Merge pull request #160 from bnema/feat/remote-picker

feat(remote): unify remote sessions in the picker

commit: 7d5c4cb17892457667a6f7085d175da9df249203
author: bnema · 2mo ago · 2026-07-31 18:01 UTC
committer: GitHub · 2mo ago · 2026-07-31 18:01 UTC
merge of: 3f4b8b3 + bd9d2c0 · diff against the first parent
signature: GPG UnverifiedB5690EEEBB952194 The key is unknown

19 files · +1958 -87

M internal/usecase/daemon/client_transport_errors.go +2 -3


@@ -54,7 +54,6 @@ func (d Daemon) finishClientGone(sess session, ac *attachedClient, failed port
54	54		if rc := sess.renderCoordinator(); rc != nil {
55	55		rc.noteDetach(ac)
56	56		}
57		-	d.unregisterPreview(ac)
58	57		sess.mu.Lock()
59	58		ephemeral := sess.ephemeral
60	59		sess.mu.Unlock()

@@ -75,6 +74,7 @@ func (d Daemon) finishClientGone(sess session, ac *attachedClient, failed port
75	74		// attachment parking marker left by a raced non-explicit teardown so
76	75		// IntentResume waiters are not stranded on a never-published park.
77	76		d.clearParkingInFlight(ac.resumeToken, ac)
	77	+	d.closePicker(ac)
78	78
79	79		d.resetScreenDefaultColors(sess)
80	80		ac.clearPreviousSession()

@@ -131,7 +131,6 @@ func (d Daemon) detachProxyOnSendError(p proxySession, ac *attachedClient, fai
131	131		d.unregisterPreview(ac)
132	132		ac.clearPreviousSession()
133	133		_ = ac.closeCapturedTransport(failed)
134		-	d.armProxyWarm(p)
135	134		d.log.Warn("detached proxy client after send error", "host", p.key.Host, "session", p.key.Name)
136	135		}
137	136

@@ -177,13 +176,13 @@ func (d Daemon) finishSendErrorDetach(sess session, ac *attachedClient, failed
177	176		if rc := sess.renderCoordinator(); rc != nil {
178	177		rc.noteDetach(ac)
179	178		}
180		-	d.unregisterPreview(ac)
181	179		if d.parkAttachment(sess, ac) {
182	180		_ = ac.closeCapturedTransport(failed)
183	181		d.log.Warn("parked client after send error", "session", sess.name)
184	182		return
185	183		}
186	184		d.clearParkingInFlight(ac.resumeToken, ac)
	185	+	d.closePicker(ac)
187	186		d.resetScreenDefaultColors(sess)
188	187		ac.clearPreviousSession()
189	188		_ = ac.closeCapturedTransport(failed)

 	if rc := sess.renderCoordinator(); rc != nil {
 		rc.noteDetach(ac)
 	}
-	d.unregisterPreview(ac)
 	sess.mu.Lock()
 	ephemeral := sess.ephemeral
 	sess.mu.Unlock()
 	// attachment parking marker left by a raced non-explicit teardown so
 	// IntentResume waiters are not stranded on a never-published park.
 	d.clearParkingInFlight(ac.resumeToken, ac)
+	d.closePicker(ac)
 	d.resetScreenDefaultColors(sess)
 	ac.clearPreviousSession()
 	d.unregisterPreview(ac)
 	ac.clearPreviousSession()
 	_ = ac.closeCapturedTransport(failed)
-	d.armProxyWarm(p)
 	d.log.Warn("detached proxy client after send error", "host", p.key.Host, "session", p.key.Name)
 }
 	if rc := sess.renderCoordinator(); rc != nil {
 		rc.noteDetach(ac)
 	}
-	d.unregisterPreview(ac)
 	if d.parkAttachment(sess, ac) {
 		_ = ac.closeCapturedTransport(failed)
 		d.log.Warn("parked client after send error", "session", sess.name)
 		return
 	}
 	d.clearParkingInFlight(ac.resumeToken, ac)
+	d.closePicker(ac)
 	d.resetScreenDefaultColors(sess)
 	ac.clearPreviousSession()
 	_ = ac.closeCapturedTransport(failed)

M internal/usecase/daemon/control_test.go +14 -6


@@ -150,7 +150,7 @@ func TestHandleCommandRejectsVersionBeforeDecodeOrDispatch(t *testing.T) {
150	150		tr, sends, _ := newConn(t, frame)
151	151
152	152		d := newTestDaemon(t, nil, stubClock{})
153		-	d.handleCommand(tr, frame)
	153	+	require.NoError(t, d.handleCommand(tr, frame))
154	154
155	155		result := awaitCommandResult(t, sends)
156	156		require.False(t, result.OK)

@@ -773,7 +773,9 @@ func TestHandleCommandSerializesSelfTargetOnNonActiveTab(t *testing.T) {
773	773		firstTransport, firstSends, _ := newConn(t, firstFrame)
774	774		firstDone := make(chan struct{})
775	775		go func() {
776		-	d.handleCommand(firstTransport, firstFrame)
	776	+	if err := d.handleCommand(firstTransport, firstFrame); err != nil {
	777	+	t.Errorf("handle first command: %v", err)
	778	+	}
777	779		close(firstDone)
778	780		}()
779	781		select {

@@ -789,7 +791,9 @@ func TestHandleCommandSerializesSelfTargetOnNonActiveTab(t *testing.T) {
789	791		secondTransport, secondSends, _ := newConn(t, secondFrame)
790	792		secondDone := make(chan struct{})
791	793		go func() {
792		-	d.handleCommand(secondTransport, secondFrame)
	794	+	if err := d.handleCommand(secondTransport, secondFrame); err != nil {
	795	+	t.Errorf("handle second command: %v", err)
	796	+	}
793	797		close(secondDone)
794	798		}()
795	799		select {

@@ -1146,12 +1150,16 @@ func TestHandleCommandOppositeMoveCommandsDoNotDeadlock(t *testing.T) {
1146	1150		done := make(chan struct{}, 2)
1147	1151		go func() {
1148	1152		<-start
1149		-	d.handleCommand(leftTransport, leftFrame)
	1153	+	if err := d.handleCommand(leftTransport, leftFrame); err != nil {
	1154	+	t.Errorf("handle left command: %v", err)
	1155	+	}
1150	1156		done <- struct{}{}
1151	1157		}()
1152	1158		go func() {
1153	1159		<-start
1154		-	d.handleCommand(rightTransport, rightFrame)
	1160	+	if err := d.handleCommand(rightTransport, rightFrame); err != nil {
	1161	+	t.Errorf("handle right command: %v", err)
	1162	+	}
1155	1163		done <- struct{}{}
1156	1164		}()
1157	1165		close(start)

@@ -1194,7 +1202,7 @@ func sendCommand(t testing.T, d Daemon, request ports.CommandRequest) ports.Co
1194	1202		t.Helper()
1195	1203		frame := commandFrame(t, request)
1196	1204		tr, sends, _ := newConn(t, frame)
1197		-	d.handleCommand(tr, frame)
	1205	+	require.NoError(t, d.handleCommand(tr, frame))
1198	1206		return awaitCommandResult(t, sends)
1199	1207		}
1200	1208

 	tr, sends, _ := newConn(t, frame)
 	d := newTestDaemon(t, nil, stubClock{})
-	d.handleCommand(tr, frame)
+	require.NoError(t, d.handleCommand(tr, frame))
 	result := awaitCommandResult(t, sends)
 	require.False(t, result.OK)
 	firstTransport, firstSends, _ := newConn(t, firstFrame)
 	firstDone := make(chan struct{})
 	go func() {
-		d.handleCommand(firstTransport, firstFrame)
+		if err := d.handleCommand(firstTransport, firstFrame); err != nil {
+			t.Errorf("handle first command: %v", err)
+		}
 		close(firstDone)
 	}()
 	select {
 	secondTransport, secondSends, _ := newConn(t, secondFrame)
 	secondDone := make(chan struct{})
 	go func() {
-		d.handleCommand(secondTransport, secondFrame)
+		if err := d.handleCommand(secondTransport, secondFrame); err != nil {
+			t.Errorf("handle second command: %v", err)
+		}
 		close(secondDone)
 	}()
 	select {
 	done := make(chan struct{}, 2)
 	go func() {
 		<-start
-		d.handleCommand(leftTransport, leftFrame)
+		if err := d.handleCommand(leftTransport, leftFrame); err != nil {
+			t.Errorf("handle left command: %v", err)
+		}
 		done <- struct{}{}
 	}()
 	go func() {
 		<-start
-		d.handleCommand(rightTransport, rightFrame)
+		if err := d.handleCommand(rightTransport, rightFrame); err != nil {
+			t.Errorf("handle right command: %v", err)
+		}
 		done <- struct{}{}
 	}()
 	close(start)
 	t.Helper()
 	frame := commandFrame(t, request)
 	tr, sends, _ := newConn(t, frame)
-	d.handleCommand(tr, frame)
+	require.NoError(t, d.handleCommand(tr, frame))
 	return awaitCommandResult(t, sends)
 }

M internal/usecase/daemon/daemon.go +12 -8


@@ -334,12 +334,13 @@ type Daemon struct {
334	334		}
335	335
336	336		type parkedAttachment struct {
337		-	sess *session
338		-	ac *attachedClient
339		-	role attachmentRole
340		-	timer ports.Timer
341		-	done chan struct{}
342		-	doneOnce sync.Once
	337	+	sess *session
	338	+	ac *attachedClient
	339	+	role attachmentRole
	340	+	pickerGeneration uint64
	341	+	timer ports.Timer
	342	+	done chan struct{}
	343	+	doneOnce sync.Once
343	344		}
344	345
345	346		// parkingAttachment is the observable detach→park lifecycle for one resume

@@ -795,6 +796,7 @@ func (d *Daemon) shutdownAll(reason uint8) (checkpointIncomplete bool) {
795	796		}
796	797
797	798		func (d Daemon) shutdownAllWithSnapshotDeadline(reason uint8, deadline snapshotShutdownDeadline) (checkpointIncomplete bool) {
	799	+	d.cancelRemotePickerRefresh()
798	800		d.closeMoveLifecycles()
799	801		d.mu.Lock()
800	802		d.closing = true

@@ -803,7 +805,7 @@ func (d Daemon) shutdownAllWithSnapshotDeadline(reason uint8, deadline snapsho
803	805		snapshot := d.sessionsSnapshotLocked()
804	806		empty := len(snapshot) == 0
805	807		d.mu.Unlock()
806		-	finishParkedAttachmentRetirements(parkedRetirements)
	808	+	d.finishParkedAttachmentRetirements(parkedRetirements)
807	809		d.log.Info("graceful shutdown begin", "reason", reason, "sessions", len(snapshot))
808	810		if empty {
809	811		d.doneOnce.Do(func() { close(d.done) })

@@ -970,7 +972,9 @@ func (d *Daemon) handleConn(tr ports.Transport) {
970	972		case ports.MsgList:
971	973		d.handleList(tr)
972	974		case ports.MsgCommand:
973		-	d.handleCommand(tr, first)
	975	+	if err := d.handleCommand(tr, first); err != nil {
	976	+	d.log.Warn("command handler failed", "err", err)
	977	+	}
974	978		case ports.MsgKill:
975	979		d.handleKill(tr, first)
976	980		case ports.MsgHello:

 }
 type parkedAttachment struct {
-	sess     *session
+	sess             *session
-	ac       *attachedClient
+	ac               *attachedClient
-	role     attachmentRole
+	role             attachmentRole
-	timer    ports.Timer
+	pickerGeneration uint64
-	done     chan struct{}
+	timer            ports.Timer
-	doneOnce sync.Once
+	done             chan struct{}
+	doneOnce         sync.Once
 }
 // parkingAttachment is the observable detach→park lifecycle for one resume
 }
 func (d *Daemon) shutdownAllWithSnapshotDeadline(reason uint8, deadline *snapshotShutdownDeadline) (checkpointIncomplete bool) {
+	d.cancelRemotePickerRefresh()
 	d.closeMoveLifecycles()
 	d.mu.Lock()
 	d.closing = true
 	snapshot := d.sessionsSnapshotLocked()
 	empty := len(snapshot) == 0
 	d.mu.Unlock()
-	finishParkedAttachmentRetirements(parkedRetirements)
+	d.finishParkedAttachmentRetirements(parkedRetirements)
 	d.log.Info("graceful shutdown begin", "reason", reason, "sessions", len(snapshot))
 	if empty {
 		d.doneOnce.Do(func() { close(d.done) })
 	case ports.MsgList:
 		d.handleList(tr)
 	case ports.MsgCommand:
-		d.handleCommand(tr, first)
+		if err := d.handleCommand(tr, first); err != nil {
+			d.log.Warn("command handler failed", "err", err)
+		}
 	case ports.MsgKill:
 		d.handleKill(tr, first)
 	case ports.MsgHello:

M internal/usecase/daemon/move_pane_postcommit.go +1 -1


@@ -132,7 +132,7 @@ func (p movePanePostcommitPlan) execute(d *Daemon) {
132	132		d.unregisterPreview(retirement.parked.ac)
133	133		retirement.parked.ac.clearCaptureFrames()
134	134		}
135		-	finishParkedAttachmentRetirements(p.retiredParked)
	135	+	d.finishParkedAttachmentRetirements(p.retiredParked)
136	136		if p.sourceEmpty && p.sourceMetadataValid && d.persistEnabled {
137	137		if err := d.beginSnapshotPurge(p.source.name, p.source.incarnation); err == nil {
138	138		if err := d.finishSnapshotPurge(d.serveCtx, p.source.name, p.source.incarnation); err != nil {


@@ -132,7 +132,7 @@ func (p movePanePostcommitPlan) execute(d *Daemon) {
132		d.unregisterPreview(retirement.parked.ac)	132		d.unregisterPreview(retirement.parked.ac)
133		retirement.parked.ac.clearCaptureFrames()	133		retirement.parked.ac.clearCaptureFrames()
134		}	134		}
135	-	finishParkedAttachmentRetirements(p.retiredParked)	135	+	d.finishParkedAttachmentRetirements(p.retiredParked)
136		if p.sourceEmpty && p.sourceMetadataValid && d.persistEnabled {	136		if p.sourceEmpty && p.sourceMetadataValid && d.persistEnabled {
137		if err := d.beginSnapshotPurge(p.source.name, p.source.incarnation); err == nil {	137		if err := d.beginSnapshotPurge(p.source.name, p.source.incarnation); err == nil {
138		if err := d.finishSnapshotPurge(d.serveCtx, p.source.name, p.source.incarnation); err != nil {	138		if err := d.finishSnapshotPurge(d.serveCtx, p.source.name, p.source.incarnation); err != nil {

M internal/usecase/daemon/move_picker.go +10 -4


@@ -161,16 +161,22 @@ func (d Daemon) refreshPickerOpts(ac attachedClient, opts pickerRefreshOptions
161	161		return
162	162		}
163	163		intent, source := rt.pickerIntent, rt.pickerSource
	164	+	observedModel, observedGeneration := rt.picker, rt.pickerGeneration
164	165		current := picker.SourceFilter{}
165	166		if intent != pickerNavigate \|\| opts.preserveSelection {
166		-	selected, _ := rt.picker.Selected()
167		-	current = picker.SourceFilter{Session: selected.Session, Incarnation: selected.Incarnation, TabID: selected.TabID}
	167	+	cursor, _ := rt.picker.Cursor()
	168	+	current = picker.SourceFilter{
	169	+	Session: cursor.Session, Incarnation: cursor.Incarnation, TabID: cursor.TabID, RemoteKey: cursor.RemoteKey,
	170	+	}
168	171		}
169	172		rt.pickerMu.Unlock()
170	173		model := d.newPickerModel(sess, intent, source, current)
	174	+	if rt.afterPickerRefreshBuild != nil {
	175	+	rt.afterPickerRefreshBuild(model)
	176	+	}
171	177		if intent != pickerNavigate {
172	178		if _, ok := model.Selected(); !ok {
173		-	d.closePicker(ac)
	179	+	d.closePickerIfCurrent(ac, observedModel, observedGeneration)
174	180		return
175	181		}
176	182		}

@@ -180,7 +186,7 @@ func (d Daemon) refreshPickerOpts(ac attachedClient, opts pickerRefreshOptions
180	186		model.SelectNearestRow(opts.nearestRow)
181	187		}
182	188		rt.pickerMu.Lock()
183		-	updated := rt.picker != nil && rt.pickerIntent == intent && rt.pickerSource == source
	189	+	updated := rt.picker == observedModel && rt.pickerGeneration == observedGeneration && rt.pickerIntent == intent && rt.pickerSource == source
184	190		if updated {
185	191		rt.picker = model
186	192		rt.pickerTitle = pickerTitle(pickerSortMode(d.pickerSort.Load()))

 		return
 	}
 	intent, source := rt.pickerIntent, rt.pickerSource
+	observedModel, observedGeneration := rt.picker, rt.pickerGeneration
 	current := picker.SourceFilter{}
 	if intent != pickerNavigate || opts.preserveSelection {
-		selected, _ := rt.picker.Selected()
+		cursor, _ := rt.picker.Cursor()
-		current = picker.SourceFilter{Session: selected.Session, Incarnation: selected.Incarnation, TabID: selected.TabID}
+		current = picker.SourceFilter{
+			Session: cursor.Session, Incarnation: cursor.Incarnation, TabID: cursor.TabID, RemoteKey: cursor.RemoteKey,
+		}
 	}
 	rt.pickerMu.Unlock()
 	model := d.newPickerModel(sess, intent, source, current)
+	if rt.afterPickerRefreshBuild != nil {
+		rt.afterPickerRefreshBuild(model)
+	}
 	if intent != pickerNavigate {
 		if _, ok := model.Selected(); !ok {
-			d.closePicker(ac)
+			d.closePickerIfCurrent(ac, observedModel, observedGeneration)
 			return
 		}
 	}
 		model.SelectNearestRow(opts.nearestRow)
 	}
 	rt.pickerMu.Lock()
-	updated := rt.picker != nil && rt.pickerIntent == intent && rt.pickerSource == source
+	updated := rt.picker == observedModel && rt.pickerGeneration == observedGeneration && rt.pickerIntent == intent && rt.pickerSource == source
 	if updated {
 		rt.picker = model
 		rt.pickerTitle = pickerTitle(pickerSortMode(d.pickerSort.Load()))

M internal/usecase/daemon/move_picker_test.go +42 -0


@@ -9,6 +9,7 @@ import (
9	9
10	10		"github.com/bnema/vev/internal/domain"
11	11		"github.com/bnema/vev/internal/ports"
	12	+	"github.com/bnema/vev/internal/usecase/picker"
12	13		)
13	14
14	15		func setupMovePickerSessions(t testing.T, extraDestinationTabs int) (Daemon, session, attachedClient, session, tab, []func()) {

@@ -314,6 +315,47 @@ func TestMovePickerFinalSourceClosesBeforeSnatchFinalization(t *testing.T) {
314	315		require.Equal(t, ports.MsgOutput, frames[0].Type)
315	316		}
316	317
	318	+	func TestMovePickerRefreshCloseKeepsReplacementPicker(t *testing.T) {
	319	+	d, source, ac, destination, _, releases := setupMovePickerSessions(t, 0)
	320	+	defer releaseAll(releases)
	321	+	require.NoError(t, d.enterPickerForIntent(source, ac, pickerMovePane, moveSourceLocator{
	322	+	Session: moveSessionLocator{ID: source.id, Incarnation: source.incarnation, Name: source.name},
	323	+	TabID: "source-tab", PaneID: "source-pane",
	324	+	}))
	325	+	d.mu.Lock()
	326	+	delete(d.sessions, destination.id)
	327	+	d.mu.Unlock()
	328	+
	329	+	rebuildReached := make(chan struct{})
	330	+	allowClose := make(chan struct{})
	331	+	refreshed := make(chan struct{})
	332	+	ac.overlays.afterPickerRefreshBuild = func(*picker.Model) {
	333	+	close(rebuildReached)
	334	+	<-allowClose
	335	+	}
	336	+	go func() {
	337	+	d.refreshPickerOpts(ac, pickerRefreshOptions{preserveSelection: true, nearestRow: -1})
	338	+	close(refreshed)
	339	+	}()
	340	+	select {
	341	+	case <-rebuildReached:
	342	+	case <-time.After(time.Second):
	343	+	t.Fatal("timed out waiting for move-picker refresh rebuild")
	344	+	}
	345	+
	346	+	replacement := d.newPickerModel(source, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	347	+	d.publishPicker(source, ac, replacement, pickerNavigate, moveSourceLocator{})
	348	+	close(allowClose)
	349	+	select {
	350	+	case <-refreshed:
	351	+	case <-time.After(time.Second):
	352	+	t.Fatal("timed out waiting for move-picker refresh")
	353	+	}
	354	+	ac.overlays.pickerMu.Lock()
	355	+	require.Same(t, replacement, ac.overlays.picker)
	356	+	ac.overlays.pickerMu.Unlock()
	357	+	}
	358	+
317	359		func TestMovePickerDispatchMuNotHeldWhileOpen(t *testing.T) {
318	360		d, source, ac, _, _, releases := setupMovePickerSessions(t, 0)
319	361		defer releaseAll(releases)


@@ -9,6 +9,7 @@ import (
9		9
10	"github.com/bnema/vev/internal/domain"	10		"github.com/bnema/vev/internal/domain"
11	"github.com/bnema/vev/internal/ports"	11		"github.com/bnema/vev/internal/ports"
		12	+	"github.com/bnema/vev/internal/usecase/picker"
12	)	13		)
13		14
14	func setupMovePickerSessions(t testing.T, extraDestinationTabs int) (Daemon, session, attachedClient, session, tab, []func()) {	15		func setupMovePickerSessions(t testing.T, extraDestinationTabs int) (Daemon, session, attachedClient, session, tab, []func()) {

@@ -314,6 +315,47 @@ func TestMovePickerFinalSourceClosesBeforeSnatchFinalization(t *testing.T) {
314	require.Equal(t, ports.MsgOutput, frames[0].Type)	315		require.Equal(t, ports.MsgOutput, frames[0].Type)
315	}	316		}
316		317
		318	+	func TestMovePickerRefreshCloseKeepsReplacementPicker(t *testing.T) {
		319	+	d, source, ac, destination, _, releases := setupMovePickerSessions(t, 0)
		320	+	defer releaseAll(releases)
		321	+	require.NoError(t, d.enterPickerForIntent(source, ac, pickerMovePane, moveSourceLocator{
		322	+	Session: moveSessionLocator{ID: source.id, Incarnation: source.incarnation, Name: source.name},
		323	+	TabID: "source-tab", PaneID: "source-pane",
		324	+	}))
		325	+	d.mu.Lock()
		326	+	delete(d.sessions, destination.id)
		327	+	d.mu.Unlock()
		328	+
		329	+	rebuildReached := make(chan struct{})
		330	+	allowClose := make(chan struct{})
		331	+	refreshed := make(chan struct{})
		332	+	ac.overlays.afterPickerRefreshBuild = func(*picker.Model) {
		333	+	close(rebuildReached)
		334	+	<-allowClose
		335	+	}
		336	+	go func() {
		337	+	d.refreshPickerOpts(ac, pickerRefreshOptions{preserveSelection: true, nearestRow: -1})
		338	+	close(refreshed)
		339	+	}()
		340	+	select {
		341	+	case <-rebuildReached:
		342	+	case <-time.After(time.Second):
		343	+	t.Fatal("timed out waiting for move-picker refresh rebuild")
		344	+	}
		345	+
		346	+	replacement := d.newPickerModel(source, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
		347	+	d.publishPicker(source, ac, replacement, pickerNavigate, moveSourceLocator{})
		348	+	close(allowClose)
		349	+	select {
		350	+	case <-refreshed:
		351	+	case <-time.After(time.Second):
		352	+	t.Fatal("timed out waiting for move-picker refresh")
		353	+	}
		354	+	ac.overlays.pickerMu.Lock()
		355	+	require.Same(t, replacement, ac.overlays.picker)
		356	+	ac.overlays.pickerMu.Unlock()
		357	+	}
		358	+
317	func TestMovePickerDispatchMuNotHeldWhileOpen(t *testing.T) {	359		func TestMovePickerDispatchMuNotHeldWhileOpen(t *testing.T) {
318	d, source, ac, _, _, releases := setupMovePickerSessions(t, 0)	360		d, source, ac, _, _, releases := setupMovePickerSessions(t, 0)
319	defer releaseAll(releases)	361		defer releaseAll(releases)

M internal/usecase/daemon/overlay_runtime.go +16 -2


@@ -16,8 +16,12 @@ import (
16	16		type overlayRuntime struct {
17	17		ac *attachedClient
18	18
19		-	pickerMu sync.Mutex
20		-	picker *picker.Model
	19	+	pickerMu sync.Mutex
	20	+	picker *picker.Model
	21	+	// pickerGeneration identifies one open lifecycle. It advances only when a
	22	+	// picker is published, so delayed close and registration work can prove it
	23	+	// still owns the exact lifecycle it captured.
	24	+	pickerGeneration uint64
21	25		pickerTitle string
22	26		pickerIntent pickerIntent
23	27		pickerSource moveSourceLocator

@@ -27,6 +31,12 @@ type overlayRuntime struct {
27	31		pickerPending []byte
28	32		pickerESC pendingByteTimer
29	33
	34	+	// Test-only, unsynchronized lifecycle seams. Assign them before picker
	35	+	// publication or goroutine startup. Hooks run without pickerMu or
	36	+	// remoteCatalog.mu held.
	37	+	beforeRemotePickerRegistration func()
	38	+	afterPickerRefreshBuild func(*picker.Model)
	39	+
30	40		paletteMu sync.Mutex
31	41		palette *palette.Model
32	42		paletteRecent []recentSession // immutable for this palette interaction

@@ -257,6 +267,7 @@ func (d *Daemon) clearForSnatch(token attachmentRoleToken) bool {
257	267		}
258	268		previewSession := rt.pickerPreviewSession
259	269		previewGeneration := rt.pickerPreviewGeneration
	270	+	pickerInstance := remotePickerInstance{ac: token.ac, generation: rt.pickerGeneration, model: rt.picker}
260	271		rt.picker = nil
261	272		rt.pickerIntent = pickerNavigate
262	273		rt.pickerSource = moveSourceLocator{}

@@ -270,6 +281,9 @@ func (d *Daemon) clearForSnatch(token attachmentRoleToken) bool {
270	281		// Subscription teardown may enter a coordinator and therefore runs outside
271	282		// every overlay-family lock.
272	283		d.teardownPreviewSubscription(token.ac, previewSession, previewGeneration)
	284	+	if pickerInstance.model != nil {
	285	+	d.remotePickerClosed(pickerInstance)
	286	+	}
273	287
274	288		rt.paletteMu.Lock()
275	289		if !current() {

 type overlayRuntime struct {
 	ac *attachedClient
-	pickerMu                sync.Mutex
+	pickerMu sync.Mutex
-	picker                  *picker.Model
+	picker   *picker.Model
+	// pickerGeneration identifies one open lifecycle. It advances only when a
+	// picker is published, so delayed close and registration work can prove it
+	// still owns the exact lifecycle it captured.
+	pickerGeneration        uint64
 	pickerTitle             string
 	pickerIntent            pickerIntent
 	pickerSource            moveSourceLocator
 	pickerPending           []byte
 	pickerESC               pendingByteTimer
+	// Test-only, unsynchronized lifecycle seams. Assign them before picker
+	// publication or goroutine startup. Hooks run without pickerMu or
+	// remoteCatalog.mu held.
+	beforeRemotePickerRegistration func()
+	afterPickerRefreshBuild        func(*picker.Model)
 	paletteMu         sync.Mutex
 	palette           *palette.Model
 	paletteRecent     []recentSession // immutable for this palette interaction
 	}
 	previewSession := rt.pickerPreviewSession
 	previewGeneration := rt.pickerPreviewGeneration
+	pickerInstance := remotePickerInstance{ac: token.ac, generation: rt.pickerGeneration, model: rt.picker}
 	rt.picker = nil
 	rt.pickerIntent = pickerNavigate
 	rt.pickerSource = moveSourceLocator{}
 	// Subscription teardown may enter a coordinator and therefore runs outside
 	// every overlay-family lock.
 	d.teardownPreviewSubscription(token.ac, previewSession, previewGeneration)
+	if pickerInstance.model != nil {
+		d.remotePickerClosed(pickerInstance)
+	}
 	rt.paletteMu.Lock()
 	if !current() {

M internal/usecase/daemon/picker.go +95 -25


@@ -64,6 +64,8 @@ func (d Daemon) publishPicker(sess session, ac attachedClient, model picker.
64	64		rt.pickerPreviewSession = nil
65	65		rt.pickerPreview = nil
66	66		rt.picker = model
	67	+	rt.pickerGeneration++
	68	+	instance := remotePickerInstance{ac: ac, generation: rt.pickerGeneration, model: model}
67	69		rt.pickerTitle = pickerTitle(pickerSortMode(d.pickerSort.Load()))
68	70		rt.pickerIntent = intent
69	71		rt.pickerSource = source

@@ -73,13 +75,24 @@ func (d Daemon) publishPicker(sess session, ac attachedClient, model picker.
73	75		d.teardownPreviewSubscription(ac, previous, previousGeneration)
74	76		d.registerPreviewForSelection(ac)
75	77		d.invalidateRender(sess, ac, true, "picker.go")
	78	+	if rt.beforeRemotePickerRegistration != nil {
	79	+	rt.beforeRemotePickerRegistration()
	80	+	}
	81	+	d.remotePickerOpened(instance)
76	82		}
77	83
78	84		// pickerViews captures one canonical lifecycle/tab snapshot. It intentionally
79	85		// knows nothing about picker intent; picker.New owns all destination policy.
80	86		func (d Daemon) pickerViews(cur session) ([]picker.SessionView, picker.SourceFilter) {
81	87		d.mu.Lock()
82		-	sessions := d.sessionsSnapshotLocked()
	88	+	sessions := make([]attachmentSession, 0, len(d.sessions))
	89	+	proxies := make(map[domain.SessionID]*proxySession)
	90	+	for id, entry := range d.sessions {
	91	+	sessions = append(sessions, entry)
	92	+	if proxy, ok := entry.(*proxySession); ok {
	93	+	proxies[id] = proxy
	94	+	}
	95	+	}
83	96		stopped := make([]stoppedSession, 0, len(d.stopped))
84	97		for _, s := range d.stopped {
85	98		if !s.purging {

@@ -88,29 +101,38 @@ func (d Daemon) pickerViews(cur session) ([]picker.SessionView, picker.SourceF
88	101		}
89	102		d.mu.Unlock()
90	103
91		-	for _, s := range sessions {
92		-	d.refreshSessionFocusedTitles(s)
	104	+	for _, entry := range sessions {
	105	+	if local, ok := localSession(entry); ok {
	106	+	d.refreshSessionFocusedTitles(local)
	107	+	}
93	108		}
94	109		opts := viewOptions{tabDetails: true, focusedTitles: true, terminalTitle: d.currentTabsConfig().TerminalTitle}
95	110
96		-	// One snapshot per session: sorting and view building read the same
	111	+	type liveSnapshot struct {
	112	+	entry attachmentSession
	113	+	view sessionView
	114	+	}
	115	+	// One snapshot per live session: sorting and view building read the same
97	116		// capture, so comparators cannot observe a concurrent touchMRU or
98		-	// renameSession mid-sort (the invariant previously enforced by the
99		-	// pickerSortSnapshot map).
100		-	snaps := make([]sessionView, 0, len(sessions))
	117	+	// renameSession mid-sort. Proxy and remote-catalog locks are released before
	118	+	// sorting and picker-row construction.
	119	+	live := make([]liveSnapshot, 0, len(sessions))
101	120		var current picker.SourceFilter
102		-	for _, s := range sessions {
103		-	snap := s.snapshotView(opts)
104		-	if s == cur && snap.active >= 0 && snap.active < len(snap.tabs) {
	121	+	for _, entry := range sessions {
	122	+	snap := entry.snapshotView(opts)
	123	+	if entry == cur && snap.active >= 0 && snap.active < len(snap.tabs) {
105	124		current = picker.SourceFilter{Session: snap.id, Incarnation: snap.incarnation, TabID: snap.tabs[snap.active].id}
106	125		}
107		-	snaps = append(snaps, snap)
	126	+	live = append(live, liveSnapshot{entry: entry, view: snap})
108	127		}
109		-	sort.Slice(snaps, func(i, j int) bool {
110		-	if snaps[i].mruAt != snaps[j].mruAt {
111		-	return snaps[i].mruAt > snaps[j].mruAt
	128	+	sort.Slice(live, func(i, j int) bool {
	129	+	if live[i].view.mruAt != live[j].view.mruAt {
	130	+	return live[i].view.mruAt > live[j].view.mruAt
	131	+	}
	132	+	if live[i].view.name != live[j].view.name {
	133	+	return live[i].view.name < live[j].view.name
112	134		}
113		-	return snaps[i].name < snaps[j].name
	135	+	return live[i].view.id < live[j].view.id
114	136		})
115	137		sort.Slice(stopped, func(i, j int) bool {
116	138		if stopped[i].lastUsedSeq != stopped[j].lastUsedSeq {

