e9e6c54 feat(remote): establish proxied content ownership · vev

A docs/ansi-content-replay-phase0.md +11 -0

@@ -0,0 +1,11 @@
	1	+	# Phase 0: ANSI content replay gate
	2	+
	3	+	The test-only prototype in `internal/usecase/daemon/ansi_content_replay_phase0_test.go` records the current feasibility boundary for remote content:
	4	+
	5	+	- ANSI produced by `pkg/renderer` is replayed into a private `pkg/vt.Screen`.
	6	+	- The screen has nil response, bell, notification, progress, and clipboard callbacks, so replay cannot emit remote host-side effects.
	7	+	- Full and incremental output, styles, wide-cell continuation, cursor state, and split CSI/OSC writes are captured as cells and cursor metadata.
	8	+	- The captured grid can be handed to a local renderer for composition; the remote ANSI stream is not passed to that renderer or a transport.
	9	+	- A test-only ordered-frame model requires metadata before the first full content frame, contiguous state-bearing deltas, and base-zero full resets. Gaps and malformed resets are rejected.
	10	+
	11	+	This is feasibility evidence only. It does not change the production renderer, protocol, layout, or attach flow. The remaining gate is to specify and integrate a production remote metadata/content ownership contract around this boundary; no compatibility path is implied by Phase 0.

M internal/app/run_test.go +1 -1


@@ -575,7 +575,7 @@ func TestAttachTargetsCreateCommonSessionRequest(t *testing.T) {
575		t.Run(tt.name, func(t *testing.T) {	575		t.Run(tt.name, func(t *testing.T) {
576		cmd, err := parseArgs([]string{"attach", tt.arg})	576		cmd, err := parseArgs([]string{"attach", tt.arg})
577		require.NoError(t, err)	577		require.NoError(t, err)
578	-	connection, err := client.NewSessionConnection(portsmocks.NewMockTransport(t), client.SessionTarget{	578	+	connection, err := client.NewSessionConnection(portsmocks.NewMockTransport(t), client.AttachRequest{
579		Intent: cmd.intent,	579		Intent: cmd.intent,
580		SessionName: cmd.name,	580		SessionName: cmd.name,
581		})	581		})

M internal/ports/frame.go +1 -1


@@ -12,7 +12,7 @@ import (
12		const HandshakeTimeout = 15 * time.Second	12		const HandshakeTimeout = 15 * time.Second
13			13
14		// ProtocolVersion is the current vev IPC wire protocol version.	14		// ProtocolVersion is the current vev IPC wire protocol version.
15	-	const ProtocolVersion uint16 = 24	15	+	const ProtocolVersion uint16 = 25
16			16
17		// MaxFrameLen is the largest permitted frame length, including the type byte	17		// MaxFrameLen is the largest permitted frame length, including the type byte
18		// and excluding the four-byte length prefix.	18		// and excluding the four-byte length prefix.

M internal/ports/frame_test.go +2 -2


@@ -3,8 +3,8 @@ package ports
3		import "testing"	3		import "testing"
4			4
5		func TestProtocolVersion(t *testing.T) {	5		func TestProtocolVersion(t *testing.T) {
6	-	if ProtocolVersion != 24 {	6	+	if ProtocolVersion != 25 {
7	-	t.Fatalf("ProtocolVersion = %d, want 24", ProtocolVersion)	7	+	t.Fatalf("ProtocolVersion = %d, want 25", ProtocolVersion)
8		}	8		}
9		}	9		}
10			10

M internal/ports/remote_preview_hardening_test.go +1 -1


@@ -194,7 +194,7 @@ func TestRemoteTargetWireRichGoldenRoundTrip(t *testing.T) {
194		want := []byte{	194		want := []byte{
195		0x00, 0x0f, 'b', 'u', 'i', 'l', 'd', '@', 'm', 'u', 'l', 'e', ':', '2', '2', '2', '2',	195		0x00, 0x0f, 'b', 'u', 'i', 'l', 'd', '@', 'm', 'u', 'l', 'e', ':', '2', '2', '2', '2',
196		0x00, 0x04, 'w', 'o', 'r', 'k', IntentAttach,	196		0x00, 0x04, 'w', 'o', 'r', 'k', IntentAttach,
197	-	0x01, 0x01,	197	+	0x01,
198		0x00, 0x0f, 'b', 'u', 'i', 'l', 'd', '@', 'm', 'u', 'l', 'e', ':', '2', '2', '2', '2',	198		0x00, 0x0f, 'b', 'u', 'i', 'l', 'd', '@', 'm', 'u', 'l', 'e', ':', '2', '2', '2', '2',
199		0x00, 0x09, 'm', 'u', 'l', 'e', ':', '2', '2', '2', '2',	199		0x00, 0x09, 'm', 'u', 'l', 'e', ':', '2', '2', '2', '2',
200		0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,	200		0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,

M internal/ports/remote_target_wire_test.go +50 -30

 import (
 	"bytes"
+	"reflect"
 	"testing"
 	"github.com/bnema/vev/internal/domain"
 	}
 }
+func TestProxiedHelloGoldenAndStrict(t *testing.T) {
+	target := testRemoteTarget(false)
+	msg := Hello{
+		Version: ProtocolVersion, Intent: IntentAttach, RenderMode: RenderModeProxiedContent,
+		ClientID: [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}, ResumeToken: 0x0102030405060708,
+		Name: target.SessionName, Size: domain.Size{Cols: 80, Rows: 24}, MaxOutputInFlight: 2,
+		RemoteTarget: target, EnvironmentPolicy: EnvironmentPolicyDaemonOwned,
+	}
+	want := []byte{
+		0, 25, IntentAttach, byte(RenderModeProxiedContent),
+		1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+		1, 2, 3, 4, 5, 6, 7, 8,
+		0, 4, 'w', 'o', 'r', 'k', 0, 80, 0, 24, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0,
+		1,
+		0, 15, 'b', 'u', 'i', 'l', 'd', '@', 'm', 'u', 'l', 'e', ':', '2', '2', '2', '2',
+		0, 9, 'm', 'u', 'l', 'e', ':', '2', '2', '2', '2',
+		1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+		0, 4, 'w', 'o', 'r', 'k', 0, 0, 5, 't', 'a', 'b', '-', '3', 0, byte(EnvironmentPolicyDaemonOwned),
+	}
+	payload := MarshalHello(msg)
+	if !bytes.Equal(payload, want) {
+		t.Fatalf("proxied Hello bytes = %x, want %x", payload, want)
+	}
+	decoded, err := UnmarshalHello(payload)
+	if err != nil || !reflect.DeepEqual(decoded, msg) || decoded.RemoteTarget == msg.RemoteTarget {
+		t.Fatalf("proxied Hello = %#v, error %v", decoded, err)
+	}
+	assertAllPrefixesFail(t, payload, UnmarshalHello)
+	assertTrailingGarbageFails(t, payload, UnmarshalHello)
+	if MarshalHello(Hello{Version: ProtocolVersion, Intent: IntentAttach, RenderMode: RenderModeProxiedContent, Size: domain.Size{Cols: 80, Rows: 24}}) != nil {
+		t.Fatal("proxied Hello without exact target marshaled")
+	}
+	malformed := append([]byte(nil), payload...)
+	malformed[3] = 2
+	if _, err := UnmarshalHello(malformed); err == nil {
+		t.Fatal("unknown render mode decoded")
+	}
+}
 func TestRemoteTargetWireRejectsClientOwnedEnvironmentPolicy(t *testing.T) {
 	target := testRemoteTarget(false)
 	tests := []struct {
-		name          string
+		name        string
-		validate      func() error
+		validate    func() error
-		marshalBad    func() []byte
+		marshalBad  func() []byte
-		marshalGood   func() []byte
+		marshalGood func() []byte
-		marshalLegacy func() []byte
+		unmarshal   func([]byte) error
-		unmarshal     func([]byte) error
 	}{
 		{
 			name: "hello",
 					RemoteTarget: target, EnvironmentPolicy: EnvironmentPolicyDaemonOwned,
 				})
 			},
-			marshalLegacy: func() []byte {
-				return MarshalHello(Hello{
-					Version: ProtocolVersion, Intent: IntentAttach,
-					Name: target.SessionName, Size: domain.Size{Cols: 80, Rows: 24},
-				})
-			},
 			unmarshal: func(payload []byte) error { _, err := UnmarshalHello(payload); return err },
 		},
 		{
 					RemoteTarget: target, EnvironmentPolicy: EnvironmentPolicyDaemonOwned,
 				})
 			},
-			marshalLegacy: func() []byte {
-				return MarshalAttachTarget(AttachTarget{
-					Endpoint: target.Endpoint, Session: target.SessionName, Intent: IntentAttach,
-				})
-			},
 			unmarshal: func(payload []byte) error { _, err := UnmarshalAttachTarget(payload); return err },
 		},
 	}
 			if payload == nil {
 				t.Fatal("failed to marshal daemon-owned control payload")
 			}
-			legacyLen := len(tt.marshalLegacy())
+			for i := range len(payload) {
-			if err := tt.unmarshal(payload[:legacyLen]); err != nil {
-				t.Fatalf("complete legacy prefix failed to decode: %v", err)
-			}
-			for i := 0; i < len(payload); i++ {
-				if i == legacyLen {
-					// The complete legacy prefix is a valid count-only payload by
-					// design; every other rich-target prefix is malformed.
-					continue
-				}
 				if err := tt.unmarshal(payload[:i]); err == nil {
 					t.Fatalf("prefix %d unexpectedly decoded", i)
 				}
 	}
 }
-func TestLegacyTargetWireBytesRemainUnchanged(t *testing.T) {
+func TestTargetWireIncludesRequiredV25Section(t *testing.T) {
-	want := []byte{0, 4, 'h', 'o', 's', 't', 0, 4, 'w', 'o', 'r', 'k', IntentAttach}
+	want := []byte{0, 4, 'h', 'o', 's', 't', 0, 4, 'w', 'o', 'r', 'k', IntentAttach, 0, 0}
 	got := MarshalAttachTarget(AttachTarget{Endpoint: "host", Session: "work", Intent: IntentAttach})
 	if !bytes.Equal(got, want) {
-		t.Fatalf("legacy target bytes = %x, want %x", got, want)
+		t.Fatalf("target bytes = %x, want %x", got, want)
 	}
 }

M internal/ports/wire.go +122 -71

 	return policy == EnvironmentPolicyClientOwned || policy == EnvironmentPolicyDaemonOwned
 }
-const remoteTargetWireVersion uint8 = 1
+// RenderMode determines whether the daemon emits a complete terminal view or
+// only the private remote content surface requested by another daemon.
+type RenderMode uint8
+const (
+	RenderModeFullTerminal RenderMode = iota
+	RenderModeProxiedContent
+)
+func validRenderMode(mode RenderMode) bool {
+	return mode == RenderModeFullTerminal || mode == RenderModeProxiedContent
+}
 // Capability bits advertised in Welcome.
 const (
 type Hello struct {
 	Version     uint16
 	Intent      uint8
+	RenderMode  RenderMode
 	ClientID    [16]byte
 	ResumeToken uint64
 	Name        string
 	SessionName  string
 	Ephemeral    bool
 	ResumeToken  uint64
+	RenderMode   RenderMode
 	Capabilities uint32
 }
 type OutputResetRequest struct{}
 // SessionTabMeta describes one tab in a remote session's metadata snapshot.
+// ID is stable for the lifetime of its remote tab and ordered only for display.
 type SessionTabMeta struct {
-	Index     uint16
+	ID        domain.TabStableID
 	Name      string
 	Attention bool
 }
-// SessionMeta is authoritative tab metadata for a remote session.
+// SessionMeta is an authoritative, revisioned snapshot of remote tab metadata.
 type SessionMeta struct {
+	LifecycleID domain.SessionLifecycleID
+	Revision    uint64
 	SessionName string
-	Active      uint16
+	ActiveTabID domain.TabStableID
 	Tabs        []SessionTabMeta
 }
 	w.b = append(w.b, b...)
 }
-func marshalRemoteTargetExtension(w *payloadWriter, target *domain.RemoteSessionTarget, policy EnvironmentPolicy) {
+// marshalRemoteTargetSection writes the required v25 target/policy section.
-	w.putUint8(remoteTargetWireVersion)
+// A target may be absent for direct local attaches, but its presence marker and
+// environment policy are never optional: v25 has no extension or legacy tail.
+func marshalRemoteTargetSection(w *payloadWriter, target *domain.RemoteSessionTarget, policy EnvironmentPolicy) {
 	if target == nil {
 		w.putBool(false)
 	} else {
 	w.putUint8(uint8(policy))
 }
-func skipRemoteTargetExtension(r *payloadReader) error {
+func skipRemoteTargetSection(r *payloadReader) error {
-	version, err := r.getUint8()
-	if err != nil {
-		return err
-	}
-	if version != remoteTargetWireVersion {
-		return errInvalidEnum
-	}
 	present, err := r.getBool()
 	if err != nil {
 		return err
 	return target, nil
 }
-func unmarshalRemoteTargetExtension(r *payloadReader) (*domain.RemoteSessionTarget, EnvironmentPolicy, error) {
+func unmarshalRemoteTargetSection(r *payloadReader) (*domain.RemoteSessionTarget, EnvironmentPolicy, error) {
-	version, err := r.getUint8()
-	if err != nil {
-		return nil, 0, err
-	}
-	if version != remoteTargetWireVersion {
-		return nil, 0, errInvalidEnum
-	}
 	target, err := unmarshalRemoteTarget(r)
 	if err != nil {
 		return nil, 0, err
 	if err != nil {
 		return nil, 0, err
 	}
+	if !validEnvironmentPolicy(EnvironmentPolicy(policy)) {
+		return nil, 0, errInvalidEnum
+	}
 	return target, EnvironmentPolicy(policy), nil
 }
 	if h.Intent != IntentEphemeral && h.Intent != IntentNew && h.Intent != IntentAttach && h.Intent != IntentResume {
 		return ErrInvalidHello
 	}
+	if !validRenderMode(h.RenderMode) {
+		return ErrInvalidHello
+	}
 	if err := ValidateSize(h.Size); err != nil {
 		return fmt.Errorf("%w: size", ErrInvalidHello)
 	}
 		}
 	}
 	if h.RemoteTarget == nil {
-		if h.EnvironmentPolicy != EnvironmentPolicyClientOwned {
+		if h.EnvironmentPolicy != EnvironmentPolicyClientOwned || h.RenderMode == RenderModeProxiedContent {
 			return ErrInvalidHello
 		}
 		return nil
 	w := payloadWriter{}
 	w.putUint16(h.Version)
 	w.putUint8(h.Intent)
+	w.putUint8(uint8(h.RenderMode))
 	w.putBytes(h.ClientID[:])
 	w.putUint64(h.ResumeToken)
 	w.putString(h.Name)
 	for _, entry := range h.Env {
 		w.putLongString(entry)
 	}
-	if h.RemoteTarget != nil || h.EnvironmentPolicy != EnvironmentPolicyClientOwned {
+	marshalRemoteTargetSection(&w, h.RemoteTarget, h.EnvironmentPolicy)
-		marshalRemoteTargetExtension(&w, h.RemoteTarget, h.EnvironmentPolicy)
-	}
 	return w.b
 }
 	if _, err := r.getUint8(); err != nil {
 		return err
 	}
+	mode, err := r.getUint8()
+	if err != nil {
+		return err
+	}
+	if !validRenderMode(RenderMode(mode)) {
+		return errInvalidEnum
+	}
 	if len(r.b) < 16 {
 		return errShortPayload
 	}
 			return err
 		}
 	}
-	if len(r.b) != 0 {
+	if err := skipRemoteTargetSection(&r); err != nil {
-		if err := skipRemoteTargetExtension(&r); err != nil {
+		return err
-			return err
-		}
 	}
 	return r.done()
 }
 	if h.Intent, err = r.getUint8(); err != nil {
 		return Hello{}, err
 	}
+	mode, err := r.getUint8()
+	if err != nil {
+		return Hello{}, err
+	}
+	h.RenderMode = RenderMode(mode)
 	clientID, err := r.getBytes(len(h.ClientID))
 	if err != nil {
 		return Hello{}, err
 			h.Env = append(h.Env, entry)
 		}
 	}
-	if len(r.b) != 0 {
+	if h.RemoteTarget, h.EnvironmentPolicy, err = unmarshalRemoteTargetSection(&r); err != nil {
-		if h.RemoteTarget, h.EnvironmentPolicy, err = unmarshalRemoteTargetExtension(&r); err != nil {
+		return Hello{}, err
-			return Hello{}, err
-		}
 	}
 	if err := r.done(); err != nil {
 		return Hello{}, err
 		w.putUint8(0)
 	}
 	w.putUint64(m.ResumeToken)
+	w.putUint8(uint8(m.RenderMode))
 	w.putUint32(m.Capabilities)
 	return w.b
 }
 	if m.ResumeToken, err = r.getUint64(); err != nil {
 		return Welcome{}, err
 	}
+	mode, err := r.getUint8()
+	if err != nil {
+		return Welcome{}, err
+	}
+	m.RenderMode = RenderMode(mode)
+	if !validRenderMode(m.RenderMode) {
+		return Welcome{}, errInvalidEnum
+	}
 	if m.Capabilities, err = r.getUint32(); err != nil {
 		return Welcome{}, err
 	}
 	w.putString(m.Endpoint)
 	w.putString(m.Session)
 	w.putUint8(m.Intent)
-	if m.RemoteTarget != nil || m.EnvironmentPolicy != EnvironmentPolicyClientOwned {
+	marshalRemoteTargetSection(&w, m.RemoteTarget, m.EnvironmentPolicy)
-		marshalRemoteTargetExtension(&w, m.RemoteTarget, m.EnvironmentPolicy)
-	}
 	return w.b
 }
 	if err != nil || (intent != IntentEphemeral && intent != IntentNew && intent != IntentAttach && intent != IntentResume) {
 		return AttachTarget{}, ErrInvalidAttachTarget
 	}
-	if len(probe.b) != 0 {
+	if err := skipRemoteTargetSection(&probe); err != nil {
-		if err := skipRemoteTargetExtension(&probe); err != nil {
+		return AttachTarget{}, ErrInvalidAttachTarget
-			return AttachTarget{}, ErrInvalidAttachTarget
-		}
 	}
 	if err := probe.done(); err != nil {
 		return AttachTarget{}, ErrInvalidAttachTarget
 	if m.Intent, err = r.getUint8(); err != nil {
 		return AttachTarget{}, err
 	}
-	if len(r.b) != 0 {
+	if m.RemoteTarget, m.EnvironmentPolicy, err = unmarshalRemoteTargetSection(&r); err != nil {
-		if m.RemoteTarget, m.EnvironmentPolicy, err = unmarshalRemoteTargetExtension(&r); err != nil {
+		return AttachTarget{}, err
-			return AttachTarget{}, err
-		}
 	}
 	if err := r.done(); err != nil {
 		return AttachTarget{}, err
 	return OutputResetRequest{}, nil
 }
-// MarshalSessionMeta encodes m when it satisfies the protocol's authoritative
+// ValidateSessionMeta validates a revisioned authoritative remote metadata
-// ordered-tab constraints.
+// snapshot. Ordered tabs remain display order, while IDs are the only identity.
-func MarshalSessionMeta(m SessionMeta) ([]byte, error) {
+func ValidateSessionMeta(m SessionMeta) error {
-	if len(m.Tabs) == 0 || len(m.Tabs) > math.MaxUint16 || int(m.Active) >= len(m.Tabs) {
+	if m.LifecycleID == (domain.SessionLifecycleID{}) || m.Revision == 0 ||
-		return nil, ErrInvalidSessionMeta
+		m.SessionName == "" || len(m.Tabs) == 0 || len(m.Tabs) > math.MaxUint16 {
+		return ErrInvalidSessionMeta
+	}
+	if len(m.SessionName) > math.MaxUint16 || len(m.ActiveTabID) > math.MaxUint16 {
+		return ErrSessionMetaStringTooLong
 	}
-	if len(m.SessionName) > math.MaxUint16 {
+	if err := domain.ValidateTabStableID(m.ActiveTabID); err != nil {
-		return nil, ErrSessionMetaStringTooLong
+		return ErrInvalidSessionMeta
 	}
-	for i, tab := range m.Tabs {
+	activeFound := false
-		if tab.Index != uint16(i) {
+	seen := make(map[domain.TabStableID]struct{}, len(m.Tabs))
-			return nil, ErrInvalidSessionMeta
+	for _, tab := range m.Tabs {
+		if len(tab.ID) > math.MaxUint16 || len(tab.Name) > math.MaxUint16 {
+			return ErrSessionMetaStringTooLong
+		}
+		if err := domain.ValidateTabStableID(tab.ID); err != nil {
+			return ErrInvalidSessionMeta
 		}
-		if len(tab.Name) > math.MaxUint16 {
+		if _, duplicate := seen[tab.ID]; duplicate {
-			return nil, ErrSessionMetaStringTooLong
+			return ErrInvalidSessionMeta
 		}
+		seen[tab.ID] = struct{}{}
+		activeFound = activeFound || tab.ID == m.ActiveTabID
 	}
+	if !activeFound {
+		return ErrInvalidSessionMeta
+	}
+	return nil
+}
+// MarshalSessionMeta encodes a strict v25 revisioned metadata snapshot.
+func MarshalSessionMeta(m SessionMeta) ([]byte, error) {
+	if err := ValidateSessionMeta(m); err != nil {
+		return nil, err
+	}
 	w := payloadWriter{}
+	w.putBytes(m.LifecycleID[:])
+	w.putUint64(m.Revision)
 	w.putString(m.SessionName)
-	w.putUint16(m.Active)
+	w.putString(string(m.ActiveTabID))
 	w.putUint16(uint16(len(m.Tabs)))
 	for _, tab := range m.Tabs {
-		w.putUint16(tab.Index)
+		w.putString(string(tab.ID))
 		w.putString(tab.Name)
 		w.putBool(tab.Attention)
 	}
 	return w.b, nil
 }
-// UnmarshalSessionMeta decodes a strict authoritative metadata snapshot.
+// UnmarshalSessionMeta decodes a strict v25 authoritative metadata snapshot.
 func UnmarshalSessionMeta(b []byte) (SessionMeta, error) {
 	r := payloadReader{b: b}
 	var m SessionMeta
-	var err error
+	lifecycle, err := r.getBytes(len(m.LifecycleID))
+	if err != nil {
+		return SessionMeta{}, err
+	}
+	copy(m.LifecycleID[:], lifecycle)
+	if m.Revision, err = r.getUint64(); err != nil {
+		return SessionMeta{}, err
+	}
 	if m.SessionName, err = r.getString(); err != nil {
 		return SessionMeta{}, err
 	}
-	if m.Active, err = r.getUint16(); err != nil {
+	activeTabID, err := r.getString()
+	if err != nil {
 		return SessionMeta{}, err
 	}
+	m.ActiveTabID = domain.TabStableID(activeTabID)
 	count, err := r.getUint16()
 	if err != nil {
 		return SessionMeta{}, err
 	}
-	if count == 0 || int(m.Active) >= int(count) {
+	if count == 0 || uint64(count) > uint64(len(r.b)/5) {
-		return SessionMeta{}, ErrInvalidSessionMeta
-	}
-	if uint64(count) > uint64(len(r.b)/5) {
 		return SessionMeta{}, errShortPayload
 	}
 	m.Tabs = make([]SessionTabMeta, 0, int(count))
-	for i := range int(count) {
+	for range int(count) {
 		var tab SessionTabMeta
-		if tab.Index, err = r.getUint16(); err != nil {
+		id, err := r.getString()
+		if err != nil {
 			return SessionMeta{}, err
 		}
-		if tab.Index != uint16(i) {
+		tab.ID = domain.TabStableID(id)
-			return SessionMeta{}, ErrInvalidSessionMeta
-		}
 		if tab.Name, err = r.getString(); err != nil {
 			return SessionMeta{}, err
 		}
 	if err := r.done(); err != nil {
 		return SessionMeta{}, err
 	}
+	if err := ValidateSessionMeta(m); err != nil {
+		return SessionMeta{}, err
+	}
 	return m, nil
 }

M internal/ports/wire_final_test.go +7 -7


@@ -11,8 +11,8 @@ import (
11		)	11		)
12			12
13		func TestFinalProtocolVersionAndNoV21Hello(t *testing.T) {	13		func TestFinalProtocolVersionAndNoV21Hello(t *testing.T) {
14	-	if ProtocolVersion != 24 {	14	+	if ProtocolVersion != 25 {
15	-	t.Fatalf("ProtocolVersion = %d, want 24", ProtocolVersion)	15	+	t.Fatalf("ProtocolVersion = %d, want 25", ProtocolVersion)
16		}	16		}
17		payload := MarshalHello(Hello{Version: ProtocolVersion, Intent: IntentAttach, Size: domain.Size{Cols: 80, Rows: 24}})	17		payload := MarshalHello(Hello{Version: ProtocolVersion, Intent: IntentAttach, Size: domain.Size{Cols: 80, Rows: 24}})
18		if len(payload) < 2 {	18		if len(payload) < 2 {

