2, hasStyle: true}	233		composed.cursor = cursorOut{row: 3, col: 4, style: 2, hasStyle: true}
234			234
235		ac.sendMu.Lock()	235		ac.sendMu.Lock()

@@ -263,7 +263,7 @@ func TestPublishFrameNoByteSuccessCommitsTransactionWithoutStateFrame(t *testing
263		state.route.Target = protocol.ExactSessionTarget{LifecycleID: sess.incarnation, SessionName: sess.name}	263		state.route.Target = protocol.ExactSessionTarget{LifecycleID: sess.incarnation, SessionName: sess.name}
264		state.view.tabID = domain.TabStableID(sess.tabs[0].stableID)	264		state.view.tabID = domain.TabStableID(sess.tabs[0].stableID)
265		state.view.revision = ac.viewSnapshot().revision	265		state.view.revision = ac.viewSnapshot().revision
266	-	initial := composeFrame(state, ac.pipelineCache, ac.pipelineScratch)	266	+	initial := composeFrame(state, ac.render.cache, ac.render.spare)
267		ac.sendMu.Lock()	267		ac.sendMu.Lock()
268		require.True(t, d.publishCapturedFrameForTest(sess, ac, &state, initial))	268		require.True(t, d.publishCapturedFrameForTest(sess, ac, &state, initial))
269		<-sends	269		<-sends

@@ -289,7 +289,7 @@ func TestPublishFrameNoByteSuccessCommitsTransactionWithoutStateFrame(t *testing
289			289
290		require.Equal(t, beforeNext, ac.output.next)	290		require.Equal(t, beforeNext, ac.output.next)
291		require.Equal(t, beforeCursor, ac.output.lastCursor)	291		require.Equal(t, beforeCursor, ac.output.lastCursor)
292	-	require.Equal(t, "no-byte-committed", ac.pipelineCache.layoutFingerprint)	292	+	require.Equal(t, "no-byte-committed", ac.render.cache.layoutFingerprint)
293		p.mu.Lock()	293		p.mu.Lock()
294		require.Empty(t, p.screen.Damage())	294		require.Empty(t, p.screen.Damage())
295		p.mu.Unlock()	295		p.mu.Unlock()

M internal/usecase/daemon/render_test.go +6 -6


@@ -782,21 +782,21 @@ func TestOverlayPaintBypassesComposedCache(t *testing.T) {
782			782
783		d.paint(sess, ac, true, nil)	783		d.paint(sess, ac, true, nil)
784		_ = mustOutputData(t, sends)	784		_ = mustOutputData(t, sends)
785	-	require.True(t, ac.pipelineCache.valid)	785	+	require.True(t, ac.render.cache.valid)
786	-	require.NotContains(t, frameText(ac.pipelineCache.frame), "Rename session")	786	+	require.NotContains(t, frameText(ac.render.cache.frame), "Rename session")
787			787
788		d.enterPrompt(sess, ac, " Rename session ", "work", func(string) error { return nil })	788		d.enterPrompt(sess, ac, " Rename session ", "work", func(string) error { return nil })
789		shown := string(mustOutputData(t, sends))	789		shown := string(mustOutputData(t, sends))
790		require.Contains(t, shown, "Rename session")	790		require.Contains(t, shown, "Rename session")
791	-	require.False(t, ac.pipelineCache.valid, "overlay paint must not store the modal-mutated frame in the composed cache")	791	+	require.False(t, ac.render.cache.valid, "overlay paint must not store the modal-mutated frame in the composed cache")
792	-	require.NotContains(t, frameText(ac.pipelineCache.frame), "Rename session")	792	+	require.NotContains(t, frameText(ac.render.cache.frame), "Rename session")
793			793
794		d.closePrompt(ac)	794		d.closePrompt(ac)
795		d.paint(sess, ac, false, nil)	795		d.paint(sess, ac, false, nil)
796		restored := string(mustOutputData(t, sends))	796		restored := string(mustOutputData(t, sends))
797		require.NotContains(t, restored, "Rename session")	797		require.NotContains(t, restored, "Rename session")
798	-	require.True(t, ac.pipelineCache.valid)	798	+	require.True(t, ac.render.cache.valid)
799	-	cached := frameText(ac.pipelineCache.frame)	799	+	cached := frameText(ac.render.cache.frame)
800		require.Contains(t, cached, "live")	800		require.Contains(t, cached, "live")
801		require.NotContains(t, cached, "Rename session")	801		require.NotContains(t, cached, "Rename session")
802		}	802		}