@@ -121,14 +143,43 @@ func (d Daemon) pickerViews(cur session) ([]picker.SessionView, picker.SourceF
121	143		if pickerSortMode(d.pickerSort.Load()) == pickerSortGrouped {
122	144		// Stable partition: named sessions first, ephemeral after, each keeping
123	145		// its MRU order from the sort above.
124		-	sort.SliceStable(snaps, func(i, j int) bool {
125		-	return !snaps[i].ephemeral && snaps[j].ephemeral
	146	+	sort.SliceStable(live, func(i, j int) bool {
	147	+	return !live[i].view.ephemeral && live[j].view.ephemeral
126	148		})
127	149		}
128	150
129		-	views := make([]picker.SessionView, 0, len(snaps)+len(stopped))
130		-	for _, snap := range snaps {
131		-	views = append(views, snap.pickerView())
	151	+	catalog := d.remotePickerCatalogSnapshot()
	152	+	sortRemotePickerCatalog(catalog, d.remotePickerHostRanks())
	153	+
	154	+	catalogRows := 0
	155	+	for _, host := range catalog {
	156	+	catalogRows += len(host.entry.Sessions)
	157	+	if len(host.entry.Sessions) == 0 && (host.status == remoteHostUnreachable \|\| host.status == remoteHostVersionMismatch) {
	158	+	catalogRows++
	159	+	}
	160	+	}
	161	+	views := make([]picker.SessionView, 0, len(live)+len(stopped)+catalogRows)
	162	+	for _, item := range live {
	163	+	if proxy, ok := item.entry.(*proxySession); ok {
	164	+	views = append(views, remoteProxyPickerView(proxy.key, item.view))
	165	+	continue
	166	+	}
	167	+	views = append(views, item.view.pickerView())
	168	+	}
	169	+	for _, host := range catalog {
	170	+	for _, session := range host.entry.Sessions {
	171	+	key := domain.RemoteSessionKey{Host: host.entry.Host, Name: session.Name}
	172	+	if key.Validate() != nil {
	173	+	continue
	174	+	}
	175	+	if proxy, ok := proxies[key.ID()]; ok && proxy.key == key {
	176	+	continue
	177	+	}
	178	+	views = append(views, remotePickerView(key, session, host.status, host.entry.FetchedAt))
	179	+	}
	180	+	if len(host.entry.Sessions) == 0 && (host.status == remoteHostUnreachable \|\| host.status == remoteHostVersionMismatch) {
	181	+	views = append(views, remotePickerHostView(host.entry.Host, host.status))
	182	+	}
132	183		}
133	184		for _, s := range stopped {
134	185		createdAt := s.createdAt

@@ -165,7 +216,8 @@ func attentionSuffix(label string) string {
165	216
166	217		func (d Daemon) pickerListInputState(ac attachedClient) listInputState {
167	218		rt := ac.overlays
168		-	var generation uint64
	219	+	var previewGeneration uint64
	220	+	var instance remotePickerInstance
169	221		return listInputState{
170	222		pending: &rt.pickerPending,
171	223		esc: &rt.pickerESC,

@@ -175,13 +227,15 @@ func (d Daemon) pickerListInputState(ac attachedClient) listInputState {
175	227		unlock: rt.pickerMu.Unlock,
176	228		active: func() bool { return rt.picker != nil },
177	229		closeLocked: func() {
	230	+	instance = remotePickerInstance{ac: ac, generation: rt.pickerGeneration, model: rt.picker}
178	231		rt.picker = nil
179	232		rt.pickerIntent = pickerNavigate
180	233		rt.pickerSource = moveSourceLocator{}
181		-	generation = rt.pickerPreviewGeneration
	234	+	previewGeneration = rt.pickerPreviewGeneration
182	235		},
183	236		afterClose: func() {
184		-	d.clearPreviewGeneration(ac, generation)
	237	+	d.clearPreviewGeneration(ac, previewGeneration)
	238	+	d.remotePickerClosed(instance)
185	239		if sess := ac.currentSession(); sess != nil {
186	240		d.invalidateRender(sess, ac, true, "picker.go")
187	241		}

@@ -451,16 +505,32 @@ func (d Daemon) clearDestroyedTabPreview(tb tab) {
451	505		}
452	506
453	507		func (d Daemon) closePicker(ac attachedClient) {
	508	+	d.closePickerIfCurrent(ac, nil, 0)
	509	+	}
	510	+
	511	+	// closePickerIfCurrent closes only the observed picker lifecycle. A nonzero
	512	+	// generation guards terminal parked cleanup even when a refresh replaced the
	513	+	// model within that generation.
	514	+	func (d Daemon) closePickerIfCurrent(ac attachedClient, model *picker.Model, generation uint64) bool {
454	515		ac.overlays.pickerMu.Lock()
	516	+	if model != nil && (ac.overlays.picker != model \|\| ac.overlays.pickerGeneration != generation) \|\| model == nil && generation != 0 && ac.overlays.pickerGeneration != generation {
	517	+	ac.overlays.pickerMu.Unlock()
	518	+	return false
	519	+	}
	520	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: ac.overlays.picker}
455	521		ac.overlays.picker = nil
456	522		ac.overlays.pickerTitle = ""
457	523		ac.overlays.pickerIntent = pickerNavigate
458	524		ac.overlays.pickerSource = moveSourceLocator{}
459	525		ac.overlays.pickerPending = nil
460	526		ac.overlays.pickerESC.stop()
461		-	generation := ac.overlays.pickerPreviewGeneration
	527	+	previewGeneration := ac.overlays.pickerPreviewGeneration
462	528		ac.overlays.pickerMu.Unlock()
463		-	d.clearPreviewGeneration(ac, generation)
	529	+	d.clearPreviewGeneration(ac, previewGeneration)
	530	+	if instance.model != nil {
	531	+	d.remotePickerClosed(instance)
	532	+	}
	533	+	return true
464	534		}
465	535
466	536		func pickerTargetsEqual(left, right picker.Target) bool {


@@ -64,6 +64,8 @@ func (d Daemon) publishPicker(sess session, ac attachedClient, model picker.
64		rt.pickerPreviewSession = nil	64		rt.pickerPreviewSession = nil
65		rt.pickerPreview = nil	65		rt.pickerPreview = nil
66		rt.picker = model	66		rt.picker = model
			67	+	rt.pickerGeneration++
			68	+	instance := remotePickerInstance{ac: ac, generation: rt.pickerGeneration, model: model}
67		rt.pickerTitle = pickerTitle(pickerSortMode(d.pickerSort.Load()))	69		rt.pickerTitle = pickerTitle(pickerSortMode(d.pickerSort.Load()))
68		rt.pickerIntent = intent	70		rt.pickerIntent = intent
69		rt.pickerSource = source	71		rt.pickerSource = source

@@ -73,13 +75,24 @@ func (d Daemon) publishPicker(sess session, ac attachedClient, model picker.
73		d.teardownPreviewSubscription(ac, previous, previousGeneration)	75		d.teardownPreviewSubscription(ac, previous, previousGeneration)
74		d.registerPreviewForSelection(ac)	76		d.registerPreviewForSelection(ac)
75		d.invalidateRender(sess, ac, true, "picker.go")	77		d.invalidateRender(sess, ac, true, "picker.go")
			78	+	if rt.beforeRemotePickerRegistration != nil {
			79	+	rt.beforeRemotePickerRegistration()
			80	+	}
			81	+	d.remotePickerOpened(instance)
76		}	82		}
77			83
78		// pickerViews captures one canonical lifecycle/tab snapshot. It intentionally	84		// pickerViews captures one canonical lifecycle/tab snapshot. It intentionally
79		// knows nothing about picker intent; picker.New owns all destination policy.	85		// knows nothing about picker intent; picker.New owns all destination policy.
80		func (d Daemon) pickerViews(cur session) ([]picker.SessionView, picker.SourceFilter) {	86		func (d Daemon) pickerViews(cur session) ([]picker.SessionView, picker.SourceFilter) {
81		d.mu.Lock()	87		d.mu.Lock()
82	-	sessions := d.sessionsSnapshotLocked()	88	+	sessions := make([]attachmentSession, 0, len(d.sessions))
			89	+	proxies := make(map[domain.SessionID]*proxySession)
			90	+	for id, entry := range d.sessions {
			91	+	sessions = append(sessions, entry)
			92	+	if proxy, ok := entry.(*proxySession); ok {
			93	+	proxies[id] = proxy
			94	+	}
			95	+	}
83		stopped := make([]stoppedSession, 0, len(d.stopped))	96		stopped := make([]stoppedSession, 0, len(d.stopped))
84		for _, s := range d.stopped {	97		for _, s := range d.stopped {
85		if !s.purging {	98		if !s.purging {

@@ -88,29 +101,38 @@ func (d Daemon) pickerViews(cur session) ([]picker.SessionView, picker.SourceF
88		}	101		}
89		d.mu.Unlock()	102		d.mu.Unlock()
90			103
91	-	for _, s := range sessions {	104	+	for _, entry := range sessions {
92	-	d.refreshSessionFocusedTitles(s)	105	+	if local, ok := localSession(entry); ok {
			106	+	d.refreshSessionFocusedTitles(local)
			107	+	}
93		}	108		}
94		opts := viewOptions{tabDetails: true, focusedTitles: true, terminalTitle: d.currentTabsConfig().TerminalTitle}	109		opts := viewOptions{tabDetails: true, focusedTitles: true, terminalTitle: d.currentTabsConfig().TerminalTitle}
95			110
96	-	// One snapshot per session: sorting and view building read the same	111	+	type liveSnapshot struct {
			112	+	entry attachmentSession
			113	+	view sessionView
			114	+	}
			115	+	// One snapshot per live session: sorting and view building read the same
97		// capture, so comparators cannot observe a concurrent touchMRU or	116		// capture, so comparators cannot observe a concurrent touchMRU or
98	-	// renameSession mid-sort (the invariant previously enforced by the	117	+	// renameSession mid-sort. Proxy and remote-catalog locks are released before
99	-	// pickerSortSnapshot map).	118	+	// sorting and picker-row construction.
100	-	snaps := make([]sessionView, 0, len(sessions))	119	+	live := make([]liveSnapshot, 0, len(sessions))
101		var current picker.SourceFilter	120		var current picker.SourceFilter
102	-	for _, s := range sessions {	121	+	for _, entry := range sessions {
103	-	snap := s.snapshotView(opts)	122	+	snap := entry.snapshotView(opts)
104	-	if s == cur && snap.active >= 0 && snap.active < len(snap.tabs) {	123	+	if entry == cur && snap.active >= 0 && snap.active < len(snap.tabs) {
105		current = picker.SourceFilter{Session: snap.id, Incarnation: snap.incarnation, TabID: snap.tabs[snap.active].id}	124		current = picker.SourceFilter{Session: snap.id, Incarnation: snap.incarnation, TabID: snap.tabs[snap.active].id}
106		}	125		}
107	-	snaps = append(snaps, snap)	126	+	live = append(live, liveSnapshot{entry: entry, view: snap})
108		}	127		}
109	-	sort.Slice(snaps, func(i, j int) bool {	128	+	sort.Slice(live, func(i, j int) bool {
110	-	if snaps[i].mruAt != snaps[j].mruAt {	129	+	if live[i].view.mruAt != live[j].view.mruAt {
111	-	return snaps[i].mruAt > snaps[j].mruAt	130	+	return live[i].view.mruAt > live[j].view.mruAt
			131	+	}
			132	+	if live[i].view.name != live[j].view.name {
			133	+	return live[i].view.name < live[j].view.name
112		}	134		}
113	-	return snaps[i].name < snaps[j].name	135	+	return live[i].view.id < live[j].view.id
114		})	136		})
115		sort.Slice(stopped, func(i, j int) bool {	137		sort.Slice(stopped, func(i, j int) bool {
116		if stopped[i].lastUsedSeq != stopped[j].lastUsedSeq {	138		if stopped[i].lastUsedSeq != stopped[j].lastUsedSeq {

@@ -121,14 +143,43 @@ func (d Daemon) pickerViews(cur session) ([]picker.SessionView, picker.SourceF
121		if pickerSortMode(d.pickerSort.Load()) == pickerSortGrouped {	143		if pickerSortMode(d.pickerSort.Load()) == pickerSortGrouped {
122		// Stable partition: named sessions first, ephemeral after, each keeping	144		// Stable partition: named sessions first, ephemeral after, each keeping
123		// its MRU order from the sort above.	145		// its MRU order from the sort above.
124	-	sort.SliceStable(snaps, func(i, j int) bool {	146	+	sort.SliceStable(live, func(i, j int) bool {
125	-	return !snaps[i].ephemeral && snaps[j].ephemeral	147	+	return !live[i].view.ephemeral && live[j].view.ephemeral
126		})	148		})
127		}	149		}
128			150
129	-	views := make([]picker.SessionView, 0, len(snaps)+len(stopped))	151	+	catalog := d.remotePickerCatalogSnapshot()
130	-	for _, snap := range snaps {	152	+	sortRemotePickerCatalog(catalog, d.remotePickerHostRanks())
131	-	views = append(views, snap.pickerView())	153	+
			154	+	catalogRows := 0
			155	+	for _, host := range catalog {
			156	+	catalogRows += len(host.entry.Sessions)
			157	+	if len(host.entry.Sessions) == 0 && (host.status == remoteHostUnreachable \|\| host.status == remoteHostVersionMismatch) {
			158	+	catalogRows++
			159	+	}
			160	+	}
			161	+	views := make([]picker.SessionView, 0, len(live)+len(stopped)+catalogRows)
			162	+	for _, item := range live {
			163	+	if proxy, ok := item.entry.(*proxySession); ok {
			164	+	views = append(views, remoteProxyPickerView(proxy.key, item.view))
			165	+	continue
			166	+	}
			167	+	views = append(views, item.view.pickerView())
			168	+	}
			169	+	for _, host := range catalog {
			170	+	for _, session := range host.entry.Sessions {
			171	+	key := domain.RemoteSessionKey{Host: host.entry.Host, Name: session.Name}
			172	+	if key.Validate() != nil {
			173	+	continue
			174	+	}
			175	+	if proxy, ok := proxies[key.ID()]; ok && proxy.key == key {
			176	+	continue
			177	+	}
			178	+	views = append(views, remotePickerView(key, session, host.status, host.entry.FetchedAt))
			179	+	}
			180	+	if len(host.entry.Sessions) == 0 && (host.status == remoteHostUnreachable \|\| host.status == remoteHostVersionMismatch) {
			181	+	views = append(views, remotePickerHostView(host.entry.Host, host.status))
			182	+	}
132		}	183		}
133		for _, s := range stopped {	184		for _, s := range stopped {
134		createdAt := s.createdAt	185		createdAt := s.createdAt

@@ -165,7 +216,8 @@ func attentionSuffix(label string) string {
165			216
166		func (d Daemon) pickerListInputState(ac attachedClient) listInputState {	217		func (d Daemon) pickerListInputState(ac attachedClient) listInputState {
167		rt := ac.overlays	218		rt := ac.overlays
168	-	var generation uint64	219	+	var previewGeneration uint64
			220	+	var instance remotePickerInstance
169		return listInputState{	221		return listInputState{
170		pending: &rt.pickerPending,	222		pending: &rt.pickerPending,
171		esc: &rt.pickerESC,	223		esc: &rt.pickerESC,

@@ -175,13 +227,15 @@ func (d Daemon) pickerListInputState(ac attachedClient) listInputState {
175		unlock: rt.pickerMu.Unlock,	227		unlock: rt.pickerMu.Unlock,
176		active: func() bool { return rt.picker != nil },	228		active: func() bool { return rt.picker != nil },
177		closeLocked: func() {	229		closeLocked: func() {
			230	+	instance = remotePickerInstance{ac: ac, generation: rt.pickerGeneration, model: rt.picker}
178		rt.picker = nil	231		rt.picker = nil
179		rt.pickerIntent = pickerNavigate	232		rt.pickerIntent = pickerNavigate
180		rt.pickerSource = moveSourceLocator{}	233		rt.pickerSource = moveSourceLocator{}
181	-	generation = rt.pickerPreviewGeneration	234	+	previewGeneration = rt.pickerPreviewGeneration
182		},	235		},
183		afterClose: func() {	236		afterClose: func() {
184	-	d.clearPreviewGeneration(ac, generation)	237	+	d.clearPreviewGeneration(ac, previewGeneration)
			238	+	d.remotePickerClosed(instance)
185		if sess := ac.currentSession(); sess != nil {	239		if sess := ac.currentSession(); sess != nil {
186		d.invalidateRender(sess, ac, true, "picker.go")	240		d.invalidateRender(sess, ac, true, "picker.go")
187		}	241		}

@@ -451,16 +505,32 @@ func (d Daemon) clearDestroyedTabPreview(tb tab) {
451		}	505		}
452			506
453		func (d Daemon) closePicker(ac attachedClient) {	507		func (d Daemon) closePicker(ac attachedClient) {
			508	+	d.closePickerIfCurrent(ac, nil, 0)
			509	+	}
			510	+
			511	+	// closePickerIfCurrent closes only the observed picker lifecycle. A nonzero
			512	+	// generation guards terminal parked cleanup even when a refresh replaced the
			513	+	// model within that generation.
			514	+	func (d Daemon) closePickerIfCurrent(ac attachedClient, model *picker.Model, generation uint64) bool {
454		ac.overlays.pickerMu.Lock()	515		ac.overlays.pickerMu.Lock()
			516	+	if model != nil && (ac.overlays.picker != model \|\| ac.overlays.pickerGeneration != generation) \|\| model == nil && generation != 0 && ac.overlays.pickerGeneration != generation {
			517	+	ac.overlays.pickerMu.Unlock()
			518	+	return false
			519	+	}
			520	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: ac.overlays.picker}
455		ac.overlays.picker = nil	521		ac.overlays.picker = nil
456		ac.overlays.pickerTitle = ""	522		ac.overlays.pickerTitle = ""
457		ac.overlays.pickerIntent = pickerNavigate	523		ac.overlays.pickerIntent = pickerNavigate
458		ac.overlays.pickerSource = moveSourceLocator{}	524		ac.overlays.pickerSource = moveSourceLocator{}
459		ac.overlays.pickerPending = nil	525		ac.overlays.pickerPending = nil
460		ac.overlays.pickerESC.stop()	526		ac.overlays.pickerESC.stop()
461	-	generation := ac.overlays.pickerPreviewGeneration	527	+	previewGeneration := ac.overlays.pickerPreviewGeneration
462		ac.overlays.pickerMu.Unlock()	528		ac.overlays.pickerMu.Unlock()
463	-	d.clearPreviewGeneration(ac, generation)	529	+	d.clearPreviewGeneration(ac, previewGeneration)
			530	+	if instance.model != nil {
			531	+	d.remotePickerClosed(instance)
			532	+	}
			533	+	return true
464		}	534		}
465			535
466		func pickerTargetsEqual(left, right picker.Target) bool {	536		func pickerTargetsEqual(left, right picker.Target) bool {

M internal/usecase/daemon/proxy_lifecycle.go +3 -1


@@ -117,7 +117,7 @@ func (d Daemon) armProxyWarm(p proxySession) bool {
117	117		// expireWarmProxy removes only the exact dormant proxy pointer and lifecycle
118	118		// generation. The canonical d.mu -> core.mu -> proxy.mu order is held only for
119	119		// validation/publication; cancellation, coordinator teardown, transport close,
120		-	// and daemon completion happen afterward.
	120	+	// picker refresh, and daemon completion happen afterward.
121	121		func (d Daemon) expireWarmProxy(p proxySession, token *proxyWarmTimer) bool {
122	122		if d == nil \|\| p == nil \|\| token == nil {
123	123		return false

@@ -176,6 +176,8 @@ func (d Daemon) expireWarmProxy(p proxySession, token *proxyWarmTimer) bool {
176	176		p.finish()
177	177		if empty {
178	178		d.doneOnce.Do(func() { close(d.done) })
	179	+	} else {
	180	+	d.refreshRemoteOpenPickers()
179	181		}
180	182		return true
181	183		}

 // expireWarmProxy removes only the exact dormant proxy pointer and lifecycle
 // generation. The canonical d.mu -> core.mu -> proxy.mu order is held only for
 // validation/publication; cancellation, coordinator teardown, transport close,
-// and daemon completion happen afterward.
+// picker refresh, and daemon completion happen afterward.
 func (d *Daemon) expireWarmProxy(p *proxySession, token *proxyWarmTimer) bool {
 	if d == nil || p == nil || token == nil {
 		return false
 	p.finish()
 	if empty {
 		d.doneOnce.Do(func() { close(d.done) })
+	} else {
+		d.refreshRemoteOpenPickers()
 	}
 	return true
 }

M internal/usecase/daemon/proxy_lifecycle_test.go +22 -0


@@ -162,6 +162,28 @@ func TestArmProxyWarmKeepsExpiryPathWhenPublicationFails(t *testing.T) {
162	162		}
163	163		}
164	164
	165	+	func TestDetachProxyIfCurrentTransportArmsExpiredProxy(t *testing.T) {
	166	+	d, p, clock := newProxyLifecycleFixture(t)
	167	+	transport := newProxyTestTransport()
	168	+	t.Cleanup(func() { _ = transport.Close() })
	169	+	ac := &attachedClient{tr: transport, output: newOutputStateStream()}
	170	+	ac.setSession(p)
	171	+	setProxyLifecycleClient(p, ac)
	172	+	p.mu.Lock()
	173	+	p.expired = true
	174	+	p.mu.Unlock()
	175	+
	176	+	require.True(t, d.detachProxyIfCurrentTransport(p, ac, ac.transportSnapshot()))
	177	+	awaitTestValue(t, clock.timers, "expired proxy detach did not arm a warm timer")
	178	+	token, generation := proxyWarmToken(p)
	179	+	require.NotNil(t, token, "expired headless proxy has no expiry path")
	180	+	require.Equal(t, generation, token.generation)
	181	+	require.Nil(t, ac.currentAttachmentSession())
	182	+
	183	+	token.stop()
	184	+	awaitTestCompletion(t, token.done, "warm timer did not stop during cleanup")
	185	+	}
	186	+
165	187		func TestMarkProxyReplacedWarmTimerOwnership(t *testing.T) {
166	188		t.Run("rekeys an already armed timer", func(t *testing.T) {
167	189		d, p, clock := newProxyLifecycleFixture(t)


@@ -162,6 +162,28 @@ func TestArmProxyWarmKeepsExpiryPathWhenPublicationFails(t *testing.T) {
162	}	162		}
163	}	163		}
164		164
		165	+	func TestDetachProxyIfCurrentTransportArmsExpiredProxy(t *testing.T) {
		166	+	d, p, clock := newProxyLifecycleFixture(t)
		167	+	transport := newProxyTestTransport()
		168	+	t.Cleanup(func() { _ = transport.Close() })
		169	+	ac := &attachedClient{tr: transport, output: newOutputStateStream()}
		170	+	ac.setSession(p)
		171	+	setProxyLifecycleClient(p, ac)
		172	+	p.mu.Lock()
		173	+	p.expired = true
		174	+	p.mu.Unlock()
		175	+
		176	+	require.True(t, d.detachProxyIfCurrentTransport(p, ac, ac.transportSnapshot()))
		177	+	awaitTestValue(t, clock.timers, "expired proxy detach did not arm a warm timer")
		178	+	token, generation := proxyWarmToken(p)
		179	+	require.NotNil(t, token, "expired headless proxy has no expiry path")
		180	+	require.Equal(t, generation, token.generation)
		181	+	require.Nil(t, ac.currentAttachmentSession())
		182	+
		183	+	token.stop()
		184	+	awaitTestCompletion(t, token.done, "warm timer did not stop during cleanup")
		185	+	}
		186	+
165	func TestMarkProxyReplacedWarmTimerOwnership(t *testing.T) {	187		func TestMarkProxyReplacedWarmTimerOwnership(t *testing.T) {
166	t.Run("rekeys an already armed timer", func(t *testing.T) {	188		t.Run("rekeys an already armed timer", func(t *testing.T) {
167	d, p, clock := newProxyLifecycleFixture(t)	189		d, p, clock := newProxyLifecycleFixture(t)

M internal/usecase/daemon/remote_catalog_state.go +8 -1

@@ -1,6 +1,7 @@
1	1		package daemon
2	2
3	3		import (
	4	+	"context"
4	5		"sort"
5	6		"sync"
6	7		"time"

@@ -25,6 +26,9 @@ type remoteCatalogState struct {
25	26		cache map[string]ports.RemoteCatalogCacheEntry
26	27		status map[string]remoteHostStatus
27	28		failure map[string]time.Time
	29	+	refresh uint64
	30	+	cancel context.CancelFunc
	31	+	pickers map[*attachedClient]struct{}
28	32		writeMu sync.Mutex
29	33		}
30	34

@@ -33,14 +37,17 @@ func newRemoteCatalogState() remoteCatalogState {
33	37		cache: make(map[string]ports.RemoteCatalogCacheEntry),
34	38		status: make(map[string]remoteHostStatus),
35	39		failure: make(map[string]time.Time),
	40	+	pickers: make(map[*attachedClient]struct{}),
36	41		}
37	42		}
38	43
39	44		func cloneRemoteCatalogEntry(entry ports.RemoteCatalogCacheEntry) ports.RemoteCatalogCacheEntry {
	45	+	sessions := make([]ports.RemoteCatalogSession, len(entry.Sessions))
	46	+	copy(sessions, entry.Sessions)
40	47		return ports.RemoteCatalogCacheEntry{
41	48		Host: entry.Host,
42	49		FetchedAt: entry.FetchedAt,
43		-	Sessions: append([]ports.RemoteCatalogSession(nil), entry.Sessions...),
	50	+	Sessions: sessions,
44	51		}
45	52		}
46	53

 package daemon
 import (
+	"context"
 	"sort"
 	"sync"
 	"time"
 	cache   map[string]ports.RemoteCatalogCacheEntry
 	status  map[string]remoteHostStatus
 	failure map[string]time.Time
+	refresh uint64
+	cancel  context.CancelFunc
+	pickers map[*attachedClient]struct{}
 	writeMu sync.Mutex
 }
 		cache:   make(map[string]ports.RemoteCatalogCacheEntry),
 		status:  make(map[string]remoteHostStatus),
 		failure: make(map[string]time.Time),
+		pickers: make(map[*attachedClient]struct{}),
 	}
 }
 func cloneRemoteCatalogEntry(entry ports.RemoteCatalogCacheEntry) ports.RemoteCatalogCacheEntry {
+	sessions := make([]ports.RemoteCatalogSession, len(entry.Sessions))
+	copy(sessions, entry.Sessions)
 	return ports.RemoteCatalogCacheEntry{
 		Host:      entry.Host,
 		FetchedAt: entry.FetchedAt,
-		Sessions:  append([]ports.RemoteCatalogSession(nil), entry.Sessions...),
+		Sessions:  sessions,
 	}
 }