@@ -26,8 +26,8 @@ func TestFinalProtocolVersionAndNoV21Hello(t *testing.T) {
26			26
27		func TestFinalHelloGoldenStrict(t *testing.T) {	27		func TestFinalHelloGoldenStrict(t *testing.T) {
28		msg := Hello{Version: ProtocolVersion, Intent: IntentAttach, Size: domain.Size{Cols: 80, Rows: 24}}	28		msg := Hello{Version: ProtocolVersion, Intent: IntentAttach, Size: domain.Size{Cols: 80, Rows: 24}}
29	-	want := append([]byte{0, 24, 2}, make([]byte, 16+8)...)	29	+	want := append([]byte{0, 25, 2, 0}, make([]byte, 16+8)...)
30	-	want = append(want, 0, 0, 0, 80, 0, 24, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0)	30	+	want = append(want, 0, 0, 0, 80, 0, 24, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0)
31		got := MarshalHello(msg)	31		got := MarshalHello(msg)
32		if !bytes.Equal(got, want) {	32		if !bytes.Equal(got, want) {
33		t.Fatalf("Hello bytes = %x, want %x", got, want)	33		t.Fatalf("Hello bytes = %x, want %x", got, want)

@@ -178,7 +178,7 @@ func TestFinalAckGoldenStrict(t *testing.T) {
178			178
179		func TestFinalAttachTargetGoldenStrict(t *testing.T) {	179		func TestFinalAttachTargetGoldenStrict(t *testing.T) {
180		msg := AttachTarget{Endpoint: "host", Session: "work", Intent: IntentAttach}	180		msg := AttachTarget{Endpoint: "host", Session: "work", Intent: IntentAttach}
181	-	want := []byte{0, 4, 'h', 'o', 's', 't', 0, 4, 'w', 'o', 'r', 'k', 2}	181	+	want := []byte{0, 4, 'h', 'o', 's', 't', 0, 4, 'w', 'o', 'r', 'k', 2, 0, 0}
182		got := MarshalAttachTarget(msg)	182		got := MarshalAttachTarget(msg)
183		if !bytes.Equal(got, want) {	183		if !bytes.Equal(got, want) {
184		t.Fatalf("AttachTarget bytes = %x, want %x", got, want)	184		t.Fatalf("AttachTarget bytes = %x, want %x", got, want)

@@ -197,7 +197,7 @@ func TestFinalAttachTargetGoldenStrict(t *testing.T) {
197		}	197		}
198			198
199		func TestFinalClosedWireValuesRejectUnknownEnumsAndBooleans(t *testing.T) {	199		func TestFinalClosedWireValuesRejectUnknownEnumsAndBooleans(t *testing.T) {
200	-	meta, err := MarshalSessionMeta(SessionMeta{Tabs: []SessionTabMeta{{Name: "tab"}}})	200	+	meta, err := MarshalSessionMeta(SessionMeta{LifecycleID: domain.SessionLifecycleID{1}, Revision: 1, SessionName: "work", ActiveTabID: "tab", Tabs: []SessionTabMeta{{ID: "tab", Name: "tab"}}})
201		if err != nil {	201		if err != nil {
202		t.Fatal(err)	202		t.Fatal(err)
203		}	203		}

@@ -210,7 +210,7 @@ func TestFinalClosedWireValuesRejectUnknownEnumsAndBooleans(t *testing.T) {
210		name: "hello boolean",	210		name: "hello boolean",
211		payload: func() []byte {	211		payload: func() []byte {
212		b := MarshalHello(Hello{Version: ProtocolVersion, Size: domain.Size{Cols: 1, Rows: 1}})	212		b := MarshalHello(Hello{Version: ProtocolVersion, Size: domain.Size{Cols: 1, Rows: 1}})
213	-	b[len(b)-6] = 2	213	+	b[len(b)-8] = 2
214		return b	214		return b
215		}(),	215		}(),
216		decode: func(b []byte) error { _, err := UnmarshalHello(b); return err },	216		decode: func(b []byte) error { _, err := UnmarshalHello(b); return err },

M internal/ports/wire_test.go +49 -27

 				TrueColor:         true,
 				MaxOutputInFlight: 8,
 			},
-			want: []byte{0x00, 0x01, 0x01, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x00, 0x02, 0x77, 0x30, 0x00, 0x50, 0x00, 0x18, 0x00, 0x0e, 0x78, 0x74, 0x65, 0x72, 0x6d, 0x2d, 0x32, 0x35, 0x36, 0x63, 0x6f, 0x6c, 0x6f, 0x72, 0x00, 0x0c, 0x2f, 0x74, 0x6d, 0x70, 0x2f, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x01, 0x08, 0x00, 0x00, 0x00, 0x00},
+			want: []byte{0x00, 0x01, 0x01, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x00, 0x02, 0x77, 0x30, 0x00, 0x50, 0x00, 0x18, 0x00, 0x0e, 0x78, 0x74, 0x65, 0x72, 0x6d, 0x2d, 0x32, 0x35, 0x36, 0x63, 0x6f, 0x6c, 0x6f, 0x72, 0x00, 0x0c, 0x2f, 0x74, 0x6d, 0x70, 0x2f, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x01, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
 		},
 		{
 			name: "empty strings",
 				Cwd:       "",
 				TrueColor: false,
 			},
-			want: []byte{0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+			want: []byte{0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
 		},
 	}
 		}
 		got := MarshalHello(msg)
 		want := []byte{
-			0x00, 0x18, 0x00, // version, intent
+			0x00, 0x19, 0x00, 0x00, // version, intent, render mode
 			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // client ID
 			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // resume token
 			0x00, 0x00, 0x00, 0x02, // uint32 environment entry count
 			0x00, 0x00, 0x00, 0x03, 'A', '=', 'B',
 			0x00, 0x00, 0x00, 0x06, 'X', 'Y', '=', '1', '2', '3',
+			0x00, 0x00, // no remote target, client-owned environment
 		}
 		require.Equal(t, want, got)
 		decoded, err := UnmarshalHello(want)
 	base := MarshalHello(Hello{Version: ProtocolVersion, Size: domain.Size{Cols: 1, Rows: 1}})
 	withCount := func(count byte) []byte {
 		payload := append([]byte(nil), base...)
-		payload[len(payload)-1] = count
+		payload[len(payload)-3] = count
 		return payload
 	}
 	tests := []struct {
 	}
 	want := append([]byte{0x0f, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x00, 0x00}, make([]byte, 48)...)
 	require.Equal(t, want, MarshalTheme(cleared))
-	require.Equal(t, uint16(24), ProtocolVersion)
+	require.Equal(t, uint16(25), ProtocolVersion)
 }
 func TestResizeGoldenAndRoundTrip(t *testing.T) {
 		{
 			name: "ephemeral",
 			msg:  Welcome{SessionID: "sess-1", SessionName: "main", Ephemeral: true, ResumeToken: 0x0102030405060708, Capabilities: CapabilityResume | CapabilityPredict},
-			want: []byte{0x00, 0x06, 0x73, 0x65, 0x73, 0x73, 0x2d, 0x31, 0x00, 0x04, 0x6d, 0x61, 0x69, 0x6e, 0x01, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x00, 0x00, 0x00, 0x05},
+			want: []byte{0x00, 0x06, 0x73, 0x65, 0x73, 0x73, 0x2d, 0x31, 0x00, 0x04, 0x6d, 0x61, 0x69, 0x6e, 0x01, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x00, 0x00, 0x00, 0x00, 0x05},
 		},
 		{
 			name: "non-ephemeral empty name",
 			msg:  Welcome{SessionID: "abc", SessionName: "", Ephemeral: false},
-			want: []byte{0x00, 0x03, 0x61, 0x62, 0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+			want: []byte{0x00, 0x03, 0x61, 0x62, 0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
 		},
 	}
 			name: "minimal",
 			msg:  CommandRequest{Version: ProtocolVersion, Slug: "split-right"},
 			want: []byte{
-				0x00, 0x18,
+				0x00, 0x19,
 				0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // request ID
 				0x00, // attached
 				0x00, // self
 				JSON:          true,
 			},
 			want: []byte{
-				0x00, 0x18,
+				0x00, 0x19,
 				0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // request ID
 				0x00, // attached
 				0x01, // self
 		t.Run(fmt.Sprintf("window_%d", window), func(t *testing.T) {
 			hello := Hello{Version: 14, Size: domain.Size{Cols: 1, Rows: 1}, MaxOutputInFlight: window}
 			// The empty Hello has a fixed 1x1 size before the negotiated output window.
-			want := append(make([]byte, 38), window, 0, 0, 0, 0)
+			want := append(make([]byte, 39), window, 0, 0, 0, 0, 0, 0)
 			want[1] = 14
-			want[30], want[32] = 1, 1
+			want[31], want[33] = 1, 1
 			got := MarshalHello(hello)
 			requireBytesEqual(t, want, got)
 			back, err := UnmarshalHello(got)
 			name: "attached",
 			msg:  CommandRequest{Version: ProtocolVersion, RequestID: 0x0102030405060708, Attached: true, Self: true, Slug: "split-right", Args: []string{"--vertical"}},
 			want: []byte{
-				0x00, 0x18, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x01,
+				0x00, 0x19, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x01,
 				0x00, 0x0b, 's', 'p', 'l', 'i', 't', '-', 'r', 'i', 'g', 'h', 't',
 				0x00, 0x01, 0x00, 0x00, 0x00, 0x0a, '-', '-', 'v', 'e', 'r', 't', 'i', 'c', 'a', 'l',
 				0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 			name: "control",
 			msg:  CommandRequest{Version: ProtocolVersion, Slug: "ls"},
 			want: []byte{
-				0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+				0x00, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 				0x00, 0x02, 'l', 's', 0x00, 0x00,
 				0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 			},
 }
 func TestSessionMetaGoldenAndStrict(t *testing.T) {
+	lifecycle := domain.SessionLifecycleID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
 	tests := []struct {
 		name string
 		msg  SessionMeta
 	}{
 		{
 			name: "one unicode tab",
-			msg:  SessionMeta{SessionName: "démo", Active: 0, Tabs: []SessionTabMeta{{Index: 0, Name: "é", Attention: true}}},
+			msg:  SessionMeta{LifecycleID: lifecycle, Revision: 2, SessionName: "démo", ActiveTabID: "tab-é", Tabs: []SessionTabMeta{{ID: "tab-é", Name: "é", Attention: true}}},
-			want: []byte{0x00, 0x05, 'd', 0xc3, 0xa9, 'm', 'o', 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02, 0xc3, 0xa9, 0x01},
+			want: []byte{
+				1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+				0, 0, 0, 0, 0, 0, 0, 2,
+				0, 5, 'd', 0xc3, 0xa9, 'm', 'o',
+				0, 6, 't', 'a', 'b', '-', 0xc3, 0xa9,
+				0, 1,
+				0, 6, 't', 'a', 'b', '-', 0xc3, 0xa9,
+				0, 2, 0xc3, 0xa9, 1,
+			},
 		},
 		{
 			name: "multiple tabs",
-			msg:  SessionMeta{SessionName: "work", Active: 1, Tabs: []SessionTabMeta{{Index: 0, Name: "shell"}, {Index: 1, Name: "build", Attention: true}}},
+			msg:  SessionMeta{LifecycleID: lifecycle, Revision: 7, SessionName: "work", ActiveTabID: "tab-build", Tabs: []SessionTabMeta{{ID: "tab-shell", Name: "shell"}, {ID: "tab-build", Name: "build", Attention: true}}},
-			want: []byte{0x00, 0x04, 'w', 'o', 'r', 'k', 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x05, 's', 'h', 'e', 'l', 'l', 0x00, 0x00, 0x01, 0x00, 0x05, 'b', 'u', 'i', 'l', 'd', 0x01},
+			want: []byte{
+				1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+				0, 0, 0, 0, 0, 0, 0, 7,
+				0, 4, 'w', 'o', 'r', 'k',
+				0, 9, 't', 'a', 'b', '-', 'b', 'u', 'i', 'l', 'd',
+				0, 2,
+				0, 9, 't', 'a', 'b', '-', 's', 'h', 'e', 'l', 'l', 0, 5, 's', 'h', 'e', 'l', 'l', 0,
+				0, 9, 't', 'a', 'b', '-', 'b', 'u', 'i', 'l', 'd', 0, 5, 'b', 'u', 'i', 'l', 'd', 1,
+			},
 		},
 	}
 	for _, tt := range tests {
 	}
 	maxString := string(bytes.Repeat([]byte{'x'}, math.MaxUint16))
-	payload, err := MarshalSessionMeta(SessionMeta{SessionName: maxString, Tabs: []SessionTabMeta{{Name: maxString}}})
+	payload, err := MarshalSessionMeta(SessionMeta{LifecycleID: lifecycle, Revision: 1, SessionName: maxString, ActiveTabID: "tab", Tabs: []SessionTabMeta{{ID: "tab", Name: maxString}}})
 	require.NoError(t, err)
 	back, err := UnmarshalSessionMeta(payload)
 	require.NoError(t, err)
 	require.Equal(t, maxString, back.SessionName)
 	require.Equal(t, maxString, back.Tabs[0].Name)
+	validMeta := func() SessionMeta {
+		return SessionMeta{LifecycleID: lifecycle, Revision: 1, SessionName: "work", ActiveTabID: "tab", Tabs: []SessionTabMeta{{ID: "tab", Name: "one"}}}
+	}
 	invalid := []SessionMeta{
 		{},
-		{Tabs: []SessionTabMeta{{Name: "one"}}, Active: 1},
+		{LifecycleID: lifecycle, Revision: 1, SessionName: "work", Tabs: []SessionTabMeta{{ID: "tab", Name: "one"}}},
-		{Tabs: []SessionTabMeta{{Index: 1, Name: "one"}}},
+		{LifecycleID: lifecycle, SessionName: "work", ActiveTabID: "tab", Tabs: []SessionTabMeta{{ID: "tab", Name: "one"}}},
-		{Tabs: []SessionTabMeta{{Name: string(bytes.Repeat([]byte{'x'}, math.MaxUint16+1))}}, Active: 0},
+		{LifecycleID: lifecycle, Revision: 1, SessionName: "work", ActiveTabID: "missing", Tabs: []SessionTabMeta{{ID: "tab", Name: "one"}}},
-		{SessionName: string(bytes.Repeat([]byte{'x'}, math.MaxUint16+1)), Tabs: []SessionTabMeta{{Name: "one"}}},
+		{LifecycleID: lifecycle, Revision: 1, SessionName: "work", ActiveTabID: "tab", Tabs: []SessionTabMeta{{ID: "tab", Name: "one"}, {ID: "tab", Name: "two"}}},
+		{LifecycleID: lifecycle, Revision: 1, SessionName: "work", ActiveTabID: "tab", Tabs: []SessionTabMeta{{ID: "tab", Name: string(bytes.Repeat([]byte{'x'}, math.MaxUint16+1))}}},
+		{LifecycleID: lifecycle, Revision: 1, SessionName: string(bytes.Repeat([]byte{'x'}, math.MaxUint16+1)), ActiveTabID: "tab", Tabs: []SessionTabMeta{{ID: "tab", Name: "one"}}},
 	}
 	for _, msg := range invalid {
 		_, err := MarshalSessionMeta(msg)
 		require.Error(t, err)
 	}
-	valid, err := MarshalSessionMeta(tests[1].msg)
+	valid, err := MarshalSessionMeta(validMeta())
 	require.NoError(t, err)
 	for _, tt := range []struct {
 		name      string
 		mutate    func([]byte)
 		wantError error
 	}{
-		{name: "active outside tab count", mutate: func(b []byte) { b[6] = 0; b[7] = 2 }, wantError: ErrInvalidSessionMeta},
+		{name: "zero lifecycle", mutate: func(b []byte) { clear(b[:16]) }, wantError: ErrInvalidSessionMeta},
-		// The first tab index is the uint16 at bytes 10–11, after the session
+		{name: "zero revision", mutate: func(b []byte) { clear(b[16:24]) }, wantError: ErrInvalidSessionMeta},
-		// name, active index, and tab count.
+		{name: "invalid active stable ID", mutate: func(b []byte) { b[32] = ' ' }, wantError: ErrInvalidSessionMeta},
-		{name: "first tab index out of order", mutate: func(b []byte) { b[10] = 0; b[11] = 1 }, wantError: ErrInvalidSessionMeta},
 		{name: "attention flag malformed", mutate: func(b []byte) { b[len(b)-1] = 2 }},
 	} {
 		t.Run(tt.name, func(t *testing.T) {

M internal/usecase/client/client.go +37 -5

 type AttachRequest struct {
 	Intent            uint8
 	SessionName       string
+	RenderMode        ports.RenderMode
 	Remote            bool
 	RemoteTarget      *domain.RemoteSessionTarget
 	EnvironmentPolicy ports.EnvironmentPolicy
 }
 func validateAttachRequest(request AttachRequest) error {
+	switch request.RenderMode {
+	case ports.RenderModeFullTerminal, ports.RenderModeProxiedContent:
+	default:
+		return fmt.Errorf("invalid render mode %d", request.RenderMode)
+	}
+	switch request.Intent {
+	case ports.IntentEphemeral:
+	case ports.IntentNew, ports.IntentAttach, ports.IntentResume:
+		if request.SessionName == "" {
+			return domain.ErrInvalidSessionName
+		}
+	default:
+		return fmt.Errorf("invalid session intent %d", request.Intent)
+	}
+	if request.SessionName != "" {
+		if err := domain.ValidateSessionName(request.SessionName); err != nil {
+			return err
+		}
+	}
 	if request.RemoteTarget == nil {
+		if request.RenderMode == ports.RenderModeProxiedContent {
+			return errors.New("vev: proxied attach request requires remote target")
+		}
+		if request.EnvironmentPolicy != ports.EnvironmentPolicyClientOwned {
+			return errors.New("vev: attach request without remote target requires client-owned environment")
+		}
 		return nil
 	}
 	if err := request.RemoteTarget.Validate(); err != nil {
 	if request.EnvironmentPolicy != ports.EnvironmentPolicyDaemonOwned {
 		return errors.New("vev: remote attach target requires daemon-owned environment")
 	}
+	if request.Intent != ports.IntentAttach && request.Intent != ports.IntentResume {
+		return fmt.Errorf("vev: remote attach target requires attach or resume intent")
+	}
 	return nil
 }
 // above attach attempts so raw mode remains active while a live client process
 // redials a lost link.
 func (r *Runner) Run(ctx context.Context, request AttachRequest) (retErr error) {
+	request = cloneAttachRequest(request)
 	if err := validateAttachRequest(request); err != nil {
 		return err
 	}
 			return errors.New("vev: dialer returned nil transport")
 		}
 		stopHandshakeTransport := watchHandshakeTransport(handshakeCtx, transport)
-		connection, err := NewSessionConnection(transport, SessionTarget{
+		connection, err := NewSessionConnection(transport, attemptRequest)
-			Intent:      attemptRequest.Intent,
-			SessionName: attemptRequest.SessionName,
-		})
 		if err != nil {
 			stopHandshakeTransport()
 			finishHandshake()
 			if handoffErr != nil {
 				return handoffErr
 			}
+			nextRequest = cloneAttachRequest(nextRequest)
 			if err := validateAttachRequest(nextRequest); err != nil {
 				return fmt.Errorf("vev: invalid remote attach handoff request: %w", err)
 			}
 	enterRaw := a.enterRaw
 	reconnect := a.reconnect
 	linkEvents := a.linkEvents
-	remote := a.remote || a.request.Remote
+	remote := a.remote || request.Remote
 	clipboard := a.runner.clipboard
 	log := a.runner.logger
 	observer := a.runner.runtimeObserver
 		ClientID:          clientID,
 		ResumeToken:       resumeToken,
 		Name:              name,
+		RenderMode:        request.RenderMode,
 		Size:              size,
 		TermEnv:           termEnv,
 		Cwd:               cwd,
 		if derr != nil {
 			return result(false, fmt.Errorf("vev: decoding welcome: %w", derr))
 		}
+		if welcome.RenderMode != request.RenderMode {
+			return result(false, fmt.Errorf("vev: daemon accepted render mode %d, want %d", welcome.RenderMode, request.RenderMode))
+		}
 		resumeToken = welcome.ResumeToken
 		name = welcome.SessionName
 		ms.welcomed = true

M internal/usecase/client/client_test.go +151 -23


@@ -789,11 +789,15 @@ func (d *sequenceDialer) Dial(context.Context) (ports.Transport, error) {
789		type recordingTransport struct {	789		type recordingTransport struct {
790		recvs []recvItem	790		recvs []recvItem
791		sends []ports.Frame	791		sends []ports.Frame
			792	+	onSend func(ports.Frame)
792		closed atomic.Int32	793		closed atomic.Int32
793		}	794		}
794			795
795		func (t *recordingTransport) Send(f ports.Frame) error {	796		func (t *recordingTransport) Send(f ports.Frame) error {
796		t.sends = append(t.sends, f)	797		t.sends = append(t.sends, f)
			798	+	if t.onSend != nil {
			799	+	t.onSend(f)
			800	+	}
797		return nil	801		return nil
798		}	802		}
799			803