M internal/usecase/daemon/resume.go +33 -77

 	return binary.BigEndian.Uint64(b[:])
 }
-func (d *Daemon) nextResumeTokenLocked() uint64 {
+func (d *Daemon) nextResumeTokenLocked() uint64 { return d.resume.issue() }
-	for {
-		tok := newResumeToken()
-		if tok == 0 {
-			continue
-		}
-		if _, exists := d.parked[tok]; !exists {
-			if _, parking := d.parking[tok]; !parking {
-				return tok
-			}
-		}
-	}
-}
 // markParkingInFlight publishes an observable parking lifecycle so IntentResume
 // can wait out the detach→park gap. Callers must publish this before clearing
 // ensureParkingInFlightLocked records or refreshes the in-flight marker for ac.
 // Caller holds d.mu and has verified the daemon is not closing.
 func (d *Daemon) ensureParkingInFlightLocked(sess *session, ac *attachedClient) {
-	token := ac.resumeToken
+	d.resume.markParking(sess, ac)
-	if token == 0 {
-		return
-	}
-	if existing := d.parking[token]; existing != nil {
-		if existing.ac == ac {
-			existing.sess = sess
-			return
-		}
-		delete(d.parking, token)
-		existing.closeDone()
-	}
-	d.parking[token] = &parkingAttachment{
-		sess: sess,
-		ac:   ac,
-		done: make(chan struct{}),
-	}
 }
 func (d *Daemon) clearParkingInFlight(token uint64, ac *attachedClient) {
 	}
 	d.mu.Lock()
 	defer d.mu.Unlock()
-	if d.parked[token] != nil {
+	if d.resume.parkedFor(token) != nil {
 		return
 	}
 	stillOwner := false
 }
 func (d *Daemon) clearParkingInFlightLocked(token uint64, ac *attachedClient) {
-	pending := d.parking[token]
+	d.resume.clearParking(token, ac)
-	if pending == nil {
-		return
-	}
-	if ac != nil && pending.ac != ac {
-		return
-	}
-	delete(d.parking, token)
-	pending.closeDone()
 }
-func (d *Daemon) purgeAllParkingLocked() {
+func (d *Daemon) purgeAllParkingLocked() { d.resume.purgeParking(nil) }
-	for token, pending := range d.parking {
-		delete(d.parking, token)
-		pending.closeDone()
-	}
-}
 // purgeParkingForSessionLocked removes and closes every in-flight parking
 // marker for sess so same-token waiters fail closed instead of hanging when
 // the session is removed before park publication. Caller holds d.mu.
 func (d *Daemon) purgeParkingForSessionLocked(sess *session) {
-	for token, pending := range d.parking {
+	if sess != nil {
-		if pending.sess == sess {
+		d.resume.purgeParking(sess)
-			delete(d.parking, token)
-			pending.closeDone()
-		}
 	}
 }
 		return false
 	}
 	d.mu.Lock()
-	pending := d.parking[h.ResumeToken]
+	pending := d.resume.parkingFor(h.ResumeToken)
 	if pending == nil {
 		d.mu.Unlock()
 		return false
 		oldRetirement *parkedAttachmentRetirement
 		oldSame       *parkedAttachment
 	)
-	if old := d.parked[token]; old != nil {
+	if old := d.resume.parkedFor(token); old != nil {
 		if old.ac == ac {
 			oldSame = old
 		} else {
 		timer: timer, done: make(chan struct{}),
 	}
 	ac.parked = true
-	d.parked[token] = parked
+	d.resume.publishParked(token, parked)
-	d.clearParkingInFlightLocked(token, ac)
 	d.mu.Unlock()
 	if oldRetirement != nil {
 		d.finishParkedAttachmentRetirements([]parkedAttachmentRetirement{*oldRetirement})
 func (d *Daemon) expireParked(token uint64, parked *parkedAttachment) {
 	d.mu.Lock()
-	if d.parked[token] == parked {
+	if d.resume.parkedFor(token) == parked {
 		if parked.claimed {
 			d.mu.Unlock()
 			return
 }
 // removeParkedLocked invalidates one non-nil parked attachment. Caller holds
-// d.mu and has verified d.parked[token] still points at parked when that matters.
+// d.mu and has verified token still holds parked when that matters.
 func (d *Daemon) removeParkedLocked(token uint64, parked *parkedAttachment) {
-	delete(d.parked, token)
+	d.resume.takeParked(token, parked)
 	d.discardAttachmentOutputLocked(parked.ac)
 	parked.ac.resumeToken = 0
 	parked.ac.parked = false
 	d.mu.Lock()
 	defer d.mu.Unlock()
 	token := ac.resumeClaimToken
-	parked := d.parked[token]
+	parked := d.resume.parkedFor(token)
 	if token == 0 || parked == nil || parked.ac != ac || !parked.claimed {
 		return token == 0
 	}
-	delete(d.parked, token)
+	d.resume.takeParked(token, parked)
 	parked.claimed = false
 	if parked.timer != nil {
 		parked.timer.Stop()
 	}
 	d.mu.Lock()
 	token := ac.resumeClaimToken
-	parked := d.parked[token]
+	parked := d.resume.parkedFor(token)
 	if token == 0 || parked == nil || parked.ac != ac || !parked.claimed {
 		d.mu.Unlock()
 		return false
 	defer frozen.unfreeze()
 	d.mu.Lock()
-	if d.parked[token] != parked || !parked.claimed || ac.resumeClaimToken != token {
+	if d.resume.parkedFor(token) != parked || !parked.claimed || ac.resumeClaimToken != token {
 		d.mu.Unlock()
 		return false
 	}
 		timer:             d.clock.NewTimer(d.resumeParkGrace),
 		done:              make(chan struct{}),
 	}
-	d.parked[token] = rearmed
+	d.resume.publishParked(token, rearmed)
 	captured := ac.transportSnapshot().transport
 	d.mu.Unlock()
 	if sess != nil {
 }
 func (d *Daemon) retireParkedAttachmentLocked(token uint64, parked *parkedAttachment) parkedAttachmentRetirement {
-	delete(d.parked, token)
+	d.resume.takeParked(token, parked)
 	d.discardAttachmentOutputLocked(parked.ac)
 	parked.ac.resumeToken = 0
 	parked.ac.parked = false
 // returns the external resources that must be retired after releasing d.mu.
 // It is reserved for terminal session kill and daemon shutdown.
 func (d *Daemon) purgeParkedForSessionLocked(sess *session) []parkedAttachmentRetirement {
-	var retirements []parkedAttachmentRetirement
+	if sess == nil {
-	for token, parked := range d.parked {
+		return nil
-		if parked.sess == sess {
-			retirements = append(retirements, d.retireParkedAttachmentLocked(token, parked))
-		}
 	}
-	return retirements
+	return d.retireParkedLocked(d.resume.parkedForSession(sess))
 }
 func (d *Daemon) purgeAllParkedLocked() []parkedAttachmentRetirement {
-	retirements := make([]parkedAttachmentRetirement, 0, len(d.parked))
+	return d.retireParkedLocked(d.resume.parkedForSession(nil))
-	for token, parked := range d.parked {
+}
+func (d *Daemon) retireParkedLocked(entries map[uint64]*parkedAttachment) []parkedAttachmentRetirement {
+	retirements := make([]parkedAttachmentRetirement, 0, len(entries))
+	for token, parked := range entries {
 		retirements = append(retirements, d.retireParkedAttachmentLocked(token, parked))
 	}
 	return retirements
 		return nil, nil, false, &protoErr{protocol.ErrServerShutdown, "daemon is shutting down"}
 	}
 	// Teardown may have parked the credential already.
-	if d.parked[h.ResumeToken] != nil {
+	if d.resume.parkedFor(h.ResumeToken) != nil {
 		d.mu.Unlock()
 		return d.resumeParked(h, tr, sz)
 	}
 		sess.mu.Unlock()
 	}
 	// Teardown may have parked the credential while we resolved the session.
-	if d.parked[h.ResumeToken] != nil {
+	if d.resume.parkedFor(h.ResumeToken) != nil {
 		d.mu.Unlock()
 		return d.resumeParked(h, tr, sz)
 	}
 // the initial lookup and lock acquisition.
 func (d *Daemon) resumeParked(h protocol.Hello, tr ports.ServerConnection, sz domain.Size) (*session, *attachedClient, bool, error) {
 	d.mu.Lock()
-	parked := d.parked[h.ResumeToken]
+	parked := d.resume.parkedFor(h.ResumeToken)
 	d.mu.Unlock()
 	if parked == nil || h.ResumeToken == 0 {
 		return nil, nil, false, nil
 		ac.sendMu.Unlock()
 		return nil, nil, false, &protoErr{protocol.ErrServerShutdown, "daemon is shutting down"}
 	}
-	if d.parked[h.ResumeToken] != parked || parked.claimed {
+	if d.resume.parkedFor(h.ResumeToken) != parked || parked.claimed {
 		if d.sessions[parked.sess.id] == parked.sess {
 			d.mu.Unlock()
 			ac.sendMu.Unlock()
 // resumeParkedLocked completes a validated resume. Caller holds both ac.sendMu
 // and d.mu in that order.
 func (d *Daemon) resumeParkedLocked(h protocol.Hello, tr ports.ServerConnection, sz domain.Size) (*session, *attachedClient, bool, error) {
-	parked := d.parked[h.ResumeToken]
+	parked := d.resume.parkedFor(h.ResumeToken)
 	if parked == nil || h.ResumeToken == 0 {
 		return nil, nil, false, nil
 	}