A internal/usecase/daemon/remote_picker.go +461 -0

@@ -0,0 +1,461 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"context"
	5	+	"encoding/base64"
	6	+	"errors"
	7	+	"fmt"
	8	+	"sort"
	9	+	"time"
	10	+
	11	+	"github.com/bnema/vev/internal/domain"
	12	+	"github.com/bnema/vev/internal/ports"
	13	+	"github.com/bnema/vev/internal/usecase/picker"
	14	+	)
	15	+
	16	+	type remotePickerCatalogEntry struct {
	17	+	entry ports.RemoteCatalogCacheEntry
	18	+	status remoteHostStatus
	19	+	}
	20	+
	21	+	// remotePickerInstance is an immutable ownership capability for one published
	22	+	// picker lifecycle. The model identity prevents delayed registration from
	23	+	// attaching ownership to a replacement within the same client.
	24	+	type remotePickerInstance struct {
	25	+	ac *attachedClient
	26	+	generation uint64
	27	+	model *picker.Model
	28	+	}
	29	+
	30	+	// remotePickerCatalogSnapshot copies the cache-derived state needed for a
	31	+	// picker before any row sorting begins. No remote-state lock survives this
	32	+	// snapshot.
	33	+	func (d *Daemon) remotePickerCatalogSnapshot() []remotePickerCatalogEntry {
	34	+	if d == nil {
	35	+	return nil
	36	+	}
	37	+	d.remoteCatalog.mu.Lock()
	38	+	entries := make([]remotePickerCatalogEntry, 0, len(d.remoteCatalog.cache)+len(d.remoteCatalog.status))
	39	+	seen := make(map[string]struct{}, len(d.remoteCatalog.cache))
	40	+	for host, entry := range d.remoteCatalog.cache {
	41	+	entries = append(entries, remotePickerCatalogEntry{
	42	+	entry: cloneRemoteCatalogEntry(entry),
	43	+	status: d.remoteCatalog.status[host],
	44	+	})
	45	+	seen[host] = struct{}{}
	46	+	}
	47	+	for host, status := range d.remoteCatalog.status {
	48	+	if _, exists := seen[host]; exists \|\| (status != remoteHostUnreachable && status != remoteHostVersionMismatch) {
	49	+	continue
	50	+	}
	51	+	entries = append(entries, remotePickerCatalogEntry{
	52	+	entry: ports.RemoteCatalogCacheEntry{Host: host},
	53	+	status: status,
	54	+	})
	55	+	}
	56	+	d.remoteCatalog.mu.Unlock()
	57	+	return entries
	58	+	}
	59	+
	60	+	func (d *Daemon) remotePickerHostRanks() map[string]int {
	61	+	ranks := make(map[string]int)
	62	+	if d == nil \|\| d.remoteHostStore == nil {
	63	+	return ranks
	64	+	}
	65	+	pinned, learned, err := d.remoteHostStore.Hosts()
	66	+	if err != nil {
	67	+	d.log.Warn("listing remote hosts for picker failed", "err", err)
	68	+	return ranks
	69	+	}
	70	+	for _, host := range append(pinned, learned...) {
	71	+	if _, exists := ranks[host]; !exists {
	72	+	ranks[host] = len(ranks)
	73	+	}
	74	+	}
	75	+	return ranks
	76	+	}
	77	+
	78	+	func remotePickerAvailability(status remoteHostStatus) picker.RemoteAvailability {
	79	+	switch status {
	80	+	case remoteHostFresh:
	81	+	return picker.RemoteFresh
	82	+	case remoteHostUnreachable:
	83	+	return picker.RemoteStale
	84	+	case remoteHostVersionMismatch:
	85	+	return picker.RemoteVersionMismatch
	86	+	default:
	87	+	return picker.RemoteCached
	88	+	}
	89	+	}
	90	+
	91	+	func remotePickerDetail(tabs uint16) string {
	92	+	if tabs == 1 {
	93	+	return "1 tab"
	94	+	}
	95	+	return fmt.Sprintf("%d tabs", tabs)
	96	+	}
	97	+
	98	+	func remotePickerStatusDetail(status remoteHostStatus, fetchedAt time.Time) string {
	99	+	switch status {
	100	+	case remoteHostUnreachable:
	101	+	if !fetchedAt.IsZero() {
	102	+	return "stale since " + fetchedAt.Format(time.RFC3339)
	103	+	}
	104	+	return "unreachable"
	105	+	case remoteHostVersionMismatch:
	106	+	return "version mismatch"
	107	+	default:
	108	+	return ""
	109	+	}
	110	+	}
	111	+
	112	+	func remotePickerView(key domain.RemoteSessionKey, session ports.RemoteCatalogSession, status remoteHostStatus, fetchedAt time.Time) picker.SessionView {
	113	+	detail := remotePickerStatusDetail(status, fetchedAt)
	114	+	if detail == "" {
	115	+	detail = remotePickerDetail(session.Tabs)
	116	+	}
	117	+	return picker.SessionView{
	118	+	ID: key.ID(),
	119	+	Name: key.Display(),
	120	+	RemoteKey: &key,
	121	+	RemoteHost: key.Host,
	122	+	RemoteAvailability: remotePickerAvailability(status),
	123	+	RemoteDetail: detail,
	124	+	ConnectOnly: true,
	125	+	RemoteAttachReady: false,
	126	+	CannotAcceptMoves: true,
	127	+	}
	128	+	}
	129	+
	130	+	func remotePickerHostView(host string, status remoteHostStatus) picker.SessionView {
	131	+	return picker.SessionView{
	132	+	ID: domain.SessionID("remote-host:" + base64.RawURLEncoding.EncodeToString([]byte(host))),
	133	+	Name: host,
	134	+	RemoteHost: host,
	135	+	RemoteAvailability: remotePickerAvailability(status),
	136	+	RemoteDetail: remotePickerStatusDetail(status, time.Time{}),
	137	+	ConnectOnly: true,
	138	+	CannotAcceptMoves: true,
	139	+	}
	140	+	}
	141	+
	142	+	func remoteProxyPickerView(key domain.RemoteSessionKey, snap sessionView) picker.SessionView {
	143	+	view := snap.pickerView()
	144	+	// Proxy construction uses this same ID and label. Restating them from the
	145	+	// structured key makes the cache-to-live row upgrade independent of mutable
	146	+	// presentation or relayed metadata. Lifecycle is carried separately from
	147	+	// presentation so a display-name change can never spoof expiry.
	148	+	view.ID = key.ID()
	149	+	view.Name = key.Display()
	150	+	if snap.expired {
	151	+	view.Name += " [expired]"
	152	+	}
	153	+	view.TargetName = ""
	154	+	view.RemoteKey = &key
	155	+	view.RemoteAvailability = picker.RemoteFresh
	156	+	view.RemoteDetail = remotePickerDetail(uint16(snap.tabCount))
	157	+	view.ConnectOnly = true
	158	+	view.RemoteAttachReady = false
	159	+	if snap.expired {
	160	+	view.RemoteAvailability = picker.RemoteStale
	161	+	view.RemoteDetail = "expired"
	162	+	view.RemoteAttachReady = false
	163	+	}
	164	+	view.CannotAcceptMoves = true
	165	+	return view
	166	+	}
	167	+
	168	+	func sortRemotePickerCatalog(entries []remotePickerCatalogEntry, ranks map[string]int) {
	169	+	for i := range entries {
	170	+	sort.Slice(entries[i].entry.Sessions, func(left, right int) bool {
	171	+	return entries[i].entry.Sessions[left].Name < entries[i].entry.Sessions[right].Name
	172	+	})
	173	+	}
	174	+	sort.Slice(entries, func(i, j int) bool {
	175	+	left, right := entries[i].entry.Host, entries[j].entry.Host
	176	+	leftRank, leftKnown := ranks[left]
	177	+	rightRank, rightKnown := ranks[right]
	178	+	if leftKnown != rightKnown {
	179	+	return leftKnown
	180	+	}
	181	+	if leftKnown && leftRank != rightRank {
	182	+	return leftRank < rightRank
	183	+	}
	184	+	return left < right
	185	+	})
	186	+	}
	187	+
	188	+	func (d *Daemon) remotePickerOpened(instance remotePickerInstance) {
	189	+	if d.registerRemotePicker(instance) {
	190	+	d.startRemotePickerRefresh(instance)
	191	+	}
	192	+	}
	193	+
	194	+	// registerRemotePicker installs one exact picker generation as a refresh owner.
	195	+	// Keeping this step separate gives refresh startup a second atomic validation
	196	+	// point: a close can win between registration and startup without being undone
	197	+	// by a delayed opener.
	198	+	func (d *Daemon) registerRemotePicker(instance remotePickerInstance) bool {
	199	+	if d == nil \|\| instance.ac == nil \|\| instance.ac.overlays == nil \|\| instance.model == nil {
	200	+	return false
	201	+	}
	202	+	rt := instance.ac.overlays
	203	+	// Picker ownership always nests pickerMu -> remoteCatalog.mu. No path may
	204	+	// acquire pickerMu while retaining the catalog lock.
	205	+	rt.pickerMu.Lock()
	206	+	defer rt.pickerMu.Unlock()
	207	+	if rt.pickerGeneration != instance.generation \|\| rt.picker != instance.model {
	208	+	return false
	209	+	}
	210	+	d.remoteCatalog.mu.Lock()
	211	+	d.remoteCatalog.pickers[instance.ac] = struct{}{}
	212	+	d.remoteCatalog.mu.Unlock()
	213	+	return true
	214	+	}
	215	+
	216	+	func (d *Daemon) remotePickerClosed(instance remotePickerInstance) {
	217	+	if d == nil \|\| instance.ac == nil \|\| instance.ac.overlays == nil \|\| instance.model == nil {
	218	+	return
	219	+	}
	220	+	rt := instance.ac.overlays
	221	+	rt.pickerMu.Lock()
	222	+	current := rt.pickerGeneration == instance.generation && rt.picker == nil
	223	+	if !current {
	224	+	rt.pickerMu.Unlock()
	225	+	return
	226	+	}
	227	+	d.remoteCatalog.mu.Lock()
	228	+	delete(d.remoteCatalog.pickers, instance.ac)
	229	+	if len(d.remoteCatalog.pickers) != 0 {
	230	+	d.remoteCatalog.mu.Unlock()
	231	+	rt.pickerMu.Unlock()
	232	+	return
	233	+	}
	234	+	d.remoteCatalog.refresh++
	235	+	cancel := d.remoteCatalog.cancel
	236	+	d.remoteCatalog.cancel = nil
	237	+	d.remoteCatalog.mu.Unlock()
	238	+	rt.pickerMu.Unlock()
	239	+	if cancel != nil {
	240	+	cancel()
	241	+	}
	242	+	}
	243	+
	244	+	func (d *Daemon) cancelRemotePickerRefresh() {
	245	+	if d == nil {
	246	+	return
	247	+	}
	248	+	d.remoteCatalog.mu.Lock()
	249	+	d.remoteCatalog.refresh++
	250	+	cancel := d.remoteCatalog.cancel
	251	+	d.remoteCatalog.cancel = nil
	252	+	d.remoteCatalog.mu.Unlock()
	253	+	if cancel != nil {
	254	+	cancel()
	255	+	}
	256	+	}
	257	+
	258	+	func (d *Daemon) remotePickerHosts() ([]string, error) {
	259	+	if d == nil \|\| d.remoteHostStore == nil {
	260	+	return nil, nil
	261	+	}
	262	+	pinned, learned, err := d.remoteHostStore.Hosts()
	263	+	if err != nil {
	264	+	return nil, err
	265	+	}
	266	+	hosts := make([]string, 0, len(pinned)+len(learned))
	267	+	seen := make(map[string]struct{}, cap(hosts))
	268	+	add := func(candidates []string) {
	269	+	for _, host := range candidates {
	270	+	if _, exists := seen[host]; exists {
	271	+	continue
	272	+	}
	273	+	seen[host] = struct{}{}
	274	+	hosts = append(hosts, host)
	275	+	}
	276	+	}
	277	+	add(pinned)
	278	+	add(learned)
	279	+	return hosts, nil
	280	+	}
	281	+
	282	+	// startRemotePickerRefresh replaces the current refresh generation and launches
	283	+	// one bounded catalog call per known host. Installing the generation is gated
	284	+	// by the exact picker generation that registered ownership. Host-store and
	285	+	// remote I/O happen after every architecture lock has been released.
	286	+	func (d *Daemon) startRemotePickerRefresh(instance remotePickerInstance) uint64 {
	287	+	if d == nil \|\| instance.ac == nil \|\| instance.ac.overlays == nil \|\| instance.model == nil {
	288	+	return 0
	289	+	}
	290	+	root := context.Background()
	291	+	if d.serveCtx != nil {
	292	+	root = d.serveCtx
	293	+	}
	294	+	ctx, cancel := context.WithCancel(root)
	295	+
	296	+	rt := instance.ac.overlays
	297	+	rt.pickerMu.Lock()
	298	+	d.remoteCatalog.mu.Lock()
	299	+	_, owner := d.remoteCatalog.pickers[instance.ac]
	300	+	current := rt.pickerGeneration == instance.generation && rt.picker == instance.model
	301	+	if !current \|\| !owner \|\| len(d.remoteCatalog.pickers) == 0 {
	302	+	d.remoteCatalog.mu.Unlock()
	303	+	rt.pickerMu.Unlock()
	304	+	cancel()
	305	+	return 0
	306	+	}
	307	+	previous := d.remoteCatalog.cancel
	308	+	d.remoteCatalog.refresh++
	309	+	generation := d.remoteCatalog.refresh
	310	+	d.remoteCatalog.cancel = cancel
	311	+	d.remoteCatalog.mu.Unlock()
	312	+	rt.pickerMu.Unlock()
	313	+	if previous != nil {
	314	+	previous()
	315	+	}
	316	+	if d.remoteCatalogClient == nil {
	317	+	return generation
	318	+	}
	319	+
	320	+	hosts, err := d.remotePickerHosts()
	321	+	if err != nil {
	322	+	d.log.Warn("listing remote hosts for refresh failed", "err", err)
	323	+	return generation
	324	+	}
	325	+	known := make(map[string]struct{}, len(hosts))
	326	+	for _, host := range hosts {
	327	+	known[host] = struct{}{}
	328	+	}
	329	+
	330	+	d.remoteCatalog.mu.Lock()
	331	+	if d.remoteCatalog.refresh != generation {
	332	+	d.remoteCatalog.mu.Unlock()
	333	+	cancel()
	334	+	return generation
	335	+	}
	336	+	cacheChanged := false
	337	+	for host := range d.remoteCatalog.cache {
	338	+	if _, exists := known[host]; exists {
	339	+	continue
	340	+	}
	341	+	delete(d.remoteCatalog.cache, host)
	342	+	delete(d.remoteCatalog.status, host)
	343	+	delete(d.remoteCatalog.failure, host)
	344	+	cacheChanged = true
	345	+	}
	346	+	for _, host := range hosts {
	347	+	d.remoteCatalog.status[host] = remoteHostRefreshing
	348	+	}
	349	+	d.remoteCatalog.mu.Unlock()
	350	+	if cacheChanged {
	351	+	d.persistRemoteCatalogCache()
	352	+	d.refreshRemoteOpenPickers()
	353	+	}
	354	+
	355	+	for _, host := range hosts {
	356	+	d.sessWg.Go(func() {
	357	+	catalog, listErr := d.remoteCatalogClient.List(ctx, host)
	358	+	d.applyRemoteRefreshResult(generation, host, catalog, listErr)
	359	+	})
	360	+	}
	361	+	return generation
	362	+	}
	363	+
	364	+	func containsRemotePickerHost(hosts []string, target string) bool {
	365	+	for _, host := range hosts {
	366	+	if host == target {
	367	+	return true
	368	+	}
	369	+	}
	370	+	return false
	371	+	}
	372	+
	373	+	// applyRemoteRefreshResult publishes one host completion only if both its
	374	+	// refresh generation and current host-registry membership remain authoritative.
	375	+	// Its return reports whether durable cache state changed.
	376	+	func (d *Daemon) applyRemoteRefreshResult(generation uint64, host string, catalog ports.RemoteCatalog, listErr error) bool {
	377	+	if d == nil {
	378	+	return false
	379	+	}
	380	+	d.remoteCatalog.mu.Lock()
	381	+	current := d.remoteCatalog.refresh == generation
	382	+	d.remoteCatalog.mu.Unlock()
	383	+	if !current {
	384	+	return false
	385	+	}
	386	+
	387	+	hosts, hostsErr := d.remotePickerHosts()
	388	+	if hostsErr != nil {
	389	+	d.log.Warn("revalidating remote host refresh failed", "host", host, "err", hostsErr)
	390	+	return false
	391	+	}
	392	+	stillKnown := containsRemotePickerHost(hosts, host)
	393	+	now := d.clock.Now()
	394	+	if listErr == nil && catalog.ProtocolVersion != ports.ProtocolVersion {
	395	+	listErr = &ports.RemoteCatalogVersionMismatchError{Got: catalog.ProtocolVersion, Want: ports.ProtocolVersion}
	396	+	}
	397	+
	398	+	d.remoteCatalog.mu.Lock()
	399	+	if d.remoteCatalog.refresh != generation {
	400	+	d.remoteCatalog.mu.Unlock()
	401	+	return false
	402	+	}
	403	+	if !stillKnown {
	404	+	_, cacheChanged := d.remoteCatalog.cache[host]
	405	+	delete(d.remoteCatalog.cache, host)
	406	+	delete(d.remoteCatalog.status, host)
	407	+	delete(d.remoteCatalog.failure, host)
	408	+	d.remoteCatalog.mu.Unlock()
	409	+	if cacheChanged {
	410	+	d.persistRemoteCatalogCache()
	411	+	d.refreshRemoteOpenPickers()
	412	+	}
	413	+	return cacheChanged
	414	+	}
	415	+	if listErr != nil {
	416	+	status := remoteHostUnreachable
	417	+	var mismatch *ports.RemoteCatalogVersionMismatchError
	418	+	if errors.As(listErr, &mismatch) {
	419	+	status = remoteHostVersionMismatch
	420	+	}
	421	+	d.remoteCatalog.status[host] = status
	422	+	d.remoteCatalog.failure[host] = now
	423	+	d.remoteCatalog.mu.Unlock()
	424	+	d.refreshRemoteOpenPickers()
	425	+	return false
	426	+	}
	427	+	d.remoteCatalog.cache[host] = ports.RemoteCatalogCacheEntry{
	428	+	Host: host,
	429	+	FetchedAt: now,
	430	+	Sessions: append([]ports.RemoteCatalogSession{}, catalog.Sessions...),
	431	+	}
	432	+	d.remoteCatalog.status[host] = remoteHostFresh
	433	+	delete(d.remoteCatalog.failure, host)
	434	+	d.remoteCatalog.mu.Unlock()
	435	+
	436	+	d.persistRemoteCatalogCache()
	437	+	d.refreshRemoteOpenPickers()
	438	+	return true
	439	+	}
	440	+
	441	+	func (d *Daemon) refreshRemoteOpenPickers() {
	442	+	if d == nil {
	443	+	return
	444	+	}
	445	+	d.remoteCatalog.mu.Lock()
	446	+	clients := make([]*attachedClient, 0, len(d.remoteCatalog.pickers))
	447	+	for ac := range d.remoteCatalog.pickers {
	448	+	clients = append(clients, ac)
	449	+	}
	450	+	d.remoteCatalog.mu.Unlock()
	451	+
	452	+	for _, ac := range clients {
	453	+	if ac == nil \|\| ac.overlays == nil {
	454	+	continue
	455	+	}
	456	+	d.refreshPickerOpts(ac, pickerRefreshOptions{preserveSelection: true, nearestRow: -1})
	457	+	if entry := ac.currentAttachmentSession(); entry != nil {
	458	+	d.invalidateRender(entry, ac, true, "remote_picker.go")
	459	+	}
	460	+	}
	461	+	}

@@ -0,0 +1,461 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"context"
	5	+	"encoding/base64"
	6	+	"errors"
	7	+	"fmt"
	8	+	"sort"
	9	+	"time"
	10	+
	11	+	"github.com/bnema/vev/internal/domain"
	12	+	"github.com/bnema/vev/internal/ports"
	13	+	"github.com/bnema/vev/internal/usecase/picker"
	14	+	)
	15	+
	16	+	type remotePickerCatalogEntry struct {
	17	+	entry ports.RemoteCatalogCacheEntry
	18	+	status remoteHostStatus
	19	+	}
	20	+
	21	+	// remotePickerInstance is an immutable ownership capability for one published
	22	+	// picker lifecycle. The model identity prevents delayed registration from
	23	+	// attaching ownership to a replacement within the same client.
	24	+	type remotePickerInstance struct {
	25	+	ac *attachedClient
	26	+	generation uint64
	27	+	model *picker.Model
	28	+	}
	29	+
	30	+	// remotePickerCatalogSnapshot copies the cache-derived state needed for a
	31	+	// picker before any row sorting begins. No remote-state lock survives this
	32	+	// snapshot.
	33	+	func (d *Daemon) remotePickerCatalogSnapshot() []remotePickerCatalogEntry {
	34	+	if d == nil {
	35	+	return nil
	36	+	}
	37	+	d.remoteCatalog.mu.Lock()
	38	+	entries := make([]remotePickerCatalogEntry, 0, len(d.remoteCatalog.cache)+len(d.remoteCatalog.status))
	39	+	seen := make(map[string]struct{}, len(d.remoteCatalog.cache))
	40	+	for host, entry := range d.remoteCatalog.cache {
	41	+	entries = append(entries, remotePickerCatalogEntry{
	42	+	entry: cloneRemoteCatalogEntry(entry),
	43	+	status: d.remoteCatalog.status[host],
	44	+	})
	45	+	seen[host] = struct{}{}
	46	+	}
	47	+	for host, status := range d.remoteCatalog.status {
	48	+	if _, exists := seen[host]; exists \|\| (status != remoteHostUnreachable && status != remoteHostVersionMismatch) {
	49	+	continue
	50	+	}
	51	+	entries = append(entries, remotePickerCatalogEntry{
	52	+	entry: ports.RemoteCatalogCacheEntry{Host: host},
	53	+	status: status,
	54	+	})
	55	+	}
	56	+	d.remoteCatalog.mu.Unlock()
	57	+	return entries
	58	+	}
	59	+
	60	+	func (d *Daemon) remotePickerHostRanks() map[string]int {
	61	+	ranks := make(map[string]int)
	62	+	if d == nil \|\| d.remoteHostStore == nil {
	63	+	return ranks
	64	+	}
	65	+	pinned, learned, err := d.remoteHostStore.Hosts()
	66	+	if err != nil {
	67	+	d.log.Warn("listing remote hosts for picker failed", "err", err)
	68	+	return ranks
	69	+	}
	70	+	for _, host := range append(pinned, learned...) {
	71	+	if _, exists := ranks[host]; !exists {
	72	+	ranks[host] = len(ranks)
	73	+	}
	74	+	}
	75	+	return ranks
	76	+	}
	77	+
	78	+	func remotePickerAvailability(status remoteHostStatus) picker.RemoteAvailability {
	79	+	switch status {
	80	+	case remoteHostFresh:
	81	+	return picker.RemoteFresh
	82	+	case remoteHostUnreachable:
	83	+	return picker.RemoteStale
	84	+	case remoteHostVersionMismatch:
	85	+	return picker.RemoteVersionMismatch
	86	+	default:
	87	+	return picker.RemoteCached
	88	+	}
	89	+	}
	90	+
	91	+	func remotePickerDetail(tabs uint16) string {
	92	+	if tabs == 1 {
	93	+	return "1 tab"
	94	+	}
	95	+	return fmt.Sprintf("%d tabs", tabs)
	96	+	}
	97	+
	98	+	func remotePickerStatusDetail(status remoteHostStatus, fetchedAt time.Time) string {
	99	+	switch status {
	100	+	case remoteHostUnreachable:
	101	+	if !fetchedAt.IsZero() {
	102	+	return "stale since " + fetchedAt.Format(time.RFC3339)
	103	+	}
	104	+	return "unreachable"
	105	+	case remoteHostVersionMismatch:
	106	+	return "version mismatch"
	107	+	default:
	108	+	return ""
	109	+	}
	110	+	}
	111	+
	112	+	func remotePickerView(key domain.RemoteSessionKey, session ports.RemoteCatalogSession, status remoteHostStatus, fetchedAt time.Time) picker.SessionView {
	113	+	detail := remotePickerStatusDetail(status, fetchedAt)
	114	+	if detail == "" {
	115	+	detail = remotePickerDetail(session.Tabs)
	116	+	}
	117	+	return picker.SessionView{
	118	+	ID: key.ID(),
	119	+	Name: key.Display(),
	120	+	RemoteKey: &key,
	121	+	RemoteHost: key.Host,
	122	+	RemoteAvailability: remotePickerAvailability(status),
	123	+	RemoteDetail: detail,
	124	+	ConnectOnly: true,
	125	+	RemoteAttachReady: false,
	126	+	CannotAcceptMoves: true,
	127	+	}
	128	+	}
	129	+
	130	+	func remotePickerHostView(host string, status remoteHostStatus) picker.SessionView {
	131	+	return picker.SessionView{
	132	+	ID: domain.SessionID("remote-host:" + base64.RawURLEncoding.EncodeToString([]byte(host))),
	133	+	Name: host,
	134	+	RemoteHost: host,
	135	+	RemoteAvailability: remotePickerAvailability(status),
	136	+	RemoteDetail: remotePickerStatusDetail(status, time.Time{}),
	137	+	ConnectOnly: true,
	138	+	CannotAcceptMoves: true,
	139	+	}
	140	+	}
	141	+
	142	+	func remoteProxyPickerView(key domain.RemoteSessionKey, snap sessionView) picker.SessionView {
	143	+	view := snap.pickerView()
	144	+	// Proxy construction uses this same ID and label. Restating them from the
	145	+	// structured key makes the cache-to-live row upgrade independent of mutable
	146	+	// presentation or relayed metadata. Lifecycle is carried separately from
	147	+	// presentation so a display-name change can never spoof expiry.
	148	+	view.ID = key.ID()
	149	+	view.Name = key.Display()
	150	+	if snap.expired {
	151	+	view.Name += " [expired]"
	152	+	}
	153	+	view.TargetName = ""
	154	+	view.RemoteKey = &key
	155	+	view.RemoteAvailability = picker.RemoteFresh
	156	+	view.RemoteDetail = remotePickerDetail(uint16(snap.tabCount))
	157	+	view.ConnectOnly = true
	158	+	view.RemoteAttachReady = false
	159	+	if snap.expired {
	160	+	view.RemoteAvailability = picker.RemoteStale
	161	+	view.RemoteDetail = "expired"
	162	+	view.RemoteAttachReady = false
	163	+	}
	164	+	view.CannotAcceptMoves = true
	165	+	return view
	166	+	}
	167	+
	168	+	func sortRemotePickerCatalog(entries []remotePickerCatalogEntry, ranks map[string]int) {
	169	+	for i := range entries {
	170	+	sort.Slice(entries[i].entry.Sessions, func(left, right int) bool {
	171	+	return entries[i].entry.Sessions[left].Name < entries[i].entry.Sessions[right].Name
	172	+	})
	173	+	}
	174	+	sort.Slice(entries, func(i, j int) bool {
	175	+	left, right := entries[i].entry.Host, entries[j].entry.Host
	176	+	leftRank, leftKnown := ranks[left]
	177	+	rightRank, rightKnown := ranks[right]
	178	+	if leftKnown != rightKnown {
	179	+	return leftKnown
	180	+	}
	181	+	if leftKnown && leftRank != rightRank {
	182	+	return leftRank < rightRank
	183	+	}
	184	+	return left < right
	185	+	})
	186	+	}
	187	+
	188	+	func (d *Daemon) remotePickerOpened(instance remotePickerInstance) {
	189	+	if d.registerRemotePicker(instance) {
	190	+	d.startRemotePickerRefresh(instance)
	191	+	}
	192	+	}
	193	+
	194	+	// registerRemotePicker installs one exact picker generation as a refresh owner.
	195	+	// Keeping this step separate gives refresh startup a second atomic validation
	196	+	// point: a close can win between registration and startup without being undone
	197	+	// by a delayed opener.
	198	+	func (d *Daemon) registerRemotePicker(instance remotePickerInstance) bool {
	199	+	if d == nil \|\| instance.ac == nil \|\| instance.ac.overlays == nil \|\| instance.model == nil {
	200	+	return false
	201	+	}
	202	+	rt := instance.ac.overlays
	203	+	// Picker ownership always nests pickerMu -> remoteCatalog.mu. No path may
	204	+	// acquire pickerMu while retaining the catalog lock.
	205	+	rt.pickerMu.Lock()
	206	+	defer rt.pickerMu.Unlock()
	207	+	if rt.pickerGeneration != instance.generation \|\| rt.picker != instance.model {
	208	+	return false
	209	+	}
	210	+	d.remoteCatalog.mu.Lock()
	211	+	d.remoteCatalog.pickers[instance.ac] = struct{}{}
	212	+	d.remoteCatalog.mu.Unlock()
	213	+	return true
	214	+	}
	215	+
	216	+	func (d *Daemon) remotePickerClosed(instance remotePickerInstance) {
	217	+	if d == nil \|\| instance.ac == nil \|\| instance.ac.overlays == nil \|\| instance.model == nil {
	218	+	return
	219	+	}
	220	+	rt := instance.ac.overlays
	221	+	rt.pickerMu.Lock()
	222	+	current := rt.pickerGeneration == instance.generation && rt.picker == nil
	223	+	if !current {
	224	+	rt.pickerMu.Unlock()
	225	+	return
	226	+	}
	227	+	d.remoteCatalog.mu.Lock()
	228	+	delete(d.remoteCatalog.pickers, instance.ac)
	229	+	if len(d.remoteCatalog.pickers) != 0 {
	230	+	d.remoteCatalog.mu.Unlock()
	231	+	rt.pickerMu.Unlock()
	232	+	return
	233	+	}
	234	+	d.remoteCatalog.refresh++
	235	+	cancel := d.remoteCatalog.cancel
	236	+	d.remoteCatalog.cancel = nil
	237	+	d.remoteCatalog.mu.Unlock()
	238	+	rt.pickerMu.Unlock()
	239	+	if cancel != nil {
	240	+	cancel()
	241	+	}
	242	+	}
	243	+
	244	+	func (d *Daemon) cancelRemotePickerRefresh() {
	245	+	if d == nil {
	246	+	return
	247	+	}
	248	+	d.remoteCatalog.mu.Lock()
	249	+	d.remoteCatalog.refresh++
	250	+	cancel := d.remoteCatalog.cancel
	251	+	d.remoteCatalog.cancel = nil
	252	+	d.remoteCatalog.mu.Unlock()
	253	+	if cancel != nil {
	254	+	cancel()
	255	+	}
	256	+	}
	257	+
	258	+	func (d *Daemon) remotePickerHosts() ([]string, error) {
	259	+	if d == nil \|\| d.remoteHostStore == nil {
	260	+	return nil, nil
	261	+	}
	262	+	pinned, learned, err := d.remoteHostStore.Hosts()
	263	+	if err != nil {
	264	+	return nil, err
	265	+	}
	266	+	hosts := make([]string, 0, len(pinned)+len(learned))
	267	+	seen := make(map[string]struct{}, cap(hosts))
	268	+	add := func(candidates []string) {
	269	+	for _, host := range candidates {
	270	+	if _, exists := seen[host]; exists {
	271	+	continue
	272	+	}
	273	+	seen[host] = struct{}{}
	274	+	hosts = append(hosts, host)
	275	+	}
	276	+	}
	277	+	add(pinned)
	278	+	add(learned)
	279	+	return hosts, nil
	280	+	}
	281	+
	282	+	// startRemotePickerRefresh replaces the current refresh generation and launches
	283	+	// one bounded catalog call per known host. Installing the generation is gated
	284	+	// by the exact picker generation that registered ownership. Host-store and
	285	+	// remote I/O happen after every architecture lock has been released.
	286	+	func (d *Daemon) startRemotePickerRefresh(instance remotePickerInstance) uint64 {
	287	+	if d == nil \|\| instance.ac == nil \|\| instance.ac.overlays == nil \|\| instance.model == nil {
	288	+	return 0
	289	+	}
	290	+	root := context.Background()
	291	+	if d.serveCtx != nil {
	292	+	root = d.serveCtx
	293	+	}
	294	+	ctx, cancel := context.WithCancel(root)
	295	+
	296	+	rt := instance.ac.overlays
	297	+	rt.pickerMu.Lock()
	298	+	d.remoteCatalog.mu.Lock()
	299	+	_, owner := d.remoteCatalog.pickers[instance.ac]
	300	+	current := rt.pickerGeneration == instance.generation && rt.picker == instance.model
	301	+	if !current \|\| !owner \|\| len(d.remoteCatalog.pickers) == 0 {
	302	+	d.remoteCatalog.mu.Unlock()
	303	+	rt.pickerMu.Unlock()
	304	+	cancel()
	305	+	return 0
	306	+	}
	307	+	previous := d.remoteCatalog.cancel
	308	+	d.remoteCatalog.refresh++
	309	+	generation := d.remoteCatalog.refresh
	310	+	d.remoteCatalog.cancel = cancel
	311	+	d.remoteCatalog.mu.Unlock()
	312	+	rt.pickerMu.Unlock()
	313	+	if previous != nil {
	314	+	previous()
	315	+	}
	316	+	if d.remoteCatalogClient == nil {
	317	+	return generation
	318	+	}
	319	+
	320	+	hosts, err := d.remotePickerHosts()
	321	+	if err != nil {
	322	+	d.log.Warn("listing remote hosts for refresh failed", "err", err)
	323	+	return generation
	324	+	}
	325	+	known := make(map[string]struct{}, len(hosts))
	326	+	for _, host := range hosts {
	327	+	known[host] = struct{}{}
	328	+	}
	329	+
	330	+	d.remoteCatalog.mu.Lock()
	331	+	if d.remoteCatalog.refresh != generation {
	332	+	d.remoteCatalog.mu.Unlock()
	333	+	cancel()
	334	+	return generation
	335	+	}
	336	+	cacheChanged := false
	337	+	for host := range d.remoteCatalog.cache {
	338	+	if _, exists := known[host]; exists {
	339	+	continue
	340	+	}
	341	+	delete(d.remoteCatalog.cache, host)
	342	+	delete(d.remoteCatalog.status, host)
	343	+	delete(d.remoteCatalog.failure, host)
	344	+	cacheChanged = true
	345	+	}
	346	+	for _, host := range hosts {
	347	+	d.remoteCatalog.status[host] = remoteHostRefreshing
	348	+	}
	349	+	d.remoteCatalog.mu.Unlock()
	350	+	if cacheChanged {
	351	+	d.persistRemoteCatalogCache()
	352	+	d.refreshRemoteOpenPickers()
	353	+	}
	354	+
	355	+	for _, host := range hosts {
	356	+	d.sessWg.Go(func() {
	357	+	catalog, listErr := d.remoteCatalogClient.List(ctx, host)
	358	+	d.applyRemoteRefreshResult(generation, host, catalog, listErr)
	359	+	})
	360	+	}
	361	+	return generation
	362	+	}
	363	+
	364	+	func containsRemotePickerHost(hosts []string, target string) bool {
	365	+	for _, host := range hosts {
	366	+	if host == target {
	367	+	return true
	368	+	}
	369	+	}
	370	+	return false
	371	+	}
	372	+
	373	+	// applyRemoteRefreshResult publishes one host completion only if both its
	374	+	// refresh generation and current host-registry membership remain authoritative.
	375	+	// Its return reports whether durable cache state changed.
	376	+	func (d *Daemon) applyRemoteRefreshResult(generation uint64, host string, catalog ports.RemoteCatalog, listErr error) bool {
	377	+	if d == nil {
	378	+	return false
	379	+	}
	380	+	d.remoteCatalog.mu.Lock()
	381	+	current := d.remoteCatalog.refresh == generation
	382	+	d.remoteCatalog.mu.Unlock()
	383	+	if !current {
	384	+	return false
	385	+	}
	386	+
	387	+	hosts, hostsErr := d.remotePickerHosts()
	388	+	if hostsErr != nil {
	389	+	d.log.Warn("revalidating remote host refresh failed", "host", host, "err", hostsErr)
	390	+	return false
	391	+	}
	392	+	stillKnown := containsRemotePickerHost(hosts, host)
	393	+	now := d.clock.Now()
	394	+	if listErr == nil && catalog.ProtocolVersion != ports.ProtocolVersion {
	395	+	listErr = &ports.RemoteCatalogVersionMismatchError{Got: catalog.ProtocolVersion, Want: ports.ProtocolVersion}
	396	+	}
	397	+
	398	+	d.remoteCatalog.mu.Lock()
	399	+	if d.remoteCatalog.refresh != generation {
	400	+	d.remoteCatalog.mu.Unlock()
	401	+	return false
	402	+	}
	403	+	if !stillKnown {
	404	+	_, cacheChanged := d.remoteCatalog.cache[host]
	405	+	delete(d.remoteCatalog.cache, host)
	406	+	delete(d.remoteCatalog.status, host)
	407	+	delete(d.remoteCatalog.failure, host)
	408	+	d.remoteCatalog.mu.Unlock()
	409	+	if cacheChanged {
	410	+	d.persistRemoteCatalogCache()
	411	+	d.refreshRemoteOpenPickers()
	412	+	}
	413	+	return cacheChanged
	414	+	}
	415	+	if listErr != nil {
	416	+	status := remoteHostUnreachable
	417	+	var mismatch *ports.RemoteCatalogVersionMismatchError
	418	+	if errors.As(listErr, &mismatch) {
	419	+	status = remoteHostVersionMismatch
	420	+	}
	421	+	d.remoteCatalog.status[host] = status
	422	+	d.remoteCatalog.failure[host] = now
	423	+	d.remoteCatalog.mu.Unlock()
	424	+	d.refreshRemoteOpenPickers()
	425	+	return false
	426	+	}
	427	+	d.remoteCatalog.cache[host] = ports.RemoteCatalogCacheEntry{
	428	+	Host: host,
	429	+	FetchedAt: now,
	430	+	Sessions: append([]ports.RemoteCatalogSession{}, catalog.Sessions...),
	431	+	}
	432	+	d.remoteCatalog.status[host] = remoteHostFresh
	433	+	delete(d.remoteCatalog.failure, host)
	434	+	d.remoteCatalog.mu.Unlock()
	435	+
	436	+	d.persistRemoteCatalogCache()
	437	+	d.refreshRemoteOpenPickers()
	438	+	return true
	439	+	}
	440	+
	441	+	func (d *Daemon) refreshRemoteOpenPickers() {
	442	+	if d == nil {
	443	+	return
	444	+	}
	445	+	d.remoteCatalog.mu.Lock()
	446	+	clients := make([]*attachedClient, 0, len(d.remoteCatalog.pickers))
	447	+	for ac := range d.remoteCatalog.pickers {
	448	+	clients = append(clients, ac)
	449	+	}
	450	+	d.remoteCatalog.mu.Unlock()
	451	+
	452	+	for _, ac := range clients {
	453	+	if ac == nil \|\| ac.overlays == nil {
	454	+	continue
	455	+	}
	456	+	d.refreshPickerOpts(ac, pickerRefreshOptions{preserveSelection: true, nearestRow: -1})
	457	+	if entry := ac.currentAttachmentSession(); entry != nil {
	458	+	d.invalidateRender(entry, ac, true, "remote_picker.go")
	459	+	}
	460	+	}
	461	+	}