@@ -846,33 +850,157 @@ func welcomeFrame(token uint64) ports.Frame {
846		return frameOf(ports.MsgWelcome, ports.MarshalWelcome(ports.Welcome{SessionID: "s1", SessionName: "main", ResumeToken: token, Capabilities: ports.CapabilityResume}))	850		return frameOf(ports.MsgWelcome, ports.MarshalWelcome(ports.Welcome{SessionID: "s1", SessionName: "main", ResumeToken: token, Capabilities: ports.CapabilityResume}))
847		}	851		}
848			852
849	-	func TestRunReconnectsWithRotatedTokenAndSameClientID(t *testing.T) {	853	+	func TestRunReconnectsPreservesRichRemoteTarget(t *testing.T) {
			854	+	lifecycle := domain.SessionLifecycleID{}
			855	+	lifecycle[0] = 1
			856	+	otherLifecycle := domain.SessionLifecycleID{}
			857	+	otherLifecycle[0] = 2
			858	+	tests := []struct {
			859	+	name string
			860	+	target domain.RemoteSessionTarget
			861	+	}{
			862	+	{
			863	+	name: "live tab",
			864	+	target: domain.RemoteSessionTarget{
			865	+	Endpoint: "arch", DisplayOrigin: "arch", LifecycleID: lifecycle,
			866	+	SessionName: "main", LiveTabID: "tab-live",
			867	+	},
			868	+	},
			869	+	{
			870	+	name: "stopped tab",
			871	+	target: domain.RemoteSessionTarget{
			872	+	Endpoint: "arch", DisplayOrigin: "arch", LifecycleID: otherLifecycle,
			873	+	SessionName: "main", Stopped: true,
			874	+	StoppedTab: domain.NewOrdinalTabSelector(1, "shell", 2),
			875	+	},
			876	+	},
			877	+	}
			878	+
			879	+	for _, tt := range tests {
			880	+	t.Run(tt.name, func(t *testing.T) {
			881	+	term := newRunTerminal()
			882	+	defer term.in.unblock()
			883	+	wantTarget := tt.target
			884	+	tr1 := &recordingTransport{recvs: []recvItem{{f: welcomeFrame(11)}, {err: io.EOF}}}
			885	+	tr1.onSend = func(frame ports.Frame) {
			886	+	if frame.Type != ports.MsgHello {
			887	+	return
			888	+	}
			889	+	tt.target.Endpoint = "mutated.invalid"
			890	+	tt.target.LifecycleID = domain.SessionLifecycleID{}
			891	+	tt.target.LiveTabID = "mutated-tab"
			892	+	}
			893	+	tr2 := &recordingTransport{recvs: []recvItem{{f: welcomeFrame(22)}, {err: io.EOF}}}
			894	+	tr3 := &recordingTransport{recvs: []recvItem{{f: welcomeFrame(33)}, {f: frameOf(ports.MsgDetached, ports.MarshalDetached(ports.Detached{Reason: ports.ReasonDetach}))}}}
			895	+	d := &sequenceDialer{trs: []ports.Transport{tr1, tr2, tr3}}
			896	+	request := client.AttachRequest{
			897	+	Intent: ports.IntentAttach,
			898	+	SessionName: "main",
			899	+	Remote: true,
			900	+	RemoteTarget: &tt.target,
			901	+	EnvironmentPolicy: ports.EnvironmentPolicyDaemonOwned,
			902	+	}
			903	+
			904	+	err := runTestClient(context.Background(), testDependencies(d, term, realClock{}, nil, nil), request)
			905	+	require.NoError(t, err)
			906	+	require.Equal(t, int32(3), d.calls.Load())
			907	+	require.Equal(t, int32(1), term.rawCount.Load())
			908	+	require.Equal(t, int32(1), term.restoreCount.Load())
			909	+
			910	+	h1 := helloFromSend(t, tr1)
			911	+	h2 := helloFromSend(t, tr2)
			912	+	h3 := helloFromSend(t, tr3)
			913	+	require.Equal(t, ports.IntentAttach, h1.Intent)
			914	+	require.Zero(t, h1.ResumeToken)
			915	+	require.Equal(t, ports.IntentResume, h2.Intent)
			916	+	require.Equal(t, uint64(11), h2.ResumeToken)
			917	+	require.Equal(t, ports.IntentResume, h3.Intent)
			918	+	require.Equal(t, uint64(22), h3.ResumeToken)
			919	+	for _, hello := range []ports.Hello{h1, h2, h3} {
			920	+	require.Equal(t, &wantTarget, hello.RemoteTarget)
			921	+	require.Equal(t, ports.EnvironmentPolicyDaemonOwned, hello.EnvironmentPolicy)
			922	+	}
			923	+	require.Equal(t, h1.ClientID, h2.ClientID)
			924	+	require.Equal(t, h1.ClientID, h3.ClientID)
			925	+	require.Contains(t, term.out.String(), "reconnecting through SSH")
			926	+	})
			927	+	}
			928	+	}
			929	+
			930	+	func TestRunSendsRequestedProxiedRenderMode(t *testing.T) {
			931	+	lifecycle := domain.SessionLifecycleID{1}
			932	+	target := domain.RemoteSessionTarget{
			933	+	Endpoint: "arch", DisplayOrigin: "arch", LifecycleID: lifecycle,
			934	+	SessionName: "main", LiveTabID: "tab-live",
			935	+	}
850		term := newRunTerminal()	936		term := newRunTerminal()
851		defer term.in.unblock()	937		defer term.in.unblock()
852	-	tr1 := &recordingTransport{recvs: []recvItem{{f: welcomeFrame(11)}, {err: io.EOF}}}	938	+	tr := &recordingTransport{recvs: []recvItem{
853	-	tr2 := &recordingTransport{recvs: []recvItem{{f: welcomeFrame(22)}, {err: io.EOF}}}	939	+	{f: frameOf(ports.MsgWelcome, ports.MarshalWelcome(ports.Welcome{
854	-	tr3 := &recordingTransport{recvs: []recvItem{{f: welcomeFrame(33)}, {f: frameOf(ports.MsgDetached, ports.MarshalDetached(ports.Detached{Reason: ports.ReasonDetach}))}}}	940	+	SessionID: "s1", SessionName: "main", RenderMode: ports.RenderModeProxiedContent,
855	-	d := &sequenceDialer{trs: []ports.Transport{tr1, tr2, tr3}}	941	+	}))},
856	-		942	+	{f: frameOf(ports.MsgDetached, ports.MarshalDetached(ports.Detached{Reason: ports.ReasonDetach}))},
857	-	err := runTestClient(context.Background(), testDependencies(d, term, realClock{}, nil, nil), client.AttachRequest{Intent: ports.IntentAttach, SessionName: "main", Remote: false})	943	+	}}
			944	+	deps := testDependencies(&sequenceDialer{trs: []ports.Transport{tr}}, term, realClock{}, nil, nil)
			945	+	err := runTestClient(context.Background(), deps, client.AttachRequest{
			946	+	Intent: ports.IntentAttach, SessionName: "main", RenderMode: ports.RenderModeProxiedContent,
			947	+	RemoteTarget: &target, EnvironmentPolicy: ports.EnvironmentPolicyDaemonOwned,
			948	+	})
858		require.NoError(t, err)	949		require.NoError(t, err)
859	-	require.Equal(t, int32(3), d.calls.Load())	950	+	require.Equal(t, ports.RenderModeProxiedContent, helloFromSend(t, tr).RenderMode)
860	-	require.Equal(t, int32(1), term.rawCount.Load())	951	+	}
861	-	require.Equal(t, int32(1), term.restoreCount.Load())
862			952
863	-	h1 := helloFromSend(t, tr1)	953	+	func TestRunnerRejectsInvalidAttachRequestBeforeHello(t *testing.T) {
864	-	h2 := helloFromSend(t, tr2)	954	+	lifecycle := domain.SessionLifecycleID{}
865	-	h3 := helloFromSend(t, tr3)	955	+	lifecycle[0] = 1
866	-	require.Equal(t, ports.IntentAttach, h1.Intent)	956	+	validTarget := domain.RemoteSessionTarget{
867	-	require.Zero(t, h1.ResumeToken)	957	+	Endpoint: "arch", DisplayOrigin: "arch", LifecycleID: lifecycle,
868	-	require.Equal(t, ports.IntentResume, h2.Intent)	958	+	SessionName: "main", LiveTabID: "tab-live",
869	-	require.Equal(t, uint64(11), h2.ResumeToken)	959	+	}
870	-	require.Equal(t, ports.IntentResume, h3.Intent)	960	+	tests := []struct {
871	-	require.Equal(t, uint64(22), h3.ResumeToken)	961	+	name string
872	-	require.Equal(t, h1.ClientID, h2.ClientID)	962	+	request client.AttachRequest
873	-	require.Equal(t, h1.ClientID, h3.ClientID)	963	+	wantErr string
874	-	require.Contains(t, term.out.String(), "reconnecting…")	964	+	}{
875	-	require.Contains(t, term.out.String(), "\x1b[2K")	965	+	{
			966	+	name: "missing daemon-owned policy",
			967	+	request: client.AttachRequest{
			968	+	Intent: ports.IntentAttach,
			969	+	SessionName: "main",
			970	+	RemoteTarget: &validTarget,
			971	+	},
			972	+	wantErr: "remote attach target requires daemon-owned environment",
			973	+	},
			974	+	{
			975	+	name: "target session mismatch",
			976	+	request: client.AttachRequest{
			977	+	Intent: ports.IntentAttach,
			978	+	SessionName: "other",
			979	+	RemoteTarget: &validTarget,
			980	+	EnvironmentPolicy: ports.EnvironmentPolicyDaemonOwned,
			981	+	},
			982	+	wantErr: "remote attach target session mismatch",
			983	+	},
			984	+	{
			985	+	name: "malformed target",
			986	+	request: client.AttachRequest{
			987	+	Intent: ports.IntentAttach,
			988	+	SessionName: "main",
			989	+	RemoteTarget: &domain.RemoteSessionTarget{SessionName: "main", LiveTabID: "tab-live"},
			990	+	EnvironmentPolicy: ports.EnvironmentPolicyDaemonOwned,
			991	+	},
			992	+	wantErr: "invalid remote attach target",
			993	+	},
			994	+	}
			995	+
			996	+	for _, tt := range tests {
			997	+	t.Run(tt.name, func(t *testing.T) {
			998	+	dialer := &sequenceDialer{}
			999	+	err := client.NewRunner(client.Dependencies{Dialer: dialer}).Run(context.Background(), tt.request)
			1000	+	require.ErrorContains(t, err, tt.wantErr)
			1001	+	require.Zero(t, dialer.calls.Load(), "invalid request must be rejected before dialing and Hello")
			1002	+	})
			1003	+	}
876		}	1004		}
877			1005
878		func TestAttachRememberRemoteHost(t *testing.T) {	1006		func TestAttachRememberRemoteHost(t *testing.T) {

M internal/usecase/client/session_connection.go +17 -32

 	"errors"
 	"fmt"
-	"github.com/bnema/vev/internal/domain"
 	"github.com/bnema/vev/internal/ports"
 )
 var errNilSessionTransport = errors.New("client: nil session transport")
-// SessionTarget is the validated daemon-facing session selection. Endpoint
+func cloneAttachRequest(request AttachRequest) AttachRequest {
-// details are resolved before a transport is opened and never enter this type.
+	if request.RemoteTarget != nil {
-type SessionTarget struct {
+		target := *request.RemoteTarget
-	Intent      uint8
+		request.RemoteTarget = &target
-	SessionName string
-}
-func (t SessionTarget) validate() error {
-	switch t.Intent {
-	case ports.IntentEphemeral:
-		if t.SessionName == "" {
-			return nil
-		}
-	case ports.IntentNew, ports.IntentAttach, ports.IntentResume:
-		if t.SessionName == "" {
-			return domain.ErrInvalidSessionName
-		}
-	default:
-		return fmt.Errorf("invalid session intent %d", t.Intent)
 	}
-	return domain.ValidateSessionName(t.SessionName)
+	return request
 }
-// SessionConnection owns one already-open transport and its daemon-facing
+// SessionConnection owns one already-open transport and the complete
-// session target. Local sockets and remote carriages use this same owner.
+// validated daemon-facing attach request. Local sockets and remote carriages
+// use this same owner.
 type SessionConnection struct {
 	transport ports.Transport
-	target    SessionTarget
+	request   AttachRequest
 }
 // NewSessionConnection creates a connection for an already-selected transport.
-// Target validation happens before the connection is used for a Hello.
+// Request validation happens before the connection is used for a Hello.
-func NewSessionConnection(transport ports.Transport, target SessionTarget) (*SessionConnection, error) {
+func NewSessionConnection(transport ports.Transport, request AttachRequest) (*SessionConnection, error) {
 	if transport == nil {
 		return nil, errNilSessionTransport
 	}
-	if err := target.validate(); err != nil {
+	request = cloneAttachRequest(request)
-		return nil, fmt.Errorf("invalid session target: %w", err)
+	if err := validateAttachRequest(request); err != nil {
+		return nil, fmt.Errorf("invalid attach request: %w", err)
 	}
-	return &SessionConnection{transport: transport, target: target}, nil
+	return &SessionConnection{transport: transport, request: request}, nil
 }
 // Transport returns the owned carriage for this connection.
 	return c.transport
 }
-// AttachRequest returns the common request shape used after transport
+// AttachRequest returns the complete request retained for this connection.
-// selection. It contains no remote/proxy semantic.
 func (c *SessionConnection) AttachRequest() AttachRequest {
 	if c == nil {
 		return AttachRequest{}
 	}
-	return AttachRequest{Intent: c.target.Intent, SessionName: c.target.SessionName}
+	return cloneAttachRequest(c.request)
 }
 // Close releases the owned transport.

M internal/usecase/client/session_connection_test.go +40 -16

 import (
 	"testing"
+	"github.com/bnema/vev/internal/domain"
 	"github.com/bnema/vev/internal/ports"
 	portsmocks "github.com/bnema/vev/internal/ports/mocks"
 	"github.com/bnema/vev/internal/usecase/client"
 	"github.com/stretchr/testify/require"
 )
-func TestSessionConnectionUsesOneAttachShapeForLocalAndRemoteTransports(t *testing.T) {
+func TestSessionConnectionOwnsCompleteAttachRequestForLocalAndRemoteTransports(t *testing.T) {
-	target := client.SessionTarget{Intent: ports.IntentAttach, SessionName: "work"}
+	var lifecycle domain.SessionLifecycleID
+	lifecycle[0] = 1
+	target := &domain.RemoteSessionTarget{
+		Endpoint: "arch", DisplayOrigin: "arch", LifecycleID: lifecycle,
+		SessionName: "work", LiveTabID: "tab-1",
+	}
+	wantTarget := *target
+	request := client.AttachRequest{
+		Intent:            ports.IntentAttach,
+		SessionName:       "work",
+		RenderMode:        ports.RenderModeProxiedContent,
+		Remote:            true,
+		RemoteTarget:      target,
+		EnvironmentPolicy: ports.EnvironmentPolicyDaemonOwned,
+	}
+	wantRequest := request
+	wantRequest.RemoteTarget = &wantTarget
 	local := portsmocks.NewMockTransport(t)
 	remote := portsmocks.NewMockTransport(t)
-	localConnection, err := client.NewSessionConnection(local, target)
+	localConnection, err := client.NewSessionConnection(local, request)
 	require.NoError(t, err)
-	remoteConnection, err := client.NewSessionConnection(remote, target)
+	remoteConnection, err := client.NewSessionConnection(remote, request)
 	require.NoError(t, err)
+	target.LiveTabID = "mutated-tab"
+	target.LifecycleID = domain.SessionLifecycleID{}
+	returned := localConnection.AttachRequest()
+	returned.RemoteTarget.LiveTabID = "mutated-returned-tab"
 	require.Equal(t, localConnection.AttachRequest(), remoteConnection.AttachRequest())
-	require.Equal(t, client.AttachRequest{Intent: ports.IntentAttach, SessionName: "work"}, localConnection.AttachRequest())
+	require.Equal(t, wantRequest, localConnection.AttachRequest())
 	require.Same(t, local, localConnection.Transport())
 	require.Same(t, remote, remoteConnection.Transport())
 }
-func TestSessionTargetValidation(t *testing.T) {
+func TestSessionConnectionAttachRequestValidation(t *testing.T) {
 	tests := []struct {
 		name    string
-		target  client.SessionTarget
+		request client.AttachRequest
 		wantErr bool
 	}{
-		{name: "ephemeral", target: client.SessionTarget{Intent: ports.IntentEphemeral}},
+		{name: "ephemeral", request: client.AttachRequest{Intent: ports.IntentEphemeral}},
-		{name: "new", target: client.SessionTarget{Intent: ports.IntentNew, SessionName: "work"}},
+		{name: "new", request: client.AttachRequest{Intent: ports.IntentNew, SessionName: "work"}},
-		{name: "attach", target: client.SessionTarget{Intent: ports.IntentAttach, SessionName: "work"}},
+		{name: "attach", request: client.AttachRequest{Intent: ports.IntentAttach, SessionName: "work"}},
-		{name: "resume", target: client.SessionTarget{Intent: ports.IntentResume, SessionName: "work"}},
+		{name: "resume", request: client.AttachRequest{Intent: ports.IntentResume, SessionName: "work"}},
-		{name: "missing named session", target: client.SessionTarget{Intent: ports.IntentAttach}, wantErr: true},
+		{name: "missing named session", request: client.AttachRequest{Intent: ports.IntentAttach}, wantErr: true},
-		{name: "unsafe session", target: client.SessionTarget{Intent: ports.IntentAttach, SessionName: "my work"}, wantErr: true},
+		{name: "unsafe session", request: client.AttachRequest{Intent: ports.IntentAttach, SessionName: "my work"}, wantErr: true},
-		{name: "unknown intent", target: client.SessionTarget{Intent: 99, SessionName: "work"}, wantErr: true},
+		{name: "unknown intent", request: client.AttachRequest{Intent: 99, SessionName: "work"}, wantErr: true},
+		{name: "invalid render mode", request: client.AttachRequest{Intent: ports.IntentAttach, SessionName: "work", RenderMode: ports.RenderMode(99)}, wantErr: true},
+		{name: "proxied without remote target", request: client.AttachRequest{Intent: ports.IntentAttach, SessionName: "work", RenderMode: ports.RenderModeProxiedContent}, wantErr: true},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			transport := portsmocks.NewMockTransport(t)
-			_, err := client.NewSessionConnection(transport, tt.target)
+			_, err := client.NewSessionConnection(transport, tt.request)
 			if tt.wantErr {
 				require.Error(t, err)
 				return
 }
 func TestSessionConnectionRequiresTransport(t *testing.T) {
-	_, err := client.NewSessionConnection(nil, client.SessionTarget{Intent: ports.IntentEphemeral})
+	_, err := client.NewSessionConnection(nil, client.AttachRequest{Intent: ports.IntentEphemeral})
 	require.Error(t, err)
 }

A internal/usecase/daemon/ansi_content_replay_phase0_test.go +434 -0

@@ -0,0 +1,434 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"fmt"
	5	+	"testing"
	6	+	"unicode/utf8"
	7	+
	8	+	"github.com/bnema/vev/pkg/renderer"
	9	+	"github.com/bnema/vev/pkg/vt"
	10	+	"github.com/stretchr/testify/require"
	11	+	)
	12	+
	13	+	// phase0ReplayCapture is deliberately test-only. It models the proposed
	14	+	// remote-content boundary: ANSI is consumed by a private VT screen, then the
	15	+	// owned visible grid and cursor are captured for local composition.
	16	+	type phase0ReplayCapture struct {
	17	+	frame renderer.Frame
	18	+	cursor vt.CursorSnapshot
	19	+	}
	20	+
	21	+	func capturePhase0Replay(screen *vt.Screen) phase0ReplayCapture {
	22	+	snapshot := screen.Snapshot()
	23	+	frame := renderer.NewFrame(snapshot.Columns(), snapshot.Rows())
	24	+	for y := range snapshot.Rows() {
	25	+	copy(frame.Row(y), snapshot.Row(y))
	26	+	}
	27	+	return phase0ReplayCapture{frame: frame, cursor: snapshot.Cursor()}
	28	+	}
	29	+
	30	+	func composePhase0Replay(capture phase0ReplayCapture) renderer.Frame {
	31	+	// Composition receives cells, not the remote ANSI stream. The private remote
	32	+	// surface occupies only the content rows, leaving locally owned chrome above
	33	+	// and below it.
	34	+	content := capture.frame
	35	+	composed := renderer.NewFrame(content.Width, content.Height+2)
	36	+	writePhase0Chrome(&composed, 0, "LOCAL TOP")
	37	+	for y := range content.Height {
	38	+	copy(composed.Row(y+1), content.Row(y))
	39	+	}
	40	+	writePhase0Chrome(&composed, composed.Height-1, "LOCAL BOTTOM")
	41	+	return composed
	42	+	}
	43	+
	44	+	func writePhase0Chrome(frame *renderer.Frame, row int, label string) {
	45	+	for column, r := range label {
	46	+	if column >= frame.Width {
	47	+	return
	48	+	}
	49	+	frame.Set(column, row, renderer.Cell{Rune: r, Style: renderer.DefaultStyle()})
	50	+	}
	51	+	}
	52	+
	53	+	// replayPhase0ANSI intentionally splits every byte of CSI/OSC controls across
	54	+	// separate writes while keeping UTF-8 runes together. vt.Screen buffers split
	55	+	// escape sequences, but deliberately does not buffer incomplete UTF-8 runes.
	56	+	func replayPhase0ANSI(screen *vt.Screen, data []byte) {
	57	+	for len(data) > 0 {
	58	+	if data[0] != 0x1b {
	59	+	_, size := utf8.DecodeRune(data)
	60	+	if size == 0 {
	61	+	size = 1
	62	+	}
	63	+	screen.Write(data[:size])
	64	+	data = data[size:]
	65	+	continue
	66	+	}
	67	+
	68	+	screen.Write(data[:1])
	69	+	data = data[1:]
	70	+	if len(data) == 0 {
	71	+	return
	72	+	}
	73	+	kind := data[0]
	74	+	screen.Write(data[:1])
	75	+	data = data[1:]
	76	+
	77	+	switch kind {
	78	+	case '[':
	79	+	for len(data) > 0 {
	80	+	b := data[0]
	81	+	screen.Write(data[:1])
	82	+	data = data[1:]
	83	+	if b >= '@' && b <= '~' {
	84	+	break
	85	+	}
	86	+	}
	87	+	case ']':
	88	+	for len(data) > 0 {
	89	+	b := data[0]
	90	+	screen.Write(data[:1])
	91	+	data = data[1:]
	92	+	if b == 0x07 {
	93	+	break
	94	+	}
	95	+	if b == 0x1b && len(data) > 0 && data[0] == '\\' {
	96	+	screen.Write(data[:1])
	97	+	data = data[1:]
	98	+	break
	99	+	}
	100	+	}
	101	+	case 'P', '_', '^', 'X':
	102	+	for len(data) > 0 {
	103	+	b := data[0]
	104	+	screen.Write(data[:1])
	105	+	data = data[1:]
	106	+	if b == 0x1b && len(data) > 0 && data[0] == '\\' {
	107	+	screen.Write(data[:1])
	108	+	data = data[1:]
	109	+	break
	110	+	}
	111	+	}
	112	+	}
	113	+	}
	114	+	}
	115	+
	116	+	func phase0CursorTail(row, col, style int, visible bool) []byte {
	117	+	tail := []byte(fmt.Sprintf("\x1b[%d;%dH\x1b[%d q", row+1, col+1, style))
	118	+	if visible {
	119	+	return append(tail, "\x1b[?25h"...)
	120	+	}
	121	+	return append(tail, "\x1b[?25l"...)
	122	+	}
	123	+
	124	+	func phase0StyledFrame() renderer.Frame {
	125	+	styled := renderer.Style{
	126	+	Bold: true,
	127	+	Italic: true,
	128	+	Attrs: renderer.AttrUnderline,
	129	+	UnderlineStyle: renderer.UnderlineCurly,
	130	+	Foreground: -1,
	131	+	Background: -1,
	132	+	HasForegroundRGB: true,
	133	+	ForegroundRGB: renderer.RGB{R: 12, G: 34, B: 56},
	134	+	HasBackgroundRGB: true,
	135	+	BackgroundRGB: renderer.RGB{R: 200, G: 100, B: 50},
	136	+	}
	137	+	indexed := renderer.Style{Foreground: 82, Background: 17}
	138	+
	139	+	frame := renderer.NewFrame(10, 2)
	140	+	frame.Set(0, 0, renderer.Cell{Rune: 'X', Style: styled})
	141	+	frame.Set(1, 0, renderer.Cell{Rune: '界', Style: styled})
	142	+	frame.Set(2, 0, renderer.Cell{Continuation: true, Style: styled})
	143	+	frame.Set(3, 0, renderer.Cell{Rune: 'A', Style: indexed})
	144	+	frame.Set(0, 1, renderer.Cell{Rune: 'q', Style: renderer.DefaultStyle()})
	145	+	return frame
	146	+	}
	147	+
	148	+	func requirePhase0Frame(t *testing.T, got, want renderer.Frame) {
	149	+	t.Helper()
	150	+	require.Equal(t, want.Width, got.Width)
	151	+	require.Equal(t, want.Height, got.Height)
	152	+	for y := range want.Height {
	153	+	for x := range want.Width {
	154	+	require.Equal(t, want.At(x, y), got.At(x, y), "cell(%d,%d)", x, y)
	155	+	}
	156	+	}
	157	+	}
	158	+
	159	+	func requirePhase0ComposedContent(t *testing.T, composed, content renderer.Frame) {
	160	+	t.Helper()
	161	+	require.Equal(t, content.Width, composed.Width)
	162	+	require.Equal(t, content.Height+2, composed.Height)
	163	+	for y := range content.Height {
	164	+	for x := range content.Width {
	165	+	require.Equal(t, content.At(x, y), composed.At(x, y+1), "content cell(%d,%d)", x, y)
	166	+	}
	167	+	}
	168	+	for column, r := range "LOCAL TOP" {
	169	+	if column >= composed.Width {
	170	+	break
	171	+	}
	172	+	require.Equal(t, r, composed.At(column, 0).Rune, "top chrome column %d", column)
	173	+	}
	174	+	for column, r := range "LOCAL BOTTOM" {
	175	+	if column >= composed.Width {
	176	+	break
	177	+	}
	178	+	require.Equal(t, r, composed.At(column, composed.Height-1).Rune, "bottom chrome column %d", column)
	179	+	}
	180	+	}
	181	+
	182	+	func TestPhase0RemoteANSIReplayFullAndIncremental(t *testing.T) {
	183	+	initial := phase0StyledFrame()
	184	+	updated := initial.Clone()
	185	+	updatedStyle := renderer.Style{
	186	+	Bold: true,
	187	+	Attrs: renderer.AttrUnderline,
	188	+	UnderlineStyle: renderer.UnderlineDouble,
	189	+	Foreground: -1,
	190	+	Background: -1,
	191	+	HasForegroundRGB: true,
	192	+	ForegroundRGB: renderer.RGB{R: 90, G: 80, B: 70},
	193	+	}
	194	+	updated.Set(0, 0, renderer.Cell{Rune: 'Z', Style: updatedStyle})
	195	+	updated.Set(1, 0, renderer.Cell{Rune: '好', Style: updatedStyle})
	196	+	updated.Set(2, 0, renderer.Cell{Continuation: true, Style: updatedStyle})
	197	+
	198	+	remoteRenderer := renderer.New(renderer.Capabilities{SynchronizedOutput: true})
	199	+	privateScreen := vt.NewScreen(initial.Width, initial.Height)
	200	+	// These callbacks are the security boundary under test: remote content is
	201	+	// replayed into a private screen that cannot answer, notify, ring, or write
	202	+	// the host clipboard.
	203	+	privateScreen.OnResponse = nil
	204	+	privateScreen.OnBell = nil
	205	+	privateScreen.OnNotify = nil
	206	+	privateScreen.OnProgress = nil
	207	+	privateScreen.OnClipboard = nil
	208	+
	209	+	full, err := remoteRenderer.Draw(initial, []renderer.Damage{renderer.FullRedraw()})
	210	+	require.NoError(t, err)
	211	+	require.Contains(t, string(full), renderer.SyncStartCSI)
	212	+	require.Contains(t, string(full), renderer.SyncEndCSI)
	213	+	full = append(full, phase0CursorTail(0, 3, 2, true)...)
	214	+	replayPhase0ANSI(privateScreen, full)
	215	+
	216	+	fullCapture := capturePhase0Replay(privateScreen)
	217	+	requirePhase0Frame(t, fullCapture.frame, initial)
	218	+	fullComposition := composePhase0Replay(fullCapture)
	219	+	requirePhase0ComposedContent(t, fullComposition, initial)
	220	+	require.Equal(t, vt.CursorSnapshot{Row: 0, Col: 3, Visible: true, Style: 2, StyleSet: true}, fullCapture.cursor)
	221	+	require.False(t, privateScreen.Snapshot().Modes().SynchronizedUpdate)
	222	+
	223	+	// A composed frame is rendered by the local renderer. The remote byte
	224	+	// stream is not passed to this renderer or to a transport.
	225	+	localRenderer := renderer.New(renderer.Capabilities{})
	226	+	localBytes, err := localRenderer.Draw(fullComposition, []renderer.Damage{renderer.FullRedraw()})
	227	+	require.NoError(t, err)
	228	+	localScreen := vt.NewScreen(fullComposition.Width, fullComposition.Height)
	229	+	replayPhase0ANSI(localScreen, localBytes)
	230	+	requirePhase0Frame(t, localScreen.Frame, fullComposition)
	231	+
	232	+	incremental, err := remoteRenderer.Draw(updated, []renderer.Damage{{Kind: renderer.DamageText, X: 0, Y: 0, Width: 3, Height: 1}})
	233	+	require.NoError(t, err)
	234	+	require.Contains(t, string(incremental), renderer.SyncStartCSI)
	235	+	require.Contains(t, string(incremental), renderer.SyncEndCSI)
	236	+	incremental = append(incremental, phase0CursorTail(1, 5, 3, false)...)
	237	+	replayPhase0ANSI(privateScreen, incremental)
	238	+
	239	+	incrementalCapture := capturePhase0Replay(privateScreen)
	240	+	requirePhase0Frame(t, incrementalCapture.frame, updated)
	241	+	requirePhase0ComposedContent(t, composePhase0Replay(incrementalCapture), updated)
	242	+	require.Equal(t, vt.CursorSnapshot{Row: 1, Col: 5, Visible: false, Style: 3, StyleSet: true}, incrementalCapture.cursor)
	243	+	require.False(t, privateScreen.Snapshot().Modes().SynchronizedUpdate)
	244	+
	245	+	noOp, err := remoteRenderer.Draw(updated, nil)
	246	+	require.NoError(t, err)
	247	+	require.Empty(t, noOp, "the remote renderer shadow must advance only once per emitted full/incremental frame")
	248	+	}
	249	+
	250	+	func TestPhase0PrivateReplaySuppressesHostSideEffects(t *testing.T) {
	251	+	screen := vt.NewScreen(16, 2)
	252	+	screen.OnResponse = nil
	253	+	screen.OnBell = nil
	254	+	screen.OnNotify = nil
	255	+	screen.OnProgress = nil
	256	+	screen.OnClipboard = nil
	257	+	screen.SetDefaultColors(renderer.RGB{R: 1, G: 2, B: 3}, renderer.RGB{R: 4, G: 5, B: 6}, true)
	258	+
	259	+	data := []byte("safe")
	260	+	data = append(data, "\x1b]52;c;Y2xpcA==\x07"...)
	261	+	data = append(data, "\x1b[5n\x1b[c\x1b[6n\x1b]10;?\x07"...)
	262	+	data = append(data, "\x1b]9;remote notification\x07"...)
	263	+	data = append(data, "\x1b]777;notify;title;body\x07"...)
	264	+	data = append(data, "\x1b]9;4;2;0\x07\x1b]9;4;0\x07\a"...)
	265	+	data = append(data, "\x1bP1;2\|dcs-payload\x1b\\"...)
	266	+	data = append(data, "\x1b_Ga=T,f=100;image-payload\x1b\\"...)
	267	+	replayPhase0ANSI(screen, data)
	268	+
	269	+	expected := renderer.NewFrame(16, 2)
	270	+	expected.Set(0, 0, renderer.Cell{Rune: 's', Style: renderer.DefaultStyle()})
	271	+	expected.Set(1, 0, renderer.Cell{Rune: 'a', Style: renderer.DefaultStyle()})
	272	+	expected.Set(2, 0, renderer.Cell{Rune: 'f', Style: renderer.DefaultStyle()})
	273	+	expected.Set(3, 0, renderer.Cell{Rune: 'e', Style: renderer.DefaultStyle()})
	274	+	capture := capturePhase0Replay(screen)
	275	+	requirePhase0Frame(t, capture.frame, expected)
	276	+	composition := composePhase0Replay(capture)
	277	+	requirePhase0ComposedContent(t, composition, expected)
	278	+	require.Equal(t, 0, capture.cursor.Row)
	279	+	require.Equal(t, 4, capture.cursor.Col)
	280	+	require.Empty(t, screen.TerminalTitle())
	281	+
	282	+	// A control sequence is consumed before composition and cannot appear in
	283	+	// the locally rendered result.
	284	+	localBytes, err := renderer.New(renderer.Capabilities{}).Draw(composition, []renderer.Damage{renderer.FullRedraw()})
	285	+	require.NoError(t, err)
	286	+	require.NotContains(t, string(localBytes), "\x1b]")
	287	+	require.NotContains(t, string(localBytes), "52;")
	288	+	}
	289	+
	290	+	type phase0OrderedFrame struct {
	291	+	metadata bool
	292	+	stateBearing bool
	293	+	epoch uint64
	294	+	base uint64
	295	+	next uint64
	296	+	full bool
	297	+	}
	298	+
	299	+	type phase0OrderedFrameContract struct {
	300	+	metadataSeen bool
	301	+	contentSeen bool
	302	+	epoch uint64
	303	+	next uint64
	304	+	}
	305	+
	306	+	func (c *phase0OrderedFrameContract) accept(frame phase0OrderedFrame) error {
	307	+	if frame.metadata {
	308	+	if frame.stateBearing \|\| frame.full {
	309	+	return fmt.Errorf("metadata frame carries output state")
	310	+	}
	311	+	if c.metadataSeen \|\| c.contentSeen {
	312	+	return fmt.Errorf("metadata must be unique and precede content")
	313	+	}
	314	+	c.metadataSeen = true
	315	+	return nil
	316	+	}
	317	+	if !frame.stateBearing {
	318	+	// Side-effect-like output does not participate in the content chain.
	319	+	return nil
	320	+	}
	321	+	if !c.metadataSeen {
	322	+	return fmt.Errorf("metadata must precede first full content")
	323	+	}
	324	+	if frame.epoch == 0 \|\| frame.next == 0 {
	325	+	return fmt.Errorf("state-bearing output has invalid state numbers")
	326	+	}
	327	+	if !c.contentSeen {
	328	+	if !frame.full \|\| frame.base != 0 {
	329	+	return fmt.Errorf("first content must be a full reset from base zero")
	330	+	}
	331	+	c.contentSeen = true
	332	+	c.epoch, c.next = frame.epoch, frame.next
	333	+	return nil
	334	+	}
	335	+	if frame.full {
	336	+	if frame.base != 0 {
	337	+	return fmt.Errorf("full content must reset from base zero")
	338	+	}
	339	+	if frame.epoch <= c.epoch {
	340	+	return fmt.Errorf("full content reset epoch %d is not newer than %d", frame.epoch, c.epoch)
	341	+	}
	342	+	c.epoch, c.next = frame.epoch, frame.next
	343	+	return nil
	344	+	}
	345	+	if frame.epoch != c.epoch {
	346	+	return fmt.Errorf("epoch changed without a full reset")
	347	+	}
	348	+	if frame.base != c.next {
	349	+	return fmt.Errorf("state-bearing output gap: base=%d want=%d", frame.base, c.next)
	350	+	}
	351	+	if frame.next != frame.base+1 {
	352	+	return fmt.Errorf("state-bearing output must advance by one")
	353	+	}
	354	+	c.next = frame.next
	355	+	return nil
	356	+	}
	357	+
	358	+	func acceptPhase0Frames(frames []phase0OrderedFrame) error {
	359	+	var contract phase0OrderedFrameContract
	360	+	for i, frame := range frames {
	361	+	if err := contract.accept(frame); err != nil {
	362	+	return fmt.Errorf("frame %d: %w", i, err)
	363	+	}
	364	+	}
	365	+	return nil
	366	+	}
	367	+
	368	+	func TestPhase0OrderedFrameContract(t *testing.T) {
	369	+	metadata := phase0OrderedFrame{metadata: true}
	370	+	full := phase0OrderedFrame{stateBearing: true, epoch: 1, base: 0, next: 1, full: true}
	371	+
	372	+	t.Run("metadata full contiguous deltas and full reset are accepted", func(t *testing.T) {
	373	+	require.NoError(t, acceptPhase0Frames([]phase0OrderedFrame{
	374	+	{stateBearing: false},
	375	+	metadata,
	376	+	full,
	377	+	{stateBearing: false},
	378	+	{stateBearing: true, epoch: 1, base: 1, next: 2},
	379	+	{stateBearing: true, epoch: 2, base: 0, next: 1, full: true},
	380	+	{stateBearing: true, epoch: 2, base: 1, next: 2},
	381	+	}))
	382	+	})
	383	+
	384	+	tests := []struct {
	385	+	name string
	386	+	frames []phase0OrderedFrame
	387	+	}{
	388	+	{
	389	+	name: "first full content before metadata",
	390	+	frames: []phase0OrderedFrame{full},
	391	+	},
	392	+	{
	393	+	name: "incremental content before first full",
	394	+	frames: []phase0OrderedFrame{metadata, {stateBearing: true, epoch: 1, base: 0, next: 1}},
	395	+	},
	396	+	{
	397	+	name: "state-bearing gap",
	398	+	frames: []phase0OrderedFrame{
	399	+	metadata, full,
	400	+	{stateBearing: true, epoch: 1, base: 3, next: 4},
	401	+	},
	402	+	},
	403	+	{
	404	+	name: "epoch change without full reset",
	405	+	frames: []phase0OrderedFrame{
	406	+	metadata, full,
	407	+	{stateBearing: true, epoch: 2, base: 1, next: 2},
	408	+	},
	409	+	},
	410	+	{
	411	+	name: "full content with nonzero base",
	412	+	frames: []phase0OrderedFrame{
	413	+	metadata, full,
	414	+	{stateBearing: true, epoch: 2, base: 1, next: 2, full: true},
	415	+	},
	416	+	},
	417	+	{
	418	+	name: "stale full reset",
	419	+	frames: []phase0OrderedFrame{
	420	+	metadata, full,
	421	+	{stateBearing: true, epoch: 1, base: 0, next: 1, full: true},
	422	+	},
	423	+	},
	424	+	{
	425	+	name: "duplicate metadata after content",
	426	+	frames: []phase0OrderedFrame{metadata, full, metadata},
	427	+	},
	428	+	}
	429	+	for _, tt := range tests {
	430	+	t.Run(tt.name, func(t *testing.T) {
	431	+	require.Error(t, acceptPhase0Frames(tt.frames))
	432	+	})
	433	+	}
	434	+	}