A internal/usecase/daemon/resume_credentials.go +136 -0

@@ -0,0 +1,136 @@
	1	+	package daemon
	2	+
	3	+	// resumeCredentials owns every resume credential that is not held by a live
	4	+	// attachment: attachments between detach and park publication (parking), and
	5	+	// parked attachments waiting for a reconnect (parked). A token is unique
	6	+	// across both, and every lookup, publication, and retirement of either goes
	7	+	// through this type, so the credential lifecycle has one owner.
	8	+	//
	9	+	// resumeCredentials is guarded by Daemon.mu; every method requires it held.
	10	+	// It never takes another lock and never stops timers or closes transports
	11	+	// beyond closing its own done channels: external retirement stays with the
	12	+	// caller, after d.mu is released.
	13	+	type resumeCredentials struct {
	14	+	parked map[uint64]*parkedAttachment
	15	+	parking map[uint64]*parkingAttachment
	16	+	}
	17	+
	18	+	func newResumeCredentials() resumeCredentials {
	19	+	return resumeCredentials{
	20	+	parked: make(map[uint64]*parkedAttachment),
	21	+	parking: make(map[uint64]*parkingAttachment),
	22	+	}
	23	+	}
	24	+
	25	+	// issue returns a fresh nonzero token no parked or parking entry holds.
	26	+	func (c *resumeCredentials) issue() uint64 {
	27	+	for {
	28	+	token := newResumeToken()
	29	+	if token == 0 {
	30	+	continue
	31	+	}
	32	+	if c.parked[token] == nil && c.parking[token] == nil {
	33	+	return token
	34	+	}
	35	+	}
	36	+	}
	37	+
	38	+	// parkedFor returns the parked entry holding token, or nil.
	39	+	func (c resumeCredentials) parkedFor(token uint64) parkedAttachment { return c.parked[token] }
	40	+
	41	+	// parkingFor returns the in-flight parking entry holding token, or nil.
	42	+	func (c resumeCredentials) parkingFor(token uint64) parkingAttachment { return c.parking[token] }
	43	+
	44	+	// sessionFor returns the session a parked or parking token belongs to.
	45	+	func (c resumeCredentials) sessionFor(token uint64) session {
	46	+	if parked := c.parked[token]; parked != nil {
	47	+	return parked.sess
	48	+	}
	49	+	if pending := c.parking[token]; pending != nil {
	50	+	return pending.sess
	51	+	}
	52	+	return nil
	53	+	}
	54	+
	55	+	// retainsSession reports whether any parked or parking credential keeps sess.
	56	+	func (c resumeCredentials) retainsSession(sess session) bool {
	57	+	for _, parked := range c.parked {
	58	+	if parked.sess == sess {
	59	+	return true
	60	+	}
	61	+	}
	62	+	for _, pending := range c.parking {
	63	+	if pending.sess == sess {
	64	+	return true
	65	+	}
	66	+	}
	67	+	return false
	68	+	}
	69	+
	70	+	// markParking records or refreshes the in-flight marker for ac's token.
	71	+	func (c resumeCredentials) markParking(sess session, ac *attachedClient) {
	72	+	token := ac.resumeToken
	73	+	if token == 0 {
	74	+	return
	75	+	}
	76	+	if existing := c.parking[token]; existing != nil {
	77	+	if existing.ac == ac {
	78	+	existing.sess = sess
	79	+	return
	80	+	}
	81	+	delete(c.parking, token)
	82	+	existing.closeDone()
	83	+	}
	84	+	c.parking[token] = &parkingAttachment{sess: sess, ac: ac, done: make(chan struct{})}
	85	+	}
	86	+
	87	+	// clearParking removes token's marker, waking its waiters. A non-nil ac only
	88	+	// clears its own marker.
	89	+	func (c resumeCredentials) clearParking(token uint64, ac attachedClient) {
	90	+	pending := c.parking[token]
	91	+	if pending == nil \|\| (ac != nil && pending.ac != ac) {
	92	+	return
	93	+	}
	94	+	delete(c.parking, token)
	95	+	pending.closeDone()
	96	+	}
	97	+
	98	+	// purgeParking removes every marker for sess, or every marker when sess is
	99	+	// nil, so same-token waiters fail closed instead of hanging.
	100	+	func (c resumeCredentials) purgeParking(sess session) {
	101	+	for token, pending := range c.parking {
	102	+	if sess == nil \|\| pending.sess == sess {
	103	+	delete(c.parking, token)
	104	+	pending.closeDone()
	105	+	}
	106	+	}
	107	+	}
	108	+
	109	+	// publishParked stores parked under token, replacing any previous entry, and
	110	+	// clears the matching in-flight marker.
	111	+	func (c resumeCredentials) publishParked(token uint64, parked parkedAttachment) {
	112	+	c.parked[token] = parked
	113	+	c.clearParking(token, parked.ac)
	114	+	}
	115	+
	116	+	// takeParked removes token's parked entry when it still holds parked. It
	117	+	// reports false when another path already replaced or removed it.
	118	+	func (c resumeCredentials) takeParked(token uint64, parked parkedAttachment) bool {
	119	+	if parked == nil \|\| c.parked[token] != parked {
	120	+	return false
	121	+	}
	122	+	delete(c.parked, token)
	123	+	return true
	124	+	}
	125	+
	126	+	// parkedForSession returns every parked entry for sess, or every parked entry
	127	+	// when sess is nil, keyed by token.
	128	+	func (c resumeCredentials) parkedForSession(sess session) map[uint64]*parkedAttachment {
	129	+	matches := make(map[uint64]*parkedAttachment)
	130	+	for token, parked := range c.parked {
	131	+	if sess == nil \|\| parked.sess == sess {
	132	+	matches[token] = parked
	133	+	}
	134	+	}
	135	+	return matches
	136	+	}

A internal/usecase/daemon/resume_credentials_test.go +69 -0

@@ -0,0 +1,69 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/stretchr/testify/require"
	7	+	)
	8	+
	9	+	func TestResumeCredentialsLifecycle(t *testing.T) {
	10	+	sessA, sessB := &session{}, &session{}
	11	+	owner, other := &attachedClient{resumeToken: 7}, &attachedClient{resumeToken: 7}
	12	+	tests := []struct {
	13	+	name string
	14	+	run func(c *resumeCredentials)
	15	+	wantParked bool
	16	+	wantParking bool
	17	+	wantSession *session
	18	+	}{
	19	+	{name: "parking marker is visible", run: func(c *resumeCredentials) { c.markParking(sessA, owner) }, wantParking: true, wantSession: sessA},
	20	+	{name: "publishing park clears the owner's marker", run: func(c *resumeCredentials) {
	21	+	c.markParking(sessA, owner)
	22	+	c.publishParked(7, &parkedAttachment{sess: sessA, ac: owner})
	23	+	}, wantParked: true, wantSession: sessA},
	24	+	{name: "another attachment cannot clear the marker", run: func(c *resumeCredentials) {
	25	+	c.markParking(sessA, owner)
	26	+	c.clearParking(7, other)
	27	+	}, wantParking: true, wantSession: sessA},
	28	+	{name: "purging another session keeps the marker", run: func(c *resumeCredentials) {
	29	+	c.markParking(sessA, owner)
	30	+	c.purgeParking(sessB)
	31	+	}, wantParking: true, wantSession: sessA},
	32	+	{name: "purging all markers", run: func(c *resumeCredentials) {
	33	+	c.markParking(sessA, owner)
	34	+	c.purgeParking(nil)
	35	+	}},
	36	+	{name: "stale take is refused", run: func(c *resumeCredentials) {
	37	+	current := &parkedAttachment{sess: sessB, ac: owner}
	38	+	c.publishParked(7, current)
	39	+	require.False(t, c.takeParked(7, &parkedAttachment{sess: sessA, ac: owner}))
	40	+	}, wantParked: true, wantSession: sessB},
	41	+	{name: "current take removes", run: func(c *resumeCredentials) {
	42	+	current := &parkedAttachment{sess: sessA, ac: owner}
	43	+	c.publishParked(7, current)
	44	+	require.True(t, c.takeParked(7, current))
	45	+	}},
	46	+	}
	47	+	for _, tt := range tests {
	48	+	t.Run(tt.name, func(t *testing.T) {
	49	+	credentials := newResumeCredentials()
	50	+	tt.run(&credentials)
	51	+	require.Equal(t, tt.wantParked, credentials.parkedFor(7) != nil)
	52	+	require.Equal(t, tt.wantParking, credentials.parkingFor(7) != nil)
	53	+	require.Same(t, tt.wantSession, credentials.sessionFor(7))
	54	+	require.Equal(t, tt.wantSession == sessA, credentials.retainsSession(sessA))
	55	+	require.Equal(t, tt.wantSession == sessB, credentials.retainsSession(sessB))
	56	+	})
	57	+	}
	58	+	}
	59	+
	60	+	func TestResumeCredentialsIssueAvoidsHeldTokens(t *testing.T) {
	61	+	credentials := newResumeCredentials()
	62	+	for range 64 {
	63	+	token := credentials.issue()
	64	+	require.NotZero(t, token)
	65	+	require.Nil(t, credentials.parkedFor(token))
	66	+	credentials.publishParked(token, &parkedAttachment{ac: &attachedClient{}})
	67	+	}
	68	+	require.Len(t, credentials.parkedForSession(nil), 64)
	69	+	}

M internal/usecase/daemon/resume_test.go +53 -53


@@ -134,7 +134,7 @@ func TestResumeRejectsMismatchedRemoteTargetBeforeOwnershipMutation(t *testing.T
134		require.Equal(t, protocol.ErrNoSuchTarget, protocolErr.code)	134		require.Equal(t, protocol.ErrNoSuchTarget, protocolErr.code)
135		require.Same(t, oldTransport, ac.transport())	135		require.Same(t, oldTransport, ac.transport())
136		d.mu.Lock()	136		d.mu.Lock()
137	-	_, parked := d.parked[token]	137	+	_, parked := d.resume.parked[token]
138		d.mu.Unlock()	138		d.mu.Unlock()
139		require.False(t, parked, "mismatched target must not park the live attachment")	139		require.False(t, parked, "mismatched target must not park the live attachment")
140			140