A internal/usecase/daemon/remote_picker_test.go +964 -0

@@ -0,0 +1,964 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"context"
	5	+	"errors"
	6	+	"fmt"
	7	+	"io"
	8	+	"log/slog"
	9	+	"sync"
	10	+	"testing"
	11	+	"time"
	12	+
	13	+	"github.com/stretchr/testify/require"
	14	+
	15	+	"github.com/bnema/vev/internal/domain"
	16	+	"github.com/bnema/vev/internal/ports"
	17	+	portsmocks "github.com/bnema/vev/internal/ports/mocks"
	18	+	"github.com/bnema/vev/internal/usecase/picker"
	19	+	)
	20	+
	21	+	const remotePickerReceiveTimeout = time.Second
	22	+
	23	+	func receiveRemotePicker[T any](t *testing.T, ch <-chan T, what string) T {
	24	+	t.Helper()
	25	+	select {
	26	+	case value, ok := <-ch:
	27	+	if !ok {
	28	+	t.Fatalf("channel closed unexpectedly while waiting for %s", what)
	29	+	}
	30	+	return value
	31	+	case <-time.After(remotePickerReceiveTimeout):
	32	+	t.Fatalf("timed out waiting for %s", what)
	33	+	var zero T
	34	+	return zero
	35	+	}
	36	+	}
	37	+
	38	+	func waitRemotePickerClose(ch <-chan struct{}, what string) error {
	39	+	select {
	40	+	case _, ok := <-ch:
	41	+	if ok {
	42	+	return fmt.Errorf("received signal instead of closure while waiting for %s", what)
	43	+	}
	44	+	return nil
	45	+	case <-time.After(remotePickerReceiveTimeout):
	46	+	return fmt.Errorf("timed out waiting for %s", what)
	47	+	}
	48	+	}
	49	+
	50	+	func receiveRemotePickerClose(t *testing.T, ch <-chan struct{}, what string) {
	51	+	t.Helper()
	52	+	require.NoError(t, waitRemotePickerClose(ch, what))
	53	+	}
	54	+
	55	+	func newRemotePickerDaemon(store ports.RemoteHostStore) *Daemon {
	56	+	return New(nil, stubClock{}, slog.New(slog.NewTextHandler(io.Discard, nil)), WithRemoteDiscovery(store, nil, nil, nil, ports.RemoteTransportUDP))
	57	+	}
	58	+
	59	+	func TestRemotePickerMerge(t *testing.T) {
	60	+	store := portsmocks.NewMockRemoteHostStore(t)
	61	+	store.EXPECT().Hosts().Return([]string{"pinned"}, []string{"learned"}, nil).Once()
	62	+	d := newRemotePickerDaemon(store)
	63	+	local := &session{sessionCore: sessionCore{id: "local", name: "local"}, tabs: []*tab{{}}}
	64	+	local.mruAt.Store(6)
	65	+	key := domain.RemoteSessionKey{Host: "pinned", Name: "work"}
	66	+	proxy := &proxySession{
	67	+	sessionCore: sessionCore{id: key.ID(), name: key.Display()},
	68	+	key: key,
	69	+	meta: ports.SessionMeta{SessionName: key.Name, Tabs: []ports.SessionTabMeta{
	70	+	{Index: 0, Name: "shell"},
	71	+	}},
	72	+	}
	73	+	proxy.mruAt.Store(5)
	74	+	d.sessions[local.id] = local
	75	+	d.sessions[proxy.id] = proxy
	76	+	d.stopped["stopped"] = stoppedSession{name: "stopped", createdAt: 2, lastUsedSeq: 9}
	77	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{
	78	+	{Host: "learned", FetchedAt: time.Unix(20, 0), Sessions: []ports.RemoteCatalogSession{{Name: "alpha", State: "running", Tabs: 3}}},
	79	+	{Host: "pinned", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "work", State: "running", Tabs: 9}, {Name: "alpha", State: "running", Tabs: 2}}},
	80	+	})
	81	+	d.remoteCatalog.mu.Lock()
	82	+	d.remoteCatalog.status["pinned"] = remoteHostFresh
	83	+	d.remoteCatalog.status["learned"] = remoteHostFresh
	84	+	d.remoteCatalog.mu.Unlock()
	85	+
	86	+	views, _ := d.pickerViews(local)
	87	+
	88	+	require.Equal(t, []string{"local", "work@pinned", "alpha@pinned", "alpha@learned", "stopped"}, pickerViewNames(views))
	89	+	require.False(t, views[0].Stopped)
	90	+	require.Equal(t, key, *views[1].RemoteKey)
	91	+	require.Equal(t, picker.RemoteFresh, views[1].RemoteAvailability)
	92	+	require.True(t, views[1].ConnectOnly)
	93	+	require.Equal(t, "2 tabs", views[2].RemoteDetail)
	94	+	require.Equal(t, picker.RemoteFresh, views[2].RemoteAvailability)
	95	+	require.Equal(t, picker.RemoteFresh, views[3].RemoteAvailability)
	96	+	require.True(t, views[4].Stopped)
	97	+	}
	98	+
	99	+	func TestRemotePickerDedupeUsesExactKeyAndKeepsLiveID(t *testing.T) {
	100	+	d := newRemotePickerDaemon(nil)
	101	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	102	+	proxy := &proxySession{
	103	+	sessionCore: sessionCore{id: key.ID(), name: key.Display()},
	104	+	key: key,
	105	+	meta: ports.SessionMeta{SessionName: key.Name, Tabs: []ports.SessionTabMeta{
	106	+	{Index: 0, Name: "live tab"},
	107	+	}},
	108	+	}
	109	+	d.sessions[key.ID()] = proxy
	110	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	111	+	Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{
	112	+	{Name: "work", State: "running", Tabs: 7},
	113	+	},
	114	+	}})
	115	+
	116	+	views, _ := d.pickerViews(nil)
	117	+
	118	+	require.Len(t, views, 1)
	119	+	require.Equal(t, key.ID(), views[0].ID)
	120	+	require.Equal(t, key, *views[0].RemoteKey)
	121	+	require.Equal(t, []picker.TabEntry{{Name: "live tab"}}, views[0].Tabs, "live proxy snapshot wins over cached discovery")
	122	+	require.Equal(t, picker.RemoteFresh, views[0].RemoteAvailability)
	123	+	}
	124	+
	125	+	func TestRemotePickerSnapshotsDoNotRetainProxyLock(t *testing.T) {
	126	+	d := newRemotePickerDaemon(nil)
	127	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	128	+	proxy := &proxySession{
	129	+	sessionCore: sessionCore{id: key.ID(), name: key.Display()},
	130	+	key: key,
	131	+	meta: ports.SessionMeta{SessionName: key.Name, Tabs: []ports.SessionTabMeta{{Index: 0, Name: "shell"}}},
	132	+	}
	133	+	d.sessions[key.ID()] = proxy
	134	+
	135	+	views, _ := d.pickerViews(nil)
	136	+
	137	+	require.Len(t, views, 1)
	138	+	require.True(t, proxy.mu.TryLock(), "picker construction must release the proxy leaf lock")
	139	+	proxy.mu.Unlock()
	140	+	require.True(t, d.remoteCatalog.mu.TryLock(), "picker construction must release the remote catalog lock")
	141	+	d.remoteCatalog.mu.Unlock()
	142	+	}
	143	+
	144	+	func TestRemotePickerAvailabilityUsesCachedRowsForFailures(t *testing.T) {
	145	+	tests := []struct {
	146	+	name string
	147	+	status remoteHostStatus
	148	+	want picker.RemoteAvailability
	149	+	}{
	150	+	{name: "cached", status: remoteHostCached, want: picker.RemoteCached},
	151	+	{name: "unreachable", status: remoteHostUnreachable, want: picker.RemoteStale},
	152	+	{name: "version mismatch", status: remoteHostVersionMismatch, want: picker.RemoteVersionMismatch},
	153	+	}
	154	+
	155	+	for _, test := range tests {
	156	+	t.Run(test.name, func(t *testing.T) {
	157	+	d := newRemotePickerDaemon(nil)
	158	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	159	+	Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "work", State: "running"}},
	160	+	}})
	161	+	d.remoteCatalog.mu.Lock()
	162	+	d.remoteCatalog.status["arch"] = test.status
	163	+	d.remoteCatalog.mu.Unlock()
	164	+
	165	+	views, _ := d.pickerViews(nil)
	166	+
	167	+	require.Len(t, views, 1)
	168	+	require.Equal(t, test.want, views[0].RemoteAvailability)
	169	+	})
	170	+	}
	171	+	}
	172	+
	173	+	func TestRemotePickerStaleDetailUsesLastSuccessfulFetch(t *testing.T) {
	174	+	d := newRemotePickerDaemon(nil)
	175	+	fetchedAt := time.Date(2025, time.January, 2, 3, 4, 5, 0, time.UTC)
	176	+	failedAt := fetchedAt.Add(6 * time.Hour)
	177	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	178	+	Host: "arch", FetchedAt: fetchedAt, Sessions: []ports.RemoteCatalogSession{{Name: "work", State: "running"}},
	179	+	}})
	180	+	d.remoteCatalog.mu.Lock()
	181	+	d.remoteCatalog.status["arch"] = remoteHostUnreachable
	182	+	d.remoteCatalog.failure["arch"] = failedAt
	183	+	d.remoteCatalog.mu.Unlock()
	184	+
	185	+	views, _ := d.pickerViews(nil)
	186	+
	187	+	require.Len(t, views, 1)
	188	+	require.Equal(t, "stale since "+fetchedAt.Format(time.RFC3339), views[0].RemoteDetail)
	189	+	require.NotContains(t, views[0].RemoteDetail, failedAt.Format(time.RFC3339), "failure time remains runtime-only and is not the freshness authority")
	190	+	}
	191	+
	192	+	func TestRemotePickerNoCacheHostFailuresRemainVisible(t *testing.T) {
	193	+	for _, test := range []struct {
	194	+	name string
	195	+	status remoteHostStatus
	196	+	want picker.RemoteAvailability
	197	+	wantDetail string
	198	+	}{
	199	+	{name: "unreachable", status: remoteHostUnreachable, want: picker.RemoteStale, wantDetail: "unreachable"},
	200	+	{name: "version mismatch", status: remoteHostVersionMismatch, want: picker.RemoteVersionMismatch, wantDetail: "version mismatch"},
	201	+	} {
	202	+	t.Run(test.name, func(t *testing.T) {
	203	+	d := newRemotePickerDaemon(nil)
	204	+	d.remoteCatalog.mu.Lock()
	205	+	d.remoteCatalog.status["arch"] = test.status
	206	+	d.remoteCatalog.failure["arch"] = time.Unix(50, 0)
	207	+	d.remoteCatalog.mu.Unlock()
	208	+
	209	+	views, _ := d.pickerViews(nil)
	210	+
	211	+	require.Len(t, views, 1)
	212	+	require.Equal(t, "arch", views[0].Name)
	213	+	require.Equal(t, test.want, views[0].RemoteAvailability)
	214	+	require.Equal(t, test.wantDetail, views[0].RemoteDetail)
	215	+	model := picker.New(views, picker.SelectionConfig{Mode: picker.SelectNavigationTab})
	216	+	_, selectable := model.Selected()
	217	+	require.False(t, selectable)
	218	+	})
	219	+	}
	220	+	}
	221	+
	222	+	func TestRemotePickerGroupedSortTreatsProxiesAsLiveSessions(t *testing.T) {
	223	+	d := newRemotePickerDaemon(nil)
	224	+	d.pickerSort.Store(uint32(pickerSortGrouped))
	225	+	ephemeral := &session{sessionCore: sessionCore{id: "ephemeral", name: "1", ephemeral: true}, tabs: []*tab{{}}}
	226	+	ephemeral.mruAt.Store(9)
	227	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	228	+	proxy := &proxySession{sessionCore: sessionCore{id: key.ID(), name: key.Display()}, key: key}
	229	+	proxy.mruAt.Store(1)
	230	+	named := &session{sessionCore: sessionCore{id: "named", name: "named"}, tabs: []*tab{{}}}
	231	+	named.mruAt.Store(2)
	232	+	d.sessions[ephemeral.id] = ephemeral
	233	+	d.sessions[proxy.id] = proxy
	234	+	d.sessions[named.id] = named
	235	+
	236	+	views, _ := d.pickerViews(nil)
	237	+
	238	+	require.Equal(t, []string{"named", "work@arch", "1"}, pickerViewNames(views))
	239	+	}
	240	+
	241	+	func pickerViewNames(views []picker.SessionView) []string {
	242	+	names := make([]string, len(views))
	243	+	for i, view := range views {
	244	+	names[i] = view.Name
	245	+	}
	246	+	return names
	247	+	}
	248	+
	249	+	type remoteRefreshHostStore struct {
	250	+	mu sync.Mutex
	251	+	hosts []string
	252	+	}
	253	+
	254	+	func (s *remoteRefreshHostStore) Hosts() ([]string, []string, error) {
	255	+	s.mu.Lock()
	256	+	defer s.mu.Unlock()
	257	+	return append([]string(nil), s.hosts...), nil, nil
	258	+	}
	259	+
	260	+	func (s *remoteRefreshHostStore) set(hosts ...string) {
	261	+	s.mu.Lock()
	262	+	s.hosts = append([]string(nil), hosts...)
	263	+	s.mu.Unlock()
	264	+	}
	265	+
	266	+	func (*remoteRefreshHostStore) AddPinned(string) error { return nil }
	267	+	func (*remoteRefreshHostStore) RemovePinned(string) error { return nil }
	268	+	func (*remoteRefreshHostStore) Remember(string) error { return nil }
	269	+	func (*remoteRefreshHostStore) Forget(string) error { return nil }
	270	+	func (*remoteRefreshHostStore) Remove(string) (bool, error) {
	271	+	return false, nil
	272	+	}
	273	+
	274	+	type remoteRefreshRequest struct {
	275	+	ctx context.Context
	276	+	host string
	277	+	result chan remoteRefreshResult
	278	+	}
	279	+
	280	+	type remoteRefreshResult struct {
	281	+	catalog ports.RemoteCatalog
	282	+	err error
	283	+	}
	284	+
	285	+	type channelRemoteCatalog struct {
	286	+	d *Daemon
	287	+	requests chan remoteRefreshRequest
	288	+	probeMu sync.Mutex
	289	+	probes bool
	290	+	violations []string
	291	+	}
	292	+
	293	+	func (c *channelRemoteCatalog) List(ctx context.Context, host string) (ports.RemoteCatalog, error) {
	294	+	c.probeMu.Lock()
	295	+	if c.probes && !c.d.mu.TryLock() {
	296	+	c.violations = append(c.violations, "daemon lock held during remote catalog I/O")
	297	+	} else if c.probes {
	298	+	c.d.mu.Unlock()
	299	+	}
	300	+	if c.probes && !c.d.remoteCatalog.mu.TryLock() {
	301	+	c.violations = append(c.violations, "remote catalog lock held during remote catalog I/O")
	302	+	} else if c.probes {
	303	+	c.d.remoteCatalog.mu.Unlock()
	304	+	}
	305	+	c.probeMu.Unlock()
	306	+	request := remoteRefreshRequest{ctx: ctx, host: host, result: make(chan remoteRefreshResult, 1)}
	307	+	c.requests <- request
	308	+	select {
	309	+	case result := <-request.result:
	310	+	return result.catalog, result.err
	311	+	case <-ctx.Done():
	312	+	return ports.RemoteCatalog{}, ctx.Err()
	313	+	}
	314	+	}
	315	+
	316	+	type recordingRemoteCache struct {
	317	+	d *Daemon
	318	+	stores chan []ports.RemoteCatalogCacheEntry
	319	+	probeMu sync.Mutex
	320	+	probes bool
	321	+	violations []string
	322	+	}
	323	+
	324	+	func (*recordingRemoteCache) Load() ([]ports.RemoteCatalogCacheEntry, error) { return nil, nil }
	325	+
	326	+	func (c *recordingRemoteCache) Store(entries []ports.RemoteCatalogCacheEntry) error {
	327	+	c.probeMu.Lock()
	328	+	if c.probes && !c.d.mu.TryLock() {
	329	+	c.violations = append(c.violations, "daemon lock held during remote cache write")
	330	+	} else if c.probes {
	331	+	c.d.mu.Unlock()
	332	+	}
	333	+	if c.probes && !c.d.remoteCatalog.mu.TryLock() {
	334	+	c.violations = append(c.violations, "remote catalog lock held during remote cache write")
	335	+	} else if c.probes {
	336	+	c.d.remoteCatalog.mu.Unlock()
	337	+	}
	338	+	c.probeMu.Unlock()
	339	+	copyEntries := make([]ports.RemoteCatalogCacheEntry, len(entries))
	340	+	for i, entry := range entries {
	341	+	copyEntries[i] = cloneRemoteCatalogEntry(entry)
	342	+	}
	343	+	c.stores <- copyEntries
	344	+	return nil
	345	+	}
	346	+
	347	+	type fixedRemoteRefreshClock struct{ now time.Time }
	348	+
	349	+	func (c fixedRemoteRefreshClock) Now() time.Time { return c.now }
	350	+	func (fixedRemoteRefreshClock) NewTimer(time.Duration) ports.Timer { return stubTimer{} }
	351	+
	352	+	func requireNoRemoteLockViolations(t testing.T, catalog channelRemoteCatalog, cache *recordingRemoteCache) {
	353	+	t.Helper()
	354	+	if catalog != nil {
	355	+	catalog.probeMu.Lock()
	356	+	require.Empty(t, catalog.violations)
	357	+	catalog.probeMu.Unlock()
	358	+	}
	359	+	if cache != nil {
	360	+	cache.probeMu.Lock()
	361	+	require.Empty(t, cache.violations)
	362	+	cache.probeMu.Unlock()
	363	+	}
	364	+	}
	365	+
	366	+	func newRemoteRefreshDaemon(t testing.T, hosts remoteRefreshHostStore, now time.Time) (Daemon, channelRemoteCatalog, *recordingRemoteCache) {
	367	+	t.Helper()
	368	+	catalog := &channelRemoteCatalog{requests: make(chan remoteRefreshRequest, 8)}
	369	+	cache := &recordingRemoteCache{stores: make(chan []ports.RemoteCatalogCacheEntry, 8)}
	370	+	d := New(nil, fixedRemoteRefreshClock{now: now}, slog.New(slog.NewTextHandler(io.Discard, nil)), WithRemoteDiscovery(hosts, catalog, cache, nil, ports.RemoteTransportUDP))
	371	+	catalog.d, cache.d = d, d
	372	+	return d, catalog, cache
	373	+	}
	374	+
	375	+	func TestRemoteRefreshStartsPerHostAndCancelsSupersededGeneration(t *testing.T) {
	376	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch", "mule"}}
	377	+	d, catalog, cache := newRemoteRefreshDaemon(t, hosts, time.Unix(100, 0))
	378	+	ac := &attachedClient{}
	379	+	ac.initOverlays()
	380	+	model := picker.New(nil, picker.SelectionConfig{})
	381	+	ac.overlays.pickerMu.Lock()
	382	+	ac.overlays.picker = model
	383	+	ac.overlays.pickerGeneration++
	384	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: model}
	385	+	ac.overlays.pickerMu.Unlock()
	386	+	require.True(t, d.registerRemotePicker(instance))
	387	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	388	+	Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "cached", State: "running"}},
	389	+	}})
	390	+
	391	+	firstGeneration := d.startRemotePickerRefresh(instance)
	392	+	first := map[string]remoteRefreshRequest{}
	393	+	for range 2 {
	394	+	request := receiveRemotePicker(t, catalog.requests, "catalog request")
	395	+	first[request.host] = request
	396	+	}
	397	+	require.Contains(t, first, "arch")
	398	+	require.Contains(t, first, "mule")
	399	+	requireNoRemoteLockViolations(t, catalog, nil)
	400	+	d.remoteCatalog.mu.Lock()
	401	+	require.Equal(t, []ports.RemoteCatalogSession{{Name: "cached", State: "running"}}, d.remoteCatalog.cache["arch"].Sessions, "cached rows publish before any remote completion")
	402	+	require.Equal(t, remoteHostRefreshing, d.remoteCatalog.status["arch"])
	403	+	d.remoteCatalog.mu.Unlock()
	404	+
	405	+	secondGeneration := d.startRemotePickerRefresh(instance)
	406	+	require.Greater(t, secondGeneration, firstGeneration)
	407	+	for _, request := range first {
	408	+	receiveRemotePickerClose(t, request.ctx.Done(), "catalog request cancellation")
	409	+	}
	410	+	for range 2 {
	411	+	request := receiveRemotePicker(t, catalog.requests, "catalog request")
	412	+	request.result <- remoteRefreshResult{catalog: ports.RemoteCatalog{ProtocolVersion: ports.ProtocolVersion}}
	413	+	}
	414	+	for range 2 {
	415	+	receiveRemotePicker(t, cache.stores, "remote cache store")
	416	+	}
	417	+	requireNoRemoteLockViolations(t, nil, cache)
	418	+
	419	+	d.remoteCatalog.mu.Lock()
	420	+	require.Equal(t, secondGeneration, d.remoteCatalog.refresh)
	421	+	require.Equal(t, remoteHostFresh, d.remoteCatalog.status["arch"])
	422	+	require.Equal(t, remoteHostFresh, d.remoteCatalog.status["mule"])
	423	+	d.remoteCatalog.mu.Unlock()
	424	+	}
	425	+
	426	+	func TestRemoteRefreshLockProbesSerialized(t *testing.T) {
	427	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	428	+	d, catalog, cache := newRemoteRefreshDaemon(t, hosts, time.Unix(125, 0))
	429	+	catalog.probes, cache.probes = true, true
	430	+	ac := &attachedClient{}
	431	+	ac.initOverlays()
	432	+	model := picker.New(nil, picker.SelectionConfig{})
	433	+	ac.overlays.pickerMu.Lock()
	434	+	ac.overlays.picker = model
	435	+	ac.overlays.pickerGeneration++
	436	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: model}
	437	+	ac.overlays.pickerMu.Unlock()
	438	+	require.True(t, d.registerRemotePicker(instance))
	439	+
	440	+	d.startRemotePickerRefresh(instance)
	441	+	request := receiveRemotePicker(t, catalog.requests, "catalog request")
	442	+	request.result <- remoteRefreshResult{catalog: ports.RemoteCatalog{ProtocolVersion: ports.ProtocolVersion}}
	443	+	receiveRemotePicker(t, cache.stores, "remote cache store")
	444	+	requireNoRemoteLockViolations(t, catalog, cache)
	445	+	}
	446	+
	447	+	func TestRemoteRefreshWithoutCatalogClientDoesNotMarkHostsRefreshing(t *testing.T) {
	448	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	449	+	d := newRemotePickerDaemon(hosts)
	450	+	ac := &attachedClient{}
	451	+	ac.initOverlays()
	452	+	model := picker.New(nil, picker.SelectionConfig{})
	453	+	ac.overlays.pickerMu.Lock()
	454	+	ac.overlays.picker = model
	455	+	ac.overlays.pickerGeneration++
	456	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: model}
	457	+	ac.overlays.pickerMu.Unlock()
	458	+	require.True(t, d.registerRemotePicker(instance))
	459	+
	460	+	require.NotZero(t, d.startRemotePickerRefresh(instance))
	461	+	d.remoteCatalog.mu.Lock()
	462	+	require.NotEqual(t, remoteHostRefreshing, d.remoteCatalog.status["arch"])
	463	+	d.remoteCatalog.mu.Unlock()
	464	+	}
	465	+
	466	+	func TestRemoteRefreshResultPreservesFailuresAndEvictsSuccessfulOmissions(t *testing.T) {
	467	+	now := time.Unix(200, 0)
	468	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch", "mule"}}
	469	+	d, _, cache := newRemoteRefreshDaemon(t, hosts, now)
	470	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{
	471	+	{Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "old", State: "running"}}},
	472	+	{Host: "mule", FetchedAt: time.Unix(20, 0), Sessions: []ports.RemoteCatalogSession{{Name: "stale", State: "running"}}},
	473	+	})
	474	+	d.remoteCatalog.mu.Lock()
	475	+	d.remoteCatalog.refresh = 7
	476	+	d.remoteCatalog.mu.Unlock()
	477	+
	478	+	require.False(t, d.applyRemoteRefreshResult(7, "mule", ports.RemoteCatalog{}, errors.New("offline")))
	479	+	d.remoteCatalog.mu.Lock()
	480	+	require.Equal(t, []ports.RemoteCatalogSession{{Name: "stale", State: "running"}}, d.remoteCatalog.cache["mule"].Sessions)
	481	+	require.Equal(t, time.Unix(20, 0), d.remoteCatalog.cache["mule"].FetchedAt)
	482	+	require.Equal(t, remoteHostUnreachable, d.remoteCatalog.status["mule"])
	483	+	d.remoteCatalog.mu.Unlock()
	484	+
	485	+	require.True(t, d.applyRemoteRefreshResult(7, "arch", ports.RemoteCatalog{ProtocolVersion: ports.ProtocolVersion}, nil))
	486	+	stored := receiveRemotePicker(t, cache.stores, "remote cache store")
	487	+	require.Equal(t, []ports.RemoteCatalogCacheEntry{
	488	+	{Host: "arch", FetchedAt: now, Sessions: []ports.RemoteCatalogSession{}},
	489	+	{Host: "mule", FetchedAt: time.Unix(20, 0), Sessions: []ports.RemoteCatalogSession{{Name: "stale", State: "running"}}},
	490	+	}, stored, "every successful write persists the newest full cache atomically")
	491	+	requireNoRemoteLockViolations(t, nil, cache)
	492	+	d.remoteCatalog.mu.Lock()
	493	+	require.Empty(t, d.remoteCatalog.cache["arch"].Sessions, "a successful omission authoritatively evicts old rows")
	494	+	require.Equal(t, remoteHostFresh, d.remoteCatalog.status["arch"])
	495	+	d.remoteCatalog.mu.Unlock()
	496	+	}
	497	+
	498	+	func TestRemoteRefreshRejectsRemovedHostAndLateGeneration(t *testing.T) {
	499	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	500	+	d, _, cache := newRemoteRefreshDaemon(t, hosts, time.Unix(300, 0))
	501	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	502	+	Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "old", State: "running"}},
	503	+	}})
	504	+	d.remoteCatalog.mu.Lock()
	505	+	d.remoteCatalog.refresh = 9
	506	+	d.remoteCatalog.mu.Unlock()
	507	+
	508	+	require.False(t, d.applyRemoteRefreshResult(8, "arch", ports.RemoteCatalog{ProtocolVersion: ports.ProtocolVersion, Sessions: []ports.RemoteCatalogSession{{Name: "late", State: "running"}}}, nil))
	509	+	hosts.set()
	510	+	require.True(t, d.applyRemoteRefreshResult(9, "arch", ports.RemoteCatalog{ProtocolVersion: ports.ProtocolVersion, Sessions: []ports.RemoteCatalogSession{{Name: "removed", State: "running"}}}, nil))
	511	+	require.Empty(t, receiveRemotePicker(t, cache.stores, "remote cache store"))
	512	+	requireNoRemoteLockViolations(t, nil, cache)
	513	+	d.remoteCatalog.mu.Lock()
	514	+	require.NotContains(t, d.remoteCatalog.cache, "arch")
	515	+	require.NotContains(t, d.remoteCatalog.status, "arch")
	516	+	d.remoteCatalog.mu.Unlock()
	517	+	}
	518	+
	519	+	func TestRemoteRefreshVersionMismatchPreservesStaleRows(t *testing.T) {
	520	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	521	+	d, _, _ := newRemoteRefreshDaemon(t, hosts, time.Unix(400, 0))
	522	+	old := ports.RemoteCatalogCacheEntry{Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "work", State: "running"}}}
	523	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{old})
	524	+	d.remoteCatalog.mu.Lock()
	525	+	d.remoteCatalog.refresh = 3
	526	+	d.remoteCatalog.mu.Unlock()
	527	+
	528	+	require.False(t, d.applyRemoteRefreshResult(3, "arch", ports.RemoteCatalog{}, &ports.RemoteCatalogVersionMismatchError{Got: 19, Want: ports.ProtocolVersion}))
	529	+	d.remoteCatalog.mu.Lock()
	530	+	require.Equal(t, old, d.remoteCatalog.cache["arch"])
	531	+	require.Equal(t, remoteHostVersionMismatch, d.remoteCatalog.status["arch"])
	532	+	d.remoteCatalog.mu.Unlock()
	533	+	}
	534	+
	535	+	func addRemoteRefreshPickerOwner(t testing.T, d Daemon, id domain.SessionID) (session, attachedClient, chan ports.Frame) {
	536	+	t.Helper()
	537	+	tr, sends := newCapturingTransport(t)
	538	+	ac := &attachedClient{tr: tr, output: newOutputStateStream(), size: domain.Size{Cols: 80, Rows: 24}}
	539	+	ac.initOverlays()
	540	+	tb := newTab(newQuietPTY(), domain.Size{Cols: 80, Rows: 22})
	541	+	tb.stableID = string(id) + "-tab"
	542	+	sess := &session{sessionCore: sessionCore{id: id, name: string(id), client: ac}, tabs: []*tab{tb}, active: 0}
	543	+	publishTiledPaneOwners(sess, tb)
	544	+	ac.setSession(sess)
	545	+	d.sessions[id] = sess
	546	+	return sess, ac, sends
	547	+	}
	548	+
	549	+	func TestRemoteRefreshUpdatesAllOpenPickersPreservingSelection(t *testing.T) {
	550	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	551	+	d, catalog, cache := newRemoteRefreshDaemon(t, hosts, time.Unix(450, 0))
	552	+	firstSession, first, _ := addRemoteRefreshPickerOwner(t, d, "first")
	553	+	_, second, _ := addRemoteRefreshPickerOwner(t, d, "second")
	554	+	before := make(map[attachedClient]picker.Model)
	555	+
	556	+	for _, owner := range []*attachedClient{first, second} {
	557	+	owner.overlays.pickerMu.Lock()
	558	+	owner.overlays.picker = d.newPickerModel(firstSession, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{Session: "second", TabID: "second-tab"})
	559	+	owner.overlays.pickerIntent = pickerNavigate
	560	+	owner.overlays.pickerGeneration++
	561	+	instance := remotePickerInstance{ac: owner, generation: owner.overlays.pickerGeneration, model: owner.overlays.picker}
	562	+	before[owner] = owner.overlays.picker
	563	+	owner.overlays.pickerMu.Unlock()
	564	+	require.True(t, d.registerRemotePicker(instance))
	565	+	}
	566	+	d.remoteCatalog.mu.Lock()
	567	+	d.remoteCatalog.refresh = 4
	568	+	d.remoteCatalog.mu.Unlock()
	569	+
	570	+	require.True(t, d.applyRemoteRefreshResult(4, "arch", ports.RemoteCatalog{
	571	+	ProtocolVersion: ports.ProtocolVersion,
	572	+	Sessions: []ports.RemoteCatalogSession{{Name: "work", State: "running", Tabs: 2}},
	573	+	}, nil))
	574	+	receiveRemotePicker(t, cache.stores, "remote cache store")
	575	+	requireNoRemoteLockViolations(t, catalog, cache)
	576	+
	577	+	for _, owner := range []*attachedClient{first, second} {
	578	+	owner.overlays.pickerMu.Lock()
	579	+	updated := owner.overlays.picker
	580	+	selected, ok := updated.Selected()
	581	+	owner.overlays.pickerMu.Unlock()
	582	+	require.NotSame(t, before[owner], updated, "every open picker must receive the refreshed model")
	583	+	require.True(t, ok)
	584	+	require.Equal(t, domain.SessionID("second"), selected.Session)
	585	+	}
	586	+	}
	587	+
	588	+	func TestRemotePickerTeardownLifecycle(t *testing.T) {
	589	+	for _, test := range []struct {
	590	+	name string
	591	+	resumeCapable bool
	592	+	teardown func(Daemon, session, *attachedClient)
	593	+	}{
	594	+	{name: "client gone parks resumable attachment", resumeCapable: true, teardown: func(d Daemon, sess session, ac *attachedClient) { d.clientGone(sess, ac, ac.transport(), false) }},
	595	+	{name: "send error parks resumable attachment", resumeCapable: true, teardown: func(d Daemon, sess session, ac *attachedClient) { d.detachOnSendError(sess, ac, ac.transport()) }},
	596	+	{name: "client gone removes non-resumable attachment", teardown: func(d Daemon, sess session, ac *attachedClient) { d.clientGone(sess, ac, ac.transport(), false) }},
	597	+	{name: "send error removes non-resumable attachment", teardown: func(d Daemon, sess session, ac *attachedClient) { d.detachOnSendError(sess, ac, ac.transport()) }},
	598	+	} {
	599	+	t.Run(test.name, func(t *testing.T) {
	600	+	d := newRemotePickerDaemon(nil)
	601	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	602	+	ac.resumeCapable = test.resumeCapable
	603	+	model := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	604	+	d.publishPicker(sess, ac, model, pickerNavigate, moveSourceLocator{})
	605	+	ac.overlays.pickerMu.Lock()
	606	+	generation := ac.overlays.pickerGeneration
	607	+	ac.overlays.pickerMu.Unlock()
	608	+
	609	+	test.teardown(d, sess, ac)
	610	+
	611	+	d.remoteCatalog.mu.Lock()
	612	+	_, registered := d.remoteCatalog.pickers[ac]
	613	+	d.remoteCatalog.mu.Unlock()
	614	+	ac.overlays.pickerMu.Lock()
	615	+	current, currentGeneration := ac.overlays.picker, ac.overlays.pickerGeneration
	616	+	ac.overlays.pickerMu.Unlock()
	617	+	if !test.resumeCapable {
	618	+	require.False(t, registered)
	619	+	require.Nil(t, current)
	620	+	return
	621	+	}
	622	+	require.True(t, ac.parked)
	623	+	require.True(t, registered)
	624	+	require.Same(t, model, current)
	625	+	require.Equal(t, generation, currentGeneration)
	626	+	d.mu.Lock()
	627	+	parked := d.parked[ac.resumeToken]
	628	+	d.mu.Unlock()
	629	+	require.NotNil(t, parked)
	630	+	require.Same(t, ac, parked.ac)
	631	+	})
	632	+	}
	633	+	}
	634	+
	635	+	func TestParkedPickerExpiryClosesCapturedGenerationAndCancelsRefresh(t *testing.T) {
	636	+	clock := &signalClock{timers: make(chan *signalTimer, 1)}
	637	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	638	+	d, catalog, _ := newRemoteRefreshDaemon(t, hosts, time.Unix(475, 0))
	639	+	d.clock = clock
	640	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	641	+	ac.resumeCapable = true
	642	+	d.publishPicker(sess, ac, d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	643	+	request := receiveRemotePicker(t, catalog.requests, "catalog request")
	644	+
	645	+	require.True(t, d.parkAttachment(sess, ac))
	646	+	timer := receiveRemotePicker(t, clock.timers, "park expiry timer")
	647	+	timer.ch <- clock.Now()
	648	+	receiveRemotePickerClose(t, request.ctx.Done(), "catalog request cancellation")
	649	+
	650	+	ac.overlays.pickerMu.Lock()
	651	+	require.Nil(t, ac.overlays.picker)
	652	+	ac.overlays.pickerMu.Unlock()
	653	+	d.remoteCatalog.mu.Lock()
	654	+	require.NotContains(t, d.remoteCatalog.pickers, ac)
	655	+	d.remoteCatalog.mu.Unlock()
	656	+	}
	657	+
	658	+	func TestParkedPickerRetirementClosesCapturedGenerationOnly(t *testing.T) {
	659	+	d := newRemotePickerDaemon(nil)
	660	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	661	+	ac.resumeCapable = true
	662	+	d.publishPicker(sess, ac, d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	663	+	d.refreshPickerOpts(ac, pickerRefreshOptions{preserveSelection: true, nearestRow: -1})
	664	+	ac.overlays.pickerMu.Lock()
	665	+	refreshed := ac.overlays.picker
	666	+	ac.overlays.pickerMu.Unlock()
	667	+	require.NotNil(t, refreshed)
	668	+	require.True(t, d.parkAttachment(sess, ac))
	669	+	token := ac.resumeToken
	670	+	d.mu.Lock()
	671	+	parked := d.parked[token]
	672	+	d.mu.Unlock()
	673	+	require.NotNil(t, parked)
	674	+
	675	+	d.mu.Lock()
	676	+	retirement := d.retireParkedAttachmentLocked(token, parked)
	677	+	d.mu.Unlock()
	678	+	d.finishParkedAttachmentRetirements([]parkedAttachmentRetirement{retirement})
	679	+	ac.overlays.pickerMu.Lock()
	680	+	require.Nil(t, ac.overlays.picker, "terminal retirement closes a refreshed model in its captured generation")
	681	+	ac.overlays.pickerMu.Unlock()
	682	+	}
	683	+
	684	+	func TestParkedPickerTokenReplacementRetiresPreviousGeneration(t *testing.T) {
	685	+	d := newRemotePickerDaemon(nil)
	686	+	firstSession, first, _ := addRemoteRefreshPickerOwner(t, d, "first")
	687	+	secondSession, second, _ := addRemoteRefreshPickerOwner(t, d, "second")
	688	+	first.resumeCapable, second.resumeCapable = true, true
	689	+	d.publishPicker(firstSession, first, d.newPickerModel(firstSession, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	690	+	require.True(t, d.parkAttachment(firstSession, first))
	691	+	token := first.resumeToken
	692	+	d.publishPicker(secondSession, second, d.newPickerModel(secondSession, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	693	+	second.resumeToken = token
	694	+	require.True(t, d.parkAttachment(secondSession, second))
	695	+
	696	+	first.overlays.pickerMu.Lock()
	697	+	require.Nil(t, first.overlays.picker)
	698	+	first.overlays.pickerMu.Unlock()
	699	+	second.overlays.pickerMu.Lock()
	700	+	require.NotNil(t, second.overlays.picker)
	701	+	second.overlays.pickerMu.Unlock()
	702	+	}
	703	+
	704	+	func TestParkedPickerResumePreservesGeneration(t *testing.T) {
	705	+	d := newRemotePickerDaemon(nil)
	706	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	707	+	ac.resumeCapable = true
	708	+	ac.clientID = [16]byte{1, 2, 3, 4}
	709	+	d.publishPicker(sess, ac, d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	710	+	ac.overlays.pickerMu.Lock()
	711	+	model, generation := ac.overlays.picker, ac.overlays.pickerGeneration
	712	+	ac.overlays.pickerMu.Unlock()
	713	+	d.clientGone(sess, ac, ac.transport(), false)
	714	+	token := ac.resumeToken
	715	+	tr := &closeTrackingTransport{}
	716	+	resumedSess, resumedAC, ok, err := d.resumeParked(helloResumeCapable(ports.IntentResume, sess.name, token), tr, domain.Size{Cols: 80, Rows: 24})
	717	+	require.NoError(t, err)
	718	+	require.True(t, ok)
	719	+	require.Same(t, sess, resumedSess)
	720	+	require.Same(t, ac, resumedAC)
	721	+	ac.overlays.pickerMu.Lock()
	722	+	require.Same(t, model, ac.overlays.picker)
	723	+	require.Equal(t, generation, ac.overlays.pickerGeneration)
	724	+	ac.overlays.pickerMu.Unlock()
	725	+	}
	726	+
	727	+	func TestStaleParkedPickerExpiryPreservesNewGeneration(t *testing.T) {
	728	+	d := newRemotePickerDaemon(nil)
	729	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	730	+	ac.resumeCapable = true
	731	+	d.publishPicker(sess, ac, d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	732	+	require.True(t, d.parkAttachment(sess, ac))
	733	+	token := ac.resumeToken
	734	+	d.mu.Lock()
	735	+	parked := d.parked[token]
	736	+	d.mu.Unlock()
	737	+	require.NotNil(t, parked)
	738	+
	739	+	newer := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	740	+	d.publishPicker(sess, ac, newer, pickerNavigate, moveSourceLocator{})
	741	+	d.expireParked(token, parked)
	742	+	ac.overlays.pickerMu.Lock()
	743	+	require.Same(t, newer, ac.overlays.picker)
	744	+	ac.overlays.pickerMu.Unlock()
	745	+	}
	746	+
	747	+	func TestRemoteRefreshPreservesRemoteCursorAcrossCacheToProxyUpgrade(t *testing.T) {
	748	+	d := newRemotePickerDaemon(nil)
	749	+	ownerSession, owner, _ := addRemoteRefreshPickerOwner(t, d, "local")
	750	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	751	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	752	+	Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: key.Name, State: "running"}},
	753	+	}})
	754	+	owner.overlays.pickerMu.Lock()
	755	+	owner.overlays.picker = d.newPickerModel(ownerSession, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{Session: key.ID(), RemoteKey: &key})
	756	+	owner.overlays.pickerIntent = pickerNavigate
	757	+	before, ok := owner.overlays.picker.Cursor()
	758	+	_, beforeSelectable := owner.overlays.picker.Selected()
	759	+	owner.overlays.pickerMu.Unlock()
	760	+	require.True(t, ok)
	761	+	require.Equal(t, &key, before.RemoteKey)
	762	+	require.False(t, beforeSelectable, "cache-derived remote row must stay gated until proxy activation lands")
	763	+
	764	+	proxy := &proxySession{
	765	+	sessionCore: sessionCore{id: key.ID(), name: key.Display()},
	766	+	key: key,
	767	+	meta: ports.SessionMeta{SessionName: key.Name, Tabs: []ports.SessionTabMeta{{Index: 0, Name: "live"}}},
	768	+	}
	769	+	d.mu.Lock()
	770	+	d.sessions[key.ID()] = proxy
	771	+	d.mu.Unlock()
	772	+
	773	+	d.refreshPickerOpts(owner, pickerRefreshOptions{preserveSelection: true, nearestRow: -1})
	774	+
	775	+	owner.overlays.pickerMu.Lock()
	776	+	after, ok := owner.overlays.picker.Cursor()
	777	+	_, selectable := owner.overlays.picker.Selected()
	778	+	owner.overlays.pickerMu.Unlock()
	779	+	require.True(t, ok)
	780	+	require.Equal(t, before.Session, after.Session)
	781	+	require.Equal(t, before.RemoteKey, after.RemoteKey)
	782	+	require.False(t, selectable, "cache-to-live upgrade must preserve the proxy activation gate")
	783	+	}
	784	+
	785	+	func TestRemoteRefreshCancellationWhenLastPickerCloses(t *testing.T) {
	786	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	787	+	d, catalog, _ := newRemoteRefreshDaemon(t, hosts, time.Unix(500, 0))
	788	+	newInstance := func() remotePickerInstance {
	789	+	ac := &attachedClient{}
	790	+	ac.initOverlays()
	791	+	model := picker.New(nil, picker.SelectionConfig{})
	792	+	ac.overlays.pickerMu.Lock()
	793	+	ac.overlays.picker = model
	794	+	ac.overlays.pickerGeneration++
	795	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: model}
	796	+	ac.overlays.pickerMu.Unlock()
	797	+	return instance
	798	+	}
	799	+	closeInstance := func(instance remotePickerInstance) {
	800	+	instance.ac.overlays.pickerMu.Lock()
	801	+	instance.ac.overlays.picker = nil
	802	+	instance.ac.overlays.pickerMu.Unlock()
	803	+	d.remotePickerClosed(instance)
	804	+	}
	805	+	first, second := newInstance(), newInstance()
	806	+	d.remotePickerOpened(first)
	807	+	request := receiveRemotePicker(t, catalog.requests, "catalog request")
	808	+	d.remotePickerOpened(second)
	809	+	receiveRemotePickerClose(t, request.ctx.Done(), "catalog request cancellation")
	810	+	request = receiveRemotePicker(t, catalog.requests, "catalog request")
	811	+
	812	+	closeInstance(first)
	813	+	select {
	814	+	case <-request.ctx.Done():
	815	+	t.Fatal("refresh canceled while another picker remained open")
	816	+	default:
	817	+	}
	818	+	closeInstance(second)
	819	+	receiveRemotePickerClose(t, request.ctx.Done(), "catalog request cancellation")
	820	+
	821	+	d.remoteCatalog.mu.Lock()
	822	+	require.Empty(t, d.remoteCatalog.pickers)
	823	+	require.Nil(t, d.remoteCatalog.cancel)
	824	+	d.remoteCatalog.mu.Unlock()
	825	+	}
	826	+
	827	+	func TestRemoteRefreshCannotStartAfterLastPickerCloseWins(t *testing.T) {
	828	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	829	+	d, catalog, _ := newRemoteRefreshDaemon(t, hosts, time.Unix(525, 0))
	830	+	ac := &attachedClient{}
	831	+	ac.initOverlays()
	832	+	model := picker.New(nil, picker.SelectionConfig{})
	833	+	ac.overlays.pickerMu.Lock()
	834	+	ac.overlays.picker = model
	835	+	ac.overlays.pickerGeneration++
	836	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: model}
	837	+	ac.overlays.pickerMu.Unlock()
	838	+
	839	+	// Stop at the production seam after exact picker ownership registration but
	840	+	// before refresh startup, then let the last-picker close linearize first.
	841	+	require.True(t, d.registerRemotePicker(instance))
	842	+	ac.overlays.pickerMu.Lock()
	843	+	ac.overlays.picker = nil
	844	+	ac.overlays.pickerMu.Unlock()
	845	+	d.remotePickerClosed(instance)
	846	+
	847	+	d.remoteCatalog.mu.Lock()
	848	+	refreshBefore := d.remoteCatalog.refresh
	849	+	d.remoteCatalog.mu.Unlock()
	850	+	require.Zero(t, d.startRemotePickerRefresh(instance))
	851	+
	852	+	d.remoteCatalog.mu.Lock()
	853	+	require.Empty(t, d.remoteCatalog.pickers, "the closing picker must remain unregistered")
	854	+	require.Equal(t, refreshBefore, d.remoteCatalog.refresh, "a close that wins before startup must prevent a later refresh generation")
	855	+	require.Nil(t, d.remoteCatalog.cancel, "a close that wins before startup must prevent a later cancel installation")
	856	+	d.remoteCatalog.mu.Unlock()
	857	+	select {
	858	+	case request := <-catalog.requests:
	859	+	t.Fatalf("catalog call remained running after the last picker closed: %s", request.host)
	860	+	default:
	861	+	}
	862	+	}
	863	+
	864	+	func TestRemotePickerPublishCannotRegisterAfterSnatchClear(t *testing.T) {
	865	+	d := newRemotePickerDaemon(nil)
	866	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	867	+	ac.roleGeneration.Store(1)
	868	+	model := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	869	+	registrationReached := make(chan struct{})
	870	+	allowRegistration := make(chan struct{})
	871	+	registrationWait := make(chan error, 1)
	872	+	ac.overlays.beforeRemotePickerRegistration = func() {
	873	+	close(registrationReached)
	874	+	registrationWait <- waitRemotePickerClose(allowRegistration, "picker registration release")
	875	+	}
	876	+	published := make(chan struct{})
	877	+	go func() {
	878	+	d.publishPicker(sess, ac, model, pickerNavigate, moveSourceLocator{})
	879	+	close(published)
	880	+	}()
	881	+	receiveRemotePickerClose(t, registrationReached, "picker registration")
	882	+
	883	+	token := attachmentRoleToken{
	884	+	sess: sess, ac: ac, role: attachmentSnatched,
	885	+	generation: 1, transport: ac.transportSnapshot(),
	886	+	}
	887	+	require.True(t, d.clearForSnatch(token))
	888	+	close(allowRegistration)
	889	+	require.NoError(t, receiveRemotePicker(t, registrationWait, "picker registration release"))
	890	+	receiveRemotePickerClose(t, published, "picker publication")
	891	+
	892	+	d.remoteCatalog.mu.Lock()
	893	+	_, registered := d.remoteCatalog.pickers[ac]
	894	+	d.remoteCatalog.mu.Unlock()
	895	+	require.False(t, registered, "a picker cleared before delayed registration must not become a refresh owner")
	896	+	}
	897	+
	898	+	func TestRemotePickerStaleAfterCloseCannotRemoveReopenedPicker(t *testing.T) {
	899	+	d := newRemotePickerDaemon(nil)
	900	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	901	+	first := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	902	+	d.publishPicker(sess, ac, first, pickerNavigate, moveSourceLocator{})
	903	+
	904	+	staleClose := d.pickerListInputState(ac)
	905	+	ac.overlays.pickerMu.Lock()
	906	+	staleClose.closeLocked()
	907	+	ac.overlays.pickerMu.Unlock()
	908	+
	909	+	reopened := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	910	+	d.publishPicker(sess, ac, reopened, pickerNavigate, moveSourceLocator{})
	911	+	staleClose.afterClose()
	912	+
	913	+	d.remoteCatalog.mu.Lock()
	914	+	_, registered := d.remoteCatalog.pickers[ac]
	915	+	d.remoteCatalog.mu.Unlock()
	916	+	require.True(t, registered, "stale close cleanup must retain the reopened picker registration")
	917	+	ac.overlays.pickerMu.Lock()
	918	+	require.Same(t, reopened, ac.overlays.picker)
	919	+	ac.overlays.pickerMu.Unlock()
	920	+	}
	921	+
	922	+	func TestRemotePickerStaleRefreshCannotOverwriteReopenedModel(t *testing.T) {
	923	+	d := newRemotePickerDaemon(nil)
	924	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	925	+	first := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	926	+	d.publishPicker(sess, ac, first, pickerNavigate, moveSourceLocator{})
	927	+
	928	+	rebuildReached := make(chan struct{})
	929	+	allowPublication := make(chan struct{})
	930	+	publicationWait := make(chan error, 1)
	931	+	ac.overlays.afterPickerRefreshBuild = func(*picker.Model) {
	932	+	close(rebuildReached)
	933	+	publicationWait <- waitRemotePickerClose(allowPublication, "picker publication release")
	934	+	}
	935	+	refreshed := make(chan struct{})
	936	+	go func() {
	937	+	d.refreshRemoteOpenPickers()
	938	+	close(refreshed)
	939	+	}()
	940	+	receiveRemotePickerClose(t, rebuildReached, "picker rebuild")
	941	+
	942	+	d.closePicker(ac)
	943	+	reopened := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	944	+	d.publishPicker(sess, ac, reopened, pickerNavigate, moveSourceLocator{})
	945	+	close(allowPublication)
	946	+	require.NoError(t, receiveRemotePicker(t, publicationWait, "picker publication release"))
	947	+	receiveRemotePickerClose(t, refreshed, "picker refresh")
	948	+
	949	+	ac.overlays.pickerMu.Lock()
	950	+	require.Same(t, reopened, ac.overlays.picker, "a rebuild for the old picker must not publish into its replacement")
	951	+	ac.overlays.pickerMu.Unlock()
	952	+	}
	953	+
	954	+	func TestRemoteRowsRemainNonSelectableDuringRefreshPhase(t *testing.T) {
	955	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	956	+	for _, availability := range []picker.RemoteAvailability{picker.RemoteCached, picker.RemoteFresh, picker.RemoteStale, picker.RemoteVersionMismatch} {
	957	+	model := picker.New([]picker.SessionView{{
	958	+	ID: key.ID(), Name: key.Display(), RemoteKey: &key, RemoteAvailability: availability,
	959	+	ConnectOnly: true, RemoteAttachReady: false,
	960	+	}}, picker.SelectionConfig{Mode: picker.SelectNavigationTab})
	961	+	_, selectable := model.Selected()
	962	+	require.False(t, selectable, "availability %d became remotely attachable in phase 5", availability)
	963	+	}
	964	+	}