M internal/usecase/daemon/attachment_connection.go +70 -32


@@ -3,11 +3,11 @@ package daemon
3		import "github.com/bnema/vev/internal/ports"	3		import "github.com/bnema/vev/internal/ports"
4			4
5		// attachmentConnectionToken is the exact capability for one registered	5		// attachmentConnectionToken is the exact capability for one registered
6	-	// attachment connection incarnation. It is invalid as soon as any of the	6	+	// attachment connection incarnation. It is invalid as soon as the owner,
7	-	// session, attachment membership, connection generation, transport link, or	7	+	// attachment membership, connection generation, transport link, or
8		// coordinator lease changes.	8		// coordinator lease changes.
9		type attachmentConnectionToken struct {	9		type attachmentConnectionToken struct {
10	-	sess *session	10	+	owner attachmentOwner
11		ac *attachedClient	11		ac *attachedClient
12		generation uint64	12		generation uint64
13		transport transportSnapshot	13		transport transportSnapshot

@@ -18,11 +18,18 @@ type attachmentConnectionToken struct {
18		rebase bool	18		rebase bool
19		}	19		}
20			20
			21	+	// attachmentToken retains the local-session constructor for the existing
			22	+	// local route. Remote-view token construction is added with remote attachment
			23	+	// membership in Phase 4; it must not manufacture a local-session capability.
21		func attachmentToken(entry session, ac attachedClient, tr ports.Transport) attachmentConnectionToken {	24		func attachmentToken(entry session, ac attachedClient, tr ports.Transport) attachmentConnectionToken {
22	-	if entry == nil \|\| entry.core() == nil \|\| ac == nil \|\| tr == nil {	25	+	return attachmentOwnerToken(entry, ac, tr)
			26	+	}
			27	+
			28	+	func attachmentOwnerToken(owner attachmentOwner, ac *attachedClient, tr ports.Transport) attachmentConnectionToken {
			29	+	if owner == nil \|\| ac == nil \|\| tr == nil {
23		return attachmentConnectionToken{}	30		return attachmentConnectionToken{}
24		}	31		}
25	-	// Capture one concrete link incarnation before taking the session lock. The	32	+	// Capture one concrete link incarnation before taking the owner lock. The
26		// same snapshot is revalidated below; do not take a second snapshot and	33		// same snapshot is revalidated below; do not take a second snapshot and
27		// accidentally bind a replacement link.	34		// accidentally bind a replacement link.
28		transport := ac.transportSnapshot()	35		transport := ac.transportSnapshot()

@@ -32,23 +39,38 @@ func attachmentToken(entry session, ac attachedClient, tr ports.Transport) att
32		if ac.beforeAttachmentTokenValidation != nil {	39		if ac.beforeAttachmentTokenValidation != nil {
33		ac.beforeAttachmentTokenValidation()	40		ac.beforeAttachmentTokenValidation()
34		}	41		}
35	-	core := entry.core()	42	+
36	-	core.mu.Lock()	43	+	token := attachmentConnectionToken{owner: owner, ac: ac, transport: transport}
37	-	if !attachmentRegisteredLocked(entry, ac) \|\| !ac.transportSnapshotCurrent(transport) {	44	+	switch entry := owner.(type) {
			45	+	case *session:
			46	+	if entry.core() == nil {
			47	+	return attachmentConnectionToken{}
			48	+	}
			49	+	core := entry.core()
			50	+	core.mu.Lock()
			51	+	if !attachmentRegisteredLocked(entry, ac) \|\|
			52	+	!sameAttachmentOwner(ac.currentAttachmentOwner(), owner) \|\|
			53	+	!ac.transportSnapshotCurrent(transport) {
			54	+	core.mu.Unlock()
			55	+	return attachmentConnectionToken{}
			56	+	}
			57	+	token.generation = ac.connectionGeneration.Load()
			58	+	if rc := core.coordinator.Load(); rc != nil {
			59	+	token.lease = rc.attachmentLease(ac)
			60	+	}
38		core.mu.Unlock()	61		core.mu.Unlock()
			62	+	case *remoteView:
			63	+	entry.mu.Lock()
			64	+	_, registered := entry.attachments[ac]
			65	+	if !registered \|\| !sameAttachmentOwner(ac.currentAttachmentOwner(), owner) \|\| !ac.transportSnapshotCurrent(transport) {
			66	+	entry.mu.Unlock()
			67	+	return attachmentConnectionToken{}
			68	+	}
			69	+	token.generation = ac.connectionGeneration.Load()
			70	+	entry.mu.Unlock()
			71	+	default:
39		return attachmentConnectionToken{}	72		return attachmentConnectionToken{}
40		}	73		}
41	-	generation := ac.connectionGeneration.Load()
42	-	token := attachmentConnectionToken{
43	-	sess: entry,
44	-	ac: ac,
45	-	generation: generation,
46	-	transport: transport,
47	-	}
48	-	if rc := core.coordinator.Load(); rc != nil {
49	-	token.lease = rc.attachmentLease(ac)
50	-	}
51	-	core.mu.Unlock()
52		if !token.current() {	74		if !token.current() {
53		return attachmentConnectionToken{}	75		return attachmentConnectionToken{}
54		}	76		}

@@ -60,27 +82,39 @@ func (s session) attachmentToken(ac attachedClient, tr ports.Transport) attach
60		return attachmentToken(s, ac, tr)	82		return attachmentToken(s, ac, tr)
61		}	83		}
62			84
63	-	// current validates every immutable identity captured by the token. Membership	85	+	// localSession narrows a token only for explicitly local operations. It is
64	-	// is the sole authority; there is no owner, replacement, or compatibility role.	86	+	// intentionally nil for a remote owner, so local PTY/persistence paths fail
			87	+	// closed rather than treating remote metadata as a local session.
			88	+	func (t attachmentConnectionToken) localSession() *session {
			89	+	return localSession(t.owner)
			90	+	}
			91	+
			92	+	// current validates every immutable identity captured by the token. The owner
			93	+	// binding is the sole mutable authority; the local session is only a derived
			94	+	// capability for local attachment membership and coordinator validation.
65		func (t attachmentConnectionToken) current() bool {	95		func (t attachmentConnectionToken) current() bool {
66	-	return t.sess != nil && t.ac != nil &&	96	+	return t.owner != nil && t.ac != nil &&
67		t.ac.connectionGeneration.Load() == t.generation &&	97		t.ac.connectionGeneration.Load() == t.generation &&
68	-	t.ac.currentAttachmentSession() == t.sess &&	98	+	sameAttachmentOwner(t.ac.currentAttachmentOwner(), t.owner) &&
69		t.ac.transportSnapshotCurrent(t.transport) &&	99		t.ac.transportSnapshotCurrent(t.transport) &&
70	-	attachmentRegistered(t.sess, t.ac)	100	+	attachmentOwnerRegistered(t.owner, t.ac)
71		}	101		}
72			102
73		// attachmentCurrent additionally validates the optional coordinator lease used	103		// attachmentCurrent additionally validates the optional coordinator lease used
74		// by render and resize effects. Attachments without that optional lease still	104		// by render and resize effects. Attachments without that optional lease still
75		// own their independent connection lifecycle.	105		// own their independent connection lifecycle.
76		func (t attachmentConnectionToken) attachmentCurrent() bool {	106		func (t attachmentConnectionToken) attachmentCurrent() bool {
77	-	if !t.current() \|\| t.ac.currentAttachmentSession() != t.sess {	107	+	if !t.current() {
78		return false	108		return false
79		}	109		}
80		if t.lease == nil {	110		if t.lease == nil {
81		return true	111		return true
82		}	112		}
83	-	rc := t.sess.core().coordinator.Load()	113	+	entry := t.localSession()
			114	+	if entry == nil {
			115	+	return false
			116	+	}
			117	+	rc := entry.core().coordinator.Load()
84		return rc != nil && t.lease.attachment == t.ac && rc.leaseCurrent(t.lease, true)	118		return rc != nil && t.lease.attachment == t.ac && rc.leaseCurrent(t.lease, true)
85		}	119		}
86			120

@@ -108,23 +142,27 @@ func (t *attachmentConnectionToken) endAttachmentEffect() {
108		t.effect = nil	142		t.effect = nil
109		}	143		}
110			144
111	-	// attachmentEffectCurrentSessionLocked is the same check at a session-owned	145	+	// attachmentEffectCurrentSessionLocked is the same check at a local
112	-	// mutation boundary where sess.core().mu is already held.	146	+	// session-owned mutation boundary where sess.core().mu is already held.
113		func (t attachmentConnectionToken) attachmentEffectCurrentSessionLocked() bool {	147		func (t attachmentConnectionToken) attachmentEffectCurrentSessionLocked() bool {
			148	+	entry := t.localSession()
			149	+	if entry == nil {
			150	+	return false
			151	+	}
114		if t.effect != nil && !t.effect.ended.Load() {	152		if t.effect != nil && !t.effect.ended.Load() {
115		return true	153		return true
116		}	154		}
117	-	if t.sess == nil \|\| t.ac == nil \|\|	155	+	if t.ac == nil \|\|
118		t.ac.connectionGeneration.Load() != t.generation \|\|	156		t.ac.connectionGeneration.Load() != t.generation \|\|
119		!t.ac.transportSnapshotCurrent(t.transport) \|\|	157		!t.ac.transportSnapshotCurrent(t.transport) \|\|
120	-	t.ac.currentAttachmentSession() != t.sess \|\|	158	+	!sameAttachmentOwner(t.ac.currentAttachmentOwner(), t.owner) \|\|
121	-	!attachmentRegisteredLocked(t.sess, t.ac) {	159	+	!attachmentRegisteredLocked(entry, t.ac) {
122		return false	160		return false
123		}	161		}
124		if t.lease == nil {	162		if t.lease == nil {
125		return true	163		return true
126		}	164		}
127	-	rc := t.sess.core().coordinator.Load()	165	+	rc := entry.core().coordinator.Load()
128		return rc != nil && t.lease.attachment == t.ac && rc.leaseCurrent(t.lease, true)	166		return rc != nil && t.lease.attachment == t.ac && rc.leaseCurrent(t.lease, true)
129		}	167		}
130			168

M internal/usecase/daemon/attachment_effect_gate.go +5 -5


@@ -18,7 +18,7 @@ const (
18		// effect admission. It deliberately contains no independently mutable state:	18		// effect admission. It deliberately contains no independently mutable state:
19		// a ticket is admitted only when every field matches the frame's token.	19		// a ticket is admitted only when every field matches the frame's token.
20		type attachmentCapability struct {	20		type attachmentCapability struct {
21	-	sess *session	21	+	owner attachmentOwner
22		generation uint64	22		generation uint64
23		transport transportSnapshot	23		transport transportSnapshot
24		lease *attachmentLease	24		lease *attachmentLease

@@ -26,7 +26,7 @@ type attachmentCapability struct {
26			26
27		func capabilityFromToken(token attachmentConnectionToken) attachmentCapability {	27		func capabilityFromToken(token attachmentConnectionToken) attachmentCapability {
28		return attachmentCapability{	28		return attachmentCapability{
29	-	sess: token.sess,	29	+	owner: token.owner,
30		generation: token.generation,	30		generation: token.generation,
31		transport: token.transport,	31		transport: token.transport,
32		lease: token.lease,	32		lease: token.lease,

@@ -34,7 +34,7 @@ func capabilityFromToken(token attachmentConnectionToken) attachmentCapability {
34		}	34		}
35			35
36		func (c attachmentCapability) matches(token attachmentConnectionToken) bool {	36		func (c attachmentCapability) matches(token attachmentConnectionToken) bool {
37	-	return token.ac != nil && c.sess == token.sess &&	37	+	return token.ac != nil && sameAttachmentOwner(c.owner, token.owner) &&
38		c.generation == token.generation && c.transport.transport == token.transport.transport &&	38		c.generation == token.generation && c.transport.transport == token.transport.transport &&
39		c.transport.incarnation == token.transport.incarnation && c.lease == token.lease	39		c.transport.incarnation == token.transport.incarnation && c.lease == token.lease
40		}	40		}

@@ -271,13 +271,13 @@ func (ac *attachedClient) publishAttachmentCapability(token attachmentConnection
271		// bootstrapAttachmentCapability supports direct/headless session construction. It	271		// bootstrapAttachmentCapability supports direct/headless session construction. It
272		// never changes an existing or frozen production publication.	272		// never changes an existing or frozen production publication.
273		func (ac *attachedClient) bootstrapAttachmentCapability(token attachmentConnectionToken) {	273		func (ac *attachedClient) bootstrapAttachmentCapability(token attachmentConnectionToken) {
274	-	if ac == nil \|\| token.sess == nil \|\| token.ac != ac {	274	+	if ac == nil \|\| token.owner == nil \|\| token.ac != ac {
275		return	275		return
276		}	276		}
277		g := &ac.attachmentEffects	277		g := &ac.attachmentEffects
278		g.mu.Lock()	278		g.mu.Lock()
279		g.initLocked()	279		g.initLocked()
280	-	if g.phase == attachmentEffectsStable && g.capability.sess == nil {	280	+	if g.phase == attachmentEffectsStable && g.capability.owner == nil {
281		g.capability = capabilityFromToken(token)	281		g.capability = capabilityFromToken(token)
282		g.failedTransport = transportSnapshot{}	282		g.failedTransport = transportSnapshot{}
283		}	283		}