@@ -162,7 +162,7 @@ func TestParkedResumeRejectsMismatchedRemoteTargetBeforeClaim(t *testing.T) {
162		require.ErrorAs(t, err, &protocolErr)	162		require.ErrorAs(t, err, &protocolErr)
163		require.Equal(t, protocol.ErrNoSuchTarget, protocolErr.code)	163		require.Equal(t, protocol.ErrNoSuchTarget, protocolErr.code)
164		d.mu.Lock()	164		d.mu.Lock()
165	-	parked := d.parked[token]	165	+	parked := d.resume.parked[token]
166		claimed := parked != nil && parked.claimed	166		claimed := parked != nil && parked.claimed
167		d.mu.Unlock()	167		d.mu.Unlock()
168		require.NotNil(t, parked)	168		require.NotNil(t, parked)

@@ -184,7 +184,7 @@ func TestFailedResumeRearmsParkExpiryAfterClaimTimerFires(t *testing.T) {
184		d.clientGone(sess, ac, oldTransport, false)	184		d.clientGone(sess, ac, oldTransport, false)
185		parkTimer := <-clock.timers	185		parkTimer := <-clock.timers
186		d.mu.Lock()	186		d.mu.Lock()
187	-	parked := d.parked[token]	187	+	parked := d.resume.parked[token]
188		d.mu.Unlock()	188		d.mu.Unlock()
189		require.NotNil(t, parked)	189		require.NotNil(t, parked)
190			190

@@ -203,7 +203,7 @@ func TestFailedResumeRearmsParkExpiryAfterClaimTimerFires(t *testing.T) {
203		rearmedTimer := <-clock.timers	203		rearmedTimer := <-clock.timers
204		require.NotSame(t, parkTimer, rearmedTimer)	204		require.NotSame(t, parkTimer, rearmedTimer)
205		d.mu.Lock()	205		d.mu.Lock()
206	-	rearmed := d.parked[token]	206	+	rearmed := d.resume.parked[token]
207		claimed := rearmed != nil && rearmed.claimed	207		claimed := rearmed != nil && rearmed.claimed
208		d.mu.Unlock()	208		d.mu.Unlock()
209		require.NotNil(t, rearmed)	209		require.NotNil(t, rearmed)

@@ -211,7 +211,7 @@ func TestFailedResumeRearmsParkExpiryAfterClaimTimerFires(t *testing.T) {
211		rearmedTimer.ch <- time.Time{}	211		rearmedTimer.ch <- time.Time{}
212		d.expireParked(token, rearmed)	212		d.expireParked(token, rearmed)
213		d.mu.Lock()	213		d.mu.Lock()
214	-	_, retained := d.parked[token]	214	+	_, retained := d.resume.parked[token]
215		d.mu.Unlock()	215		d.mu.Unlock()
216		require.False(t, retained, "rearmed credential must still expire")	216		require.False(t, retained, "rearmed credential must still expire")
217			217

@@ -234,7 +234,7 @@ func TestNamedLinkLossParks(t *testing.T) {
234		require.Equal(t, 1, sessionCount(d), "named session survives parked link loss")	234		require.Equal(t, 1, sessionCount(d), "named session survives parked link loss")
235		require.Empty(t, sess.snapshotAttachments())	235		require.Empty(t, sess.snapshotAttachments())
236		d.mu.Lock()	236		d.mu.Lock()
237	-	_, parked := d.parked[token]	237	+	_, parked := d.resume.parked[token]
238		d.mu.Unlock()	238		d.mu.Unlock()
239		require.True(t, parked, "named resume-capable link loss is parked")	239		require.True(t, parked, "named resume-capable link loss is parked")
240		}	240		}

@@ -402,7 +402,7 @@ func TestEphemeralLinkLossParksAndResumes(t *testing.T) {
402		}	402		}
403		require.True(t, peerRegistered, "the live peer attachment was removed while parking")	403		require.True(t, peerRegistered, "the live peer attachment was removed while parking")
404		d.mu.Lock()	404		d.mu.Lock()
405	-	_, parked := d.parked[token]	405	+	_, parked := d.resume.parked[token]
406		d.mu.Unlock()	406		d.mu.Unlock()
407		require.True(t, parked, "ephemeral resume-capable link loss is parked")	407		require.True(t, parked, "ephemeral resume-capable link loss is parked")
408			408

@@ -440,7 +440,7 @@ func TestResumeParkedTokenReplacedDuringWaitFailsClosed(t *testing.T) {
440		d.clientGone(sess, ac, oldTr, false)	440		d.clientGone(sess, ac, oldTr, false)
441		require.Empty(t, sess.snapshotAttachments())	441		require.Empty(t, sess.snapshotAttachments())
442		d.mu.Lock()	442		d.mu.Lock()
443	-	parked := d.parked[token]	443	+	parked := d.resume.parked[token]
444		sessionsBefore := len(d.sessions)	444		sessionsBefore := len(d.sessions)
445		d.mu.Unlock()	445		d.mu.Unlock()
446		require.NotNil(t, parked)	446		require.NotNil(t, parked)

@@ -468,9 +468,9 @@ func TestResumeParkedTokenReplacedDuringWaitFailsClosed(t *testing.T) {
468		awaitTestCompletion(t, reachedLookup, "resumeParked did not pause after the parked lookup")	468		awaitTestCompletion(t, reachedLookup, "resumeParked did not pause after the parked lookup")
469			469
470		d.mu.Lock()	470		d.mu.Lock()
471	-	require.Same(t, parked, d.parked[token], "fixture: token must still be parked at the seam")	471	+	require.Same(t, parked, d.resume.parked[token], "fixture: token must still be parked at the seam")
472		d.removeParkedLocked(token, parked)	472		d.removeParkedLocked(token, parked)
473	-	require.Nil(t, d.parked[token])	473	+	require.Nil(t, d.resume.parked[token])
474		require.Same(t, sess, d.sessions[sess.id], "fixture: named session must remain registered")	474		require.Same(t, sess, d.sessions[sess.id], "fixture: named session must remain registered")
475		d.mu.Unlock()	475		d.mu.Unlock()
476			476

@@ -487,7 +487,7 @@ func TestResumeParkedTokenReplacedDuringWaitFailsClosed(t *testing.T) {
487		require.Empty(t, sess.snapshotAttachments(), "lifecycle-race resume must not take over the named session")	487		require.Empty(t, sess.snapshotAttachments(), "lifecycle-race resume must not take over the named session")
488		require.Empty(t, resumeTr.Sends(), "failed resume must not complete a Welcome handshake")	488		require.Empty(t, resumeTr.Sends(), "failed resume must not complete a Welcome handshake")
489		d.mu.Lock()	489		d.mu.Lock()
490	-	_, stillParked := d.parked[token]	490	+	_, stillParked := d.resume.parked[token]
491		sessionsAfter := len(d.sessions)	491		sessionsAfter := len(d.sessions)
492		d.mu.Unlock()	492		d.mu.Unlock()
493		require.False(t, stillParked, "consumed token must stay invalid")	493		require.False(t, stillParked, "consumed token must stay invalid")

@@ -511,7 +511,7 @@ func TestResumeLiveAttachmentParkedResumeRaceFailsClosed(t *testing.T) {
511		require.NotZero(t, token)	511		require.NotZero(t, token)
512		require.True(t, slices.Contains(sess.snapshotAttachments(), ac))	512		require.True(t, slices.Contains(sess.snapshotAttachments(), ac))
513		d.mu.Lock()	513		d.mu.Lock()
514	-	_, parkedAtStart := d.parked[token]	514	+	_, parkedAtStart := d.resume.parked[token]
515		sessionsBefore := len(d.sessions)	515		sessionsBefore := len(d.sessions)
516		d.mu.Unlock()	516		d.mu.Unlock()
517		require.False(t, parkedAtStart, "fixture: live attachment must not be parked yet")	517		require.False(t, parkedAtStart, "fixture: live attachment must not be parked yet")