@@ -0,0 +1,964 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"context"
	5	+	"errors"
	6	+	"fmt"
	7	+	"io"
	8	+	"log/slog"
	9	+	"sync"
	10	+	"testing"
	11	+	"time"
	12	+
	13	+	"github.com/stretchr/testify/require"
	14	+
	15	+	"github.com/bnema/vev/internal/domain"
	16	+	"github.com/bnema/vev/internal/ports"
	17	+	portsmocks "github.com/bnema/vev/internal/ports/mocks"
	18	+	"github.com/bnema/vev/internal/usecase/picker"
	19	+	)
	20	+
	21	+	const remotePickerReceiveTimeout = time.Second
	22	+
	23	+	func receiveRemotePicker[T any](t *testing.T, ch <-chan T, what string) T {
	24	+	t.Helper()
	25	+	select {
	26	+	case value, ok := <-ch:
	27	+	if !ok {
	28	+	t.Fatalf("channel closed unexpectedly while waiting for %s", what)
	29	+	}
	30	+	return value
	31	+	case <-time.After(remotePickerReceiveTimeout):
	32	+	t.Fatalf("timed out waiting for %s", what)
	33	+	var zero T
	34	+	return zero
	35	+	}
	36	+	}
	37	+
	38	+	func waitRemotePickerClose(ch <-chan struct{}, what string) error {
	39	+	select {
	40	+	case _, ok := <-ch:
	41	+	if ok {
	42	+	return fmt.Errorf("received signal instead of closure while waiting for %s", what)
	43	+	}
	44	+	return nil
	45	+	case <-time.After(remotePickerReceiveTimeout):
	46	+	return fmt.Errorf("timed out waiting for %s", what)
	47	+	}
	48	+	}
	49	+
	50	+	func receiveRemotePickerClose(t *testing.T, ch <-chan struct{}, what string) {
	51	+	t.Helper()
	52	+	require.NoError(t, waitRemotePickerClose(ch, what))
	53	+	}
	54	+
	55	+	func newRemotePickerDaemon(store ports.RemoteHostStore) *Daemon {
	56	+	return New(nil, stubClock{}, slog.New(slog.NewTextHandler(io.Discard, nil)), WithRemoteDiscovery(store, nil, nil, nil, ports.RemoteTransportUDP))
	57	+	}
	58	+
	59	+	func TestRemotePickerMerge(t *testing.T) {
	60	+	store := portsmocks.NewMockRemoteHostStore(t)
	61	+	store.EXPECT().Hosts().Return([]string{"pinned"}, []string{"learned"}, nil).Once()
	62	+	d := newRemotePickerDaemon(store)
	63	+	local := &session{sessionCore: sessionCore{id: "local", name: "local"}, tabs: []*tab{{}}}
	64	+	local.mruAt.Store(6)
	65	+	key := domain.RemoteSessionKey{Host: "pinned", Name: "work"}
	66	+	proxy := &proxySession{
	67	+	sessionCore: sessionCore{id: key.ID(), name: key.Display()},
	68	+	key: key,
	69	+	meta: ports.SessionMeta{SessionName: key.Name, Tabs: []ports.SessionTabMeta{
	70	+	{Index: 0, Name: "shell"},
	71	+	}},
	72	+	}
	73	+	proxy.mruAt.Store(5)
	74	+	d.sessions[local.id] = local
	75	+	d.sessions[proxy.id] = proxy
	76	+	d.stopped["stopped"] = stoppedSession{name: "stopped", createdAt: 2, lastUsedSeq: 9}
	77	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{
	78	+	{Host: "learned", FetchedAt: time.Unix(20, 0), Sessions: []ports.RemoteCatalogSession{{Name: "alpha", State: "running", Tabs: 3}}},
	79	+	{Host: "pinned", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "work", State: "running", Tabs: 9}, {Name: "alpha", State: "running", Tabs: 2}}},
	80	+	})
	81	+	d.remoteCatalog.mu.Lock()
	82	+	d.remoteCatalog.status["pinned"] = remoteHostFresh
	83	+	d.remoteCatalog.status["learned"] = remoteHostFresh
	84	+	d.remoteCatalog.mu.Unlock()
	85	+
	86	+	views, _ := d.pickerViews(local)
	87	+
	88	+	require.Equal(t, []string{"local", "work@pinned", "alpha@pinned", "alpha@learned", "stopped"}, pickerViewNames(views))
	89	+	require.False(t, views[0].Stopped)
	90	+	require.Equal(t, key, *views[1].RemoteKey)
	91	+	require.Equal(t, picker.RemoteFresh, views[1].RemoteAvailability)
	92	+	require.True(t, views[1].ConnectOnly)
	93	+	require.Equal(t, "2 tabs", views[2].RemoteDetail)
	94	+	require.Equal(t, picker.RemoteFresh, views[2].RemoteAvailability)
	95	+	require.Equal(t, picker.RemoteFresh, views[3].RemoteAvailability)
	96	+	require.True(t, views[4].Stopped)
	97	+	}
	98	+
	99	+	func TestRemotePickerDedupeUsesExactKeyAndKeepsLiveID(t *testing.T) {
	100	+	d := newRemotePickerDaemon(nil)
	101	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	102	+	proxy := &proxySession{
	103	+	sessionCore: sessionCore{id: key.ID(), name: key.Display()},
	104	+	key: key,
	105	+	meta: ports.SessionMeta{SessionName: key.Name, Tabs: []ports.SessionTabMeta{
	106	+	{Index: 0, Name: "live tab"},
	107	+	}},
	108	+	}
	109	+	d.sessions[key.ID()] = proxy
	110	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	111	+	Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{
	112	+	{Name: "work", State: "running", Tabs: 7},
	113	+	},
	114	+	}})
	115	+
	116	+	views, _ := d.pickerViews(nil)
	117	+
	118	+	require.Len(t, views, 1)
	119	+	require.Equal(t, key.ID(), views[0].ID)
	120	+	require.Equal(t, key, *views[0].RemoteKey)
	121	+	require.Equal(t, []picker.TabEntry{{Name: "live tab"}}, views[0].Tabs, "live proxy snapshot wins over cached discovery")
	122	+	require.Equal(t, picker.RemoteFresh, views[0].RemoteAvailability)
	123	+	}
	124	+
	125	+	func TestRemotePickerSnapshotsDoNotRetainProxyLock(t *testing.T) {
	126	+	d := newRemotePickerDaemon(nil)
	127	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	128	+	proxy := &proxySession{
	129	+	sessionCore: sessionCore{id: key.ID(), name: key.Display()},
	130	+	key: key,
	131	+	meta: ports.SessionMeta{SessionName: key.Name, Tabs: []ports.SessionTabMeta{{Index: 0, Name: "shell"}}},
	132	+	}
	133	+	d.sessions[key.ID()] = proxy
	134	+
	135	+	views, _ := d.pickerViews(nil)
	136	+
	137	+	require.Len(t, views, 1)
	138	+	require.True(t, proxy.mu.TryLock(), "picker construction must release the proxy leaf lock")
	139	+	proxy.mu.Unlock()
	140	+	require.True(t, d.remoteCatalog.mu.TryLock(), "picker construction must release the remote catalog lock")
	141	+	d.remoteCatalog.mu.Unlock()
	142	+	}
	143	+
	144	+	func TestRemotePickerAvailabilityUsesCachedRowsForFailures(t *testing.T) {
	145	+	tests := []struct {
	146	+	name string
	147	+	status remoteHostStatus
	148	+	want picker.RemoteAvailability
	149	+	}{
	150	+	{name: "cached", status: remoteHostCached, want: picker.RemoteCached},
	151	+	{name: "unreachable", status: remoteHostUnreachable, want: picker.RemoteStale},
	152	+	{name: "version mismatch", status: remoteHostVersionMismatch, want: picker.RemoteVersionMismatch},
	153	+	}
	154	+
	155	+	for _, test := range tests {
	156	+	t.Run(test.name, func(t *testing.T) {
	157	+	d := newRemotePickerDaemon(nil)
	158	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	159	+	Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "work", State: "running"}},
	160	+	}})
	161	+	d.remoteCatalog.mu.Lock()
	162	+	d.remoteCatalog.status["arch"] = test.status
	163	+	d.remoteCatalog.mu.Unlock()
	164	+
	165	+	views, _ := d.pickerViews(nil)
	166	+
	167	+	require.Len(t, views, 1)
	168	+	require.Equal(t, test.want, views[0].RemoteAvailability)
	169	+	})
	170	+	}
	171	+	}
	172	+
	173	+	func TestRemotePickerStaleDetailUsesLastSuccessfulFetch(t *testing.T) {
	174	+	d := newRemotePickerDaemon(nil)
	175	+	fetchedAt := time.Date(2025, time.January, 2, 3, 4, 5, 0, time.UTC)
	176	+	failedAt := fetchedAt.Add(6 * time.Hour)
	177	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	178	+	Host: "arch", FetchedAt: fetchedAt, Sessions: []ports.RemoteCatalogSession{{Name: "work", State: "running"}},
	179	+	}})
	180	+	d.remoteCatalog.mu.Lock()
	181	+	d.remoteCatalog.status["arch"] = remoteHostUnreachable
	182	+	d.remoteCatalog.failure["arch"] = failedAt
	183	+	d.remoteCatalog.mu.Unlock()
	184	+
	185	+	views, _ := d.pickerViews(nil)
	186	+
	187	+	require.Len(t, views, 1)
	188	+	require.Equal(t, "stale since "+fetchedAt.Format(time.RFC3339), views[0].RemoteDetail)
	189	+	require.NotContains(t, views[0].RemoteDetail, failedAt.Format(time.RFC3339), "failure time remains runtime-only and is not the freshness authority")
	190	+	}
	191	+
	192	+	func TestRemotePickerNoCacheHostFailuresRemainVisible(t *testing.T) {
	193	+	for _, test := range []struct {
	194	+	name string
	195	+	status remoteHostStatus
	196	+	want picker.RemoteAvailability
	197	+	wantDetail string
	198	+	}{
	199	+	{name: "unreachable", status: remoteHostUnreachable, want: picker.RemoteStale, wantDetail: "unreachable"},
	200	+	{name: "version mismatch", status: remoteHostVersionMismatch, want: picker.RemoteVersionMismatch, wantDetail: "version mismatch"},
	201	+	} {
	202	+	t.Run(test.name, func(t *testing.T) {
	203	+	d := newRemotePickerDaemon(nil)
	204	+	d.remoteCatalog.mu.Lock()
	205	+	d.remoteCatalog.status["arch"] = test.status
	206	+	d.remoteCatalog.failure["arch"] = time.Unix(50, 0)
	207	+	d.remoteCatalog.mu.Unlock()
	208	+
	209	+	views, _ := d.pickerViews(nil)
	210	+
	211	+	require.Len(t, views, 1)
	212	+	require.Equal(t, "arch", views[0].Name)
	213	+	require.Equal(t, test.want, views[0].RemoteAvailability)
	214	+	require.Equal(t, test.wantDetail, views[0].RemoteDetail)
	215	+	model := picker.New(views, picker.SelectionConfig{Mode: picker.SelectNavigationTab})
	216	+	_, selectable := model.Selected()
	217	+	require.False(t, selectable)
	218	+	})
	219	+	}
	220	+	}
	221	+
	222	+	func TestRemotePickerGroupedSortTreatsProxiesAsLiveSessions(t *testing.T) {
	223	+	d := newRemotePickerDaemon(nil)
	224	+	d.pickerSort.Store(uint32(pickerSortGrouped))
	225	+	ephemeral := &session{sessionCore: sessionCore{id: "ephemeral", name: "1", ephemeral: true}, tabs: []*tab{{}}}
	226	+	ephemeral.mruAt.Store(9)
	227	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	228	+	proxy := &proxySession{sessionCore: sessionCore{id: key.ID(), name: key.Display()}, key: key}
	229	+	proxy.mruAt.Store(1)
	230	+	named := &session{sessionCore: sessionCore{id: "named", name: "named"}, tabs: []*tab{{}}}
	231	+	named.mruAt.Store(2)
	232	+	d.sessions[ephemeral.id] = ephemeral
	233	+	d.sessions[proxy.id] = proxy
	234	+	d.sessions[named.id] = named
	235	+
	236	+	views, _ := d.pickerViews(nil)
	237	+
	238	+	require.Equal(t, []string{"named", "work@arch", "1"}, pickerViewNames(views))
	239	+	}
	240	+
	241	+	func pickerViewNames(views []picker.SessionView) []string {
	242	+	names := make([]string, len(views))
	243	+	for i, view := range views {
	244	+	names[i] = view.Name
	245	+	}
	246	+	return names
	247	+	}
	248	+
	249	+	type remoteRefreshHostStore struct {
	250	+	mu sync.Mutex
	251	+	hosts []string
	252	+	}
	253	+
	254	+	func (s *remoteRefreshHostStore) Hosts() ([]string, []string, error) {
	255	+	s.mu.Lock()
	256	+	defer s.mu.Unlock()
	257	+	return append([]string(nil), s.hosts...), nil, nil
	258	+	}
	259	+
	260	+	func (s *remoteRefreshHostStore) set(hosts ...string) {
	261	+	s.mu.Lock()
	262	+	s.hosts = append([]string(nil), hosts...)
	263	+	s.mu.Unlock()
	264	+	}
	265	+
	266	+	func (*remoteRefreshHostStore) AddPinned(string) error { return nil }
	267	+	func (*remoteRefreshHostStore) RemovePinned(string) error { return nil }
	268	+	func (*remoteRefreshHostStore) Remember(string) error { return nil }
	269	+	func (*remoteRefreshHostStore) Forget(string) error { return nil }
	270	+	func (*remoteRefreshHostStore) Remove(string) (bool, error) {
	271	+	return false, nil
	272	+	}
	273	+
	274	+	type remoteRefreshRequest struct {
	275	+	ctx context.Context
	276	+	host string
	277	+	result chan remoteRefreshResult
	278	+	}
	279	+
	280	+	type remoteRefreshResult struct {
	281	+	catalog ports.RemoteCatalog
	282	+	err error
	283	+	}
	284	+
	285	+	type channelRemoteCatalog struct {
	286	+	d *Daemon
	287	+	requests chan remoteRefreshRequest
	288	+	probeMu sync.Mutex
	289	+	probes bool
	290	+	violations []string
	291	+	}
	292	+
	293	+	func (c *channelRemoteCatalog) List(ctx context.Context, host string) (ports.RemoteCatalog, error) {
	294	+	c.probeMu.Lock()
	295	+	if c.probes && !c.d.mu.TryLock() {
	296	+	c.violations = append(c.violations, "daemon lock held during remote catalog I/O")
	297	+	} else if c.probes {
	298	+	c.d.mu.Unlock()
	299	+	}
	300	+	if c.probes && !c.d.remoteCatalog.mu.TryLock() {
	301	+	c.violations = append(c.violations, "remote catalog lock held during remote catalog I/O")
	302	+	} else if c.probes {
	303	+	c.d.remoteCatalog.mu.Unlock()
	304	+	}
	305	+	c.probeMu.Unlock()
	306	+	request := remoteRefreshRequest{ctx: ctx, host: host, result: make(chan remoteRefreshResult, 1)}
	307	+	c.requests <- request
	308	+	select {
	309	+	case result := <-request.result:
	310	+	return result.catalog, result.err
	311	+	case <-ctx.Done():
	312	+	return ports.RemoteCatalog{}, ctx.Err()
	313	+	}
	314	+	}
	315	+
	316	+	type recordingRemoteCache struct {
	317	+	d *Daemon
	318	+	stores chan []ports.RemoteCatalogCacheEntry
	319	+	probeMu sync.Mutex
	320	+	probes bool
	321	+	violations []string
	322	+	}
	323	+
	324	+	func (*recordingRemoteCache) Load() ([]ports.RemoteCatalogCacheEntry, error) { return nil, nil }
	325	+
	326	+	func (c *recordingRemoteCache) Store(entries []ports.RemoteCatalogCacheEntry) error {
	327	+	c.probeMu.Lock()
	328	+	if c.probes && !c.d.mu.TryLock() {
	329	+	c.violations = append(c.violations, "daemon lock held during remote cache write")
	330	+	} else if c.probes {
	331	+	c.d.mu.Unlock()
	332	+	}
	333	+	if c.probes && !c.d.remoteCatalog.mu.TryLock() {
	334	+	c.violations = append(c.violations, "remote catalog lock held during remote cache write")
	335	+	} else if c.probes {
	336	+	c.d.remoteCatalog.mu.Unlock()
	337	+	}
	338	+	c.probeMu.Unlock()
	339	+	copyEntries := make([]ports.RemoteCatalogCacheEntry, len(entries))
	340	+	for i, entry := range entries {
	341	+	copyEntries[i] = cloneRemoteCatalogEntry(entry)
	342	+	}
	343	+	c.stores <- copyEntries
	344	+	return nil
	345	+	}
	346	+
	347	+	type fixedRemoteRefreshClock struct{ now time.Time }
	348	+
	349	+	func (c fixedRemoteRefreshClock) Now() time.Time { return c.now }
	350	+	func (fixedRemoteRefreshClock) NewTimer(time.Duration) ports.Timer { return stubTimer{} }
	351	+
	352	+	func requireNoRemoteLockViolations(t testing.T, catalog channelRemoteCatalog, cache *recordingRemoteCache) {
	353	+	t.Helper()
	354	+	if catalog != nil {
	355	+	catalog.probeMu.Lock()
	356	+	require.Empty(t, catalog.violations)
	357	+	catalog.probeMu.Unlock()
	358	+	}
	359	+	if cache != nil {
	360	+	cache.probeMu.Lock()
	361	+	require.Empty(t, cache.violations)
	362	+	cache.probeMu.Unlock()
	363	+	}
	364	+	}
	365	+
	366	+	func newRemoteRefreshDaemon(t testing.T, hosts remoteRefreshHostStore, now time.Time) (Daemon, channelRemoteCatalog, *recordingRemoteCache) {
	367	+	t.Helper()
	368	+	catalog := &channelRemoteCatalog{requests: make(chan remoteRefreshRequest, 8)}
	369	+	cache := &recordingRemoteCache{stores: make(chan []ports.RemoteCatalogCacheEntry, 8)}
	370	+	d := New(nil, fixedRemoteRefreshClock{now: now}, slog.New(slog.NewTextHandler(io.Discard, nil)), WithRemoteDiscovery(hosts, catalog, cache, nil, ports.RemoteTransportUDP))
	371	+	catalog.d, cache.d = d, d
	372	+	return d, catalog, cache
	373	+	}
	374	+
	375	+	func TestRemoteRefreshStartsPerHostAndCancelsSupersededGeneration(t *testing.T) {
	376	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch", "mule"}}
	377	+	d, catalog, cache := newRemoteRefreshDaemon(t, hosts, time.Unix(100, 0))
	378	+	ac := &attachedClient{}
	379	+	ac.initOverlays()
	380	+	model := picker.New(nil, picker.SelectionConfig{})
	381	+	ac.overlays.pickerMu.Lock()
	382	+	ac.overlays.picker = model
	383	+	ac.overlays.pickerGeneration++
	384	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: model}
	385	+	ac.overlays.pickerMu.Unlock()
	386	+	require.True(t, d.registerRemotePicker(instance))
	387	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	388	+	Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "cached", State: "running"}},
	389	+	}})
	390	+
	391	+	firstGeneration := d.startRemotePickerRefresh(instance)
	392	+	first := map[string]remoteRefreshRequest{}
	393	+	for range 2 {
	394	+	request := receiveRemotePicker(t, catalog.requests, "catalog request")
	395	+	first[request.host] = request
	396	+	}
	397	+	require.Contains(t, first, "arch")
	398	+	require.Contains(t, first, "mule")
	399	+	requireNoRemoteLockViolations(t, catalog, nil)
	400	+	d.remoteCatalog.mu.Lock()
	401	+	require.Equal(t, []ports.RemoteCatalogSession{{Name: "cached", State: "running"}}, d.remoteCatalog.cache["arch"].Sessions, "cached rows publish before any remote completion")
	402	+	require.Equal(t, remoteHostRefreshing, d.remoteCatalog.status["arch"])
	403	+	d.remoteCatalog.mu.Unlock()
	404	+
	405	+	secondGeneration := d.startRemotePickerRefresh(instance)
	406	+	require.Greater(t, secondGeneration, firstGeneration)
	407	+	for _, request := range first {
	408	+	receiveRemotePickerClose(t, request.ctx.Done(), "catalog request cancellation")
	409	+	}
	410	+	for range 2 {
	411	+	request := receiveRemotePicker(t, catalog.requests, "catalog request")
	412	+	request.result <- remoteRefreshResult{catalog: ports.RemoteCatalog{ProtocolVersion: ports.ProtocolVersion}}
	413	+	}
	414	+	for range 2 {
	415	+	receiveRemotePicker(t, cache.stores, "remote cache store")
	416	+	}
	417	+	requireNoRemoteLockViolations(t, nil, cache)
	418	+
	419	+	d.remoteCatalog.mu.Lock()
	420	+	require.Equal(t, secondGeneration, d.remoteCatalog.refresh)
	421	+	require.Equal(t, remoteHostFresh, d.remoteCatalog.status["arch"])
	422	+	require.Equal(t, remoteHostFresh, d.remoteCatalog.status["mule"])
	423	+	d.remoteCatalog.mu.Unlock()
	424	+	}
	425	+
	426	+	func TestRemoteRefreshLockProbesSerialized(t *testing.T) {
	427	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	428	+	d, catalog, cache := newRemoteRefreshDaemon(t, hosts, time.Unix(125, 0))
	429	+	catalog.probes, cache.probes = true, true
	430	+	ac := &attachedClient{}
	431	+	ac.initOverlays()
	432	+	model := picker.New(nil, picker.SelectionConfig{})
	433	+	ac.overlays.pickerMu.Lock()
	434	+	ac.overlays.picker = model
	435	+	ac.overlays.pickerGeneration++
	436	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: model}
	437	+	ac.overlays.pickerMu.Unlock()
	438	+	require.True(t, d.registerRemotePicker(instance))
	439	+
	440	+	d.startRemotePickerRefresh(instance)
	441	+	request := receiveRemotePicker(t, catalog.requests, "catalog request")
	442	+	request.result <- remoteRefreshResult{catalog: ports.RemoteCatalog{ProtocolVersion: ports.ProtocolVersion}}
	443	+	receiveRemotePicker(t, cache.stores, "remote cache store")
	444	+	requireNoRemoteLockViolations(t, catalog, cache)
	445	+	}
	446	+
	447	+	func TestRemoteRefreshWithoutCatalogClientDoesNotMarkHostsRefreshing(t *testing.T) {
	448	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	449	+	d := newRemotePickerDaemon(hosts)
	450	+	ac := &attachedClient{}
	451	+	ac.initOverlays()
	452	+	model := picker.New(nil, picker.SelectionConfig{})
	453	+	ac.overlays.pickerMu.Lock()
	454	+	ac.overlays.picker = model
	455	+	ac.overlays.pickerGeneration++
	456	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: model}
	457	+	ac.overlays.pickerMu.Unlock()
	458	+	require.True(t, d.registerRemotePicker(instance))
	459	+
	460	+	require.NotZero(t, d.startRemotePickerRefresh(instance))
	461	+	d.remoteCatalog.mu.Lock()
	462	+	require.NotEqual(t, remoteHostRefreshing, d.remoteCatalog.status["arch"])
	463	+	d.remoteCatalog.mu.Unlock()
	464	+	}
	465	+
	466	+	func TestRemoteRefreshResultPreservesFailuresAndEvictsSuccessfulOmissions(t *testing.T) {
	467	+	now := time.Unix(200, 0)
	468	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch", "mule"}}
	469	+	d, _, cache := newRemoteRefreshDaemon(t, hosts, now)
	470	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{
	471	+	{Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "old", State: "running"}}},
	472	+	{Host: "mule", FetchedAt: time.Unix(20, 0), Sessions: []ports.RemoteCatalogSession{{Name: "stale", State: "running"}}},
	473	+	})
	474	+	d.remoteCatalog.mu.Lock()
	475	+	d.remoteCatalog.refresh = 7
	476	+	d.remoteCatalog.mu.Unlock()
	477	+
	478	+	require.False(t, d.applyRemoteRefreshResult(7, "mule", ports.RemoteCatalog{}, errors.New("offline")))
	479	+	d.remoteCatalog.mu.Lock()
	480	+	require.Equal(t, []ports.RemoteCatalogSession{{Name: "stale", State: "running"}}, d.remoteCatalog.cache["mule"].Sessions)
	481	+	require.Equal(t, time.Unix(20, 0), d.remoteCatalog.cache["mule"].FetchedAt)
	482	+	require.Equal(t, remoteHostUnreachable, d.remoteCatalog.status["mule"])
	483	+	d.remoteCatalog.mu.Unlock()
	484	+
	485	+	require.True(t, d.applyRemoteRefreshResult(7, "arch", ports.RemoteCatalog{ProtocolVersion: ports.ProtocolVersion}, nil))
	486	+	stored := receiveRemotePicker(t, cache.stores, "remote cache store")
	487	+	require.Equal(t, []ports.RemoteCatalogCacheEntry{
	488	+	{Host: "arch", FetchedAt: now, Sessions: []ports.RemoteCatalogSession{}},
	489	+	{Host: "mule", FetchedAt: time.Unix(20, 0), Sessions: []ports.RemoteCatalogSession{{Name: "stale", State: "running"}}},
	490	+	}, stored, "every successful write persists the newest full cache atomically")
	491	+	requireNoRemoteLockViolations(t, nil, cache)
	492	+	d.remoteCatalog.mu.Lock()
	493	+	require.Empty(t, d.remoteCatalog.cache["arch"].Sessions, "a successful omission authoritatively evicts old rows")
	494	+	require.Equal(t, remoteHostFresh, d.remoteCatalog.status["arch"])
	495	+	d.remoteCatalog.mu.Unlock()
	496	+	}
	497	+
	498	+	func TestRemoteRefreshRejectsRemovedHostAndLateGeneration(t *testing.T) {
	499	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	500	+	d, _, cache := newRemoteRefreshDaemon(t, hosts, time.Unix(300, 0))
	501	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	502	+	Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "old", State: "running"}},
	503	+	}})
	504	+	d.remoteCatalog.mu.Lock()
	505	+	d.remoteCatalog.refresh = 9
	506	+	d.remoteCatalog.mu.Unlock()
	507	+
	508	+	require.False(t, d.applyRemoteRefreshResult(8, "arch", ports.RemoteCatalog{ProtocolVersion: ports.ProtocolVersion, Sessions: []ports.RemoteCatalogSession{{Name: "late", State: "running"}}}, nil))
	509	+	hosts.set()