A internal/usecase/daemon/attachment_owner.go +217 -0

@@ -0,0 +1,217 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"errors"
	5	+	"sync"
	6	+
	7	+	"github.com/bnema/vev/internal/domain"
	8	+	)
	9	+
	10	+	// attachmentOwner is the sole mutable owner binding for an attached client.
	11	+	// It is deliberately sealed to this package: only a local session or a
	12	+	// daemon-owned remote view may own an attachment. Local-only operations must
	13	+	// obtain a *session through localSession instead of assuming every owner has
	14	+	// PTYs, persistence, or a tab tree.
	15	+	type attachmentOwner interface {
	16	+	attachmentOwner()
	17	+	}
	18	+
	19	+	func (*session) attachmentOwner() {}
	20	+
	21	+	// remoteViewID is allocated by the local daemon. It is distinct from the
	22	+	// remote lifecycle identity: a remote lifecycle validates the remote endpoint,
	23	+	// while this ID identifies the exact local object that owns attachments and
	24	+	// asynchronous lifecycle work.
	25	+	type remoteViewID uint64
	26	+
	27	+	// remoteViewKey identifies the one reusable local view for an exact remote
	28	+	// session lifecycle. Display data and tab selection are intentionally absent:
	29	+	// both are mutable presentation state, not remote-link identity.
	30	+	type remoteViewKey struct {
	31	+	endpoint string
	32	+	lifecycleID domain.SessionLifecycleID
	33	+	sessionName string
	34	+	}
	35	+
	36	+	func remoteViewKeyForTarget(target domain.RemoteSessionTarget) (remoteViewKey, error) {
	37	+	if err := target.Validate(); err != nil {
	38	+	return remoteViewKey{}, err
	39	+	}
	40	+	return remoteViewKey{
	41	+	endpoint: target.Endpoint,
	42	+	lifecycleID: target.LifecycleID,
	43	+	sessionName: target.SessionName,
	44	+	}, nil
	45	+	}
	46	+
	47	+	// remoteView is intentionally attachment-facing only. Link state, remote VT
	48	+	// content, metadata, and warm lifecycle are added in Phase 4; keeping this
	49	+	// type free of local session state prevents accidental PTY/persistence reuse.
	50	+	type remoteView struct {
	51	+	id remoteViewID
	52	+	key remoteViewKey
	53	+
	54	+	mu sync.Mutex
	55	+	closed bool
	56	+	attachments map[*attachedClient]struct{}
	57	+	}
	58	+
	59	+	func (*remoteView) attachmentOwner() {}
	60	+
	61	+	func (v remoteView) registerAttachmentLocked(ac attachedClient) bool {
	62	+	if v == nil \|\| v.closed \|\| ac == nil {
	63	+	return false
	64	+	}
	65	+	if v.attachments == nil {
	66	+	v.attachments = make(map[*attachedClient]struct{})
	67	+	}
	68	+	if _, exists := v.attachments[ac]; exists {
	69	+	return false
	70	+	}
	71	+	v.attachments[ac] = struct{}{}
	72	+	return true
	73	+	}
	74	+
	75	+	func (v remoteView) unregisterAttachmentLocked(ac attachedClient) bool {
	76	+	if v == nil \|\| ac == nil {
	77	+	return false
	78	+	}
	79	+	if _, exists := v.attachments[ac]; !exists {
	80	+	return false
	81	+	}
	82	+	delete(v.attachments, ac)
	83	+	return true
	84	+	}
	85	+
	86	+	func (v remoteView) attachmentRegistered(ac attachedClient) bool {
	87	+	if v == nil \|\| ac == nil {
	88	+	return false
	89	+	}
	90	+	v.mu.Lock()
	91	+	defer v.mu.Unlock()
	92	+	if v.closed {
	93	+	return false
	94	+	}
	95	+	_, registered := v.attachments[ac]
	96	+	return registered
	97	+	}
	98	+
	99	+	// close retires attachment membership without transport I/O. The daemon first
	100	+	// marks shutdown under its registry lock, then calls this after releasing it;
	101	+	// exact token validation observes the cleared membership immediately.
	102	+	func (v *remoteView) close() {
	103	+	if v == nil {
	104	+	return
	105	+	}
	106	+	v.mu.Lock()
	107	+	v.closed = true
	108	+	clear(v.attachments)
	109	+	v.mu.Unlock()
	110	+	}
	111	+
	112	+	func attachmentOwnerRegistered(owner attachmentOwner, ac *attachedClient) bool {
	113	+	switch owner := owner.(type) {
	114	+	case *session:
	115	+	return attachmentRegistered(owner, ac)
	116	+	case *remoteView:
	117	+	return owner.attachmentRegistered(ac)
	118	+	default:
	119	+	return false
	120	+	}
	121	+	}
	122	+
	123	+	func normalizeAttachmentOwner(owner attachmentOwner) attachmentOwner {
	124	+	switch typed := owner.(type) {
	125	+	case *session:
	126	+	if typed == nil {
	127	+	return nil
	128	+	}
	129	+	case *remoteView:
	130	+	if typed == nil {
	131	+	return nil
	132	+	}
	133	+	}
	134	+	return owner
	135	+	}
	136	+
	137	+	func localSession(owner attachmentOwner) *session {
	138	+	sess, _ := normalizeAttachmentOwner(owner).(*session)
	139	+	return sess
	140	+	}
	141	+
	142	+	func sameAttachmentOwner(a, b attachmentOwner) bool {
	143	+	a, b = normalizeAttachmentOwner(a), normalizeAttachmentOwner(b)
	144	+	return a != nil && a == b
	145	+	}
	146	+
	147	+	func attachmentOwnerName(owner attachmentOwner) string {
	148	+	switch owner := normalizeAttachmentOwner(owner).(type) {
	149	+	case *session:
	150	+	owner.mu.Lock()
	151	+	defer owner.mu.Unlock()
	152	+	return owner.name
	153	+	case *remoteView:
	154	+	return owner.key.sessionName
	155	+	default:
	156	+	return ""
	157	+	}
	158	+	}
	159	+
	160	+	// attachmentOwnerRegisteredByDaemonLocked verifies the owner has not been
	161	+	// removed or replaced in its concrete registry. Caller holds d.mu.
	162	+	func (d *Daemon) attachmentOwnerRegisteredByDaemonLocked(owner attachmentOwner) bool {
	163	+	switch owner := normalizeAttachmentOwner(owner).(type) {
	164	+	case *session:
	165	+	return owner.core() != nil && d.sessions[owner.core().id] == owner
	166	+	case *remoteView:
	167	+	return d.remoteViews[owner.id] == owner && d.remoteViewsByKey[owner.key] == owner.id
	168	+	default:
	169	+	return false
	170	+	}
	171	+	}
	172	+
	173	+	func (d Daemon) registerRemoteViewLocked(view remoteView) error {
	174	+	if d == nil \|\| view == nil \|\| view.key.endpoint == "" \|\|
	175	+	view.key.lifecycleID == (domain.SessionLifecycleID{}) \|\| view.key.sessionName == "" {
	176	+	return errors.New("invalid remote view")
	177	+	}
	178	+	if d.remoteViews == nil {
	179	+	d.remoteViews = make(map[remoteViewID]*remoteView)
	180	+	}
	181	+	if d.remoteViewsByKey == nil {
	182	+	d.remoteViewsByKey = make(map[remoteViewKey]remoteViewID)
	183	+	}
	184	+	if existingID, exists := d.remoteViewsByKey[view.key]; exists {
	185	+	if d.remoteViews[existingID] == view {
	186	+	return nil
	187	+	}
	188	+	return errors.New("remote view key is already registered")
	189	+	}
	190	+	if view.id == 0 {
	191	+	d.nextRemoteViewID++
	192	+	view.id = d.nextRemoteViewID
	193	+	} else if d.remoteViews[view.id] != nil {
	194	+	return errors.New("remote view ID is already registered")
	195	+	} else if view.id > d.nextRemoteViewID {
	196	+	d.nextRemoteViewID = view.id
	197	+	}
	198	+	d.remoteViews[view.id] = view
	199	+	d.remoteViewsByKey[view.key] = view.id
	200	+	return nil
	201	+	}
	202	+
	203	+	func (d Daemon) remoteViewByKeyLocked(key remoteViewKey) remoteView {
	204	+	if d == nil {
	205	+	return nil
	206	+	}
	207	+	return d.remoteViews[d.remoteViewsByKey[key]]
	208	+	}
	209	+
	210	+	func (d Daemon) unregisterRemoteViewLocked(view remoteView) bool {
	211	+	if d == nil \|\| view == nil \|\| d.remoteViews[view.id] != view \|\| d.remoteViewsByKey[view.key] != view.id {
	212	+	return false
	213	+	}
	214	+	delete(d.remoteViews, view.id)
	215	+	delete(d.remoteViewsByKey, view.key)
	216	+	return true
	217	+	}

A internal/usecase/daemon/attachment_owner_test.go +153 -0

@@ -0,0 +1,153 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/bnema/vev/internal/domain"
	7	+	"github.com/bnema/vev/internal/ports"
	8	+	"github.com/stretchr/testify/require"
	9	+	)
	10	+
	11	+	func TestAttachedClientOwnerBindingNarrowsLocalOnlyBehavior(t *testing.T) {
	12	+	local := &session{sessionCore: sessionCore{id: "local"}}
	13	+	remote := &remoteView{id: 7}
	14	+	ac := &attachedClient{}
	15	+
	16	+	ac.setSession(local)
	17	+	require.Same(t, local, ac.currentAttachmentOwner())
	18	+	require.Same(t, local, ac.currentAttachmentSession())
	19	+
	20	+	ac.setAttachmentOwner(remote)
	21	+	require.Same(t, remote, ac.currentAttachmentOwner())
	22	+	require.Nil(t, ac.currentAttachmentSession(), "remote owners must not reach local-only paths")
	23	+	}
	24	+
	25	+	func TestAttachedClientOwnerBindingNormalizesTypedNil(t *testing.T) {
	26	+	ac := &attachedClient{}
	27	+
	28	+	ac.setSession(nil)
	29	+	require.Nil(t, ac.currentAttachmentOwner())
	30	+
	31	+	var remote *remoteView
	32	+	ac.setAttachmentOwner(remote)
	33	+	require.Nil(t, ac.currentAttachmentOwner())
	34	+	}
	35	+
	36	+	func TestAttachmentTokenRejectsAnOwnerReboundToRemoteView(t *testing.T) {
	37	+	transport := &closeTrackingTransport{}
	38	+	local := &session{sessionCore: sessionCore{id: "local"}}
	39	+	ac := &attachedClient{tr: transport}
	40	+	ac.setSession(local)
	41	+	local.mu.Lock()
	42	+	require.True(t, local.registerAttachmentLocked(ac))
	43	+	local.mu.Unlock()
	44	+
	45	+	token := local.attachmentToken(ac, transport)
	46	+	require.True(t, token.current())
	47	+
	48	+	ac.setAttachmentOwner(&remoteView{id: 1})
	49	+	require.False(t, token.current(), "a local token must not survive an exact owner rebind")
	50	+	}
	51	+
	52	+	func TestRemoteAttachmentTokenUsesExactRemoteOwnerMembership(t *testing.T) {
	53	+	transport := &closeTrackingTransport{}
	54	+	view := &remoteView{id: 1}
	55	+	ac := &attachedClient{tr: transport}
	56	+	ac.setAttachmentOwner(view)
	57	+	view.mu.Lock()
	58	+	require.True(t, view.registerAttachmentLocked(ac))
	59	+	view.mu.Unlock()
	60	+
	61	+	token := attachmentOwnerToken(view, ac, transport)
	62	+	require.True(t, token.current())
	63	+	require.True(t, token.attachmentCurrent(), "remote tokens do not acquire a local render lease")
	64	+
	65	+	view.mu.Lock()
	66	+	require.True(t, view.unregisterAttachmentLocked(ac))
	67	+	view.mu.Unlock()
	68	+	require.False(t, token.current(), "remote membership is part of exact token identity")
	69	+	}
	70	+
	71	+	func TestShutdownRetiresRemoteViewsWithoutLocalSession(t *testing.T) {
	72	+	d := newTestDaemon(t, nil, stubClock{})
	73	+	view := &remoteView{key: remoteViewKey{endpoint: "host", lifecycleID: domain.SessionLifecycleID{1}, sessionName: "remote"}}
	74	+	d.mu.Lock()
	75	+	require.NoError(t, d.registerRemoteViewLocked(view))
	76	+	d.mu.Unlock()
	77	+
	78	+	transport := &closeTrackingTransport{}
	79	+	ac := &attachedClient{tr: transport}
	80	+	ac.setAttachmentOwner(view)
	81	+	view.mu.Lock()
	82	+	require.True(t, view.registerAttachmentLocked(ac))
	83	+	view.mu.Unlock()
	84	+	token := attachmentOwnerToken(view, ac, transport)
	85	+	require.True(t, token.current())
	86	+
	87	+	d.shutdownAll(ports.ReasonServerShutdown)
	88	+
	89	+	d.mu.Lock()
	90	+	require.Empty(t, d.remoteViews)
	91	+	require.Empty(t, d.remoteViewsByKey)
	92	+	d.mu.Unlock()
	93	+	require.False(t, token.current())
	94	+	}
	95	+
	96	+	func TestRemoteParkingRetainsStableOwnerBinding(t *testing.T) {
	97	+	d := newTestDaemon(t, nil, stubClock{})
	98	+	view := &remoteView{
	99	+	id: 1,
	100	+	key: remoteViewKey{endpoint: "host", lifecycleID: domain.SessionLifecycleID{1}, sessionName: "remote"},
	101	+	}
	102	+	d.mu.Lock()
	103	+	require.NoError(t, d.registerRemoteViewLocked(view))
	104	+	d.mu.Unlock()
	105	+
	106	+	ac := &attachedClient{tr: &closeTrackingTransport{}, resumeCapable: true}
	107	+	ac.setAttachmentOwner(view)
	108	+	view.mu.Lock()
	109	+	require.True(t, view.registerAttachmentLocked(ac))
	110	+	view.mu.Unlock()
	111	+
	112	+	token := d.markParkingInFlightOwner(view, ac)
	113	+	require.NotZero(t, token)
	114	+	view.mu.Lock()
	115	+	require.True(t, view.unregisterAttachmentLocked(ac))
	116	+	view.mu.Unlock()
	117	+	ac.setAttachmentOwner(nil)
	118	+	require.True(t, d.parkAttachmentOwner(view, ac))
	119	+
	120	+	d.mu.Lock()
	121	+	parked := d.parked[token]
	122	+	d.mu.Unlock()
	123	+	require.NotNil(t, parked)
	124	+	require.Same(t, view, parked.owner)
	125	+	}
	126	+
	127	+	func TestRemoteViewRegistryUsesDaemonLocalIDAndExactRemoteLifecycleKey(t *testing.T) {
	128	+	target := domain.RemoteSessionTarget{
	129	+	Endpoint: "user@host",
	130	+	DisplayOrigin: "host",
	131	+	LifecycleID: domain.SessionLifecycleID{1},
	132	+	SessionName: "remote",
	133	+	LiveTabID: "tab-1",
	134	+	}
	135	+	key, err := remoteViewKeyForTarget(target)
	136	+	require.NoError(t, err)
	137	+
	138	+	d := &Daemon{
	139	+	remoteViews: make(map[remoteViewID]*remoteView),
	140	+	remoteViewsByKey: make(map[remoteViewKey]remoteViewID),
	141	+	}
	142	+	first := &remoteView{key: key}
	143	+	second := &remoteView{key: key}
	144	+
	145	+	d.mu.Lock()
	146	+	require.NoError(t, d.registerRemoteViewLocked(first))
	147	+	require.NotZero(t, first.id)
	148	+	require.Same(t, first, d.remoteViewByKeyLocked(key))
	149	+	require.Error(t, d.registerRemoteViewLocked(second), "a lifecycle key cannot alias another local view")
	150	+	require.True(t, d.unregisterRemoteViewLocked(first))
	151	+	require.Nil(t, d.remoteViewByKeyLocked(key))
	152	+	d.mu.Unlock()
	153	+	}

M internal/usecase/daemon/attachment_transition.go +3 -3


@@ -45,7 +45,7 @@ type attachmentTransitionRequest struct {
45		}	45		}
46			46
47		func transitionSourceTokenMatchesRequest(token attachmentConnectionToken, source *session, req attachmentTransitionRequest) bool {	47		func transitionSourceTokenMatchesRequest(token attachmentConnectionToken, source *session, req attachmentTransitionRequest) bool {
48	-	return token.sess == source && token.ac == req.next &&	48	+	return sameAttachmentOwner(token.owner, source) && token.ac == req.next &&
49		token.generation == req.next.connectionGeneration.Load() &&	49		token.generation == req.next.connectionGeneration.Load() &&
50		token.transport.transport == req.expectedTransport.transport &&	50		token.transport.transport == req.expectedTransport.transport &&
51		token.transport.incarnation == req.expectedTransport.incarnation	51		token.transport.incarnation == req.expectedTransport.incarnation

@@ -55,9 +55,9 @@ func transitionSourceTokenMatchesRequest(token attachmentConnectionToken, source
55		// lease exists, sourceCoordinator.mu. It is the canonical exact-connection	55		// lease exists, sourceCoordinator.mu. It is the canonical exact-connection
56		// handoff check for client-originated navigation and lifecycle mutations.	56		// handoff check for client-originated navigation and lifecycle mutations.
57		func transitionSourceTokenCurrentLocked(token attachmentConnectionToken, source session, sourceCoordinator renderCoordinator, req attachmentTransitionRequest) bool {	57		func transitionSourceTokenCurrentLocked(token attachmentConnectionToken, source session, sourceCoordinator renderCoordinator, req attachmentTransitionRequest) bool {
58	-	if token.sess != source \|\| token.ac != req.next \|\|	58	+	if !sameAttachmentOwner(token.owner, source) \|\| token.ac != req.next \|\|
59		token.generation != req.next.connectionGeneration.Load() \|\|	59		token.generation != req.next.connectionGeneration.Load() \|\|
60	-	token.sess == nil \|\| token.ac.currentAttachmentSession() != source \|\|	60	+	token.localSession() == nil \|\| !sameAttachmentOwner(token.ac.currentAttachmentOwner(), source) \|\|
61		!attachmentRegisteredLocked(source, req.next) \|\|	61		!attachmentRegisteredLocked(source, req.next) \|\|
62		!req.next.transportSnapshotCurrent(token.transport) {	62		!req.next.transportSnapshotCurrent(token.transport) {
63		return false	63		return false

M internal/usecase/daemon/attachment_transition_publish.go +9 -8

 }
 func (d *Daemon) sourceAttachmentTokenCurrentFrozen(token attachmentConnectionToken) bool {
-	if token.sess == nil || token.ac == nil {
+	sess := token.localSession()
+	if sess == nil || token.ac == nil {
 		return false
 	}
 	d.mu.Lock()
 	defer d.mu.Unlock()
-	if d.closing || token.sess.core() == nil || d.sessions[token.sess.core().id] != token.sess {
+	if d.closing || sess.core() == nil || d.sessions[sess.core().id] != sess {
 		return false
 	}
 	d.notices.routingMu.Lock()
 	defer d.notices.routingMu.Unlock()
-	token.sess.core().mu.Lock()
+	sess.core().mu.Lock()
-	defer token.sess.core().mu.Unlock()
+	defer sess.core().mu.Unlock()
-	coordinator := token.sess.core().coordinator.Load()
+	coordinator := sess.core().coordinator.Load()
 	if coordinator != nil {
 		coordinator.mu.Lock()
 		defer coordinator.mu.Unlock()
 	}
-	req := attachmentTransitionRequest{source: token.sess, next: token.ac, expectedTransport: token.transport}
+	req := attachmentTransitionRequest{source: sess, next: token.ac, expectedTransport: token.transport}
-	return transitionSourceTokenCurrentLocked(token, token.sess, coordinator, req)
+	return transitionSourceTokenCurrentLocked(token, sess, coordinator, req)
 }
 func transitionSourceTabCurrentLocked(source *session, expected *tab) bool {
 		}
 	}
 	result.published = attachmentConnectionToken{
-		sess: req.target, ac: req.next,
+		owner: req.target, ac: req.next,
 		generation: publication.nextGeneration,
 		transport:  req.expectedTransport, lease: lease,
 		rebase: publication.source != req.target,

M internal/usecase/daemon/client.go +57 -17

 	// remoteOrigin is attachment-specific presentation metadata supplied by a
 	// validated picker handoff; it never participates in routing.
 	remoteOrigin string
+	// renderMode is fixed by the accepted Hello and controls the remote daemon's
+	// publication contract for this transport. It is immutable for one
+	// attachment lifetime and is not local session ownership state.
+	renderMode ports.RenderMode
+	// proxiedMetaRevision and proxiedOutputStarted are serialized by sendMu.
+	// They order metadata snapshots ahead of every post-handshake content output.
+	proxiedMetaRevision  uint64
+	proxiedOutputStarted bool
 	// connectionGeneration is the wire-facing capability generation. attachmentEffects is
 	// the linearization gate for every attachment-bound observable operation. A role
 	// transition freezes and drains this gate before changing either generation
 	// tabs and panes without changing shared session ownership.
 	viewMu       sync.Mutex
 	view         attachmentView
-	sess         Guarded[*session]
+	owner        Guarded[attachmentOwner]
 	mouseScan    mouse.Scanner
 	themeMu      sync.Mutex
 	clientTheme  themeui.Theme
 	appliedTheme appliedTheme
 	lastCursor   cursorOut
 	renderStages renderStageHooks // optional render and handoff observability hooks
-	// previousSession is guarded independently. It is retained through temporary
+	// previousOwner is guarded independently. It retains navigation history
-	// setSession(nil) hand-offs and cleared only on terminal teardown.
+	// through temporary owner hand-offs and is cleared only on terminal teardown.
-	previousSession Guarded[*session]
+	previousOwner Guarded[attachmentOwner]
-	linkMu          sync.Mutex
+	linkMu        sync.Mutex
-	sendMu          sync.Mutex
+	sendMu        sync.Mutex
 	// routeCreatedSession marks a session created by this attachment's route.
 	// A handshake that never commits Welcome must tear down that exact empty
 	// session, while an attachment routed to an existing session must not.
 	ac.sizeMu.Unlock()
 }
-func (ac *attachedClient) currentAttachmentSession() *session { return ac.sess.Get() }
+// currentAttachmentOwner returns the one authoritative binding for this
+// attachment. Callers that need local-only behavior must narrow it with
+// localSession rather than retaining a second session owner.
+func (ac *attachedClient) currentAttachmentOwner() attachmentOwner {
+	if ac == nil {
+		return nil
+	}
+	return ac.owner.Get()
+}
-// currentSession narrows the attachment to its owning local session.
+func (ac *attachedClient) currentAttachmentSession() *session {
+	return localSession(ac.currentAttachmentOwner())
+}
+// currentSession is retained for local-session call sites. It deliberately
+// returns nil for a remote view so local PTY/persistence paths fail closed.
 func (ac *attachedClient) currentSession() *session {
 	return ac.currentAttachmentSession()
 }
-func (ac *attachedClient) setSession(sess *session) { ac.sess.Set(sess) }
+func (ac *attachedClient) setAttachmentOwner(owner attachmentOwner) {
+	if ac != nil {
+		ac.owner.Set(normalizeAttachmentOwner(owner))
+	}
+}
+func (ac *attachedClient) setSession(sess *session) { ac.setAttachmentOwner(sess) }
 func (ac *attachedClient) clearPreviousSession() {
 	if ac != nil {
-		ac.previousSession.Set(nil)
+		ac.previousOwner.Set(nil)
 	}
 }
 	resumeCapable     bool
 	maxOutputInFlight uint8
 	remoteOrigin      string
+	renderMode        ports.RenderMode
 }
 func (d *Daemon) attachClient(sess *session, tr ports.Transport, sz domain.Size, opts attachClientOptions) (*attachedClient, error) {
 		view:          attachmentView{windowRows: sz.Rows, windowSet: true},
 		clientID:      opts.clientID,
 		remoteOrigin:  opts.remoteOrigin,
+		renderMode:    opts.renderMode,
 		resumeCapable: opts.resumeCapable,
 		resumeToken:   resumeToken,
 	}
 		token.ac.captureFrames = nil
 		token.ac.sendMu.Unlock()
 	}
-	if token.sess == nil {
+	sess := token.localSession()
+	if sess == nil {
 		return false
 	}
-	d.firstPaintWithLease(token.sess, token.ac, token.lease, true)
+	if token.ac.renderMode == ports.RenderModeProxiedContent {
+		// The proxied Hello size is already content geometry. Reconcile the shared
+		// PTY/layout claim before the first authoritative content reset and wake
+		// every existing attachment if that claim changed their geometry. Welcome
+		// and the first SessionMeta were committed before this post-transition
+		// path, so the proxied attachment cannot receive content ahead of metadata.
+		d.recalculateSessionGeometryAndInvalidate(sess, nil, "client.go")
+		return d.paintProxiedContent(sess, token.ac, true, token.lease) == paintEmitted
+	}
+	d.firstPaintWithLease(sess, token.ac, token.lease, true)
 	return true
 }
 	}
 	clientTheme := themeFromMessage(msg)
 	token.ac.setClientTheme(clientTheme)
-	sess := token.sess
+	sess := token.localSession()
 	if sess == nil || !token.attachmentEffectCurrent() || !d.applyHostTheme(sess, token.ac, clientTheme, false) {
 		return false
 	}
 	if !token.attachmentEffectCurrent() {
 		return false
 	}
-	if rc := token.sess.core().coordinator.Load(); rc != nil {
+	if rc := sess.core().coordinator.Load(); rc != nil {
 		return rc.invalidateForLease(token.ac, token.lease, renderInvalidation{class: invalidateUrgent, reset: true, producer: "client.go"})
 	}
 	return false
 		d.registerPreviewForSelection(ac)
 	}
-	sess := token.sess
+	sess := token.localSession()
 	if sess == nil {
 		return false
 	}
 		d.notices.routingMu.Unlock()
 		return
 	}
-	if token.sess == nil {
+	sess := token.localSession()
+	if sess == nil {
 		d.notices.routingMu.Unlock()
 		return
 	}
-	repaint := d.mutateClientNotice(token.sess, token.ac, notice)
+	repaint := d.mutateClientNotice(sess, token.ac, notice)
 	d.notices.routingMu.Unlock()
 	if repaint && token.attachmentEffectCurrent() {
 		d.repaintForNotice(token.ac)

M internal/usecase/daemon/client_frame_routing.go +8 -4

 		result.Text = "attached commands cannot override their active session target"
 		return result
 	}
-	sess := token.sess
+	sess := token.localSession()
 	if sess == nil || !token.attachmentEffectCurrent() {
 		result.Code = ports.ErrNoSuchTarget
 		result.Text = "attached session is no longer active"
 	ac.pipelineCache = composeCacheInput{}
 	ac.pipelineScratch = composeCacheInput{}
 	ac.sendMu.Unlock()
-	go d.paint(token.sess, ac, true, token.lease)
+	if sess := token.localSession(); sess != nil {
+		go d.paint(sess, ac, true, token.lease)
+	}
 	return true
 }
 	ac.sendMu.Lock()
 	ac.output.ack(epoch, state)
 	ac.sendMu.Unlock()
-	if rc := token.sess.core().coordinator.Load(); rc != nil {
+	if sess := token.localSession(); sess != nil {
-		rc.notifyAckForLease(token.lease)
+		if rc := sess.core().coordinator.Load(); rc != nil {
+			rc.notifyAckForLease(token.lease)
+		}
 	}
 	return true
 }

M internal/usecase/daemon/client_transport_errors.go +2 -2


@@ -37,7 +37,7 @@ func (d *Daemon) clientGoneForAttachment(token attachmentConnectionToken, explic
37		}	37		}
38		token.effect.bindActionEnd(d, "detach")	38		token.effect.bindActionEnd(d, "detach")
39		token.effect.End()	39		token.effect.End()
40	-	sess := token.sess	40	+	sess := token.localSession()
41		if sess == nil {	41		if sess == nil {
42		return false	42		return false
43		}	43		}

@@ -127,7 +127,7 @@ func (d *Daemon) detachOnAttachmentSendErrorUntil(token attachmentConnectionToke
127		if failed == nil \|\| failed != token.transport.transport {	127		if failed == nil \|\| failed != token.transport.transport {
128		return	128		return
129		}	129		}
130	-	sess := token.sess	130	+	sess := token.localSession()
131		if sess == nil {	131		if sess == nil {
132		return	132		return
133		}	133		}

M internal/usecase/daemon/clipboard.go +8 -3

 )
 func (d *Daemon) handleSequencedImagePushForAttachment(token attachmentConnectionToken, _ uint64, ip ports.ImagePush) {
-	if !token.attachmentEffectCurrent() {
+	if !token.attachmentEffectCurrent() || token.ac.renderMode == ports.RenderModeProxiedContent {
 		return
 	}
 	d.handleImagePushForAttachment(token, ip)
 	if err != nil {
 		return "", err
 	}
-	sess := token.sess
+	sess := token.localSession()
 	if sess == nil {
 		_ = os.Remove(path)
 		return "", errAttachmentTransition
 }
 func (d *Daemon) injectClipboardPathForAttachment(token attachmentConnectionToken, path string) {
-	sess := token.sess
+	sess := token.localSession()
 	if sess == nil || !token.attachmentEffectCurrent() {
 		return
 	}
 	items := make([]clipboardForward, 0, len(attachments))
 	for _, ac := range attachments {
+		// A remote daemon's proxied content stream must never carry OSC52 or
+		// another host-facing side effect to the local link.
+		if ac.renderMode == ports.RenderModeProxiedContent {
+			continue
+		}
 		transport := ac.transport()
 		token := sess.attachmentToken(ac, transport)
 		if token.attachmentCurrent() {