@@ -539,11 +539,11 @@ func TestResumeLiveAttachmentParkedResumeRaceFailsClosed(t *testing.T) {
539		awaitTestCompletion(t, reachedLookup, "live resume did not pause inside resumeParked after parking")	539		awaitTestCompletion(t, reachedLookup, "live resume did not pause inside resumeParked after parking")
540			540
541		d.mu.Lock()	541		d.mu.Lock()
542	-	parked := d.parked[token]	542	+	parked := d.resume.parked[token]
543		require.NotNil(t, parked, "fixture: live recovery must have parked before the sendMu seam")	543		require.NotNil(t, parked, "fixture: live recovery must have parked before the sendMu seam")
544		require.Same(t, ac, parked.ac)	544		require.Same(t, ac, parked.ac)
545		d.removeParkedLocked(token, parked)	545		d.removeParkedLocked(token, parked)
546	-	require.Nil(t, d.parked[token])	546	+	require.Nil(t, d.resume.parked[token])
547		require.Same(t, sess, d.sessions[sess.id], "fixture: named session must remain registered")	547		require.Same(t, sess, d.sessions[sess.id], "fixture: named session must remain registered")
548		d.mu.Unlock()	548		d.mu.Unlock()
549			549

@@ -561,7 +561,7 @@ func TestResumeLiveAttachmentParkedResumeRaceFailsClosed(t *testing.T) {
561		require.Empty(t, sess.snapshotAttachments(), "losing live resume must not take over the named session")	561		require.Empty(t, sess.snapshotAttachments(), "losing live resume must not take over the named session")
562		require.Empty(t, resumeTr.Sends(), "failed live resume must not complete a Welcome handshake")	562		require.Empty(t, resumeTr.Sends(), "failed live resume must not complete a Welcome handshake")
563		d.mu.Lock()	563		d.mu.Lock()
564	-	_, stillParked := d.parked[token]	564	+	_, stillParked := d.resume.parked[token]
565		sessionsAfter := len(d.sessions)	565		sessionsAfter := len(d.sessions)
566		d.mu.Unlock()	566		d.mu.Unlock()
567		require.False(t, stillParked, "consumed token must stay invalid")	567		require.False(t, stillParked, "consumed token must stay invalid")

@@ -602,8 +602,8 @@ func TestResumeDuringTeardownBeforeParkRecoversSameAttachment(t *testing.T) {
602			602
603		require.Empty(t, sess.snapshotAttachments(), "fixture: detach must have cleared the live owner")	603		require.Empty(t, sess.snapshotAttachments(), "fixture: detach must have cleared the live owner")
604		d.mu.Lock()	604		d.mu.Lock()
605	-	parkingInGap := d.parking[token]	605	+	parkingInGap := d.resume.parking[token]
606	-	_, parkedInGap := d.parked[token]	606	+	_, parkedInGap := d.resume.parked[token]
607		d.mu.Unlock()	607		d.mu.Unlock()
608		require.NotNil(t, parkingInGap, "fixture: parking marker must precede detach publication")	608		require.NotNil(t, parkingInGap, "fixture: parking marker must precede detach publication")
609		require.Same(t, ac, parkingInGap.ac)	609		require.Same(t, ac, parkingInGap.ac)

@@ -655,8 +655,8 @@ func TestResumeDuringTeardownBeforeParkRecoversSameAttachment(t *testing.T) {
655		require.True(t, oldTr.Closed(), "teardown/resume must retire the old transport")	655		require.True(t, oldTr.Closed(), "teardown/resume must retire the old transport")
656		require.False(t, newTr.Closed(), "rebound transport must survive")	656		require.False(t, newTr.Closed(), "rebound transport must survive")
657		d.mu.Lock()	657		d.mu.Lock()
658	-	_, oldTokenParked := d.parked[token]	658	+	_, oldTokenParked := d.resume.parked[token]
659	-	_, stillParking := d.parking[token]	659	+	_, stillParking := d.resume.parking[token]
660		d.mu.Unlock()	660		d.mu.Unlock()
661		require.False(t, oldTokenParked, "consumed credential must not remain resumeable")	661		require.False(t, oldTokenParked, "consumed credential must not remain resumeable")
662		require.False(t, stillParking, "parking marker must be consumed after park/resume")	662		require.False(t, stillParking, "parking marker must be consumed after park/resume")

@@ -707,8 +707,8 @@ func TestConcurrentLiveResumesWaitParkingMarkerBeforePark(t *testing.T) {
707			707
708		require.Empty(t, sess.snapshotAttachments(), "fixture: winning resume must have cleared the live owner")	708		require.Empty(t, sess.snapshotAttachments(), "fixture: winning resume must have cleared the live owner")
709		d.mu.Lock()	709		d.mu.Lock()
710	-	parkingInGap := d.parking[token]	710	+	parkingInGap := d.resume.parking[token]
711	-	_, parkedInGap := d.parked[token]	711	+	_, parkedInGap := d.resume.parked[token]
712		d.mu.Unlock()	712		d.mu.Unlock()
713		require.NotNil(t, parkingInGap, "fixture: parking marker must precede detach for concurrent resumes")	713		require.NotNil(t, parkingInGap, "fixture: parking marker must precede detach for concurrent resumes")
714		require.Same(t, ac, parkingInGap.ac)	714		require.Same(t, ac, parkingInGap.ac)

@@ -765,8 +765,8 @@ func TestConcurrentLiveResumesWaitParkingMarkerBeforePark(t *testing.T) {
765			765
766		require.True(t, d.commitResumeClaim(ac), "successful concurrent resume must consume its parked credential")	766		require.True(t, d.commitResumeClaim(ac), "successful concurrent resume must consume its parked credential")
767		d.mu.Lock()	767		d.mu.Lock()
768	-	_, oldTokenParked := d.parked[token]	768	+	_, oldTokenParked := d.resume.parked[token]
769	-	_, stillParking := d.parking[token]	769	+	_, stillParking := d.resume.parking[token]
770		d.mu.Unlock()	770		d.mu.Unlock()
771		require.False(t, oldTokenParked, "consumed credential must not remain resumeable")	771		require.False(t, oldTokenParked, "consumed credential must not remain resumeable")
772		require.False(t, stillParking, "parking marker must be consumed after park/resume")	772		require.False(t, stillParking, "parking marker must be consumed after park/resume")

@@ -801,8 +801,8 @@ func TestExplicitDetachClearsOrphanedSameAttachmentParkingMarker(t *testing.T) {
801		// Pre-mark as a same-attachment non-explicit teardown would before detach.	801		// Pre-mark as a same-attachment non-explicit teardown would before detach.
802		require.Equal(t, token, d.markParkingInFlight(sess, ac))	802		require.Equal(t, token, d.markParkingInFlight(sess, ac))
803		d.mu.Lock()	803		d.mu.Lock()
804	-	orphaned := d.parking[token]	804	+	orphaned := d.resume.parking[token]
805	-	otherMarker := d.parking[otherToken]	805	+	otherMarker := d.resume.parking[otherToken]
806		d.mu.Unlock()	806		d.mu.Unlock()
807		require.NotNil(t, orphaned, "fixture: non-explicit teardown must publish the parking marker")	807		require.NotNil(t, orphaned, "fixture: non-explicit teardown must publish the parking marker")
808		require.Same(t, ac, orphaned.ac)	808		require.Same(t, ac, orphaned.ac)

@@ -824,8 +824,8 @@ func TestExplicitDetachClearsOrphanedSameAttachmentParkingMarker(t *testing.T) {
824		require.True(t, waited, "waiter must observe the same-attachment marker before it is cleared")	824		require.True(t, waited, "waiter must observe the same-attachment marker before it is cleared")
825			825
826		d.mu.Lock()	826		d.mu.Lock()
827	-	_, stillParking := d.parking[token]	827	+	_, stillParking := d.resume.parking[token]
828	-	otherAfter := d.parking[otherToken]	828	+	otherAfter := d.resume.parking[otherToken]
829		d.mu.Unlock()	829		d.mu.Unlock()
830		require.False(t, stillParking, "explicit winner must clear the same attachment's orphaned marker")	830		require.False(t, stillParking, "explicit winner must clear the same attachment's orphaned marker")
831		require.NotNil(t, otherAfter, "explicit winner must not clear another attachment's marker")	831		require.NotNil(t, otherAfter, "explicit winner must not clear another attachment's marker")