	510	+	require.True(t, d.applyRemoteRefreshResult(9, "arch", ports.RemoteCatalog{ProtocolVersion: ports.ProtocolVersion, Sessions: []ports.RemoteCatalogSession{{Name: "removed", State: "running"}}}, nil))
	511	+	require.Empty(t, receiveRemotePicker(t, cache.stores, "remote cache store"))
	512	+	requireNoRemoteLockViolations(t, nil, cache)
	513	+	d.remoteCatalog.mu.Lock()
	514	+	require.NotContains(t, d.remoteCatalog.cache, "arch")
	515	+	require.NotContains(t, d.remoteCatalog.status, "arch")
	516	+	d.remoteCatalog.mu.Unlock()
	517	+	}
	518	+
	519	+	func TestRemoteRefreshVersionMismatchPreservesStaleRows(t *testing.T) {
	520	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	521	+	d, _, _ := newRemoteRefreshDaemon(t, hosts, time.Unix(400, 0))
	522	+	old := ports.RemoteCatalogCacheEntry{Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: "work", State: "running"}}}
	523	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{old})
	524	+	d.remoteCatalog.mu.Lock()
	525	+	d.remoteCatalog.refresh = 3
	526	+	d.remoteCatalog.mu.Unlock()
	527	+
	528	+	require.False(t, d.applyRemoteRefreshResult(3, "arch", ports.RemoteCatalog{}, &ports.RemoteCatalogVersionMismatchError{Got: 19, Want: ports.ProtocolVersion}))
	529	+	d.remoteCatalog.mu.Lock()
	530	+	require.Equal(t, old, d.remoteCatalog.cache["arch"])
	531	+	require.Equal(t, remoteHostVersionMismatch, d.remoteCatalog.status["arch"])
	532	+	d.remoteCatalog.mu.Unlock()
	533	+	}
	534	+
	535	+	func addRemoteRefreshPickerOwner(t testing.T, d Daemon, id domain.SessionID) (session, attachedClient, chan ports.Frame) {
	536	+	t.Helper()
	537	+	tr, sends := newCapturingTransport(t)
	538	+	ac := &attachedClient{tr: tr, output: newOutputStateStream(), size: domain.Size{Cols: 80, Rows: 24}}
	539	+	ac.initOverlays()
	540	+	tb := newTab(newQuietPTY(), domain.Size{Cols: 80, Rows: 22})
	541	+	tb.stableID = string(id) + "-tab"
	542	+	sess := &session{sessionCore: sessionCore{id: id, name: string(id), client: ac}, tabs: []*tab{tb}, active: 0}
	543	+	publishTiledPaneOwners(sess, tb)
	544	+	ac.setSession(sess)
	545	+	d.sessions[id] = sess
	546	+	return sess, ac, sends
	547	+	}
	548	+
	549	+	func TestRemoteRefreshUpdatesAllOpenPickersPreservingSelection(t *testing.T) {
	550	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	551	+	d, catalog, cache := newRemoteRefreshDaemon(t, hosts, time.Unix(450, 0))
	552	+	firstSession, first, _ := addRemoteRefreshPickerOwner(t, d, "first")
	553	+	_, second, _ := addRemoteRefreshPickerOwner(t, d, "second")
	554	+	before := make(map[attachedClient]picker.Model)
	555	+
	556	+	for _, owner := range []*attachedClient{first, second} {
	557	+	owner.overlays.pickerMu.Lock()
	558	+	owner.overlays.picker = d.newPickerModel(firstSession, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{Session: "second", TabID: "second-tab"})
	559	+	owner.overlays.pickerIntent = pickerNavigate
	560	+	owner.overlays.pickerGeneration++
	561	+	instance := remotePickerInstance{ac: owner, generation: owner.overlays.pickerGeneration, model: owner.overlays.picker}
	562	+	before[owner] = owner.overlays.picker
	563	+	owner.overlays.pickerMu.Unlock()
	564	+	require.True(t, d.registerRemotePicker(instance))
	565	+	}
	566	+	d.remoteCatalog.mu.Lock()
	567	+	d.remoteCatalog.refresh = 4
	568	+	d.remoteCatalog.mu.Unlock()
	569	+
	570	+	require.True(t, d.applyRemoteRefreshResult(4, "arch", ports.RemoteCatalog{
	571	+	ProtocolVersion: ports.ProtocolVersion,
	572	+	Sessions: []ports.RemoteCatalogSession{{Name: "work", State: "running", Tabs: 2}},
	573	+	}, nil))
	574	+	receiveRemotePicker(t, cache.stores, "remote cache store")
	575	+	requireNoRemoteLockViolations(t, catalog, cache)
	576	+
	577	+	for _, owner := range []*attachedClient{first, second} {
	578	+	owner.overlays.pickerMu.Lock()
	579	+	updated := owner.overlays.picker
	580	+	selected, ok := updated.Selected()
	581	+	owner.overlays.pickerMu.Unlock()
	582	+	require.NotSame(t, before[owner], updated, "every open picker must receive the refreshed model")
	583	+	require.True(t, ok)
	584	+	require.Equal(t, domain.SessionID("second"), selected.Session)
	585	+	}
	586	+	}
	587	+
	588	+	func TestRemotePickerTeardownLifecycle(t *testing.T) {
	589	+	for _, test := range []struct {
	590	+	name string
	591	+	resumeCapable bool
	592	+	teardown func(Daemon, session, *attachedClient)
	593	+	}{
	594	+	{name: "client gone parks resumable attachment", resumeCapable: true, teardown: func(d Daemon, sess session, ac *attachedClient) { d.clientGone(sess, ac, ac.transport(), false) }},
	595	+	{name: "send error parks resumable attachment", resumeCapable: true, teardown: func(d Daemon, sess session, ac *attachedClient) { d.detachOnSendError(sess, ac, ac.transport()) }},
	596	+	{name: "client gone removes non-resumable attachment", teardown: func(d Daemon, sess session, ac *attachedClient) { d.clientGone(sess, ac, ac.transport(), false) }},
	597	+	{name: "send error removes non-resumable attachment", teardown: func(d Daemon, sess session, ac *attachedClient) { d.detachOnSendError(sess, ac, ac.transport()) }},
	598	+	} {
	599	+	t.Run(test.name, func(t *testing.T) {
	600	+	d := newRemotePickerDaemon(nil)
	601	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	602	+	ac.resumeCapable = test.resumeCapable
	603	+	model := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	604	+	d.publishPicker(sess, ac, model, pickerNavigate, moveSourceLocator{})
	605	+	ac.overlays.pickerMu.Lock()
	606	+	generation := ac.overlays.pickerGeneration
	607	+	ac.overlays.pickerMu.Unlock()
	608	+
	609	+	test.teardown(d, sess, ac)
	610	+
	611	+	d.remoteCatalog.mu.Lock()
	612	+	_, registered := d.remoteCatalog.pickers[ac]
	613	+	d.remoteCatalog.mu.Unlock()
	614	+	ac.overlays.pickerMu.Lock()
	615	+	current, currentGeneration := ac.overlays.picker, ac.overlays.pickerGeneration
	616	+	ac.overlays.pickerMu.Unlock()
	617	+	if !test.resumeCapable {
	618	+	require.False(t, registered)
	619	+	require.Nil(t, current)
	620	+	return
	621	+	}
	622	+	require.True(t, ac.parked)
	623	+	require.True(t, registered)
	624	+	require.Same(t, model, current)
	625	+	require.Equal(t, generation, currentGeneration)
	626	+	d.mu.Lock()
	627	+	parked := d.parked[ac.resumeToken]
	628	+	d.mu.Unlock()
	629	+	require.NotNil(t, parked)
	630	+	require.Same(t, ac, parked.ac)
	631	+	})
	632	+	}
	633	+	}
	634	+
	635	+	func TestParkedPickerExpiryClosesCapturedGenerationAndCancelsRefresh(t *testing.T) {
	636	+	clock := &signalClock{timers: make(chan *signalTimer, 1)}
	637	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	638	+	d, catalog, _ := newRemoteRefreshDaemon(t, hosts, time.Unix(475, 0))
	639	+	d.clock = clock
	640	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	641	+	ac.resumeCapable = true
	642	+	d.publishPicker(sess, ac, d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	643	+	request := receiveRemotePicker(t, catalog.requests, "catalog request")
	644	+
	645	+	require.True(t, d.parkAttachment(sess, ac))
	646	+	timer := receiveRemotePicker(t, clock.timers, "park expiry timer")
	647	+	timer.ch <- clock.Now()
	648	+	receiveRemotePickerClose(t, request.ctx.Done(), "catalog request cancellation")
	649	+
	650	+	ac.overlays.pickerMu.Lock()
	651	+	require.Nil(t, ac.overlays.picker)
	652	+	ac.overlays.pickerMu.Unlock()
	653	+	d.remoteCatalog.mu.Lock()
	654	+	require.NotContains(t, d.remoteCatalog.pickers, ac)
	655	+	d.remoteCatalog.mu.Unlock()
	656	+	}
	657	+
	658	+	func TestParkedPickerRetirementClosesCapturedGenerationOnly(t *testing.T) {
	659	+	d := newRemotePickerDaemon(nil)
	660	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	661	+	ac.resumeCapable = true
	662	+	d.publishPicker(sess, ac, d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	663	+	d.refreshPickerOpts(ac, pickerRefreshOptions{preserveSelection: true, nearestRow: -1})
	664	+	ac.overlays.pickerMu.Lock()
	665	+	refreshed := ac.overlays.picker
	666	+	ac.overlays.pickerMu.Unlock()
	667	+	require.NotNil(t, refreshed)
	668	+	require.True(t, d.parkAttachment(sess, ac))
	669	+	token := ac.resumeToken
	670	+	d.mu.Lock()
	671	+	parked := d.parked[token]
	672	+	d.mu.Unlock()
	673	+	require.NotNil(t, parked)
	674	+
	675	+	d.mu.Lock()
	676	+	retirement := d.retireParkedAttachmentLocked(token, parked)
	677	+	d.mu.Unlock()
	678	+	d.finishParkedAttachmentRetirements([]parkedAttachmentRetirement{retirement})
	679	+	ac.overlays.pickerMu.Lock()
	680	+	require.Nil(t, ac.overlays.picker, "terminal retirement closes a refreshed model in its captured generation")
	681	+	ac.overlays.pickerMu.Unlock()
	682	+	}
	683	+
	684	+	func TestParkedPickerTokenReplacementRetiresPreviousGeneration(t *testing.T) {
	685	+	d := newRemotePickerDaemon(nil)
	686	+	firstSession, first, _ := addRemoteRefreshPickerOwner(t, d, "first")
	687	+	secondSession, second, _ := addRemoteRefreshPickerOwner(t, d, "second")
	688	+	first.resumeCapable, second.resumeCapable = true, true
	689	+	d.publishPicker(firstSession, first, d.newPickerModel(firstSession, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	690	+	require.True(t, d.parkAttachment(firstSession, first))
	691	+	token := first.resumeToken
	692	+	d.publishPicker(secondSession, second, d.newPickerModel(secondSession, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	693	+	second.resumeToken = token
	694	+	require.True(t, d.parkAttachment(secondSession, second))
	695	+
	696	+	first.overlays.pickerMu.Lock()
	697	+	require.Nil(t, first.overlays.picker)
	698	+	first.overlays.pickerMu.Unlock()
	699	+	second.overlays.pickerMu.Lock()
	700	+	require.NotNil(t, second.overlays.picker)
	701	+	second.overlays.pickerMu.Unlock()
	702	+	}
	703	+
	704	+	func TestParkedPickerResumePreservesGeneration(t *testing.T) {
	705	+	d := newRemotePickerDaemon(nil)
	706	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	707	+	ac.resumeCapable = true
	708	+	ac.clientID = [16]byte{1, 2, 3, 4}
	709	+	d.publishPicker(sess, ac, d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	710	+	ac.overlays.pickerMu.Lock()
	711	+	model, generation := ac.overlays.picker, ac.overlays.pickerGeneration
	712	+	ac.overlays.pickerMu.Unlock()
	713	+	d.clientGone(sess, ac, ac.transport(), false)
	714	+	token := ac.resumeToken
	715	+	tr := &closeTrackingTransport{}
	716	+	resumedSess, resumedAC, ok, err := d.resumeParked(helloResumeCapable(ports.IntentResume, sess.name, token), tr, domain.Size{Cols: 80, Rows: 24})
	717	+	require.NoError(t, err)
	718	+	require.True(t, ok)
	719	+	require.Same(t, sess, resumedSess)
	720	+	require.Same(t, ac, resumedAC)
	721	+	ac.overlays.pickerMu.Lock()
	722	+	require.Same(t, model, ac.overlays.picker)
	723	+	require.Equal(t, generation, ac.overlays.pickerGeneration)
	724	+	ac.overlays.pickerMu.Unlock()
	725	+	}
	726	+
	727	+	func TestStaleParkedPickerExpiryPreservesNewGeneration(t *testing.T) {
	728	+	d := newRemotePickerDaemon(nil)
	729	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	730	+	ac.resumeCapable = true
	731	+	d.publishPicker(sess, ac, d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{}), pickerNavigate, moveSourceLocator{})
	732	+	require.True(t, d.parkAttachment(sess, ac))
	733	+	token := ac.resumeToken
	734	+	d.mu.Lock()
	735	+	parked := d.parked[token]
	736	+	d.mu.Unlock()
	737	+	require.NotNil(t, parked)
	738	+
	739	+	newer := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	740	+	d.publishPicker(sess, ac, newer, pickerNavigate, moveSourceLocator{})
	741	+	d.expireParked(token, parked)
	742	+	ac.overlays.pickerMu.Lock()
	743	+	require.Same(t, newer, ac.overlays.picker)
	744	+	ac.overlays.pickerMu.Unlock()
	745	+	}
	746	+
	747	+	func TestRemoteRefreshPreservesRemoteCursorAcrossCacheToProxyUpgrade(t *testing.T) {
	748	+	d := newRemotePickerDaemon(nil)
	749	+	ownerSession, owner, _ := addRemoteRefreshPickerOwner(t, d, "local")
	750	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	751	+	d.remoteCatalog.replaceCache([]ports.RemoteCatalogCacheEntry{{
	752	+	Host: "arch", FetchedAt: time.Unix(10, 0), Sessions: []ports.RemoteCatalogSession{{Name: key.Name, State: "running"}},
	753	+	}})
	754	+	owner.overlays.pickerMu.Lock()
	755	+	owner.overlays.picker = d.newPickerModel(ownerSession, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{Session: key.ID(), RemoteKey: &key})
	756	+	owner.overlays.pickerIntent = pickerNavigate
	757	+	before, ok := owner.overlays.picker.Cursor()
	758	+	_, beforeSelectable := owner.overlays.picker.Selected()
	759	+	owner.overlays.pickerMu.Unlock()
	760	+	require.True(t, ok)
	761	+	require.Equal(t, &key, before.RemoteKey)
	762	+	require.False(t, beforeSelectable, "cache-derived remote row must stay gated until proxy activation lands")
	763	+
	764	+	proxy := &proxySession{
	765	+	sessionCore: sessionCore{id: key.ID(), name: key.Display()},
	766	+	key: key,
	767	+	meta: ports.SessionMeta{SessionName: key.Name, Tabs: []ports.SessionTabMeta{{Index: 0, Name: "live"}}},
	768	+	}
	769	+	d.mu.Lock()
	770	+	d.sessions[key.ID()] = proxy
	771	+	d.mu.Unlock()
	772	+
	773	+	d.refreshPickerOpts(owner, pickerRefreshOptions{preserveSelection: true, nearestRow: -1})
	774	+
	775	+	owner.overlays.pickerMu.Lock()
	776	+	after, ok := owner.overlays.picker.Cursor()
	777	+	_, selectable := owner.overlays.picker.Selected()
	778	+	owner.overlays.pickerMu.Unlock()
	779	+	require.True(t, ok)
	780	+	require.Equal(t, before.Session, after.Session)
	781	+	require.Equal(t, before.RemoteKey, after.RemoteKey)
	782	+	require.False(t, selectable, "cache-to-live upgrade must preserve the proxy activation gate")
	783	+	}
	784	+
	785	+	func TestRemoteRefreshCancellationWhenLastPickerCloses(t *testing.T) {
	786	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	787	+	d, catalog, _ := newRemoteRefreshDaemon(t, hosts, time.Unix(500, 0))
	788	+	newInstance := func() remotePickerInstance {
	789	+	ac := &attachedClient{}
	790	+	ac.initOverlays()
	791	+	model := picker.New(nil, picker.SelectionConfig{})
	792	+	ac.overlays.pickerMu.Lock()
	793	+	ac.overlays.picker = model
	794	+	ac.overlays.pickerGeneration++
	795	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: model}
	796	+	ac.overlays.pickerMu.Unlock()
	797	+	return instance
	798	+	}
	799	+	closeInstance := func(instance remotePickerInstance) {
	800	+	instance.ac.overlays.pickerMu.Lock()
	801	+	instance.ac.overlays.picker = nil
	802	+	instance.ac.overlays.pickerMu.Unlock()
	803	+	d.remotePickerClosed(instance)
	804	+	}
	805	+	first, second := newInstance(), newInstance()
	806	+	d.remotePickerOpened(first)
	807	+	request := receiveRemotePicker(t, catalog.requests, "catalog request")
	808	+	d.remotePickerOpened(second)
	809	+	receiveRemotePickerClose(t, request.ctx.Done(), "catalog request cancellation")
	810	+	request = receiveRemotePicker(t, catalog.requests, "catalog request")
	811	+
	812	+	closeInstance(first)
	813	+	select {
	814	+	case <-request.ctx.Done():
	815	+	t.Fatal("refresh canceled while another picker remained open")
	816	+	default:
	817	+	}
	818	+	closeInstance(second)
	819	+	receiveRemotePickerClose(t, request.ctx.Done(), "catalog request cancellation")
	820	+
	821	+	d.remoteCatalog.mu.Lock()
	822	+	require.Empty(t, d.remoteCatalog.pickers)
	823	+	require.Nil(t, d.remoteCatalog.cancel)
	824	+	d.remoteCatalog.mu.Unlock()
	825	+	}
	826	+
	827	+	func TestRemoteRefreshCannotStartAfterLastPickerCloseWins(t *testing.T) {
	828	+	hosts := &remoteRefreshHostStore{hosts: []string{"arch"}}
	829	+	d, catalog, _ := newRemoteRefreshDaemon(t, hosts, time.Unix(525, 0))
	830	+	ac := &attachedClient{}
	831	+	ac.initOverlays()
	832	+	model := picker.New(nil, picker.SelectionConfig{})
	833	+	ac.overlays.pickerMu.Lock()
	834	+	ac.overlays.picker = model
	835	+	ac.overlays.pickerGeneration++
	836	+	instance := remotePickerInstance{ac: ac, generation: ac.overlays.pickerGeneration, model: model}
	837	+	ac.overlays.pickerMu.Unlock()
	838	+
	839	+	// Stop at the production seam after exact picker ownership registration but
	840	+	// before refresh startup, then let the last-picker close linearize first.
	841	+	require.True(t, d.registerRemotePicker(instance))
	842	+	ac.overlays.pickerMu.Lock()
	843	+	ac.overlays.picker = nil
	844	+	ac.overlays.pickerMu.Unlock()
	845	+	d.remotePickerClosed(instance)
	846	+
	847	+	d.remoteCatalog.mu.Lock()
	848	+	refreshBefore := d.remoteCatalog.refresh
	849	+	d.remoteCatalog.mu.Unlock()
	850	+	require.Zero(t, d.startRemotePickerRefresh(instance))
	851	+
	852	+	d.remoteCatalog.mu.Lock()
	853	+	require.Empty(t, d.remoteCatalog.pickers, "the closing picker must remain unregistered")
	854	+	require.Equal(t, refreshBefore, d.remoteCatalog.refresh, "a close that wins before startup must prevent a later refresh generation")
	855	+	require.Nil(t, d.remoteCatalog.cancel, "a close that wins before startup must prevent a later cancel installation")
	856	+	d.remoteCatalog.mu.Unlock()
	857	+	select {
	858	+	case request := <-catalog.requests:
	859	+	t.Fatalf("catalog call remained running after the last picker closed: %s", request.host)
	860	+	default:
	861	+	}
	862	+	}
	863	+
	864	+	func TestRemotePickerPublishCannotRegisterAfterSnatchClear(t *testing.T) {
	865	+	d := newRemotePickerDaemon(nil)
	866	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	867	+	ac.roleGeneration.Store(1)
	868	+	model := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	869	+	registrationReached := make(chan struct{})
	870	+	allowRegistration := make(chan struct{})
	871	+	registrationWait := make(chan error, 1)
	872	+	ac.overlays.beforeRemotePickerRegistration = func() {
	873	+	close(registrationReached)
	874	+	registrationWait <- waitRemotePickerClose(allowRegistration, "picker registration release")
	875	+	}
	876	+	published := make(chan struct{})
	877	+	go func() {
	878	+	d.publishPicker(sess, ac, model, pickerNavigate, moveSourceLocator{})
	879	+	close(published)
	880	+	}()
	881	+	receiveRemotePickerClose(t, registrationReached, "picker registration")
	882	+
	883	+	token := attachmentRoleToken{
	884	+	sess: sess, ac: ac, role: attachmentSnatched,
	885	+	generation: 1, transport: ac.transportSnapshot(),
	886	+	}
	887	+	require.True(t, d.clearForSnatch(token))
	888	+	close(allowRegistration)
	889	+	require.NoError(t, receiveRemotePicker(t, registrationWait, "picker registration release"))
	890	+	receiveRemotePickerClose(t, published, "picker publication")
	891	+
	892	+	d.remoteCatalog.mu.Lock()
	893	+	_, registered := d.remoteCatalog.pickers[ac]
	894	+	d.remoteCatalog.mu.Unlock()
	895	+	require.False(t, registered, "a picker cleared before delayed registration must not become a refresh owner")
	896	+	}
	897	+
	898	+	func TestRemotePickerStaleAfterCloseCannotRemoveReopenedPicker(t *testing.T) {
	899	+	d := newRemotePickerDaemon(nil)
	900	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	901	+	first := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	902	+	d.publishPicker(sess, ac, first, pickerNavigate, moveSourceLocator{})
	903	+
	904	+	staleClose := d.pickerListInputState(ac)
	905	+	ac.overlays.pickerMu.Lock()
	906	+	staleClose.closeLocked()
	907	+	ac.overlays.pickerMu.Unlock()
	908	+
	909	+	reopened := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	910	+	d.publishPicker(sess, ac, reopened, pickerNavigate, moveSourceLocator{})
	911	+	staleClose.afterClose()
	912	+
	913	+	d.remoteCatalog.mu.Lock()
	914	+	_, registered := d.remoteCatalog.pickers[ac]
	915	+	d.remoteCatalog.mu.Unlock()
	916	+	require.True(t, registered, "stale close cleanup must retain the reopened picker registration")
	917	+	ac.overlays.pickerMu.Lock()
	918	+	require.Same(t, reopened, ac.overlays.picker)
	919	+	ac.overlays.pickerMu.Unlock()
	920	+	}
	921	+
	922	+	func TestRemotePickerStaleRefreshCannotOverwriteReopenedModel(t *testing.T) {
	923	+	d := newRemotePickerDaemon(nil)
	924	+	sess, ac, _ := addRemoteRefreshPickerOwner(t, d, "owner")
	925	+	first := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	926	+	d.publishPicker(sess, ac, first, pickerNavigate, moveSourceLocator{})
	927	+
	928	+	rebuildReached := make(chan struct{})
	929	+	allowPublication := make(chan struct{})
	930	+	publicationWait := make(chan error, 1)
	931	+	ac.overlays.afterPickerRefreshBuild = func(*picker.Model) {
	932	+	close(rebuildReached)
	933	+	publicationWait <- waitRemotePickerClose(allowPublication, "picker publication release")
	934	+	}
	935	+	refreshed := make(chan struct{})
	936	+	go func() {
	937	+	d.refreshRemoteOpenPickers()
	938	+	close(refreshed)
	939	+	}()
	940	+	receiveRemotePickerClose(t, rebuildReached, "picker rebuild")
	941	+
	942	+	d.closePicker(ac)
	943	+	reopened := d.newPickerModel(sess, pickerNavigate, moveSourceLocator{}, picker.SourceFilter{})
	944	+	d.publishPicker(sess, ac, reopened, pickerNavigate, moveSourceLocator{})
	945	+	close(allowPublication)
	946	+	require.NoError(t, receiveRemotePicker(t, publicationWait, "picker publication release"))
	947	+	receiveRemotePickerClose(t, refreshed, "picker refresh")
	948	+
	949	+	ac.overlays.pickerMu.Lock()
	950	+	require.Same(t, reopened, ac.overlays.picker, "a rebuild for the old picker must not publish into its replacement")
	951	+	ac.overlays.pickerMu.Unlock()
	952	+	}
	953	+
	954	+	func TestRemoteRowsRemainNonSelectableDuringRefreshPhase(t *testing.T) {
	955	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	956	+	for _, availability := range []picker.RemoteAvailability{picker.RemoteCached, picker.RemoteFresh, picker.RemoteStale, picker.RemoteVersionMismatch} {
	957	+	model := picker.New([]picker.SessionView{{
	958	+	ID: key.ID(), Name: key.Display(), RemoteKey: &key, RemoteAvailability: availability,
	959	+	ConnectOnly: true, RemoteAttachReady: false,
	960	+	}}, picker.SelectionConfig{Mode: picker.SelectNavigationTab})
	961	+	_, selectable := model.Selected()
	962	+	require.False(t, selectable, "availability %d became remotely attachable in phase 5", availability)
	963	+	}
	964	+	}