M internal/usecase/daemon/daemon.go +40 -2

 	mu       sync.Mutex
 	sessions map[domain.SessionID]*session
 	stopped  map[string]stoppedSession
+	// remoteViews holds non-persistent, daemon-local attachment owners. The
+	// companion key index provides warm-link reuse without ever widening
+	// sessions beyond concrete local *session values. Both are guarded by mu.
+	remoteViews      map[remoteViewID]*remoteView
+	remoteViewsByKey map[remoteViewKey]remoteViewID
+	nextRemoteViewID remoteViewID
 	// creating reserves names while durable creation I/O runs without mu.
 	creating map[string]struct{}
 	nextID   uint64
 }
 type parkedAttachment struct {
-	sess             *session
+	owner            attachmentOwner
 	ac               *attachedClient
 	pickerGeneration uint64
 	timer            ports.Timer
 // credential. done closes when the token is published into parked or parking
 // is abandoned.
 type parkingAttachment struct {
-	sess     *session
+	owner    attachmentOwner
 	ac       *attachedClient
 	done     chan struct{}
 	doneOnce sync.Once
 	d := &Daemon{
 		sessions:          make(map[domain.SessionID]*session),
 		stopped:           make(map[string]stoppedSession),
+		remoteViews:       make(map[remoteViewID]*remoteView),
+		remoteViewsByKey:  make(map[remoteViewKey]remoteViewID),
 		creating:          make(map[string]struct{}),
 		parked:            make(map[uint64]*parkedAttachment),
 		parking:           make(map[uint64]*parkingAttachment),
 	d.closing = true
 	d.purgeAllParkingLocked()
 	parkedRetirements := d.purgeAllParkedLocked()
+	remoteViews := make([]*remoteView, 0, len(d.remoteViews))
+	for _, view := range d.remoteViews {
+		remoteViews = append(remoteViews, view)
+	}
+	clear(d.remoteViews)
+	clear(d.remoteViewsByKey)
 	snapshot := d.sessionsSnapshotLocked()
 	empty := len(snapshot) == 0
 	d.mu.Unlock()
+	// A remote view is not a daemon-liveness root. Retire its membership after
+	// releasing d.mu so a token cannot remain valid once shutdown begins.
+	for _, view := range remoteViews {
+		view.close()
+	}
 	d.finishParkedAttachmentRetirements(parkedRetirements)
 	d.log.Info("graceful shutdown begin", "reason", reason, "sessions", len(snapshot))
 	if empty {
 		failAttachment()
 		return
 	}
+	if postWelcomeToken.ac.renderMode == ports.RenderModeProxiedContent {
+		meta, metaErr := frameSessionMeta(sess, postWelcomeToken.ac, 1)
+		if metaErr != nil {
+			postWelcomeTicket.End()
+			failAttachment()
+			return
+		}
+		if err := boundedHandshakeOperation(handshakeCtx, tr, func() error {
+			return postWelcomeToken.ac.sendExpectedTransportForAttachment(expected, meta, postWelcomeTicket)
+		}); err != nil {
+			postWelcomeTicket.End()
+			failAttachment()
+			return
+		}
+		postWelcomeToken.ac.sendMu.Lock()
+		postWelcomeToken.ac.proxiedMetaRevision = 1
+		postWelcomeToken.ac.sendMu.Unlock()
+	}
 	if postWelcomeLease != nil && (rc == nil || !rc.markAttachmentReady(postWelcomeLease)) {
 		postWelcomeTicket.End()
 		// The attachment was detached while Welcome was in flight; never let
 		clientID:          h.ClientID,
 		resumeCapable:     true,
 		maxOutputInFlight: normalizeOutputWindow(h.MaxOutputInFlight),
+		renderMode:        h.RenderMode,
 	}
 	if h.RemoteTarget != nil {
 		opts.remoteOrigin = h.RemoteTarget.DisplayOrigin

M internal/usecase/daemon/input.go +35 -3

 	"strconv"
 	"github.com/bnema/vev/internal/domain"
+	"github.com/bnema/vev/internal/ports"
 	"github.com/bnema/vev/internal/usecase/keys"
 	"github.com/bnema/vev/internal/usecase/layout"
 	"github.com/bnema/vev/internal/usecase/mouse"
 	if !token.attachmentEffectCurrent() {
 		return
 	}
+	if token.ac.renderMode == ports.RenderModeProxiedContent {
+		d.handleProxiedInputForAttachment(token, data)
+		return
+	}
 	d.handleInputForAttachment(token, data)
 }
+// handleProxiedInputForAttachment preserves remote terminal bytes exactly.
+// Local key routing, overlays, mouse interpretation, and copy-mode state are
+// deliberately unavailable on the remote daemon's content-only surface.
+func (d *Daemon) handleProxiedInputForAttachment(token attachmentConnectionToken, data []byte) {
+	sess := token.localSession()
+	if len(data) == 0 || !token.attachmentEffectCurrent() || sess == nil {
+		return
+	}
+	_ = sess.runMutation(func() error {
+		if !token.attachmentEffectCurrent() {
+			return nil
+		}
+		tab := sess.tabForAttachment(token.ac)
+		if tab == nil {
+			return nil
+		}
+		tab.mu.Lock()
+		pane := tab.terminalTargetLocked()
+		tab.mu.Unlock()
+		if pane != nil {
+			d.writeToPane(sess, pane, data)
+		}
+		return nil
+	})
+}
 func (d *Daemon) handleInput(_ *session, ac *attachedClient, data []byte) {
 	ac.initOverlays()
 	ac.mouseScan.Scan(data,
 func (h daemonKeyHandler) acquireAttachmentEffect() (*session, *attachmentEffectTicket, bool) {
 	if h.connectionToken.ac != nil {
 		if effect := h.connectionToken.effect; effect != nil && !effect.ended.Load() {
-			return h.connectionToken.sess, effect, false
+			return h.connectionToken.localSession(), effect, false
 		}
 		effect, admitted := h.connectionToken.ac.beginAttachmentEffect(h.connectionToken)
 		if h.d.afterDelayedKeyEffectAttempt != nil {
 			token.effect = effect
 			h.d.afterAttachmentEffectAdmitted(token)
 		}
-		if h.connectionToken.sess == nil {
+		sess := h.connectionToken.localSession()
+		if sess == nil {
 			effect.End()
 			return nil, nil, false
 		}
-		return h.connectionToken.sess, effect, true
+		return sess, effect, true
 	}
 	sess := h.ac.currentSession()
 	if sess == nil {

M internal/usecase/daemon/input_test.go +15 -15


@@ -799,8 +799,8 @@ func TestPaletteBackSessionDoesNotMoveWithoutValidTarget(t *testing.T) {
799		prepare func()	799		prepare func()
800		}{	800		}{
801		{name: "no target", prepare: func() {}},	801		{name: "no target", prepare: func() {}},
802	-	{name: "stale target", prepare: func() { ac.previousSession.Set(&session{sessionCore: sessionCore{id: "gone"}}) }},	802	+	{name: "stale target", prepare: func() { ac.previousOwner.Set(&session{sessionCore: sessionCore{id: "gone"}}) }},
803	-	{name: "same session", prepare: func() { ac.previousSession.Set(current) }},	803	+	{name: "same session", prepare: func() { ac.previousOwner.Set(current) }},
804		} {	804		} {
805		t.Run(tc.name, func(t *testing.T) {	805		t.Run(tc.name, func(t *testing.T) {
806		ac.clearPreviousSession()	806		ac.clearPreviousSession()

@@ -808,7 +808,7 @@ func TestPaletteBackSessionDoesNotMoveWithoutValidTarget(t *testing.T) {
808		runPaletteCommand(t, d, current, ac, "BSK")	808		runPaletteCommand(t, d, current, ac, "BSK")
809		require.Same(t, current, ac.currentSession())	809		require.Same(t, current, ac.currentSession())
810		if tc.name != "no target" {	810		if tc.name != "no target" {
811	-	require.Nil(t, ac.previousSession.Get(), "invalid target must not remain toggleable")	811	+	require.Nil(t, ac.previousOwner.Get(), "invalid target must not remain toggleable")
812		}	812		}
813		})	813		})
814		}	814		}

@@ -818,7 +818,7 @@ func TestBackSessionReportsStaleHandoffOnce(t *testing.T) {
818		d, current, ac, _, releases := newRecentNavigationTestSessions(t)	818		d, current, ac, _, releases := newRecentNavigationTestSessions(t)
819		defer releaseAll(releases)	819		defer releaseAll(releases)
820		target := d.sessions[domain.SessionID("recent")]	820		target := d.sessions[domain.SessionID("recent")]
821	-	ac.previousSession.Set(target)	821	+	ac.previousOwner.Set(target)
822			822
823		// A displaced attachment makes the previously valid handoff stale by the	823		// A displaced attachment makes the previously valid handoff stale by the
824		// time switchToTarget commits it.	824		// time switchToTarget commits it.

@@ -829,7 +829,7 @@ func TestBackSessionReportsStaleHandoffOnce(t *testing.T) {
829		d.backSession(current, ac)	829		d.backSession(current, ac)
830			830
831		require.Same(t, current, ac.currentSession(), "a stale handoff must leave the attachment on its origin")	831		require.Same(t, current, ac.currentSession(), "a stale handoff must leave the attachment on its origin")
832	-	require.Same(t, target, ac.previousSession.Get(), "a failed handoff remains retryable")	832	+	require.Same(t, target, ac.previousOwner.Get(), "a failed handoff remains retryable")
833		history := d.notices.history()	833		history := d.notices.history()
834		require.Len(t, history, 1, "the switch failure must be reported exactly once")	834		require.Len(t, history, 1, "the switch failure must be reported exactly once")
835		require.Equal(t, domain.NoticeSessionUnavailable, history[0].Code)	835		require.Equal(t, domain.NoticeSessionUnavailable, history[0].Code)

@@ -839,14 +839,14 @@ func TestStaleBackSessionClearPreservesConcurrentTarget(t *testing.T) {
839		ac := &attachedClient{}	839		ac := &attachedClient{}
840		stale := &session{sessionCore: sessionCore{id: "stale"}}	840		stale := &session{sessionCore: sessionCore{id: "stale"}}
841		updated := &session{sessionCore: sessionCore{id: "updated"}}	841		updated := &session{sessionCore: sessionCore{id: "updated"}}
842	-	ac.previousSession.Set(stale)	842	+	ac.previousOwner.Set(stale)
843			843
844		// Model a completed hand-off between observing a stale target and clearing	844		// Model a completed hand-off between observing a stale target and clearing
845		// it. The conditional clear must not erase the newer toggle destination.	845		// it. The conditional clear must not erase the newer toggle destination.
846	-	ac.previousSession.Set(updated)	846	+	ac.previousOwner.Set(updated)
847	-	ac.clearPreviousSessionIf(stale)	847	+	ac.clearPreviousOwnerIf(stale)
848			848
849	-	require.Same(t, updated, ac.previousSession.Get())	849	+	require.Same(t, updated, ac.previousOwner.Get())
850		}	850		}
851			851
852		// backSession's invalid-target fallback is a render producer: it must publish	852		// backSession's invalid-target fallback is a render producer: it must publish

@@ -861,10 +861,10 @@ func TestBackSessionInvalidTargetsFallBackThroughOneInvalidation(t *testing.T) {
861		}{	861		}{
862		{name: "no previous target", prepare: func(session, attachedClient) {}},	862		{name: "no previous target", prepare: func(session, attachedClient) {}},
863		{name: "stale previous target", prepare: func(_ session, ac attachedClient) {	863		{name: "stale previous target", prepare: func(_ session, ac attachedClient) {
864	-	ac.previousSession.Set(&session{sessionCore: sessionCore{id: "gone"}})	864	+	ac.previousOwner.Set(&session{sessionCore: sessionCore{id: "gone"}})
865		}},	865		}},
866		{name: "previous target equals current", prepare: func(current session, ac attachedClient) {	866		{name: "previous target equals current", prepare: func(current session, ac attachedClient) {
867	-	ac.previousSession.Set(current)	867	+	ac.previousOwner.Set(current)
868		}},	868		}},
869		} {	869		} {
870		t.Run(tc.name, func(t *testing.T) {	870		t.Run(tc.name, func(t *testing.T) {

@@ -940,10 +940,10 @@ func TestSwitchSourcePreviousSessionContracts(t *testing.T) {
940		}	940		}
941		require.Equal(t, domain.SessionID(tc.wantCurrent), ac.currentSession().id)	941		require.Equal(t, domain.SessionID(tc.wantCurrent), ac.currentSession().id)
942		if tc.wantPrev == "" {	942		if tc.wantPrev == "" {
943	-	require.Nil(t, ac.previousSession.Get())	943	+	require.Nil(t, ac.previousOwner.Get())
944		return	944		return
945		}	945		}
946	-	require.Equal(t, domain.SessionID(tc.wantPrev), ac.previousSession.Get().core().id)	946	+	require.Equal(t, domain.SessionID(tc.wantPrev), localSession(ac.previousOwner.Get()).core().id)
947		})	947		})
948		}	948		}
949		}	949		}

@@ -963,10 +963,10 @@ func TestTerminalTeardownClearsPreviousSession(t *testing.T) {
963		d, current, ac, _, releases := newRecentNavigationTestSessions(t)	963		d, current, ac, _, releases := newRecentNavigationTestSessions(t)
964		defer releaseAll(releases)	964		defer releaseAll(releases)
965			965
966	-	ac.previousSession.Set(d.sessions[domain.SessionID("recent")])	966	+	ac.previousOwner.Set(d.sessions[domain.SessionID("recent")])
967		tc.teardown(d, current, ac)	967		tc.teardown(d, current, ac)
968			968
969	-	require.Nil(t, ac.previousSession.Get())	969	+	require.Nil(t, ac.previousOwner.Get())
970		})	970		})
971		}	971		}
972		}	972		}

M internal/usecase/daemon/move_attachments.go +2 -2

@@ -1,8 +1,8 @@
1		package daemon	1		package daemon
2			2
3		func moveAttachmentTokenCurrentLocked(token attachmentConnectionToken, sess *session) bool {	3		func moveAttachmentTokenCurrentLocked(token attachmentConnectionToken, sess *session) bool {
4	-	return token.sess == sess && token.ac != nil && token.generation == token.ac.connectionGeneration.Load() &&	4	+	return sameAttachmentOwner(token.owner, sess) && token.ac != nil && token.generation == token.ac.connectionGeneration.Load() &&
5	-	token.ac.currentAttachmentSession() == sess && token.ac.transportSnapshotCurrent(token.transport) &&	5	+	sameAttachmentOwner(token.ac.currentAttachmentOwner(), sess) && token.ac.transportSnapshotCurrent(token.transport) &&
6		attachmentRegisteredLocked(sess, token.ac)	6		attachmentRegisteredLocked(sess, token.ac)
7		}	7		}
8			8

M internal/usecase/daemon/palette_test.go +1 -1


@@ -460,7 +460,7 @@ func TestPaletteFailedRoleHandoffClosesExecutedInteraction(t *testing.T) {
460		// Establish a valid back-session target, then remove that target immediately	460		// Establish a valid back-session target, then remove that target immediately
461		// after the command releases its role admission.	461		// after the command releases its role admission.
462		target := d.sessions[domain.SessionID("recent")]	462		target := d.sessions[domain.SessionID("recent")]
463	-	ac.previousSession.Set(target)	463	+	ac.previousOwner.Set(target)
464		invalidations := installPaletteInvalidationObserver(current)	464		invalidations := installPaletteInvalidationObserver(current)
465		d.enterPalette(current, ac)	465		d.enterPalette(current, ac)
466		d.handlePaletteInput(ac, []byte("BSK"))	466		d.handlePaletteInput(ac, []byte("BSK"))

M internal/usecase/daemon/picker.go +10 -8

 }
 func (d *Daemon) switchActiveTargetForAttachmentGuarded(token attachmentConnectionToken, target picker.Target, guard sessionHandoffGuard, action string) error {
-	if token.sess == nil || token.ac == nil {
+	source := token.localSession()
+	if source == nil || token.ac == nil {
 		return nil
 	}
 	d.mu.Lock()
 		if !token.attachmentCurrent() {
 			return nil
 		}
-		d.invalidateRender(token.sess, token.ac, true, "picker.go")
+		d.invalidateRender(source, token.ac, true, "picker.go")
 		return domain.UserErr(domain.NoticeSessionUnavailable, "couldn't switch to that session", nil)
 	}
-	if targetSess == token.sess {
+	if targetSess == source {
 		return nil
 	}
 	transition, err := d.transitionAttachment(attachmentTransitionRequest{
-		source: token.sess, target: targetSess, next: token.ac,
+		source: source, target: targetSess, next: token.ac,
 		expectedTransport: token.transport, sourceToken: &token, action: action,
 		expectedTargetLifecycle: pickerTargetLifecycleFence(target),
 		}
 	}
 	d.touchMRU(targetSess)
-	token.ac.recordPreviousSession(token.sess)
+	token.ac.recordPreviousSession(source)
 	d.deferAttachmentTransitionCleanups(transition)
 	d.firstPaintForTransition(transition.published)
 	return nil
 // every active, stopped, and same-session target then uses transitionAttachment
 // for frozen, atomic source-token preflight.
 func (d *Daemon) switchToTargetForAttachment(token attachmentConnectionToken, target picker.Target, guard sessionHandoffGuard, action string) error {
-	if token.sess == nil || token.ac == nil || token.effect == nil {
+	if token.localSession() == nil || token.ac == nil || token.effect == nil {
 		return nil
 	}
 	if target.RemoteTarget != nil {
 	}
 	token.effect.bindActionEnd(d, action)
 	token.effect.End()
-	if token.sess == nil {
+	source := token.localSession()
+	if source == nil {
 		return errAttachmentTransition
 	}
-	return d.switchToTargetGuardedForAttachment(token.sess, token.ac, target, guard, &token, action)
+	return d.switchToTargetGuardedForAttachment(source, token.ac, target, guard, &token, action)
 }
 // sendRemoteAttachTargetForAttachment validates the catalog row and hands the

M internal/usecase/daemon/picker_test.go +1 -1


@@ -920,7 +920,7 @@ func TestBackSessionFirstResetDoesNotReuseSamePaneIDCapture(t *testing.T) {
920		targetPane.screen.Write([]byte("TARGET"))	920		targetPane.screen.Write([]byte("TARGET"))
921		targetPane.screen.ClearDamage() // TARGET is already rendered and has no pending VT damage.	921		targetPane.screen.ClearDamage() // TARGET is already rendered and has no pending VT damage.
922		require.Empty(t, targetPane.screen.Damage(), "target deliberately has no pending VT damage")	922		require.Empty(t, targetPane.screen.Damage(), "target deliberately has no pending VT damage")
923	-	ac.previousSession.Set(target)	923	+	ac.previousOwner.Set(target)
924			924
925		// Exercise the user-facing previous-session route, which delegates to the	925		// Exercise the user-facing previous-session route, which delegates to the
926		// real switchToTarget hand-off and immediately emits its required reset.	926		// real switchToTarget hand-off and immediately emits its required reset.