@@ -849,15 +849,15 @@ func TestExplicitDetachClearsOrphanedSameAttachmentParkingMarker(t *testing.T) {
849		// scoped to the retired attachment identity.	849		// scoped to the retired attachment identity.
850		require.True(t, d.parkAttachment(otherSess, otherAC))	850		require.True(t, d.parkAttachment(otherSess, otherAC))
851		d.mu.Lock()	851		d.mu.Lock()
852	-	parkedOther := d.parked[otherToken]	852	+	parkedOther := d.resume.parked[otherToken]
853	-	_, otherStillParking := d.parking[otherToken]	853	+	_, otherStillParking := d.resume.parking[otherToken]
854		d.mu.Unlock()	854		d.mu.Unlock()
855		require.NotNil(t, parkedOther, "subsequent park must publish the other attachment")	855		require.NotNil(t, parkedOther, "subsequent park must publish the other attachment")
856		require.False(t, otherStillParking, "park consumes the other attachment's in-flight marker")	856		require.False(t, otherStillParking, "park consumes the other attachment's in-flight marker")
857			857
858		d.clearParkingInFlight(otherToken, ac)	858		d.clearParkingInFlight(otherToken, ac)
859		d.mu.Lock()	859		d.mu.Lock()
860	-	parkedAfterMismatchedClear := d.parked[otherToken]	860	+	parkedAfterMismatchedClear := d.resume.parked[otherToken]
861		d.mu.Unlock()	861		d.mu.Unlock()
862		require.Same(t, parkedOther, parkedAfterMismatchedClear, "mismatched clear must not drop a subsequent parked lifecycle")	862		require.Same(t, parkedOther, parkedAfterMismatchedClear, "mismatched clear must not drop a subsequent parked lifecycle")
863		}	863		}

@@ -927,7 +927,7 @@ func TestLiveResumeRejectsLateMarkerAfterTerminalCleanupWins(t *testing.T) {
927		tc.win(t, d, sess, ac, oldTr, token)	927		tc.win(t, d, sess, ac, oldTr, token)
928			928
929		d.mu.Lock()	929		d.mu.Lock()
930	-	_, parkingBeforeRelease := d.parking[token]	930	+	_, parkingBeforeRelease := d.resume.parking[token]
931		d.mu.Unlock()	931		d.mu.Unlock()
932		require.False(t, parkingBeforeRelease, "terminal cleanup must not leave a parking marker before late mark resumes")	932		require.False(t, parkingBeforeRelease, "terminal cleanup must not leave a parking marker before late mark resumes")
933			933

@@ -940,8 +940,8 @@ func TestLiveResumeRejectsLateMarkerAfterTerminalCleanupWins(t *testing.T) {
940		require.Contains(t, pe.Error(), "resume token is no longer valid")	940		require.Contains(t, pe.Error(), "resume token is no longer valid")
941			941
942		d.mu.Lock()	942		d.mu.Lock()
943	-	_, stillParking := d.parking[token]	943	+	_, stillParking := d.resume.parking[token]
944	-	_, stillParked := d.parked[token]	944	+	_, stillParked := d.resume.parked[token]
945		d.mu.Unlock()	945		d.mu.Unlock()
946		require.False(t, stillParking, "late markParkingInFlight must not recreate a parking marker after terminal cleanup")	946		require.False(t, stillParking, "late markParkingInFlight must not recreate a parking marker after terminal cleanup")
947		require.False(t, stillParked, "terminal cleanup must not leave a parked credential")	947		require.False(t, stillParked, "terminal cleanup must not leave a parked credential")

@@ -964,14 +964,14 @@ func TestLiveResumeRejectsLateMarkerAfterTerminalCleanupWins(t *testing.T) {
964		require.Zero(t, d.markParkingInFlight(sess, ac), "detached active attachment must not publish a late marker")	964		require.Zero(t, d.markParkingInFlight(sess, ac), "detached active attachment must not publish a late marker")
965			965
966		d.mu.Lock()	966		d.mu.Lock()
967	-	_, parkingBeforePark := d.parking[token]	967	+	_, parkingBeforePark := d.resume.parking[token]
968		d.mu.Unlock()	968		d.mu.Unlock()
969		require.False(t, parkingBeforePark)	969		require.False(t, parkingBeforePark)
970			970
971		require.True(t, d.parkAttachment(sess, ac), "direct parkAttachment after detach must still park without recreating an in-flight marker")	971		require.True(t, d.parkAttachment(sess, ac), "direct parkAttachment after detach must still park without recreating an in-flight marker")
972		d.mu.Lock()	972		d.mu.Lock()
973	-	parked := d.parked[token]	973	+	parked := d.resume.parked[token]
974	-	_, stillParking := d.parking[token]	974	+	_, stillParking := d.resume.parking[token]
975		d.mu.Unlock()	975		d.mu.Unlock()
976		require.NotNil(t, parked)	976		require.NotNil(t, parked)
977		require.Same(t, ac, parked.ac)	977		require.Same(t, ac, parked.ac)

@@ -1054,7 +1054,7 @@ func TestResumeLiveAttachmentParkFailureRetiresOldTransport(t *testing.T) {
1054		require.Nil(t, ac.transport(), "failed live park must revoke the captured old transport")	1054		require.Nil(t, ac.transport(), "failed live park must revoke the captured old transport")
1055		require.True(t, oldTr.Closed(), "failed live park must close the captured old transport")	1055		require.True(t, oldTr.Closed(), "failed live park must close the captured old transport")
1056		d.mu.Lock()	1056		d.mu.Lock()
1057	-	_, parked := d.parked[token]	1057	+	_, parked := d.resume.parked[token]
1058		d.mu.Unlock()	1058		d.mu.Unlock()
1059		require.False(t, parked, "failed live park must not publish a resume credential")	1059		require.False(t, parked, "failed live park must not publish a resume credential")
1060		}	1060		}

@@ -1124,7 +1124,7 @@ func TestResumeClientIDMismatchDoesNotConsumeParkedToken(t *testing.T) {
1124		wrongClient.ClientID = [16]byte{9, 9, 9, 9}	1124		wrongClient.ClientID = [16]byte{9, 9, 9, 9}
1125		_, _, ok, err := d.resumeParked(wrongClient, &closeTrackingTransport{}, domain.Size{Cols: 80, Rows: 24})	1125		_, _, ok, err := d.resumeParked(wrongClient, &closeTrackingTransport{}, domain.Size{Cols: 80, Rows: 24})
1126		d.mu.Lock()	1126		d.mu.Lock()
1127	-	_, stillParked := d.parked[token]	1127	+	_, stillParked := d.resume.parked[token]
1128		d.mu.Unlock()	1128		d.mu.Unlock()
1129		require.Error(t, err)	1129		require.Error(t, err)
1130		require.False(t, ok)	1130		require.False(t, ok)

@@ -1221,7 +1221,7 @@ func TestParkingReleasesPaneCapturesBeforeHeadlessCloseAndResume(t *testing.T) {
1221		d.paint(sess, ac, true, nil)	1221		d.paint(sess, ac, true, nil)
1222			1222
1223		ac.sendMu.Lock()	1223		ac.sendMu.Lock()
1224	-	require.Contains(t, ac.captureFrames, closed, "fixture must render and capture the pane before parking")	1224	+	require.Contains(t, ac.render.panes, closed, "fixture must render and capture the pane before parking")
1225		ac.sendMu.Unlock()	1225		ac.sendMu.Unlock()
1226		token := ac.resumeToken	1226		token := ac.resumeToken
1227		require.True(t, sess.detachIfCurrent(ac))	1227		require.True(t, sess.detachIfCurrent(ac))