M internal/usecase/daemon/resume.go +19 -9


@@ -216,6 +216,12 @@ func (d Daemon) parkAttachmentAs(sess session, ac *attachedClient, role attach
216	216		// cannot leave closed panes retained through its capture cache. This must
217	217		// remain outside d.mu: sendMu is ordered before the daemon lock.
218	218		ac.clearCaptureFrames()
	219	+	var pickerGeneration uint64
	220	+	if ac.overlays != nil {
	221	+	ac.overlays.pickerMu.Lock()
	222	+	pickerGeneration = ac.overlays.pickerGeneration
	223	+	ac.overlays.pickerMu.Unlock()
	224	+	}
219	225		d.mu.Lock()
220	226		if d.closing \|\| d.sessions[sess.id] != sess {
221	227		d.clearParkingInFlightLocked(ac.resumeToken, ac)

@@ -244,13 +250,13 @@ func (d Daemon) parkAttachmentAs(sess session, ac *attachedClient, role attach
244	250		}
245	251		grace := d.resumeParkGrace
246	252		timer := d.clock.NewTimer(grace)
247		-	parked := &parkedAttachment{sess: sess, ac: ac, role: role, timer: timer, done: make(chan struct{})}
	253	+	parked := &parkedAttachment{sess: sess, ac: ac, role: role, pickerGeneration: pickerGeneration, timer: timer, done: make(chan struct{})}
248	254		ac.parked = true
249	255		d.parked[token] = parked
250	256		d.clearParkingInFlightLocked(token, ac)
251	257		d.mu.Unlock()
252	258		if oldRetirement != nil {
253		-	finishParkedAttachmentRetirements([]parkedAttachmentRetirement{*oldRetirement})
	259	+	d.finishParkedAttachmentRetirements([]parkedAttachmentRetirement{*oldRetirement})
254	260		}
255	261		if oldSame != nil {
256	262		if oldSame.timer != nil {

@@ -275,6 +281,7 @@ func (d Daemon) expireParked(token uint64, parked parkedAttachment) {
275	281		if d.parked[token] == parked {
276	282		d.removeParkedLocked(token, parked)
277	283		d.mu.Unlock()
	284	+	d.closePickerIfCurrent(parked.ac, nil, parked.pickerGeneration)
278	285		d.log.Warn("parked client expired", "session", parked.sess.name)
279	286		return
280	287		}

@@ -312,8 +319,9 @@ func (d Daemon) demoteParkedActiveForSessionLocked(sess session) {
312	319		}
313	320
314	321		type parkedAttachmentRetirement struct {
315		-	parked *parkedAttachment
316		-	transport transportSnapshot
	322	+	parked *parkedAttachment
	323	+	pickerGeneration uint64
	324	+	transport transportSnapshot
317	325		}
318	326
319	327		func (d Daemon) retireParkedAttachmentLocked(token uint64, parked parkedAttachment) parkedAttachmentRetirement {

@@ -324,8 +332,9 @@ func (d Daemon) retireParkedAttachmentLocked(token uint64, parked parkedAttach
324	332		parked.ac.roleGeneration.Add(1)
325	333		parked.ac.setSession(nil)
326	334		return parkedAttachmentRetirement{
327		-	parked: parked,
328		-	transport: parked.ac.transportSnapshot(),
	335	+	parked: parked,
	336	+	pickerGeneration: parked.pickerGeneration,
	337	+	transport: parked.ac.transportSnapshot(),
329	338		}
330	339		}
331	340

@@ -350,15 +359,16 @@ func (d *Daemon) purgeAllParkedLocked() []parkedAttachmentRetirement {
350	359		return retirements
351	360		}
352	361
353		-	// finishParkedAttachmentRetirements stops timers and closes transports without
354		-	// holding daemon, session, coordinator, or pane locks.
355		-	func finishParkedAttachmentRetirements(retirements []parkedAttachmentRetirement) {
	362	+	// finishParkedAttachmentRetirements stops timers and retires picker ownership
	363	+	// and transports without holding daemon, session, coordinator, or pane locks.
	364	+	func (d *Daemon) finishParkedAttachmentRetirements(retirements []parkedAttachmentRetirement) {
356	365		for _, retirement := range retirements {
357	366		if retirement.parked.timer != nil {
358	367		retirement.parked.timer.Stop()
359	368		}
360	369		retirement.parked.closeDone()
361	370		ac := retirement.parked.ac
	371	+	d.closePickerIfCurrent(ac, nil, retirement.pickerGeneration)
362	372		_ = ac.closeCapturedTransport(ac.revokeTransport(retirement.transport.transport))
363	373		}
364	374		}

 	// cannot leave closed panes retained through its capture cache. This must
 	// remain outside d.mu: sendMu is ordered before the daemon lock.
 	ac.clearCaptureFrames()
+	var pickerGeneration uint64
+	if ac.overlays != nil {
+		ac.overlays.pickerMu.Lock()
+		pickerGeneration = ac.overlays.pickerGeneration
+		ac.overlays.pickerMu.Unlock()
+	}
 	d.mu.Lock()
 	if d.closing || d.sessions[sess.id] != sess {
 		d.clearParkingInFlightLocked(ac.resumeToken, ac)
 	}
 	grace := d.resumeParkGrace
 	timer := d.clock.NewTimer(grace)
-	parked := &parkedAttachment{sess: sess, ac: ac, role: role, timer: timer, done: make(chan struct{})}
+	parked := &parkedAttachment{sess: sess, ac: ac, role: role, pickerGeneration: pickerGeneration, timer: timer, done: make(chan struct{})}
 	ac.parked = true
 	d.parked[token] = parked
 	d.clearParkingInFlightLocked(token, ac)
 	d.mu.Unlock()
 	if oldRetirement != nil {
-		finishParkedAttachmentRetirements([]parkedAttachmentRetirement{*oldRetirement})
+		d.finishParkedAttachmentRetirements([]parkedAttachmentRetirement{*oldRetirement})
 	}
 	if oldSame != nil {
 		if oldSame.timer != nil {
 	if d.parked[token] == parked {
 		d.removeParkedLocked(token, parked)
 		d.mu.Unlock()
+		d.closePickerIfCurrent(parked.ac, nil, parked.pickerGeneration)
 		d.log.Warn("parked client expired", "session", parked.sess.name)
 		return
 	}
 }
 type parkedAttachmentRetirement struct {
-	parked    *parkedAttachment
+	parked           *parkedAttachment
-	transport transportSnapshot
+	pickerGeneration uint64
+	transport        transportSnapshot
 }
 func (d *Daemon) retireParkedAttachmentLocked(token uint64, parked *parkedAttachment) parkedAttachmentRetirement {
 	parked.ac.roleGeneration.Add(1)
 	parked.ac.setSession(nil)
 	return parkedAttachmentRetirement{
-		parked:    parked,
+		parked:           parked,
-		transport: parked.ac.transportSnapshot(),
+		pickerGeneration: parked.pickerGeneration,
+		transport:        parked.ac.transportSnapshot(),
 	}
 }
 	return retirements
 }
-// finishParkedAttachmentRetirements stops timers and closes transports without
+// finishParkedAttachmentRetirements stops timers and retires picker ownership
-// holding daemon, session, coordinator, or pane locks.
+// and transports without holding daemon, session, coordinator, or pane locks.
-func finishParkedAttachmentRetirements(retirements []parkedAttachmentRetirement) {
+func (d *Daemon) finishParkedAttachmentRetirements(retirements []parkedAttachmentRetirement) {
 	for _, retirement := range retirements {
 		if retirement.parked.timer != nil {
 			retirement.parked.timer.Stop()
 		}
 		retirement.parked.closeDone()
 		ac := retirement.parked.ac
+		d.closePickerIfCurrent(ac, nil, retirement.pickerGeneration)
 		_ = ac.closeCapturedTransport(ac.revokeTransport(retirement.transport.transport))
 	}
 }

M internal/usecase/daemon/resume_test.go +1 -1


@@ -1702,7 +1702,7 @@ func TestDiscardingParkedAttachmentClearsPreviousSession(t *testing.T) {
1702	1702		require.NotNil(t, parked)
1703	1703		retirements := tc.discard(d, ac.resumeToken, parked)
1704	1704		d.mu.Unlock()
1705		-	finishParkedAttachmentRetirements(retirements)
	1705	+	d.finishParkedAttachmentRetirements(retirements)
1706	1706
1707	1707		require.Nil(t, ac.previousSession.Get())
1708	1708		})


@@ -1702,7 +1702,7 @@ func TestDiscardingParkedAttachmentClearsPreviousSession(t *testing.T) {
1702		require.NotNil(t, parked)	1702		require.NotNil(t, parked)
1703		retirements := tc.discard(d, ac.resumeToken, parked)	1703		retirements := tc.discard(d, ac.resumeToken, parked)
1704		d.mu.Unlock()	1704		d.mu.Unlock()
1705	-	finishParkedAttachmentRetirements(retirements)	1705	+	d.finishParkedAttachmentRetirements(retirements)
1706			1706
1707		require.Nil(t, ac.previousSession.Get())	1707		require.Nil(t, ac.previousSession.Get())
1708		})	1708		})

M internal/usecase/daemon/session.go +4 -1


@@ -778,6 +778,9 @@ func (d Daemon) detachProxyIfCurrentTransport(p proxySession, ac *attachedClie
778	778		}
779	779		p.sessionCore.mu.Unlock()
780	780		d.notices.routingMu.Unlock()
	781	+	if current {
	782	+	d.armProxyWarm(p)
	783	+	}
781	784		return current
782	785		}
783	786

@@ -1605,7 +1608,7 @@ func (d Daemon) killSessionWithSnapshotDeadline(sess session, reason uint8, pu
1605	1608		d.closing = true
1606	1609		}
1607	1610		d.mu.Unlock()
1608		-	finishParkedAttachmentRetirements(parkedRetirements)
	1611	+	d.finishParkedAttachmentRetirements(parkedRetirements)
1609	1612		frozen.unfreeze()
1610	1613		frozen = frozenRoleEffectGates{}
1611	1614		d.log.Info("session closed", "session", stoppedName, "id", sess.id, "ephemeral", ephemeral, "purge", purge, "reason", reason)

 	}
 	p.sessionCore.mu.Unlock()
 	d.notices.routingMu.Unlock()
+	if current {
+		d.armProxyWarm(p)
+	}
 	return current
 }
 		d.closing = true
 	}
 	d.mu.Unlock()
-	finishParkedAttachmentRetirements(parkedRetirements)
+	d.finishParkedAttachmentRetirements(parkedRetirements)
 	frozen.unfreeze()
 	frozen = frozenRoleEffectGates{}
 	d.log.Info("session closed", "session", stoppedName, "id", sess.id, "ephemeral", ephemeral, "purge", purge, "reason", reason)

M internal/usecase/daemon/status_test.go +6 -3


@@ -581,7 +581,8 @@ func TestAttachClientClearsStaleColorSchemeOnReplacement(t *testing.T) {
581	581		assertSessionColorScheme(t, sess, true)
582	582
583	583		tr, _ := newCapturingTransport(t)
584		-	d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
	584	+	_, _, err := d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
	585	+	require.NoError(t, err)
585	586
586	587		assertSessionColorSchemeUnknown(t, sess)
587	588		}

@@ -682,7 +683,8 @@ func TestAttachClientClearsStaleScreenDefaultColors(t *testing.T) {
682	683		})
683	684		tr, _ := newCapturingTransport(t)
684	685
685		-	d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
	686	+	_, _, err := d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
	687	+	require.NoError(t, err)
686	688
687	689		var got []byte
688	690		tb := sess.activeTab()

@@ -791,7 +793,8 @@ func TestApplyThemeIgnoresReplacedClient(t *testing.T) {
791	793		d, sess, old, _ := newManualSessionWithPTYs(t, p)
792	794		defer release()
793	795		tr, _ := newCapturingTransport(t)
794		-	d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
	796	+	_, _, err := d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
	797	+	require.NoError(t, err)
795	798
796	799		d.applyTheme(sess, old, ports.Theme{
797	800		HasForeground: true, Foreground: renderer.RGB{R: 1, G: 2, B: 3},

 	assertSessionColorScheme(t, sess, true)
 	tr, _ := newCapturingTransport(t)
-	d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
+	_, _, err := d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
+	require.NoError(t, err)
 	assertSessionColorSchemeUnknown(t, sess)
 }
 	})
 	tr, _ := newCapturingTransport(t)
-	d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
+	_, _, err := d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
+	require.NoError(t, err)
 	var got []byte
 	tb := sess.activeTab()
 	d, sess, old, _ := newManualSessionWithPTYs(t, p)
 	defer release()
 	tr, _ := newCapturingTransport(t)
-	d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
+	_, _, err := d.attachClient(sess, tr, domain.Size{Cols: 80, Rows: 24}, attachClientOptions{})
+	require.NoError(t, err)
 	d.applyTheme(sess, old, ports.Theme{
 		HasForeground: true, Foreground: renderer.RGB{R: 1, G: 2, B: 3},

M internal/usecase/picker/model.go +122 -22


@@ -15,6 +15,16 @@ const (
15	15		MinStackHeight = 12
16	16		)
17	17
	18	+	type RemoteAvailability uint8
	19	+
	20	+	const (
	21	+	RemoteNone RemoteAvailability = iota
	22	+	RemoteCached
	23	+	RemoteFresh
	24	+	RemoteStale
	25	+	RemoteVersionMismatch
	26	+	)
	27	+
18	28		type SessionView struct {
19	29		ID domain.SessionID
20	30		Incarnation domain.IncarnationID

@@ -24,9 +34,16 @@ type SessionView struct {
24	34		Active int
25	35		Stopped bool
26	36		ExpectedCreatedAt *int64
	37	+	RemoteKey *domain.RemoteSessionKey
	38	+	// RemoteHost marks remote host status rows that have no session key.
	39	+	RemoteHost string
	40	+	RemoteAvailability RemoteAvailability
	41	+	RemoteDetail string
	42	+	ConnectOnly bool
	43	+	RemoteAttachReady bool
27	44		// CannotAcceptMoves reports whether this session cannot receive a moved tab
28	45		// or pane. False for ordinary local (and stopped) sessions; true for
29		-	// restricted proxy sessions in phase 4. Populated, not yet consumed.
	46	+	// restricted proxy sessions.
30	47		CannotAcceptMoves bool
31	48		}
32	49

@@ -50,6 +67,7 @@ type SourceFilter struct {
50	67		Session domain.SessionID
51	68		Incarnation domain.IncarnationID
52	69		TabID domain.TabStableID
	70	+	RemoteKey *domain.RemoteSessionKey
53	71		}
54	72
55	73		// SelectionConfig describes which rows are selectable, which stable target

@@ -95,6 +113,7 @@ type Target struct {
95	113		Session domain.SessionID
96	114		Incarnation domain.IncarnationID
97	115		Name string
	116	+	RemoteKey *domain.RemoteSessionKey
98	117		TabID domain.TabStableID
99	118		TabIndex int
100	119		Stopped bool

@@ -165,6 +184,11 @@ type row struct {
165	184		stopped bool
166	185		expectedCreatedAt int64
167	186		hasExpectedCreatedAt bool
	187	+	remoteKey domain.RemoteSessionKey
	188	+	hasRemoteKey bool
	189	+	remote bool
	190	+	selectable bool
	191	+	dim bool
168	192		}
169	193
170	194		func New(sessions []SessionView, config SelectionConfig) *Model {

@@ -175,10 +199,10 @@ func New(sessions []SessionView, config SelectionConfig) *Model {
175	199		for _, pickerRow := range sessionRows {
176	200		idx := len(m.rows)
177	201		m.rows = append(m.rows, pickerRow)
178		-	if pickerRow.kind.selectable(config.Mode) && selectionMatches(pickerRow, config.Current, config.Mode) {
	202	+	if selectionMatches(pickerRow, config.Current, config.Mode) {
179	203		m.selected = idx
180	204		}
181		-	if config.Mode == SelectNavigationTab && activeSelection < 0 && pickerRow.kind == rowTab && pickerRow.tabIndex == normalizedActive(session) {
	205	+	if config.Mode == SelectNavigationTab && activeSelection < 0 && pickerRow.selectable && pickerRow.kind == rowTab && pickerRow.tabIndex == normalizedActive(session) {
182	206		activeSelection = idx
183	207		}
184	208		}

@@ -201,7 +225,10 @@ func rowsForSession(session SessionView, config SelectionConfig) []row {
201	225		if config.Mode != SelectNavigationTab && session.Stopped {
202	226		return nil
203	227		}
204		-	if config.Mode == SelectMoveTabSession && (sourceMatchesSession(config.Source, session) \|\| len(session.Tabs) == 0) {
	228	+	if config.Mode == SelectMoveTabSession && sourceMatchesSession(config.Source, session) {
	229	+	return nil
	230	+	}
	231	+	if config.Mode == SelectMoveTabSession && len(session.Tabs) == 0 && !session.CannotAcceptMoves {
205	232		return nil
206	233		}
207	234

@@ -217,24 +244,65 @@ func rowsForSession(session SessionView, config SelectionConfig) []row {
217	244		stopped: session.Stopped, expectedCreatedAt: expectedCreatedAt,
218	245		hasExpectedCreatedAt: hasExpectedCreatedAt,
219	246		}
	247	+	if session.RemoteKey != nil {
	248	+	common.remoteKey, common.hasRemoteKey = *session.RemoteKey, true
	249	+	}
	250	+	common.remote = common.hasRemoteKey \|\| session.RemoteHost != ""
220	251		header := common
221	252		header.kind, header.dispName, header.tabIndex = rowSession, session.Name, -1
	253	+	header.selectable = header.kind.selectable(config.Mode)
	254	+	if common.remote {
	255	+	header.detail = remoteRowDetail(session)
	256	+	header.selectable = common.hasRemoteKey && config.Mode == SelectNavigationTab && session.ConnectOnly && remoteSelectable(session)
	257	+	header.dim = remoteDim(session)
	258	+	}
	259	+	if config.Mode != SelectNavigationTab && session.CannotAcceptMoves {
	260	+	header.selectable, header.dim = false, true
	261	+	}
222	262		rows := []row{header}
223		-	for i, tab := range session.Tabs {
224		-	if config.Mode == SelectMovePaneTab && sourceMatchesTab(config.Source, session, tab) {
225		-	continue
	263	+	if !session.ConnectOnly {
	264	+	for i, tab := range session.Tabs {
	265	+	if config.Mode == SelectMovePaneTab && sourceMatchesTab(config.Source, session, tab) {
	266	+	continue
	267	+	}
	268	+	tabRow := common
	269	+	tabRow.kind, tabRow.dispName, tabRow.detail, tabRow.attention = rowTab, tab.Name, tab.Detail, tab.Attention
	270	+	tabRow.tabID, tabRow.tabIndex = tab.TabID, i
	271	+	tabRow.selectable = tabRow.kind.selectable(config.Mode)
	272	+	if common.remote {
	273	+	tabRow.selectable = false
	274	+	tabRow.dim = remoteDim(session)
	275	+	}
	276	+	if config.Mode != SelectNavigationTab && session.CannotAcceptMoves {
	277	+	tabRow.selectable, tabRow.dim = false, true
	278	+	}
	279	+	rows = append(rows, tabRow)
226	280		}
227		-	tabRow := common
228		-	tabRow.kind, tabRow.dispName, tabRow.detail, tabRow.attention = rowTab, tab.Name, tab.Detail, tab.Attention
229		-	tabRow.tabID, tabRow.tabIndex = tab.TabID, i
230		-	rows = append(rows, tabRow)
231	281		}
232		-	if config.Mode == SelectMovePaneTab && len(rows) == 1 {
	282	+	if config.Mode == SelectMovePaneTab && len(rows) == 1 && !session.CannotAcceptMoves {
233	283		return nil
234	284		}
235	285		return rows
236	286		}
237	287
	288	+	func remoteSelectable(session SessionView) bool {
	289	+	return session.RemoteAttachReady && session.RemoteAvailability != RemoteVersionMismatch
	290	+	}
	291	+
	292	+	func remoteDim(session SessionView) bool {
	293	+	return !session.RemoteAttachReady \|\| session.RemoteAvailability == RemoteStale \|\| session.RemoteAvailability == RemoteVersionMismatch
	294	+	}
	295	+
	296	+	func remoteRowDetail(session SessionView) string {
	297	+	if session.RemoteDetail != "" && (session.RemoteAvailability == RemoteStale \|\| session.RemoteAvailability == RemoteVersionMismatch) {
	298	+	return session.RemoteDetail
	299	+	}
	300	+	if !session.RemoteAttachReady {
	301	+	return "proxy activation pending"
	302	+	}
	303	+	return session.RemoteDetail
	304	+	}
	305	+
238	306		func sourceMatchesSession(source SourceFilter, session SessionView) bool {
239	307		if source.Session != session.ID {
240	308		return false

@@ -257,6 +325,9 @@ func selectionMatches(pickerRow row, current SourceFilter, mode SelectionMode) b
257	325		if pickerRow.session != current.Session \|\| (current.Incarnation != (domain.IncarnationID{}) && pickerRow.incarnation != current.Incarnation) {
258	326		return false
259	327		}
	328	+	if pickerRow.hasRemoteKey && pickerRow.kind == rowSession {
	329	+	return current.RemoteKey == nil \|\| pickerRow.remoteKey == *current.RemoteKey
	330	+	}
260	331		if mode == SelectMoveTabSession {
261	332		return pickerRow.kind == rowSession
262	333		}