A internal/usecase/daemon/proxied_handshake_test.go +223 -0

@@ -0,0 +1,223 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"strings"
	5	+	"testing"
	6	+
	7	+	"github.com/bnema/vev/internal/domain"
	8	+	"github.com/bnema/vev/internal/ports"
	9	+	portsmocks "github.com/bnema/vev/internal/ports/mocks"
	10	+	"github.com/bnema/vev/internal/usecase/layout"
	11	+	"github.com/bnema/vev/pkg/renderer"
	12	+	"github.com/bnema/vev/pkg/vt"
	13	+	"github.com/stretchr/testify/require"
	14	+	)
	15	+
	16	+	func TestProxiedInputBypassesRemoteDaemonUI(t *testing.T) {
	17	+	pty := portsmocks.NewMockPTY(t)
	18	+	pty.EXPECT().Write([]byte{'\x02', 'p'}).Return(2, nil).Once()
	19	+	d, sess, ac, _ := newManualSessionWithPTYs(t, pty)
	20	+	ac.renderMode = ports.RenderModeProxiedContent
	21	+	token := attachmentToken(sess, ac, ac.transport())
	22	+	require.True(t, token.attachmentCurrent())
	23	+
	24	+	d.handleSequencedInputForAttachment(token, 1, []byte{'\x02', 'p'})
	25	+	}
	26	+
	27	+	func TestProxiedInputTargetsVisibleFloatingPane(t *testing.T) {
	28	+	floatingPTY := portsmocks.NewMockPTY(t)
	29	+	floatingPTY.EXPECT().Write([]byte("remote-input")).Return(len("remote-input"), nil).Once()
	30	+	d, sess, ac, _ := newManualSessionWithPTYs(t, newQuietPTY())
	31	+	ac.renderMode = ports.RenderModeProxiedContent
	32	+	installTestFloating(testAttachmentTab(sess), newPane("floating", floatingPTY, domain.Size{Cols: 20, Rows: 5}), true)
	33	+	token := attachmentToken(sess, ac, ac.transport())
	34	+	require.True(t, token.attachmentCurrent())
	35	+
	36	+	d.handleSequencedInputForAttachment(token, 1, []byte("remote-input"))
	37	+	}
	38	+
	39	+	func TestProxiedCommandKeepsRequestCorrelation(t *testing.T) {
	40	+	d, sess, ac, sends := newManualSessionWithPTYs(t, newQuietPTY())
	41	+	ac.renderMode = ports.RenderModeProxiedContent
	42	+	token := attachmentToken(sess, ac, ac.transport())
	43	+	payload, err := ports.MarshalCommandRequest(ports.CommandRequest{
	44	+	Version: ports.ProtocolVersion, RequestID: 42, Attached: true, Slug: "unknown-command",
	45	+	})
	46	+	require.NoError(t, err)
	47	+
	48	+	require.False(t, d.handleAttachmentClientFrame(token, ports.Frame{Type: ports.MsgCommand, Payload: payload}))
	49	+	frame := <-sends
	50	+	require.Equal(t, ports.MsgCommandResult, frame.Type)
	51	+	result, err := ports.UnmarshalCommandResult(frame.Payload)
	52	+	require.NoError(t, err)
	53	+	require.Equal(t, uint64(42), result.RequestID)
	54	+	require.Equal(t, ports.ErrUnknownCommand, result.Code)
	55	+	}
	56	+
	57	+	func TestProxiedResizeUsesContentGeometry(t *testing.T) {
	58	+	pty := portsmocks.NewMockPTY(t)
	59	+	pty.EXPECT().Resize(domain.Size{Cols: 80, Rows: 20}).Return(nil).Once()
	60	+	d, sess, ac, _ := newManualSessionWithPTYs(t, pty)
	61	+	ac.renderMode = ports.RenderModeProxiedContent
	62	+	token := attachmentToken(sess, ac, ac.transport())
	63	+	require.True(t, token.attachmentCurrent())
	64	+
	65	+	d.resizeAttachmentForLease(token, domain.Size{Cols: 80, Rows: 20})
	66	+	ac.sizeMu.RLock()
	67	+	require.Equal(t, domain.Size{Cols: 80, Rows: 20}, ac.size)
	68	+	ac.sizeMu.RUnlock()
	69	+	sess.tabs[0].mu.Lock()
	70	+	require.Equal(t, domain.Size{Cols: 80, Rows: 20}, sess.tabs[0].size)
	71	+	sess.tabs[0].mu.Unlock()
	72	+	}
	73	+
	74	+	func TestProxiedCompositionUsesAttachmentContentWindowAndFloatingSurface(t *testing.T) {
	75	+	paneFrame := renderer.NewFrame(20, 10)
	76	+	paneFrame.Set(0, 0, renderer.Cell{Rune: 'p'})
	77	+	floatingFrame := renderer.NewFrame(3, 2)
	78	+	floatingFrame.Set(0, 0, renderer.Cell{Rune: 'f'})
	79	+
	80	+	composed := composeProxiedContent(capturedRenderState{
	81	+	window: domain.Size{Cols: 10, Rows: 5},
	82	+	layout: capturedTabLayout{area: domain.Rect{Width: 20, Height: 10}},
	83	+	panes: []capturedPaneRenderState{{
	84	+	placement: layout.Placement{Content: domain.Rect{Width: 20, Height: 10}},
	85	+	frame: paneFrame,
	86	+	}},
	87	+	floating: capturedFloatingRenderState{
	88	+	visible: true,
	89	+	pane: capturedPaneRenderState{frame: floatingFrame},
	90	+	geometry: floatingGeometry{Inner: domain.Rect{X: 4, Y: 2, Width: 3, Height: 2}},
	91	+	},
	92	+	})
	93	+
	94	+	require.Equal(t, 10, composed.frame.Width)
	95	+	require.Equal(t, 5, composed.frame.Height)
	96	+	require.Equal(t, 'p', composed.frame.At(0, 0).Rune)
	97	+	require.Equal(t, 'f', composed.frame.At(4, 2).Rune)
	98	+	require.Equal(t, []renderer.Damage{renderer.FullRedraw()}, composed.damage)
	99	+	}
	100	+
	101	+	func TestProxiedMetadataFallsBackFromStaleAttachmentTab(t *testing.T) {
	102	+	_, sess, ac, _ := newManualSessionWithPTYs(t, newQuietPTY())
	103	+	sess.mu.Lock()
	104	+	sess.incarnation = domain.SessionLifecycleID{1}
	105	+	sess.tabs[0].stableID = "live-tab"
	106	+	sess.mu.Unlock()
	107	+	ac.publishView(attachmentView{tabID: "stale-tab"})
	108	+
	109	+	frame, err := frameSessionMeta(sess, ac, 1)
	110	+	require.NoError(t, err)
	111	+	meta, err := ports.UnmarshalSessionMeta(frame.Payload)
	112	+	require.NoError(t, err)
	113	+	require.Equal(t, domain.TabStableID("live-tab"), meta.ActiveTabID)
	114	+	require.Equal(t, domain.TabStableID("live-tab"), meta.Tabs[0].ID)
	115	+	}
	116	+
	117	+	func TestProxiedMetadataRevisionPrecedesSubsequentContent(t *testing.T) {
	118	+	d, sess, ac, sends := newManualSessionWithPTYs(t, newQuietPTY())
	119	+	sess.mu.Lock()
	120	+	sess.incarnation = domain.SessionLifecycleID{1}
	121	+	sess.tabs[0].stableID = "tab"
	122	+	sess.mu.Unlock()
	123	+	ac.renderMode = ports.RenderModeProxiedContent
	124	+	ac.proxiedOutputStarted = true
	125	+	ac.proxiedMetaRevision = 1
	126	+
	127	+	ac.sendMu.Lock()
	128	+	failedTransport, err := d.sendProxiedMetadataLocked(sess, ac, nil)
	129	+	ac.sendMu.Unlock()
	130	+	require.NoError(t, err)
	131	+	require.Same(t, ac.transport(), failedTransport)
	132	+	frame := <-sends
	133	+	require.Equal(t, ports.MsgSessionMeta, frame.Type)
	134	+	meta, err := ports.UnmarshalSessionMeta(frame.Payload)
	135	+	require.NoError(t, err)
	136	+	require.Equal(t, uint64(2), meta.Revision)
	137	+	require.Equal(t, uint64(2), ac.proxiedMetaRevision)
	138	+	}
	139	+
	140	+	func TestProxiedHandshakePublishesStableMetadataBeforeOutput(t *testing.T) {
	141	+	d := newTestDaemon(t, newFactory(t, newQuietPTY()), stubClock{})
	142	+	base := &closeTrackingTransport{}
	143	+	sess, _, err := d.route(ports.Hello{
	144	+	Version: ports.ProtocolVersion, Intent: ports.IntentNew, Name: "remote",
	145	+	Size: domain.Size{Cols: 80, Rows: 24},
	146	+	}, base)
	147	+	require.NoError(t, err)
	148	+	sess.tabs[0].focusedPane().screen.Write([]byte("content-marker"))
	149	+
	150	+	sess.mu.Lock()
	151	+	target := domain.RemoteSessionTarget{
	152	+	Endpoint: "user@host", DisplayOrigin: "host", LifecycleID: sess.incarnation,
	153	+	SessionName: sess.name, LiveTabID: domain.TabStableID(sess.tabs[0].stableID),
	154	+	}
	155	+	sess.mu.Unlock()
	156	+
	157	+	hello := ports.Hello{
	158	+	Version: ports.ProtocolVersion, Intent: ports.IntentAttach,
	159	+	RenderMode: ports.RenderModeProxiedContent, Name: target.SessionName,
	160	+	Size: domain.Size{Cols: 80, Rows: 22}, RemoteTarget: &target,
	161	+	EnvironmentPolicy: ports.EnvironmentPolicyDaemonOwned,
	162	+	}
	163	+	tr, sends, release := newConn(t,
	164	+	ports.Frame{Type: ports.MsgHello, Payload: ports.MarshalHello(hello)},
	165	+	ports.Frame{Type: ports.MsgOutputResetRequest, Payload: ports.MarshalOutputResetRequest(ports.OutputResetRequest{})},
	166	+	)
	167	+	done := make(chan struct{})
	168	+	go func() {
	169	+	d.handleConn(tr)
	170	+	close(done)
	171	+	}()
	172	+
	173	+	welcomeFrame := <-sends
	174	+	require.Equal(t, ports.MsgWelcome, welcomeFrame.Type)
	175	+	welcome, err := ports.UnmarshalWelcome(welcomeFrame.Payload)
	176	+	require.NoError(t, err)
	177	+	require.Equal(t, ports.RenderModeProxiedContent, welcome.RenderMode)
	178	+
	179	+	metadataFrame := <-sends
	180	+	require.Equal(t, ports.MsgSessionMeta, metadataFrame.Type)
	181	+	metadata, err := ports.UnmarshalSessionMeta(metadataFrame.Payload)
	182	+	require.NoError(t, err)
	183	+	require.Equal(t, target.LifecycleID, metadata.LifecycleID)
	184	+	require.Equal(t, uint64(1), metadata.Revision)
	185	+	require.Equal(t, target.SessionName, metadata.SessionName)
	186	+	require.Equal(t, target.LiveTabID, metadata.ActiveTabID)
	187	+	require.Len(t, metadata.Tabs, 1)
	188	+	require.Equal(t, target.LiveTabID, metadata.Tabs[0].ID)
	189	+
	190	+	outputFrame := <-sends
	191	+	require.Equal(t, ports.MsgOutput, outputFrame.Type)
	192	+	output, err := ports.UnmarshalOutput(outputFrame.Payload)
	193	+	require.NoError(t, err)
	194	+	require.Zero(t, output.Base)
	195	+	require.Equal(t, uint64(1), output.New)
	196	+	require.True(t, output.Full)
	197	+	require.Equal(t, hello.Size, output.Size)
	198	+	private := vt.NewScreen(output.Size.Cols, output.Size.Rows)
	199	+	private.Write(output.Data)
	200	+	require.Contains(t, screenLineText(private, 0), "content-marker")
	201	+	for y := range private.Frame.Height {
	202	+	require.NotContains(t, strings.TrimSpace(screenLineText(private, y)), "remote", "proxied content must omit remote chrome")
	203	+	}
	204	+
	205	+	resetMetadataFrame := <-sends
	206	+	require.Equal(t, ports.MsgSessionMeta, resetMetadataFrame.Type)
	207	+	resetMetadata, err := ports.UnmarshalSessionMeta(resetMetadataFrame.Payload)
	208	+	require.NoError(t, err)
	209	+	require.Equal(t, uint64(2), resetMetadata.Revision)
	210	+	resetOutputFrame := <-sends
	211	+	require.Equal(t, ports.MsgOutput, resetOutputFrame.Type)
	212	+	resetOutput, err := ports.UnmarshalOutput(resetOutputFrame.Payload)
	213	+	require.NoError(t, err)
	214	+	require.Greater(t, resetOutput.Epoch, output.Epoch)
	215	+	require.Zero(t, resetOutput.Base)
	216	+	require.Equal(t, uint64(1), resetOutput.New)
	217	+	require.True(t, resetOutput.Full)
	218	+	private.Write(resetOutput.Data)
	219	+	require.Contains(t, screenLineText(private, 0), "content-marker")
	220	+
	221	+	release()
	222	+	awaitTestCompletion(t, done, "proxied connection did not stop")
	223	+	}

A internal/usecase/daemon/proxied_render.go +149 -0

@@ -0,0 +1,149 @@
	1	+	package daemon
	2	+
	3	+	import (
	4	+	"github.com/bnema/vev/internal/ports"
	5	+	themeui "github.com/bnema/vev/internal/usecase/theme"
	6	+	"github.com/bnema/vev/pkg/renderer"
	7	+	)
	8	+
	9	+	// paintProxiedContent publishes only the remote session's content surface. It
	10	+	// deliberately bypasses bars, pane title chrome, overlays, notices, and every
	11	+	// terminal-global side-effect path used by a full terminal attachment.
	12	+	func (d Daemon) paintProxiedContent(entry session, ac attachedClient, reset bool, lease attachmentLease) paintResult {
	13	+	if entry == nil \|\| ac == nil {
	14	+	return paintRejected
	15	+	}
	16	+	marks := d.newRuntimeMarkBatch()
	17	+	if lease != nil {
	18	+	token := attachmentToken(entry, ac, ac.transport())
	19	+	token.lease = lease
	20	+	ticket, admitted := ac.beginAttachmentEffect(token)
	21	+	if !admitted {
	22	+	return paintRejected
	23	+	}
	24	+	marks.attachmentEffect = ticket
	25	+	defer ticket.End()
	26	+	}
	27	+
	28	+	ac.sendMu.Lock()
	29	+	entry.core().mu.Lock()
	30	+	_, owned := entry.core().attachments[ac]
	31	+	entry.core().mu.Unlock()
	32	+	if !owned \|\| ac.currentAttachmentSession() != entry {
	33	+	ac.sendMu.Unlock()
	34	+	return paintRejected
	35	+	}
	36	+	if lease != nil {
	37	+	rc := attachmentRenderCoordinator(entry)
	38	+	if rc == nil \|\| lease.attachment != ac \|\| !rc.leaseCurrent(lease, true) {
	39	+	ac.sendMu.Unlock()
	40	+	return paintRejected
	41	+	}
	42	+	}
	43	+	if ac.output != nil {
	44	+	ac.output.syncCapacityLocked()
	45	+	if ac.output.atCapacity() {
	46	+	ac.sendMu.Unlock()
	47	+	return paintBlockedCapacity
	48	+	}
	49	+	}
	50	+	if ac.proxiedOutputStarted {
	51	+	failedTransport, err := d.sendProxiedMetadataLocked(entry, ac, &marks)
	52	+	if err != nil {
	53	+	ac.sendMu.Unlock()
	54	+	if marks.attachmentEffect == nil {
	55	+	d.detachOnSendError(entry, ac, failedTransport)
	56	+	} else {
	57	+	token := marks.attachmentEffect.connectionToken()
	58	+	launchCleanup := d.reserveAttachmentSendErrorCleanup(token, failedTransport)
	59	+	marks.attachmentEffect.End()
	60	+	launchCleanup()
	61	+	}
	62	+	return paintRejected
	63	+	}
	64	+	}
	65	+
	66	+	state, ok := captureLocalRenderState(entry, ac, renderCaptureRequest{reset: reset, lease: lease})
	67	+	if !ok {
	68	+	ac.sendMu.Unlock()
	69	+	return paintRejected
	70	+	}
	71	+	composed := composeProxiedContent(*state)
	72	+	ac.proxiedOutputStarted = true
	73	+	d.emitFrame(entry, ac, state, composed, &marks)
	74	+	return paintEmitted
	75	+	}
	76	+
	77	+	// sendProxiedMetadataLocked emits a newer authoritative snapshot before every
	78	+	// post-handshake proxied Output. Caller holds ac.sendMu and no architecture
	79	+	// lock; metadata capture itself completes before the transport write.
	80	+	func (d Daemon) sendProxiedMetadataLocked(entry session, ac attachedClient, marks runtimeMarkBatch) (ports.Transport, error) {
	81	+	if entry == nil \|\| ac == nil \|\| ac.proxiedMetaRevision == ^uint64(0) {
	82	+	return nil, errAttachmentTransition
	83	+	}
	84	+	meta, err := frameSessionMeta(entry, ac, ac.proxiedMetaRevision+1)
	85	+	if err != nil {
	86	+	return nil, err
	87	+	}
	88	+	expected := ac.transportSnapshot()
	89	+	if expected.transport == nil \|\| !ac.transportSnapshotCurrent(expected) {
	90	+	return expected.transport, errTransportReplaced
	91	+	}
	92	+	if marks != nil && marks.attachmentEffect != nil {
	93	+	if !marks.attachmentEffect.beginTransportSend(expected) {
	94	+	return expected.transport, errAttachmentTransition
	95	+	}
	96	+	defer marks.attachmentEffect.endTransportSend()
	97	+	}
	98	+	if err := expected.transport.Send(meta); err != nil {
	99	+	if marks != nil && marks.attachmentEffect != nil {
	100	+	marks.attachmentEffect.reportTransportFailure(expected)
	101	+	}
	102	+	return expected.transport, err
	103	+	}
	104	+	ac.proxiedMetaRevision++
	105	+	return expected.transport, nil
	106	+	}
	107	+
	108	+	// composeProxiedContent retains the remote terminal layout but excludes every
	109	+	// daemon UI layer. Pane frames are copied at their content placements, so the
	110	+	// emitted size is exactly the proxied content geometry.
	111	+	func composeProxiedContent(state capturedRenderState) composedRenderFrame {
	112	+	area := state.layout.area
	113	+	// The proxied attachment owns the remote content window. Shared layout may
	114	+	// lag an accepted resize or be driven by another local attachment, so never
	115	+	// derive the remote wire surface from it when the attachment supplied a
	116	+	// valid content geometry.
	117	+	if state.window.Valid() {
	118	+	area.Width, area.Height = state.window.Cols, state.window.Rows
	119	+	}
	120	+	if area.Width <= 0 \|\| area.Height <= 0 {
	121	+	return composedRenderFrame{frame: renderer.NewFrame(0, 0), cursor: cursorOut{hidden: true}, reset: state.reset}
	122	+	}
	123	+	frame := renderer.NewFrame(area.Width, area.Height)
	124	+	full := state.reset \|\| state.floating.visible
	125	+	damage := make([]renderer.Damage, 0, len(state.panes))
	126	+	for _, pane := range state.panes {
	127	+	if pane.placement.Collapsed \|\| pane.placement.Content.Width <= 0 \|\| pane.placement.Content.Height <= 0 {
	128	+	continue
	129	+	}
	130	+	blitPaneFrame(frame, pane.placement.Content, pane.frame, false, themeui.NewDimmer(themeui.Theme{}))
	131	+	if len(pane.damage) != 0 {
	132	+	damage = append(damage, pane.damage...)
	133	+	}
	134	+	}
	135	+	if state.floating.visible {
	136	+	// A floating pane is the active terminal surface. Proxied mode omits its
	137	+	// local chrome/border but must preserve its content and cursor target.
	138	+	blitPaneFrame(frame, state.floating.geometry.Inner, state.floating.pane.frame, false, themeui.NewDimmer(themeui.Theme{}))
	139	+	}
	140	+	if full {
	141	+	damage = []renderer.Damage{renderer.FullRedraw()}
	142	+	}
	143	+	return composedRenderFrame{
	144	+	frame: frame,
	145	+	damage: damage,
	146	+	cursor: desiredCapturedCursor(state.cursor, 0),
	147	+	reset: state.reset,
	148	+	}
	149	+	}

M internal/usecase/daemon/render.go +6 -2

 )
 func (d *Daemon) paint(entry *session, ac *attachedClient, reset bool, lease *attachmentLease) paintResult {
+	if ac != nil && ac.renderMode == ports.RenderModeProxiedContent {
+		return d.paintProxiedContent(entry, ac, reset, lease)
+	}
 	// Session-owned PTY preparation remains local; attachment rendering is
 	// captured through session.captureRenderState.
 	sess := entry
 		resizeActive: overlays.resizeActive, statusFeedback: statusFeedback,
 	}
 	endCapture := marks.span(ports.RuntimeCaptureStart, ports.RuntimeCaptureEnd, 0)
-	state, ok := entry.captureRenderState(ac, renderCaptureRequest{
+	captureRequest := renderCaptureRequest{
 		bars:            bars,
 		overlays:        capturedOverlays,
 		preview:         preview,
 		styleGeneration: applied.Generation,
 		reset:           reset,
 		lease:           lease,
-	})
+	}
+	state, ok := entry.captureRenderState(ac, captureRequest)
 	endCapture(0, ok)
 	if !ok {
 		ac.sendMu.Unlock()

M internal/usecase/daemon/resize_publication.go +2 -2


@@ -28,11 +28,11 @@ func (p resizeCommitPublication) current() bool {
28		if p.connection.effect == nil {	28		if p.connection.effect == nil {
29		return false	29		return false
30		}	30		}
31	-	if p.connection.effect.ended.Load() \|\| p.connection.sess != p.session \|\|	31	+	if p.connection.effect.ended.Load() \|\| !sameAttachmentOwner(p.connection.owner, p.session) \|\|
32		p.connection.ac != p.attachment \|\| p.connection.lease != p.lease \|\|	32		p.connection.ac != p.attachment \|\| p.connection.lease != p.lease \|\|
33		p.connection.generation != p.attachment.connectionGeneration.Load() \|\|	33		p.connection.generation != p.attachment.connectionGeneration.Load() \|\|
34		!p.attachment.transportSnapshotCurrent(p.connection.transport) \|\|	34		!p.attachment.transportSnapshotCurrent(p.connection.transport) \|\|
35	-	p.attachment.currentSession() != p.session \|\| p.coordinator == nil {	35	+	!sameAttachmentOwner(p.attachment.currentAttachmentOwner(), p.session) \|\| p.coordinator == nil {
36		return false	36		return false
37		}	37		}
38		registered := attachmentRegistered(p.session, p.attachment)	38		registered := attachmentRegistered(p.session, p.attachment)

M internal/usecase/daemon/resume.go +48 -45

 // it returns 0 and never creates a marker after terminal
 // cleanup. Returns the resume token, or 0 when parking cannot be advertised.
 func (d *Daemon) markParkingInFlight(sess *session, ac *attachedClient) uint64 {
-	if sess == nil || ac == nil || !ac.resumeCapable {
+	return d.markParkingInFlightOwner(sess, ac)
+}
+// markParkingInFlightOwner advertises a stable attachment binding before its
+// live membership is removed. The resume credential identifies this owner
+// binding, never a local session name.
+func (d *Daemon) markParkingInFlightOwner(owner attachmentOwner, ac *attachedClient) uint64 {
+	if normalizeAttachmentOwner(owner) == nil || ac == nil || !ac.resumeCapable {
 		return 0
 	}
 	d.mu.Lock()
 	defer d.mu.Unlock()
-	if d.closing || d.sessions[sess.id] != sess {
+	if d.closing || !d.attachmentOwnerRegisteredByDaemonLocked(owner) || !attachmentOwnerRegistered(owner, ac) {
-		return 0
-	}
-	sess.mu.Lock()
-	registered := attachmentRegisteredLocked(sess, ac)
-	sess.mu.Unlock()
-	if !registered {
 		return 0
 	}
 	if ac.resumeToken == 0 {
 		ac.resumeToken = d.nextResumeTokenLocked()
 	}
-	d.ensureParkingInFlightLocked(sess, ac)
+	d.ensureParkingInFlightLocked(owner, ac)
-	d.log.Info("parking in flight", "session", sess.name)
+	d.log.Info("parking in flight", "session", attachmentOwnerName(owner))
 	return ac.resumeToken
 }
 // ensureParkingInFlightLocked records or refreshes the in-flight marker for ac.
 // Caller holds d.mu and has verified the daemon is not closing.
-func (d *Daemon) ensureParkingInFlightLocked(sess *session, ac *attachedClient) {
+func (d *Daemon) ensureParkingInFlightLocked(owner attachmentOwner, ac *attachedClient) {
 	token := ac.resumeToken
 	if token == 0 {
 		return
 	}
 	if existing := d.parking[token]; existing != nil {
 		if existing.ac == ac {
-			existing.sess = sess
+			existing.owner = owner
 			return
 		}
 		delete(d.parking, token)
 		existing.closeDone()
 	}
 	d.parking[token] = &parkingAttachment{
-		sess: sess,
+		owner: owner,
-		ac:   ac,
+		ac:    ac,
-		done: make(chan struct{}),
+		done:  make(chan struct{}),
 	}
 }
 // If another path already detached/unrouted, that path
 // owns park publication.
 func (d *Daemon) clearParkingInFlightIfAbandoned(sess *session, ac *attachedClient, token uint64) {
+	d.clearParkingInFlightIfAbandonedOwner(sess, ac, token)
+}
+func (d *Daemon) clearParkingInFlightIfAbandonedOwner(owner attachmentOwner, ac *attachedClient, token uint64) {
 	if token == 0 || ac == nil {
 		return
 	}
 	d.mu.Lock()
 	defer d.mu.Unlock()
-	if d.parked[token] != nil {
+	if d.parked[token] != nil || !d.attachmentOwnerRegisteredByDaemonLocked(owner) || !attachmentOwnerRegistered(owner, ac) {
-		return
-	}
-	stillOwner := false
-	if sess != nil {
-		sess.mu.Lock()
-		stillOwner = attachmentRegisteredLocked(sess, ac)
-		sess.mu.Unlock()
-	}
-	if !stillOwner {
 		return
 	}
 	d.clearParkingInFlightLocked(token, ac)
 // the session is removed before park publication. Caller holds d.mu.
 func (d *Daemon) purgeParkingForSessionLocked(sess *session) {
 	for token, pending := range d.parking {
-		if pending.sess == sess {
+		if localSession(pending.owner) == sess {
 			delete(d.parking, token)
 			pending.closeDone()
 		}
 		d.mu.Unlock()
 		return false
 	}
-	if h.Name != "" && pending.sess != nil && pending.sess.name != h.Name {
+	if sess := localSession(pending.owner); h.Name != "" && sess != nil && sess.name != h.Name {
 		d.mu.Unlock()
 		return false
 	}
 }
 func (d *Daemon) prepareParkAttachment(sess *session, ac *attachedClient) bool {
-	if !ac.resumeCapable {
+	return d.prepareParkAttachmentOwner(sess, ac)
+}
+func (d *Daemon) prepareParkAttachmentOwner(owner attachmentOwner, ac *attachedClient) bool {
+	if normalizeAttachmentOwner(owner) == nil || ac == nil || !ac.resumeCapable {
 		return false
 	}
 	d.mu.Lock()
 	defer d.mu.Unlock()
-	if d.closing {
+	if d.closing || !d.attachmentOwnerRegisteredByDaemonLocked(owner) {
 		return false
 	}
 	if ac.resumeToken == 0 {
 		ac.resumeToken = d.nextResumeTokenLocked()
 	}
 	// Do not recreate parking markers here: post-detach publication races
-	// terminal session removal and can strand IntentResume waiters. Callers
+	// terminal owner removal and can strand IntentResume waiters. Callers that
-	// that need the detach→park gap advertised must markParkingInFlight while
+	// need the detach→park gap advertised must publish it while still exact.
-	// still the exact live owner. Direct parkAttachment still parks below.
+	d.log.Info("parking client prepared", "session", attachmentOwnerName(owner))
-	d.log.Info("parking client prepared", "session", sess.name)
 	return true
 }
 func (d *Daemon) parkAttachment(sess *session, ac *attachedClient) bool {
-	if !d.prepareParkAttachment(sess, ac) {
+	return d.parkAttachmentOwner(sess, ac)
+}
+func (d *Daemon) parkAttachmentOwner(owner attachmentOwner, ac *attachedClient) bool {
+	if !d.prepareParkAttachmentOwner(owner, ac) {
 		return false
 	}
 	// A parked attachment has no session owner. Release pane snapshots before
 		ac.overlays.pickerMu.Unlock()
 	}
 	d.mu.Lock()
-	if d.closing || d.sessions[sess.id] != sess {
+	if d.closing || !d.attachmentOwnerRegisteredByDaemonLocked(owner) {
 		d.clearParkingInFlightLocked(ac.resumeToken, ac)
 		d.mu.Unlock()
 		return false
 	}
 	grace := d.resumeParkGrace
 	timer := d.clock.NewTimer(grace)
-	parked := &parkedAttachment{sess: sess, ac: ac, pickerGeneration: pickerGeneration, timer: timer, done: make(chan struct{})}
+	parked := &parkedAttachment{owner: owner, ac: ac, pickerGeneration: pickerGeneration, timer: timer, done: make(chan struct{})}
 	ac.parked = true
 	d.parked[token] = parked
 	d.clearParkingInFlightLocked(token, ac)
 		}
 		oldSame.closeDone()
 	}
-	d.log.Info("client parked for resume", "session", sess.name, "grace", grace)
+	d.log.Info("client parked for resume", "session", attachmentOwnerName(owner), "grace", grace)
 	d.watchParkedTimer(token, parked)
 	return true
 }
 		d.removeParkedLocked(token, parked)
 		d.mu.Unlock()
 		d.closePickerIfCurrent(parked.ac, nil, parked.pickerGeneration)
-		d.log.Warn("parked client expired", "session", parked.sess.name)
+		d.log.Warn("parked client expired", "session", attachmentOwnerName(parked.owner))
 		return
 	}
 	d.mu.Unlock()
 	ac.resumeToken = token
 	ac.parked = true
 	ac.connectionGeneration.Add(1)
-	sess := parked.sess
+	sess := localSession(parked.owner)
 	if sess != nil {
 		sess.mu.Lock()
 		sess.unregisterAttachmentLocked(ac)
 	}
 	parked.closeDone()
 	rearmed := &parkedAttachment{
-		sess:             parked.sess,
+		owner:            parked.owner,
 		ac:               ac,
 		pickerGeneration: parked.pickerGeneration,
 		timer:            d.clock.NewTimer(d.resumeParkGrace),
 func (d *Daemon) purgeParkedForSessionLocked(sess *session) []parkedAttachmentRetirement {
 	var retirements []parkedAttachmentRetirement
 	for token, parked := range d.parked {
-		if parked.sess == sess {
+		if localSession(parked.owner) == sess {
 			retirements = append(retirements, d.retireParkedAttachmentLocked(token, parked))
 		}
 	}
 		return nil, nil, false, &protoErr{ports.ErrServerShutdown, "daemon is shutting down"}
 	}
 	if d.parked[h.ResumeToken] != parked || parked.claimed {
-		if d.sessions[parked.sess.id] == parked.sess {
+		if sess := localSession(parked.owner); sess != nil && d.sessions[sess.id] == sess {
 			d.mu.Unlock()
 			ac.sendMu.Unlock()
 			return nil, nil, false, errResumeTokenLifecycleRace
 	if parked == nil || h.ResumeToken == 0 {
 		return nil, nil, false, nil
 	}
-	sess := parked.sess
+	sess := localSession(parked.owner)
-	registered := d.sessions[sess.id] == sess
+	registered := sess != nil && d.sessions[sess.id] == sess
 	if !registered {
 		d.removeParkedLocked(h.ResumeToken, parked)
-		d.log.Warn("resume rejected", "session", sess.name, "registered", false)
+		d.log.Warn("resume rejected", "session", attachmentOwnerName(parked.owner), "registered", false)
 		return nil, nil, false, &protoErr{ports.ErrNoSuchSession, "resume token is no longer valid"}
 	}
 	ac := parked.ac