@@ -1231,7 +1231,7 @@ func TestParkingReleasesPaneCapturesBeforeHeadlessCloseAndResume(t *testing.T) {
1231		// Its capture must already have been released before the attachment parked.	1231		// Its capture must already have been released before the attachment parked.
1232		require.NoError(t, d.closePane(sess, tb, closed.id, nil, false))	1232		require.NoError(t, d.closePane(sess, tb, closed.id, nil, false))
1233		ac.sendMu.Lock()	1233		ac.sendMu.Lock()
1234	-	require.NotContains(t, ac.captureFrames, closed, "parked attachment must not retain a pane closed while headless")	1234	+	require.NotContains(t, ac.render.panes, closed, "parked attachment must not retain a pane closed while headless")
1235		ac.sendMu.Unlock()	1235		ac.sendMu.Unlock()
1236			1236
1237		newTransport := &closeTrackingTransport{}	1237		newTransport := &closeTrackingTransport{}

@@ -1262,7 +1262,7 @@ func TestExplicitDetachDoesNotPark(t *testing.T) {
1262		require.NoError(t, err)	1262		require.NoError(t, err)
1263		d.clientGone(sess, ac, ac.transport(), true)	1263		d.clientGone(sess, ac, ac.transport(), true)
1264		d.mu.Lock()	1264		d.mu.Lock()
1265	-	parked := len(d.parked)	1265	+	parked := len(d.resume.parked)
1266		d.mu.Unlock()	1266		d.mu.Unlock()
1267		require.Zero(t, parked)	1267		require.Zero(t, parked)
1268		}	1268		}

@@ -1282,7 +1282,7 @@ func TestResumeParkUsesConfiguredGraceAndExpiresOnlyAfterGrace(t *testing.T) {
1282		timer := <-clk.timers	1282		timer := <-clk.timers
1283		require.Equal(t, 20*time.Minute, timer.duration)	1283		require.Equal(t, 20*time.Minute, timer.duration)
1284		d.mu.Lock()	1284		d.mu.Lock()
1285	-	_, parkedBeforeGrace := d.parked[token]	1285	+	_, parkedBeforeGrace := d.resume.parked[token]
1286		d.mu.Unlock()	1286		d.mu.Unlock()
1287		require.True(t, parkedBeforeGrace, "parked attachment remains before configured grace timer fires")	1287		require.True(t, parkedBeforeGrace, "parked attachment remains before configured grace timer fires")
1288			1288

@@ -1290,7 +1290,7 @@ func TestResumeParkUsesConfiguredGraceAndExpiresOnlyAfterGrace(t *testing.T) {
1290		require.Eventually(t, func() bool {	1290		require.Eventually(t, func() bool {
1291		d.mu.Lock()	1291		d.mu.Lock()
1292		defer d.mu.Unlock()	1292		defer d.mu.Unlock()
1293	-	_, ok := d.parked[token]	1293	+	_, ok := d.resume.parked[token]
1294		return !ok	1294		return !ok
1295		}, 2time.Second, 10time.Millisecond)	1295		}, 2time.Second, 10time.Millisecond)
1296		}	1296		}

@@ -1310,7 +1310,7 @@ func TestParkExpiryAndShutdownCleanup(t *testing.T) {
1310		require.Eventually(t, func() bool {	1310		require.Eventually(t, func() bool {
1311		d.mu.Lock()	1311		d.mu.Lock()
1312		defer d.mu.Unlock()	1312		defer d.mu.Unlock()
1313	-	_, ok := d.parked[token]	1313	+	_, ok := d.resume.parked[token]
1314		return !ok	1314		return !ok
1315		}, 2time.Second, 10time.Millisecond)	1315		}, 2time.Second, 10time.Millisecond)
1316			1316

@@ -1323,7 +1323,7 @@ func TestParkExpiryAndShutdownCleanup(t *testing.T) {
1323		d2.clientGone(sess2, ac2, ac2.transport(), false)	1323		d2.clientGone(sess2, ac2, ac2.transport(), false)
1324		d2.shutdownAll(protocol.ReasonServerShutdown)	1324		d2.shutdownAll(protocol.ReasonServerShutdown)
1325		d2.mu.Lock()	1325		d2.mu.Lock()
1326	-	parked := len(d2.parked)	1326	+	parked := len(d2.resume.parked)
1327		d2.mu.Unlock()	1327		d2.mu.Unlock()
1328		require.Zero(t, parked)	1328		require.Zero(t, parked)
1329		}	1329		}

@@ -1340,7 +1340,7 @@ func TestLiveParkAndResumeRetainsAttachmentWithoutDaemonHistory(t *testing.T) {
1340			1340
1341		token := ac.resumeToken	1341		token := ac.resumeToken
1342		d.mu.Lock()	1342		d.mu.Lock()
1343	-	parked := d.parked[token]	1343	+	parked := d.resume.parked[token]
1344		d.mu.Unlock()	1344		d.mu.Unlock()
1345		require.NotNil(t, parked)	1345		require.NotNil(t, parked)
1346			1346

@@ -1381,7 +1381,7 @@ func TestDiscardingParkedAttachmentDoesNotOwnPreviousSession(t *testing.T) {
1381		d.clientGone(sess, ac, ac.transport(), false)	1381		d.clientGone(sess, ac, ac.transport(), false)
1382			1382
1383		d.mu.Lock()	1383		d.mu.Lock()
1384	-	parked := d.parked[ac.resumeToken]	1384	+	parked := d.resume.parked[ac.resumeToken]
1385		require.NotNil(t, parked)	1385		require.NotNil(t, parked)
1386		retirements := tc.discard(d, ac.resumeToken, parked)	1386		retirements := tc.discard(d, ac.resumeToken, parked)
1387		d.mu.Unlock()	1387		d.mu.Unlock()

@@ -1411,7 +1411,7 @@ func TestEphemeralParkExpiryKeepsSessionWhenCloseOnExitOff(t *testing.T) {
1411		require.Eventually(t, func() bool {	1411		require.Eventually(t, func() bool {
1412		d.mu.Lock()	1412		d.mu.Lock()
1413		defer d.mu.Unlock()	1413		defer d.mu.Unlock()
1414	-	_, ok := d.parked[token]	1414	+	_, ok := d.resume.parked[token]
1415		return !ok	1415		return !ok
1416		}, 2time.Second, 10time.Millisecond)	1416		}, 2time.Second, 10time.Millisecond)
1417			1417

@@ -1433,7 +1433,7 @@ func TestKilledSessionPurgesParkedResumeToken(t *testing.T) {
1433			1433
1434		require.NoError(t, d.killSession(sess, protocol.ReasonSessionKilled, true))	1434		require.NoError(t, d.killSession(sess, protocol.ReasonSessionKilled, true))
1435		d.mu.Lock()	1435		d.mu.Lock()
1436	-	_, parked := d.parked[token]	1436	+	_, parked := d.resume.parked[token]
1437		d.mu.Unlock()	1437		d.mu.Unlock()
1438		_, _, ok, err := d.resumeParked(helloResumeCapable(protocol.IntentResume, "work", token), &closeTrackingTransport{}, domain.Size{Cols: 80, Rows: 24})	1438		_, _, ok, err := d.resumeParked(helloResumeCapable(protocol.IntentResume, "work", token), &closeTrackingTransport{}, domain.Size{Cols: 80, Rows: 24})
1439		require.False(t, parked, "killSession purges parked token")	1439		require.False(t, parked, "killSession purges parked token")

@@ -1470,8 +1470,8 @@ func TestKilledSessionUnblocksParkingWaiterFailsClosed(t *testing.T) {
1470			1470
1471		require.Equal(t, token, d.markParkingInFlight(sess, ac))	1471		require.Equal(t, token, d.markParkingInFlight(sess, ac))
1472		d.mu.Lock()	1472		d.mu.Lock()
1473	-	parkingMarker := d.parking[token]	1473	+	parkingMarker := d.resume.parking[token]
1474	-	otherMarker := d.parking[otherToken]	1474	+	otherMarker := d.resume.parking[otherToken]
1475		d.mu.Unlock()	1475		d.mu.Unlock()
1476		require.NotNil(t, parkingMarker, "fixture: parking marker must be published before kill")	1476		require.NotNil(t, parkingMarker, "fixture: parking marker must be published before kill")
1477		require.Same(t, ac, parkingMarker.ac)	1477		require.Same(t, ac, parkingMarker.ac)