@@ -317,18 +388,25 @@ func (m *Model) Down() {
317	388		m.move(1)
318	389		}
319	390
	391	+	// Cursor reports the identity under the picker cursor independently from
	392	+	// whether that row may be activated. Remote refreshes use it to preserve a
	393	+	// structured remote session key while Selected continues to enforce safety.
	394	+	func (m *Model) Cursor() (Target, bool) {
	395	+	if m == nil \|\| m.selected < 0 \|\| m.selected >= len(m.rows) {
	396	+	return Target{}, false
	397	+	}
	398	+	return m.rows[m.selected].target(), true
	399	+	}
	400	+
320	401		func (m *Model) Selected() (Target, bool) {
321	402		if m == nil \|\| m.selected < 0 \|\| m.selected >= len(m.rows) {
322	403		return Target{}, false
323	404		}
324	405		r := m.rows[m.selected]
325		-	if !r.kind.selectable(m.mode) {
	406	+	if !r.selectable {
326	407		return Target{}, false
327	408		}
328		-	return Target{
329		-	Session: r.session, Incarnation: r.incarnation, Name: r.targetName, TabID: r.tabID,
330		-	TabIndex: r.tabIndex, Stopped: r.stopped, ExpectedCreatedAt: r.expectedCreatedAtPointer(),
331		-	}, true
	409	+	return r.target(), true
332	410		}
333	411
334	412		// SelectedIndex reports the raw selected row index. It is -1 only when the

@@ -351,13 +429,13 @@ func (m *Model) SelectNearestRow(idx int) {
351	429		}
352	430		idx = clamp(idx, 0, len(m.rows)-1)
353	431		for i := idx; i < len(m.rows); i++ {
354		-	if m.rows[i].kind.selectable(m.mode) {
	432	+	if m.rows[i].selectable {
355	433		m.selected = i
356	434		return
357	435		}
358	436		}
359	437		for i := idx - 1; i >= 0; i-- {
360		-	if m.rows[i].kind.selectable(m.mode) {
	438	+	if m.rows[i].selectable {
361	439		m.selected = i
362	440		return
363	441		}

@@ -396,12 +474,12 @@ func (m *Model) move(delta int) {
396	474		if m == nil \|\| len(m.rows) == 0 {
397	475		return
398	476		}
399		-	if m.selected < 0 \|\| m.selected >= len(m.rows) \|\| !m.rows[m.selected].kind.selectable(m.mode) {
	477	+	if m.selected < 0 \|\| m.selected >= len(m.rows) \|\| !m.rows[m.selected].selectable {
400	478		m.selected = m.firstSelectable()
401	479		return
402	480		}
403	481		for i := m.selected + delta; i >= 0 && i < len(m.rows); i += delta {
404		-	if m.rows[i].kind.selectable(m.mode) {
	482	+	if m.rows[i].selectable {
405	483		m.selected = i
406	484		return
407	485		}

@@ -410,13 +488,20 @@ func (m *Model) move(delta int) {
410	488
411	489		func (m *Model) firstSelectable() int {
412	490		for i, r := range m.rows {
413		-	if r.kind.selectable(m.mode) {
	491	+	if r.selectable {
414	492		return i
415	493		}
416	494		}
417	495		return -1
418	496		}
419	497
	498	+	func (r row) target() Target {
	499	+	return Target{
	500	+	Session: r.session, Incarnation: r.incarnation, Name: r.targetName, RemoteKey: r.remoteKeyPointer(), TabID: r.tabID,
	501	+	TabIndex: r.tabIndex, Stopped: r.stopped, ExpectedCreatedAt: r.expectedCreatedAtPointer(),
	502	+	}
	503	+	}
	504	+
420	505		func (r row) expectedCreatedAtPointer() *int64 {
421	506		if !r.hasExpectedCreatedAt {
422	507		return nil

@@ -425,6 +510,14 @@ func (r row) expectedCreatedAtPointer() *int64 {
425	510		return &value
426	511		}
427	512
	513	+	func (r row) remoteKeyPointer() *domain.RemoteSessionKey {
	514	+	if !r.hasRemoteKey {
	515	+	return nil
	516	+	}
	517	+	key := r.remoteKey
	518	+	return &key
	519	+	}
	520	+
428	521		// renderList draws each visible row as up to three segments: a name segment
429	522		// (bold when styles came from a truecolor theme), a base-styled attention
430	523		// marker right after the name, and a muted detail segment (tab rows only) —

@@ -450,6 +543,11 @@ func (m *Model) renderList(frame renderer.Frame, rect domain.Rect, styles Render
450	543		if r.stopped && idx != m.selected {
451	544		base, nameStyle, detailStyle = styles.Stopped, styles.Stopped, styles.Stopped
452	545		}
	546	+	if r.dim {
	547	+	base.Attrs \|= renderer.AttrDim
	548	+	nameStyle.Attrs \|= renderer.AttrDim
	549	+	detailStyle.Attrs \|= renderer.AttrDim
	550	+	}
453	551		ui.FillRect(frame, domain.Rect{X: rect.X, Y: rect.Y + y, Width: rect.Width, Height: 1}, renderer.Cell{Rune: ' ', Style: base})
454	552
455	553		name := r.dispName

@@ -462,6 +560,8 @@ func (m *Model) renderList(frame renderer.Frame, rect domain.Rect, styles Render
462	560		if r.kind.rendersAsHeader() {
463	561		if r.stopped {
464	562		ui.DrawText(frame, x, rect.Y+y, clipX, " (stopped)", base)
	563	+	} else {
	564	+	ui.DrawText(frame, x, rect.Y+y, clipX, ui.TruncateText(r.detail, clipX-x), detailStyle)
465	565		}
466	566		continue
467	567		}

 	MinStackHeight            = 12
 )
+type RemoteAvailability uint8
+const (
+	RemoteNone RemoteAvailability = iota
+	RemoteCached
+	RemoteFresh
+	RemoteStale
+	RemoteVersionMismatch
+)
 type SessionView struct {
 	ID                domain.SessionID
 	Incarnation       domain.IncarnationID
 	Active            int
 	Stopped           bool
 	ExpectedCreatedAt *int64
+	RemoteKey         *domain.RemoteSessionKey
+	// RemoteHost marks remote host status rows that have no session key.
+	RemoteHost         string
+	RemoteAvailability RemoteAvailability
+	RemoteDetail       string
+	ConnectOnly        bool
+	RemoteAttachReady  bool
 	// CannotAcceptMoves reports whether this session cannot receive a moved tab
 	// or pane. False for ordinary local (and stopped) sessions; true for
-	// restricted proxy sessions in phase 4. Populated, not yet consumed.
+	// restricted proxy sessions.
 	CannotAcceptMoves bool
 }
 	Session     domain.SessionID
 	Incarnation domain.IncarnationID
 	TabID       domain.TabStableID
+	RemoteKey   *domain.RemoteSessionKey
 }
 // SelectionConfig describes which rows are selectable, which stable target
 	Session     domain.SessionID
 	Incarnation domain.IncarnationID
 	Name        string
+	RemoteKey   *domain.RemoteSessionKey
 	TabID       domain.TabStableID
 	TabIndex    int
 	Stopped     bool
 	stopped              bool
 	expectedCreatedAt    int64
 	hasExpectedCreatedAt bool
+	remoteKey            domain.RemoteSessionKey
+	hasRemoteKey         bool
+	remote               bool
+	selectable           bool
+	dim                  bool
 }
 func New(sessions []SessionView, config SelectionConfig) *Model {
 		for _, pickerRow := range sessionRows {
 			idx := len(m.rows)
 			m.rows = append(m.rows, pickerRow)
-			if pickerRow.kind.selectable(config.Mode) && selectionMatches(pickerRow, config.Current, config.Mode) {
+			if selectionMatches(pickerRow, config.Current, config.Mode) {
 				m.selected = idx
 			}
-			if config.Mode == SelectNavigationTab && activeSelection < 0 && pickerRow.kind == rowTab && pickerRow.tabIndex == normalizedActive(session) {
+			if config.Mode == SelectNavigationTab && activeSelection < 0 && pickerRow.selectable && pickerRow.kind == rowTab && pickerRow.tabIndex == normalizedActive(session) {
 				activeSelection = idx
 			}
 		}
 	if config.Mode != SelectNavigationTab && session.Stopped {
 		return nil
 	}
-	if config.Mode == SelectMoveTabSession && (sourceMatchesSession(config.Source, session) || len(session.Tabs) == 0) {
+	if config.Mode == SelectMoveTabSession && sourceMatchesSession(config.Source, session) {
+		return nil
+	}
+	if config.Mode == SelectMoveTabSession && len(session.Tabs) == 0 && !session.CannotAcceptMoves {
 		return nil
 	}
 		stopped: session.Stopped, expectedCreatedAt: expectedCreatedAt,
 		hasExpectedCreatedAt: hasExpectedCreatedAt,
 	}
+	if session.RemoteKey != nil {
+		common.remoteKey, common.hasRemoteKey = *session.RemoteKey, true
+	}
+	common.remote = common.hasRemoteKey || session.RemoteHost != ""
 	header := common
 	header.kind, header.dispName, header.tabIndex = rowSession, session.Name, -1
+	header.selectable = header.kind.selectable(config.Mode)
+	if common.remote {
+		header.detail = remoteRowDetail(session)
+		header.selectable = common.hasRemoteKey && config.Mode == SelectNavigationTab && session.ConnectOnly && remoteSelectable(session)
+		header.dim = remoteDim(session)
+	}
+	if config.Mode != SelectNavigationTab && session.CannotAcceptMoves {
+		header.selectable, header.dim = false, true
+	}
 	rows := []row{header}
-	for i, tab := range session.Tabs {
+	if !session.ConnectOnly {
-		if config.Mode == SelectMovePaneTab && sourceMatchesTab(config.Source, session, tab) {
+		for i, tab := range session.Tabs {
-			continue
+			if config.Mode == SelectMovePaneTab && sourceMatchesTab(config.Source, session, tab) {
+				continue
+			}
+			tabRow := common
+			tabRow.kind, tabRow.dispName, tabRow.detail, tabRow.attention = rowTab, tab.Name, tab.Detail, tab.Attention
+			tabRow.tabID, tabRow.tabIndex = tab.TabID, i
+			tabRow.selectable = tabRow.kind.selectable(config.Mode)
+			if common.remote {
+				tabRow.selectable = false
+				tabRow.dim = remoteDim(session)
+			}
+			if config.Mode != SelectNavigationTab && session.CannotAcceptMoves {
+				tabRow.selectable, tabRow.dim = false, true
+			}
+			rows = append(rows, tabRow)
 		}
-		tabRow := common
-		tabRow.kind, tabRow.dispName, tabRow.detail, tabRow.attention = rowTab, tab.Name, tab.Detail, tab.Attention
-		tabRow.tabID, tabRow.tabIndex = tab.TabID, i
-		rows = append(rows, tabRow)
 	}
-	if config.Mode == SelectMovePaneTab && len(rows) == 1 {
+	if config.Mode == SelectMovePaneTab && len(rows) == 1 && !session.CannotAcceptMoves {
 		return nil
 	}
 	return rows
 }
+func remoteSelectable(session SessionView) bool {
+	return session.RemoteAttachReady && session.RemoteAvailability != RemoteVersionMismatch
+}
+func remoteDim(session SessionView) bool {
+	return !session.RemoteAttachReady || session.RemoteAvailability == RemoteStale || session.RemoteAvailability == RemoteVersionMismatch
+}
+func remoteRowDetail(session SessionView) string {
+	if session.RemoteDetail != "" && (session.RemoteAvailability == RemoteStale || session.RemoteAvailability == RemoteVersionMismatch) {
+		return session.RemoteDetail
+	}
+	if !session.RemoteAttachReady {
+		return "proxy activation pending"
+	}
+	return session.RemoteDetail
+}
 func sourceMatchesSession(source SourceFilter, session SessionView) bool {
 	if source.Session != session.ID {
 		return false
 	if pickerRow.session != current.Session || (current.Incarnation != (domain.IncarnationID{}) && pickerRow.incarnation != current.Incarnation) {
 		return false
 	}
+	if pickerRow.hasRemoteKey && pickerRow.kind == rowSession {
+		return current.RemoteKey == nil || pickerRow.remoteKey == *current.RemoteKey
+	}
 	if mode == SelectMoveTabSession {
 		return pickerRow.kind == rowSession
 	}
 	m.move(1)
 }
+// Cursor reports the identity under the picker cursor independently from
+// whether that row may be activated. Remote refreshes use it to preserve a
+// structured remote session key while Selected continues to enforce safety.
+func (m *Model) Cursor() (Target, bool) {
+	if m == nil || m.selected < 0 || m.selected >= len(m.rows) {
+		return Target{}, false
+	}
+	return m.rows[m.selected].target(), true
+}
 func (m *Model) Selected() (Target, bool) {
 	if m == nil || m.selected < 0 || m.selected >= len(m.rows) {
 		return Target{}, false
 	}
 	r := m.rows[m.selected]
-	if !r.kind.selectable(m.mode) {
+	if !r.selectable {
 		return Target{}, false
 	}
-	return Target{
+	return r.target(), true
-		Session: r.session, Incarnation: r.incarnation, Name: r.targetName, TabID: r.tabID,
-		TabIndex: r.tabIndex, Stopped: r.stopped, ExpectedCreatedAt: r.expectedCreatedAtPointer(),
-	}, true
 }
 // SelectedIndex reports the raw selected row index. It is -1 only when the
 	}
 	idx = clamp(idx, 0, len(m.rows)-1)
 	for i := idx; i < len(m.rows); i++ {
-		if m.rows[i].kind.selectable(m.mode) {
+		if m.rows[i].selectable {
 			m.selected = i
 			return
 		}
 	}
 	for i := idx - 1; i >= 0; i-- {
-		if m.rows[i].kind.selectable(m.mode) {
+		if m.rows[i].selectable {
 			m.selected = i
 			return
 		}
 	if m == nil || len(m.rows) == 0 {
 		return
 	}
-	if m.selected < 0 || m.selected >= len(m.rows) || !m.rows[m.selected].kind.selectable(m.mode) {
+	if m.selected < 0 || m.selected >= len(m.rows) || !m.rows[m.selected].selectable {
 		m.selected = m.firstSelectable()
 		return
 	}
 	for i := m.selected + delta; i >= 0 && i < len(m.rows); i += delta {
-		if m.rows[i].kind.selectable(m.mode) {
+		if m.rows[i].selectable {
 			m.selected = i
 			return
 		}
 func (m *Model) firstSelectable() int {
 	for i, r := range m.rows {
-		if r.kind.selectable(m.mode) {
+		if r.selectable {
 			return i
 		}
 	}
 	return -1
 }
+func (r row) target() Target {
+	return Target{
+		Session: r.session, Incarnation: r.incarnation, Name: r.targetName, RemoteKey: r.remoteKeyPointer(), TabID: r.tabID,
+		TabIndex: r.tabIndex, Stopped: r.stopped, ExpectedCreatedAt: r.expectedCreatedAtPointer(),
+	}
+}
 func (r row) expectedCreatedAtPointer() *int64 {
 	if !r.hasExpectedCreatedAt {
 		return nil
 	return &value
 }
+func (r row) remoteKeyPointer() *domain.RemoteSessionKey {
+	if !r.hasRemoteKey {
+		return nil
+	}
+	key := r.remoteKey
+	return &key
+}
 // renderList draws each visible row as up to three segments: a name segment
 // (bold when styles came from a truecolor theme), a base-styled attention
 // marker right after the name, and a muted detail segment (tab rows only) —
 		if r.stopped && idx != m.selected {
 			base, nameStyle, detailStyle = styles.Stopped, styles.Stopped, styles.Stopped
 		}
+		if r.dim {
+			base.Attrs |= renderer.AttrDim
+			nameStyle.Attrs |= renderer.AttrDim
+			detailStyle.Attrs |= renderer.AttrDim
+		}
 		ui.FillRect(frame, domain.Rect{X: rect.X, Y: rect.Y + y, Width: rect.Width, Height: 1}, renderer.Cell{Rune: ' ', Style: base})
 		name := r.dispName
 		if r.kind.rendersAsHeader() {
 			if r.stopped {
 				ui.DrawText(frame, x, rect.Y+y, clipX, " (stopped)", base)
+			} else {
+				ui.DrawText(frame, x, rect.Y+y, clipX, ui.TruncateText(r.detail, clipX-x), detailStyle)
 			}
 			continue
 		}

M internal/usecase/picker/model_test.go +156 -0


@@ -722,3 +722,159 @@ func TestPickerRowsKeepTerminalBackgroundAcrossAccentFallbacks(t *testing.T) {
722	722		})
723	723		}
724	724		}
	725	+
	726	+	func TestRemoteRowsCarryStructuredIdentityAndRemainNonSelectable(t *testing.T) {
	727	+	key := domain.RemoteSessionKey{Host: "build@mule", Name: "work"}
	728	+	availability := []RemoteAvailability{RemoteCached, RemoteFresh, RemoteStale, RemoteVersionMismatch}
	729	+	sessions := make([]SessionView, 0, len(availability))
	730	+	for _, state := range availability {
	731	+	sessions = append(sessions, SessionView{
	732	+	ID: key.ID(),
	733	+	Name: "presentation text is not routing data",
	734	+	Tabs: []TabEntry{{Name: "relayed metadata is not a picker target"}},
	735	+	RemoteKey: &key,
	736	+	RemoteAvailability: state,
	737	+	RemoteDetail: "remote state detail",
	738	+	ConnectOnly: true,
	739	+	RemoteAttachReady: false,
	740	+	})
	741	+	}
	742	+
	743	+	model := New(sessions, SelectionConfig{Mode: SelectNavigationTab})
	744	+	require.Len(t, model.rows, len(availability), "connect-only remote rows do not synthesize tab destinations")
	745	+	for i, pickerRow := range model.rows {
	746	+	require.Equal(t, rowSession, pickerRow.kind)
	747	+	require.Equal(t, key, pickerRow.remoteKey)
	748	+	require.True(t, pickerRow.hasRemoteKey)
	749	+	require.False(t, pickerRow.selectable, "remote state %d must remain gated in phase 5", availability[i])
	750	+	require.True(t, pickerRow.dim, "remote state %d is visibly unavailable", availability[i])
	751	+	wantDetail := "proxy activation pending"
	752	+	if availability[i] == RemoteStale \|\| availability[i] == RemoteVersionMismatch {
	753	+	wantDetail = "remote state detail"
	754	+	}
	755	+	require.Equal(t, wantDetail, pickerRow.detail)
	756	+	}
	757	+	_, ok := model.Selected()
	758	+	require.False(t, ok)
	759	+	frame := model.Render(domain.Size{Cols: 80, Rows: len(availability)}, Preview{})
	760	+	for y := range availability {
	761	+	require.NotZero(t, frame.At(0, y).Style.Attrs&renderer.AttrDim)
	762	+	}
	763	+	}
	764	+
	765	+	func TestRemoteCursorIdentitySurvivesCacheToLiveUpgradeWithoutActivation(t *testing.T) {
	766	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	767	+	cached := New([]SessionView{{
	768	+	ID: key.ID(), Name: key.Display(), RemoteKey: &key, RemoteAvailability: RemoteCached,
	769	+	ConnectOnly: true, RemoteAttachReady: false,
	770	+	}}, SelectionConfig{Mode: SelectNavigationTab, Current: SourceFilter{Session: key.ID()}})
	771	+
	772	+	cursor, ok := cached.Cursor()
	773	+	require.True(t, ok)
	774	+	require.Equal(t, key.ID(), cursor.Session)
	775	+	require.Equal(t, &key, cursor.RemoteKey)
	776	+	_, selectable := cached.Selected()
	777	+	require.False(t, selectable, "cursor identity must not bypass the phase 5 activation gate")
	778	+
	779	+	live := New([]SessionView{{
	780	+	ID: key.ID(), Name: key.Display(), RemoteKey: &key, RemoteAvailability: RemoteFresh,
	781	+	ConnectOnly: true, RemoteAttachReady: false,
	782	+	}}, SelectionConfig{Mode: SelectNavigationTab, Current: SourceFilter{
	783	+	Session: cursor.Session, Incarnation: cursor.Incarnation, TabID: cursor.TabID, RemoteKey: cursor.RemoteKey,
	784	+	}})
	785	+
	786	+	upgraded, ok := live.Cursor()
	787	+	require.True(t, ok)
	788	+	require.Equal(t, cursor, upgraded)
	789	+	_, selectable = live.Selected()
	790	+	require.False(t, selectable, "cache-to-live cursor preservation must not enable attach")
	791	+	}
	792	+
	793	+	func TestRemoteTabsRemainNonSelectableWhileAttachmentIsGated(t *testing.T) {
	794	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	795	+	model := New([]SessionView{{
	796	+	ID: key.ID(),
	797	+	Name: key.Display(),
	798	+	Tabs: []TabEntry{{TabID: "remote-tab", Name: "metadata"}},
	799	+	RemoteKey: &key,
	800	+	RemoteAvailability: RemoteFresh,
	801	+	RemoteAttachReady: false,
	802	+	}}, SelectionConfig{Mode: SelectNavigationTab})
	803	+
	804	+	require.Len(t, model.rows, 2)
	805	+	for _, pickerRow := range model.rows {
	806	+	require.False(t, pickerRow.selectable)
	807	+	require.True(t, pickerRow.dim)
	808	+	}
	809	+	}
	810	+
	811	+	func TestRemoteConnectOnlyTargetUsesStructuredKey(t *testing.T) {
	812	+	key := domain.RemoteSessionKey{Host: "user@build.example", Name: "work"}
	813	+	wantKey := key
	814	+	model := New([]SessionView{{
	815	+	ID: key.ID(),
	816	+	Name: "not a parseable remote display label",
	817	+	RemoteKey: &key,
	818	+	RemoteAvailability: RemoteFresh,
	819	+	ConnectOnly: true,
	820	+	RemoteAttachReady: true,
	821	+	}}, SelectionConfig{Mode: SelectNavigationTab})
	822	+	key.Host = "mutated-after-model-construction"
	823	+
	824	+	got, ok := model.Selected()
	825	+	require.True(t, ok)
	826	+	require.Equal(t, wantKey.ID(), got.Session)
	827	+	require.Equal(t, &wantKey, got.RemoteKey)
	828	+	require.Equal(t, "", got.Name, "connect-only remote routing never derives a name from display text")
	829	+	}
	830	+
	831	+	func TestRemoteRowsCannotAcceptMovesInEitherMoveMode(t *testing.T) {
	832	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
	833	+	local := SessionView{ID: "local", Name: "local", Tabs: []TabEntry{{TabID: "local-tab", Name: "local"}}}
	834	+	availability := []struct {
	835	+	name string
	836	+	state RemoteAvailability
	837	+	}{
	838	+	{name: "cached", state: RemoteCached},
	839	+	{name: "fresh", state: RemoteFresh},
	840	+	{name: "stale", state: RemoteStale},
	841	+	{name: "version mismatch", state: RemoteVersionMismatch},
	842	+	}
	843	+	modes := []struct {
	844	+	name string
	845	+	mode SelectionMode
	846	+	}{
	847	+	{name: "move pane", mode: SelectMovePaneTab},
	848	+	{name: "move tab", mode: SelectMoveTabSession},
	849	+	}
	850	+
	851	+	for _, availabilityCase := range availability {
	852	+	t.Run(availabilityCase.name, func(t *testing.T) {
	853	+	remote := SessionView{
	854	+	ID: key.ID(),
	855	+	Name: key.Display(),
	856	+	Tabs: []TabEntry{{TabID: "remote-tab", Name: "metadata"}},
	857	+	RemoteKey: &key,
	858	+	RemoteAvailability: availabilityCase.state,
	859	+	ConnectOnly: true,
	860	+	RemoteAttachReady: true,
	861	+	CannotAcceptMoves: true,
	862	+	}
	863	+	for _, mode := range modes {
	864	+	t.Run(mode.name, func(t *testing.T) {
	865	+	model := New([]SessionView{local, remote}, SelectionConfig{Mode: mode.mode, Source: SourceFilter{Session: "source"}})
	866	+	var remoteRow *row
	867	+	for i := range model.rows {
	868	+	if model.rows[i].session == key.ID() {
	869	+	remoteRow = &model.rows[i]
	870	+	break
	871	+	}
	872	+	}
	873	+	require.NotNil(t, remoteRow)
	874	+	require.True(t, remoteRow.dim)
	875	+	require.False(t, remoteRow.selectable)
	876	+	})
	877	+	}
	878	+	})
	879	+	}
	880	+	}


@@ -722,3 +722,159 @@ func TestPickerRowsKeepTerminalBackgroundAcrossAccentFallbacks(t *testing.T) {
722	})	722		})
723	}	723		}
724	}	724		}
		725	+
		726	+	func TestRemoteRowsCarryStructuredIdentityAndRemainNonSelectable(t *testing.T) {
		727	+	key := domain.RemoteSessionKey{Host: "build@mule", Name: "work"}
		728	+	availability := []RemoteAvailability{RemoteCached, RemoteFresh, RemoteStale, RemoteVersionMismatch}
		729	+	sessions := make([]SessionView, 0, len(availability))
		730	+	for _, state := range availability {
		731	+	sessions = append(sessions, SessionView{
		732	+	ID: key.ID(),
		733	+	Name: "presentation text is not routing data",
		734	+	Tabs: []TabEntry{{Name: "relayed metadata is not a picker target"}},
		735	+	RemoteKey: &key,
		736	+	RemoteAvailability: state,
		737	+	RemoteDetail: "remote state detail",
		738	+	ConnectOnly: true,
		739	+	RemoteAttachReady: false,
		740	+	})
		741	+	}
		742	+
		743	+	model := New(sessions, SelectionConfig{Mode: SelectNavigationTab})
		744	+	require.Len(t, model.rows, len(availability), "connect-only remote rows do not synthesize tab destinations")
		745	+	for i, pickerRow := range model.rows {
		746	+	require.Equal(t, rowSession, pickerRow.kind)
		747	+	require.Equal(t, key, pickerRow.remoteKey)
		748	+	require.True(t, pickerRow.hasRemoteKey)
		749	+	require.False(t, pickerRow.selectable, "remote state %d must remain gated in phase 5", availability[i])
		750	+	require.True(t, pickerRow.dim, "remote state %d is visibly unavailable", availability[i])
		751	+	wantDetail := "proxy activation pending"
		752	+	if availability[i] == RemoteStale \|\| availability[i] == RemoteVersionMismatch {
		753	+	wantDetail = "remote state detail"
		754	+	}
		755	+	require.Equal(t, wantDetail, pickerRow.detail)
		756	+	}
		757	+	_, ok := model.Selected()
		758	+	require.False(t, ok)
		759	+	frame := model.Render(domain.Size{Cols: 80, Rows: len(availability)}, Preview{})
		760	+	for y := range availability {
		761	+	require.NotZero(t, frame.At(0, y).Style.Attrs&renderer.AttrDim)
		762	+	}
		763	+	}
		764	+
		765	+	func TestRemoteCursorIdentitySurvivesCacheToLiveUpgradeWithoutActivation(t *testing.T) {
		766	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
		767	+	cached := New([]SessionView{{
		768	+	ID: key.ID(), Name: key.Display(), RemoteKey: &key, RemoteAvailability: RemoteCached,
		769	+	ConnectOnly: true, RemoteAttachReady: false,
		770	+	}}, SelectionConfig{Mode: SelectNavigationTab, Current: SourceFilter{Session: key.ID()}})
		771	+
		772	+	cursor, ok := cached.Cursor()
		773	+	require.True(t, ok)
		774	+	require.Equal(t, key.ID(), cursor.Session)
		775	+	require.Equal(t, &key, cursor.RemoteKey)
		776	+	_, selectable := cached.Selected()
		777	+	require.False(t, selectable, "cursor identity must not bypass the phase 5 activation gate")
		778	+
		779	+	live := New([]SessionView{{
		780	+	ID: key.ID(), Name: key.Display(), RemoteKey: &key, RemoteAvailability: RemoteFresh,
		781	+	ConnectOnly: true, RemoteAttachReady: false,
		782	+	}}, SelectionConfig{Mode: SelectNavigationTab, Current: SourceFilter{
		783	+	Session: cursor.Session, Incarnation: cursor.Incarnation, TabID: cursor.TabID, RemoteKey: cursor.RemoteKey,
		784	+	}})
		785	+
		786	+	upgraded, ok := live.Cursor()
		787	+	require.True(t, ok)
		788	+	require.Equal(t, cursor, upgraded)
		789	+	_, selectable = live.Selected()
		790	+	require.False(t, selectable, "cache-to-live cursor preservation must not enable attach")
		791	+	}
		792	+
		793	+	func TestRemoteTabsRemainNonSelectableWhileAttachmentIsGated(t *testing.T) {
		794	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
		795	+	model := New([]SessionView{{
		796	+	ID: key.ID(),
		797	+	Name: key.Display(),
		798	+	Tabs: []TabEntry{{TabID: "remote-tab", Name: "metadata"}},
		799	+	RemoteKey: &key,
		800	+	RemoteAvailability: RemoteFresh,
		801	+	RemoteAttachReady: false,
		802	+	}}, SelectionConfig{Mode: SelectNavigationTab})
		803	+
		804	+	require.Len(t, model.rows, 2)
		805	+	for _, pickerRow := range model.rows {
		806	+	require.False(t, pickerRow.selectable)
		807	+	require.True(t, pickerRow.dim)
		808	+	}
		809	+	}
		810	+
		811	+	func TestRemoteConnectOnlyTargetUsesStructuredKey(t *testing.T) {
		812	+	key := domain.RemoteSessionKey{Host: "user@build.example", Name: "work"}
		813	+	wantKey := key
		814	+	model := New([]SessionView{{
		815	+	ID: key.ID(),
		816	+	Name: "not a parseable remote display label",
		817	+	RemoteKey: &key,
		818	+	RemoteAvailability: RemoteFresh,
		819	+	ConnectOnly: true,
		820	+	RemoteAttachReady: true,
		821	+	}}, SelectionConfig{Mode: SelectNavigationTab})
		822	+	key.Host = "mutated-after-model-construction"
		823	+
		824	+	got, ok := model.Selected()
		825	+	require.True(t, ok)
		826	+	require.Equal(t, wantKey.ID(), got.Session)
		827	+	require.Equal(t, &wantKey, got.RemoteKey)
		828	+	require.Equal(t, "", got.Name, "connect-only remote routing never derives a name from display text")
		829	+	}
		830	+
		831	+	func TestRemoteRowsCannotAcceptMovesInEitherMoveMode(t *testing.T) {
		832	+	key := domain.RemoteSessionKey{Host: "arch", Name: "work"}
		833	+	local := SessionView{ID: "local", Name: "local", Tabs: []TabEntry{{TabID: "local-tab", Name: "local"}}}
		834	+	availability := []struct {
		835	+	name string
		836	+	state RemoteAvailability
		837	+	}{
		838	+	{name: "cached", state: RemoteCached},
		839	+	{name: "fresh", state: RemoteFresh},
		840	+	{name: "stale", state: RemoteStale},
		841	+	{name: "version mismatch", state: RemoteVersionMismatch},
		842	+	}
		843	+	modes := []struct {
		844	+	name string
		845	+	mode SelectionMode
		846	+	}{
		847	+	{name: "move pane", mode: SelectMovePaneTab},
		848	+	{name: "move tab", mode: SelectMoveTabSession},
		849	+	}
		850	+
		851	+	for _, availabilityCase := range availability {
		852	+	t.Run(availabilityCase.name, func(t *testing.T) {
		853	+	remote := SessionView{
		854	+	ID: key.ID(),
		855	+	Name: key.Display(),
		856	+	Tabs: []TabEntry{{TabID: "remote-tab", Name: "metadata"}},
		857	+	RemoteKey: &key,
		858	+	RemoteAvailability: availabilityCase.state,
		859	+	ConnectOnly: true,
		860	+	RemoteAttachReady: true,
		861	+	CannotAcceptMoves: true,
		862	+	}
		863	+	for _, mode := range modes {
		864	+	t.Run(mode.name, func(t *testing.T) {
		865	+	model := New([]SessionView{local, remote}, SelectionConfig{Mode: mode.mode, Source: SourceFilter{Session: "source"}})
		866	+	var remoteRow *row
		867	+	for i := range model.rows {
		868	+	if model.rows[i].session == key.ID() {
		869	+	remoteRow = &model.rows[i]
		870	+	break
		871	+	}
		872	+	}
		873	+	require.NotNil(t, remoteRow)
		874	+	require.True(t, remoteRow.dim)
		875	+	require.False(t, remoteRow.selectable)
		876	+	})
		877	+	}
		878	+	})
		879	+	}
		880	+	}