@@ -1492,8 +1492,8 @@ func TestKilledSessionUnblocksParkingWaiterFailsClosed(t *testing.T) {
1492		require.True(t, waited, "waiter must observe the session marker before it is purged")	1492		require.True(t, waited, "waiter must observe the session marker before it is purged")
1493			1493
1494		d.mu.Lock()	1494		d.mu.Lock()
1495	-	_, stillParking := d.parking[token]	1495	+	_, stillParking := d.resume.parking[token]
1496	-	otherAfter := d.parking[otherToken]	1496	+	otherAfter := d.resume.parking[otherToken]
1497		otherRegistered := d.sessions[otherSess.id] == otherSess	1497		otherRegistered := d.sessions[otherSess.id] == otherSess
1498		closing := d.closing	1498		closing := d.closing
1499		d.mu.Unlock()	1499		d.mu.Unlock()

M internal/usecase/daemon/resume_wake_incarnation_test.go +1 -1


@@ -55,7 +55,7 @@ func TestParkedResumeRejectsDispatchedWakeFromPriorAttachment(t *testing.T) {
55		<-wakeDone	55		<-wakeDone
56		require.Empty(t, newTransport.Sends(), "a stale pre-resume wake must not emit Output before Welcome")	56		require.Empty(t, newTransport.Sends(), "a stale pre-resume wake must not emit Output before Welcome")
57		ac.sendMu.Lock()	57		ac.sendMu.Lock()
58	-	staleWakeComposed := ac.pipelineCache.valid	58	+	staleWakeComposed := ac.render.cache.valid
59		ac.sendMu.Unlock()	59		ac.sendMu.Unlock()
60		require.False(t, staleWakeComposed, "a stale wake must not mutate the resumed attachment shadow")	60		require.False(t, staleWakeComposed, "a stale wake must not mutate the resumed attachment shadow")
61			61

M internal/usecase/daemon/session_admission.go +2 -5

 func (d *Daemon) resumeTokenOwnedSession(token uint64) *session {
 	d.mu.Lock()
 	defer d.mu.Unlock()
-	if parked := d.parked[token]; parked != nil {
+	if sess := d.resume.sessionFor(token); sess != nil {
-		return parked.sess
+		return sess
-	}
-	if pending := d.parking[token]; pending != nil {
-		return pending.sess
 	}
 	for _, sess := range d.sessions {
 		if sess == nil {

M internal/usecase/daemon/session_admission_test.go +1 -1


@@ -684,7 +684,7 @@ func TestRouteResumeRejectsMismatchedAdmittedTargetBeforeClaim(t *testing.T) {
684		require.Equal(t, protocol.ErrNoSuchTarget, protocolErr.code)	684		require.Equal(t, protocol.ErrNoSuchTarget, protocolErr.code)
685			685
686		d.mu.Lock()	686		d.mu.Lock()
687	-	parked := d.parked[token]	687	+	parked := d.resume.parked[token]
688		claimed := parked != nil && parked.claimed	688		claimed := parked != nil && parked.claimed
689		d.mu.Unlock()	689		d.mu.Unlock()
690		require.NotNil(t, parked, "a mismatched admitted target must not remove the parked credential")	690		require.NotNil(t, parked, "a mismatched admitted target must not remove the parked credential")

M internal/usecase/daemon/status_test.go +6 -6


@@ -51,9 +51,9 @@ func TestApplyConfigThemeRepaintInvalidatesComposedFrameCache(t *testing.T) {
51			51
52		d.paint(sess, ac, true, nil)	52		d.paint(sess, ac, true, nil)
53		ac.sendMu.Lock()	53		ac.sendMu.Lock()
54	-	require.True(t, ac.pipelineCache.valid)	54	+	require.True(t, ac.render.cache.valid)
55	-	lightDimmedPane := ac.pipelineCache.frame.At(21, 1).Style	55	+	lightDimmedPane := ac.render.cache.frame.At(21, 1).Style
56	-	lightDivider := ac.pipelineCache.frame.At(20, 1).Style	56	+	lightDivider := ac.render.cache.frame.At(20, 1).Style
57		ac.sendMu.Unlock()	57		ac.sendMu.Unlock()
58		left.mu.Lock()	58		left.mu.Lock()
59		left.screen.ClearDamage()	59		left.screen.ClearDamage()

@@ -66,9 +66,9 @@ func TestApplyConfigThemeRepaintInvalidatesComposedFrameCache(t *testing.T) {
66			66
67		ac.sendMu.Lock()	67		ac.sendMu.Lock()
68		defer ac.sendMu.Unlock()	68		defer ac.sendMu.Unlock()
69	-	require.True(t, ac.pipelineCache.valid, "reset=false config repaint should rebuild the composed cache")	69	+	require.True(t, ac.render.cache.valid, "reset=false config repaint should rebuild the composed cache")
70	-	require.NotEqual(t, lightDimmedPane, ac.pipelineCache.frame.At(21, 1).Style, "dimmed pane style must not stay cached across theme reapply")	70	+	require.NotEqual(t, lightDimmedPane, ac.render.cache.frame.At(21, 1).Style, "dimmed pane style must not stay cached across theme reapply")
71	-	require.NotEqual(t, lightDivider, ac.pipelineCache.frame.At(20, 1).Style, "divider style must not stay cached across theme reapply")	71	+	require.NotEqual(t, lightDivider, ac.render.cache.frame.At(20, 1).Style, "divider style must not stay cached across theme reapply")
72		}	72		}
73			73
74		func TestStatusCompositionGolden(t *testing.T) {	74		func TestStatusCompositionGolden(t *testing.T) {

M internal/usecase/daemon/ui_fence_render_test.go +1 -1


@@ -84,7 +84,7 @@ func TestUIFencePreRegistrationCaptureCannotConfirmAction(t *testing.T) {
84		}	84		}
85		emit := func(state *capturedRenderState) {	85		emit := func(state *capturedRenderState) {
86		t.Helper()	86		t.Helper()
87	-	composed := composeFrame(*state, ac.pipelineCache)	87	+	composed := composeFrame(*state, ac.render.cache)
88		require.True(t, d.publishCapturedFrameForTest(sess, ac, state, composed))	88		require.True(t, d.publishCapturedFrameForTest(sess, ac, state, composed))
89		}	89		}
90		state := capture(true)	90		state := capture(true)

M internal/usecase/daemon/ui_render_publication_test.go +2 -2


@@ -21,7 +21,7 @@ func TestRenderPublicationUsesCapturedIdentityAndRevision(t *testing.T) {
21		want := state.viewContext()	21		want := state.viewContext()
22		want.Publication = 1	22		want.Publication = 1
23		require.NoError(t, want.Validate())	23		require.NoError(t, want.Validate())
24	-	composed := composeFrame(*state, ac.pipelineCache)	24	+	composed := composeFrame(*state, ac.render.cache)
25		switch scenario {	25		switch scenario {
26		case "rename after capture":	26		case "rename after capture":
27		sess.mu.Lock()	27		sess.mu.Lock()

@@ -58,7 +58,7 @@ func TestRenderPublishesContextWithoutTerminalBytes(t *testing.T) {
58		ac.sendMu.Unlock()	58		ac.sendMu.Unlock()
59		t.Fatal("capture rejected")	59		t.Fatal("capture rejected")
60		}	60		}
61	-	composed := composeFrame(*state, ac.pipelineCache)	61	+	composed := composeFrame(*state, ac.render.cache)
62		require.True(t, d.publishCapturedFrameForTest(sess, ac, state, composed))	62		require.True(t, d.publishCapturedFrameForTest(sess, ac, state, composed))
63		}	63		}
64		paint(true)	64		paint(true)