M internal/usecase/daemon/resume_test.go +7 -7


@@ -533,7 +533,7 @@ func TestResumeDuringTeardownBeforeParkRecoversSameAttachment(t *testing.T) {
533		d.mu.Unlock()	533		d.mu.Unlock()
534		require.NotNil(t, parkingInGap, "fixture: parking marker must precede detach publication")	534		require.NotNil(t, parkingInGap, "fixture: parking marker must precede detach publication")
535		require.Same(t, ac, parkingInGap.ac)	535		require.Same(t, ac, parkingInGap.ac)
536	-	require.Same(t, sess, parkingInGap.sess)	536	+	require.Same(t, sess, localSession(parkingInGap.owner))
537		require.False(t, parkedInGap, "fixture: park must not have published yet")	537		require.False(t, parkedInGap, "fixture: park must not have published yet")
538			538
539		_, _, err = d.route(helloResumeCapable(ports.IntentResume, "work", 0xdecafbad), &closeTrackingTransport{})	539		_, _, err = d.route(helloResumeCapable(ports.IntentResume, "work", 0xdecafbad), &closeTrackingTransport{})

@@ -1268,7 +1268,7 @@ func TestLiveParkAndResumeRetainsPreviousSession(t *testing.T) {
1268		require.NoError(t, err)	1268		require.NoError(t, err)
1269			1269
1270		previous := &session{sessionCore: sessionCore{id: "previous"}}	1270		previous := &session{sessionCore: sessionCore{id: "previous"}}
1271	-	ac.previousSession.Set(previous)	1271	+	ac.previousOwner.Set(previous)
1272		d.clientGone(sess, ac, ac.transport(), false)	1272		d.clientGone(sess, ac, ac.transport(), false)
1273			1273
1274		token := ac.resumeToken	1274		token := ac.resumeToken

@@ -1276,14 +1276,14 @@ func TestLiveParkAndResumeRetainsPreviousSession(t *testing.T) {
1276		parked := d.parked[token]	1276		parked := d.parked[token]
1277		d.mu.Unlock()	1277		d.mu.Unlock()
1278		require.NotNil(t, parked)	1278		require.NotNil(t, parked)
1279	-	require.Same(t, previous, ac.previousSession.Get(), "a live parked attachment keeps its toggle")	1279	+	require.Same(t, previous, ac.previousOwner.Get(), "a live parked attachment keeps its toggle")
1280			1280
1281		tr2, _, _ := newConn(t, mustHello(ports.IntentAttach, "unused", domain.Size{}))	1281		tr2, _, _ := newConn(t, mustHello(ports.IntentAttach, "unused", domain.Size{}))
1282		resumedSess, resumedAC, err := d.route(helloResumeCapable(ports.IntentResume, "work", token), tr2)	1282		resumedSess, resumedAC, err := d.route(helloResumeCapable(ports.IntentResume, "work", token), tr2)
1283		require.NoError(t, err)	1283		require.NoError(t, err)
1284		require.Same(t, sess, resumedSess)	1284		require.Same(t, sess, resumedSess)
1285		require.Same(t, ac, resumedAC)	1285		require.Same(t, ac, resumedAC)
1286	-	require.Same(t, previous, resumedAC.previousSession.Get(), "resume keeps the live attachment toggle")	1286	+	require.Same(t, previous, resumedAC.previousOwner.Get(), "resume keeps the live attachment toggle")
1287		}	1287		}
1288			1288
1289		func TestDiscardingParkedAttachmentClearsPreviousSession(t *testing.T) {	1289		func TestDiscardingParkedAttachmentClearsPreviousSession(t *testing.T) {

@@ -1301,7 +1301,7 @@ func TestDiscardingParkedAttachmentClearsPreviousSession(t *testing.T) {
1301		{	1301		{
1302		name: "session purge",	1302		name: "session purge",
1303		discard: func(d Daemon, _ uint64, parked parkedAttachment) []parkedAttachmentRetirement {	1303		discard: func(d Daemon, _ uint64, parked parkedAttachment) []parkedAttachmentRetirement {
1304	-	return d.purgeParkedForSessionLocked(parked.sess)	1304	+	return d.purgeParkedForSessionLocked(localSession(parked.owner))
1305		},	1305		},
1306		},	1306		},
1307		} {	1307		} {

@@ -1313,7 +1313,7 @@ func TestDiscardingParkedAttachmentClearsPreviousSession(t *testing.T) {
1313		sess, ac, err := d.route(helloResumeCapable(ports.IntentNew, "work", 0), tr)	1313		sess, ac, err := d.route(helloResumeCapable(ports.IntentNew, "work", 0), tr)
1314		require.NoError(t, err)	1314		require.NoError(t, err)
1315			1315
1316	-	ac.previousSession.Set(&session{sessionCore: sessionCore{id: "previous"}})	1316	+	ac.previousOwner.Set(&session{sessionCore: sessionCore{id: "previous"}})
1317		d.clientGone(sess, ac, ac.transport(), false)	1317		d.clientGone(sess, ac, ac.transport(), false)
1318			1318
1319		d.mu.Lock()	1319		d.mu.Lock()

@@ -1323,7 +1323,7 @@ func TestDiscardingParkedAttachmentClearsPreviousSession(t *testing.T) {
1323		d.mu.Unlock()	1323		d.mu.Unlock()
1324		d.finishParkedAttachmentRetirements(retirements)	1324		d.finishParkedAttachmentRetirements(retirements)
1325			1325
1326	-	require.Nil(t, ac.previousSession.Get())	1326	+	require.Nil(t, ac.previousOwner.Get())
1327		})	1327		})
1328		}	1328		}
1329		}	1329		}

M internal/usecase/daemon/session.go +18 -16

 	if err := domain.ValidateSessionName(name); err != nil {
 		return err
 	}
-	if token.sess == nil || token.ac == nil || token.effect == nil {
+	source := token.localSession()
+	if source == nil || token.ac == nil || token.effect == nil {
 		return errAttachmentTransition
 	}
 	token.effect.bindActionEnd(d, "create-session")
 	var created *session
 	transition, err := d.transitionAttachment(attachmentTransitionRequest{
-		source: token.sess, next: token.ac,
+		source: source, next: token.ac,
 		expectedTransport: token.transport, sourceToken: &token, action: "create-session",
 		copySourceEnvironment: true, ready: true,
 		createTargetLocked: func() (*session, error) {
-			source := token.sess
 			if source == nil {
 				return nil, errAttachmentTransition
 			}
 	}
 	d.touchMRU(created)
-	if token.sess != nil {
+	if source != nil {
-		token.ac.recordPreviousSession(token.sess)
+		token.ac.recordPreviousSession(source)
 	}
 	d.log.Info("client attached", "session", created.name, "resume", token.ac.resumeCapable)
 	d.deferAttachmentTransitionCleanups(transition)
 }
 func (d *Daemon) detachIfAttachmentCurrentUntil(token attachmentConnectionToken, done func() <-chan struct{}) bool {
-	if token.sess == nil || token.ac == nil || token.transport.transport == nil {
+	sess := token.localSession()
+	if sess == nil || token.ac == nil || token.transport.transport == nil {
 		return false
 	}
 	// Attachments without the session's optional primary render lease still
 	// own an independent connection lifecycle and detach through the same exact
 	// transport/generation fence.
 	if token.lease == nil {
-		return d.detachIfCurrentTransport(token.sess, token.ac, token.transport)
+		return d.detachIfCurrentTransport(sess, token.ac, token.transport)
 	}
 	frozen := freezeAttachmentEffectGatesWith(attachmentEffectFreezeOptions{done: done}, token.ac)
 	defer frozen.unfreeze()
 		d.afterDetachAttachmentEffectsFrozen()
 	}
 	d.mu.Lock()
-	core := token.sess.core()
+	core := sess.core()
-	if core == nil || d.sessions[core.id] != token.sess {
+	if core == nil || d.sessions[core.id] != sess {
 		d.mu.Unlock()
 		return false
 	}
 		coordinator.mu.Lock()
 	}
 	req := attachmentTransitionRequest{
-		source: token.sess, next: token.ac, expectedTransport: token.transport,
+		source: sess, next: token.ac, expectedTransport: token.transport,
 	}
-	current := coordinator != nil && transitionSourceTokenCurrentLocked(token, token.sess, coordinator, req)
+	current := coordinator != nil && transitionSourceTokenCurrentLocked(token, sess, coordinator, req)
 	if current {
-		unregisterAttachmentSessionLocked(token.sess, token.ac)
+		unregisterAttachmentSessionLocked(sess, token.ac)
 		token.ac.connectionGeneration.Add(1)
 		token.ac.setSession(nil)
 		token.ac.invalidateFrozenAttachmentCapability()
 	snapshot := sessionKillParticipants{target: target}
 	if admission != nil {
 		token := admission.token
-		if token.sess == nil || token.ac == nil || token.transport.transport == nil {
+		if token.localSession() == nil || token.ac == nil || token.transport.transport == nil {
 			return sessionKillParticipants{}, false
 		}
-		snapshot.source = token.sess
+		snapshot.source = token.localSession()
 		if snapshot.source == nil {
 			return sessionKillParticipants{}, false
 		}
 		return true
 	}
 	token := *snapshot.sourceToken
+	source := token.localSession()
 	req := attachmentTransitionRequest{
-		source: token.sess, next: token.ac, expectedTransport: token.transport,
+		source: source, next: token.ac, expectedTransport: token.transport,
 	}
-	return transitionSourceTokenCurrentLocked(token, token.sess, sourceCoordinator, req)
+	return transitionSourceTokenCurrentLocked(token, source, sourceCoordinator, req)
 }
 // stopInMemoryLifecycle cancels every session producer and closes every PTY

M internal/usecase/daemon/session_back.go +36 -16

 	"github.com/bnema/vev/internal/usecase/picker"
 )
-// backSession toggles this attachment between its current session and the
+// backSession toggles this attachment between its current local session and
-// immediately preceding successfully activated session.
+// the immediately preceding successfully activated local session. A remote
+// owner is retained in the owner history but is not interpreted as a local
+// session; remote back navigation is published with remote transitions.
 func (d *Daemon) backSessionForAttachment(token attachmentConnectionToken) error {
-	if d == nil || token.sess == nil || token.ac == nil {
+	current := token.localSession()
+	if d == nil || current == nil || token.ac == nil {
 		return nil
 	}
-	target := token.ac.previousSession.Get()
+	previous := token.ac.previousOwner.Get()
-	if target == nil || target == token.sess || target.core() == nil || d.sessionByID(target.core().id) != target {
+	target := localSession(previous)
-		token.ac.clearPreviousSessionIf(target)
+	if target == nil {
+		// A remote predecessor remains stable history for the remote transition
+		// path; the local-only back path must not discard it.
+		return nil
+	}
+	if target == current || target.core() == nil || d.sessionByID(target.core().id) != target {
+		token.ac.clearPreviousOwnerIf(previous)
 		return nil
 	}
 	pickerTarget := picker.Target{Session: target.core().id, TabIndex: -1}
 	if d == nil || current == nil || ac == nil {
 		return
 	}
-	target := ac.previousSession.Get()
+	previous := ac.previousOwner.Get()
-	if target == nil || target == current || target.core() == nil || d.sessionByID(target.core().id) != target {
+	target := localSession(previous)
-		ac.clearPreviousSessionIf(target)
+	if target == nil {
+		if previous == nil {
+			d.invalidateRender(current, ac, true, "session_back.go")
+		}
+		return
+	}
+	if target == current || target.core() == nil || d.sessionByID(target.core().id) != target {
+		ac.clearPreviousOwnerIf(previous)
 		d.invalidateRender(current, ac, true, "session_back.go")
 		return
 	}
 	}
 }
-// clearPreviousSessionIf clears target only if it has not been replaced since
+// clearPreviousOwnerIf clears target only if it has not been replaced since
 // the caller observed it. This preserves a concurrent successful hand-off.
-func (ac *attachedClient) clearPreviousSessionIf(target *session) {
+func (ac *attachedClient) clearPreviousOwnerIf(target attachmentOwner) {
 	if ac == nil {
 		return
 	}
-	ac.previousSession.With(func(previous **session) {
+	ac.previousOwner.With(func(previous *attachmentOwner) {
-		if *previous == target {
+		if sameAttachmentOwner(*previous, target) {
 			*previous = nil
 		}
 	})
 }
-// recordPreviousSession is called only after a cross-session hand-off has
+// recordPreviousOwner is called only after a cross-owner hand-off has
 // committed. Keeping this after the commit makes failed/displaced switches
 // leave the toggle pair intact.
-func (ac *attachedClient) recordPreviousSession(origin *session) {
+func (ac *attachedClient) recordPreviousOwner(origin attachmentOwner) {
 	if ac != nil && origin != nil {
-		ac.previousSession.Set(origin)
+		ac.previousOwner.Set(origin)
 	}
 }
+func (ac *attachedClient) recordPreviousSession(origin *session) {
+	ac.recordPreviousOwner(origin)
+}

M internal/usecase/daemon/session_geometry.go +9 -1

 package daemon
-import "github.com/bnema/vev/internal/domain"
+import (
+	"github.com/bnema/vev/internal/domain"
+	"github.com/bnema/vev/internal/ports"
+)
 // sessionGeometrySource identifies the attachment whose latest attach,
 // resume, or resize claim controls shared PTY/layout geometry. claim is zero
 		return domain.Size{}, sessionGeometrySource{}, false
 	}
 	content := contentSize(source.size)
+	if source.attachment.renderMode == ports.RenderModeProxiedContent {
+		// A proxied Hello already carries content geometry; do not subtract the
+		// remote daemon's local chrome rows from it.
+		content = source.size
+	}
 	return domain.Size{Cols: content.Cols, Rows: content.Rows + tabChromeRows}, source, true
 }

M internal/usecase/daemon/wire.go +38 -0


@@ -12,6 +12,7 @@ func frameWelcome(s session, ac attachedClient) ports.Frame {
12	SessionID: string(s.id),	12		SessionID: string(s.id),
13	SessionName: s.name,	13		SessionName: s.name,
14	Ephemeral: s.ephemeral,	14		Ephemeral: s.ephemeral,
		15	+	RenderMode: ac.renderMode,
15	Capabilities: ports.CapabilityResume,	16		Capabilities: ports.CapabilityResume,
16	}	17		}
17	s.mu.Unlock()	18		s.mu.Unlock()

@@ -19,6 +20,43 @@ func frameWelcome(s session, ac attachedClient) ports.Frame {
19	return ports.Frame{Type: ports.MsgWelcome, Payload: ports.MarshalWelcome(w)}	20		return ports.Frame{Type: ports.MsgWelcome, Payload: ports.MarshalWelcome(w)}
20	}	21		}
21		22
		23	+	// frameSessionMeta snapshots the authoritative remote session identity and
		24	+	// ordered stable tab metadata for a proxied attachment. Its first publication
		25	+	// is emitted during the handshake before that attachment may render output.
		26	+	func frameSessionMeta(s session, ac attachedClient, revision uint64) (ports.Frame, error) {
		27	+	if s == nil \|\| ac == nil {
		28	+	return ports.Frame{}, ports.ErrInvalidSessionMeta
		29	+	}
		30	+	// Capture the session tab set and this attachment's active stable tab under
		31	+	// the same session snapshot. A stale attachment view must fall back to the
		32	+	// first current tab instead of emitting metadata whose active ID is absent
		33	+	// from Tabs and therefore invalid on the wire.
		34	+	s.mu.Lock()
		35	+	active := ac.viewSnapshot().tabID
		36	+	meta := ports.SessionMeta{
		37	+	LifecycleID: s.incarnation,
		38	+	Revision: revision,
		39	+	SessionName: s.name,
		40	+	Tabs: make([]ports.SessionTabMeta, 0, len(s.tabs)),
		41	+	}
		42	+	activePresent := false
		43	+	for i, tab := range s.tabs {
		44	+	id := domain.TabStableID(tab.stableID)
		45	+	meta.Tabs = append(meta.Tabs, ports.SessionTabMeta{ID: id, Name: tabDisplayName(tab, i), Attention: tab.attention})
		46	+	activePresent = activePresent \|\| active == id
		47	+	}
		48	+	if !activePresent && len(meta.Tabs) != 0 {
		49	+	active = meta.Tabs[0].ID
		50	+	}
		51	+	meta.ActiveTabID = active
		52	+	s.mu.Unlock()
		53	+	payload, err := ports.MarshalSessionMeta(meta)
		54	+	if err != nil {
		55	+	return ports.Frame{}, err
		56	+	}
		57	+	return ports.Frame{Type: ports.MsgSessionMeta, Payload: payload}, nil
		58	+	}
		59	+
22	func frameError(code uint16, text string) ports.Frame {	60		func frameError(code uint16, text string) ports.Frame {
23	return ports.Frame{Type: ports.MsgError, Payload: ports.MarshalErrorMsg(ports.ErrorMsg{Code: code, Text: text})}	61		return ports.Frame{Type: ports.MsgError, Payload: ports.MarshalErrorMsg(ports.ErrorMsg{Code: code, Text: text})}
24	}	62		}

M scripts/remote-picker-harness/README.md +12 -0


@@ -18,6 +18,18 @@ Environment overrides:
18	containers (default: `ubuntu:24.04`).	18		containers (default: `ubuntu:24.04`).
19	- `VEV_HARNESS_TARGET` selects the SSH target passed to the harness binary	19		- `VEV_HARNESS_TARGET` selects the SSH target passed to the harness binary
20	(default: `test@remote`).	20		(default: `test@remote`).
		21	+	- `VEV_HARNESS_ARTIFACT_DIR`, when set, writes a bounded
		22	+	`remote-picker-harness.json` containing output-state, checkpoint, and event
		23	+	metadata. It is unset by default; the artifact contains no terminal bytes,
		24	+	raw screen text, credentials, or target output. `run.sh` copies the report to
		25	+	that host directory before it removes the disposable containers.
		26	+
		27	+	Each logical transport has one persistent `vt.Screen` and a client-equivalent
		28	+	output-state chain. The probe writes accepted full, incremental, and side-effect
		29	+	frames to that screen, ACKs only accepted state-bearing frames, and retains a
		30	+	bounded set of screen checkpoints plus non-sensitive event metadata. The local
		31	+	picker phase uses separate local-picker and selected-remote probes to
		32	+	characterize the existing `MsgAttachTarget` direct handoff and its event order.
21		33
22	The run exercises real SSH-stdio and UDP attachment, typed live catalog and	34		The run exercises real SSH-stdio and UDP attachment, typed live catalog and
23	preview requests, tab creation/removal fencing, exact lifecycle fencing after	35		preview requests, tab creation/removal fencing, exact lifecycle fencing after

M scripts/remote-picker-harness/main.go +92 -83

 	"github.com/bnema/vev/internal/adapters/sshstdio"
 	"github.com/bnema/vev/internal/domain"
 	"github.com/bnema/vev/internal/ports"
-	"github.com/bnema/vev/pkg/vt"
 )
 const (
 	fmt.Println("remote picker harness: PASS")
 }
-func run() error {
+func run() (runErr error) {
 	target := os.Getenv("VEV_HARNESS_TARGET")
 	if target == "" {
 		target = defaultTarget
 	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
 	defer cancel()
+	artifact := newHarnessArtifact(os.Getenv("VEV_HARNESS_ARTIFACT_DIR"))
+	if artifact != nil {
+		ctx = withHarnessArtifact(ctx, artifact)
+		defer func() {
+			if err := artifact.write(runErr == nil); err != nil {
+				runErr = errors.Join(runErr, err)
+			}
+		}()
+	}
 	catalog := remoteadapter.NewCatalogClient()
 	preview := remoteadapter.NewPreviewClient()
 	if err := runLocalPickerUnitedPhase(ctx, target, catalog, preview); err != nil {
 		previewMarker = "VEV_REMOTE_PICKER_ACTIVE"
 	)
+	trace := &probeTrace{}
+	if artifact := harnessArtifactFromContext(ctx); artifact != nil {
+		artifact.registerTrace(trace)
+	}
 	remote, err := openTransport(ctx, ports.RemoteTransportStdio, target)
 	if err != nil {
 		return fmt.Errorf("open remote picker source: %w", err)
 	}
+	remote.probe.configure("remote-picker-source", nil)
 	ownsRemoteSession := false
 	defer func() {
 		_ = remote.Close()
 	if err != nil {
 		return fmt.Errorf("open local picker transport: %w", err)
 	}
+	local.probe.configure("local-picker", trace)
 	defer func() { _ = local.Close() }()
 	if err := attachAndCheck(ctx, local, ports.Hello{
 		Intent: ports.IntentNew, Name: localSession, Env: localEnvironment(), Cwd: "/tmp/local-cwd",
 	if err != nil {
 		return fmt.Errorf("open selected remote transport: %w", err)
 	}
+	selected.probe.configure("selected-remote", trace)
 	defer func() { _ = selected.Close() }()
 	if err := attachAndCheck(ctx, selected, ports.Hello{
 		Intent: ports.IntentAttach, Name: handoff.Session, Env: localEnvironment(), Cwd: "/tmp/local-cwd",
 	if err := awaitOutputContains(ctx, selected, remoteSession+" at remote"); err != nil {
 		return fmt.Errorf("remote provenance status bar: %w", err)
 	}
+	if err := validateHandoffEventOrdering(trace.events); err != nil {
+		return fmt.Errorf("characterize remote picker handoff: %w", err)
+	}
 	return nil
 }
 type harnessTransport struct {
 	ports.Transport
+	probe     *visualProbe
 	frames    chan harnessFrame
 	stop      chan struct{}
 	closeOnce sync.Once
 }
 func newHarnessTransport(transport ports.Transport) *harnessTransport {
-	h := &harnessTransport{Transport: transport, frames: make(chan harnessFrame, 16), stop: make(chan struct{})}
+	h := &harnessTransport{
+		Transport: transport,
+		probe:     newVisualProbe(domain.Size{Cols: defaultProbeCols, Rows: defaultProbeRows}),
+		frames:    make(chan harnessFrame, 16),
+		stop:      make(chan struct{}),
+	}
 	go h.receiveLoop()
 	return h
 }
 	if err != nil {
 		return nil, err
 	}
-	return newHarnessTransport(transport), nil
+	h := newHarnessTransport(transport)
+	h.probe.configure(string(mode), nil)
+	if artifact := harnessArtifactFromContext(ctx); artifact != nil {
+		artifact.registerProbe(h.probe)
+	}
+	return h, nil
 }
 const commandStderrLimit = 4 << 10
 	if err != nil {
 		return nil, err
 	}
-	return newHarnessTransport(transport), nil
+	h := newHarnessTransport(transport)
+	h.probe.configure("local", nil)
+	if artifact := harnessArtifactFromContext(ctx); artifact != nil {
+		artifact.registerProbe(h.probe)
+	}
+	return h, nil
 }
 func attachAndCheck(ctx context.Context, tr *harnessTransport, hello ports.Hello) error {
 	if frame.Type != ports.MsgWelcome {
 		return fmt.Errorf("welcome frame type %d", frame.Type)
 	}
+	tr.probe.recordControl(probeEventWelcome)
 	if err := tr.Send(ports.Frame{Type: ports.MsgTheme, Payload: ports.MarshalTheme(ports.Theme{TrueColor: hello.TrueColor, SchemeKnown: true})}); err != nil {
 		return fmt.Errorf("send initial theme: %w", err)
 	}
 	return tr.Send(ports.Frame{Type: ports.MsgInput, Payload: ports.MarshalInput(ports.Input{Data: []byte(data)})})
 }
-func acknowledgeOutput(tr *harnessTransport, output ports.Output) error {
+func processOutputFrame(tr *harnessTransport, frame ports.Frame) error {
-	if output.Epoch == 0 || output.New == 0 {
+	output, err := ports.UnmarshalOutput(frame.Payload)
+	if err != nil {
+		return err
+	}
+	result := tr.probe.apply(output)
+	if !result.Accepted {
+		if !tr.probe.resetPending {
+			if err := tr.Send(ports.Frame{Type: ports.MsgOutputResetRequest, Payload: ports.MarshalOutputResetRequest(ports.OutputResetRequest{})}); err != nil {
+				return err
+			}
+			tr.probe.resetPending = true
+			tr.probe.recordControl(probeEventOutputReset)
+		}
+		return nil
+	}
+	if !result.StateBearing {
 		return nil
 	}
-	payload, err := ports.MarshalAck(ports.Ack{Epoch: output.Epoch, State: output.New})
+	payload, err := ports.MarshalAck(result.Ack)
 	if err != nil {
 		return err
 	}
-	return tr.Send(ports.Frame{Type: ports.MsgAck, Payload: payload})
+	if err := tr.Send(ports.Frame{Type: ports.MsgAck, Payload: payload}); err != nil {
+		return err
+	}
+	tr.probe.resetPending = false
+	tr.probe.markAcked(result)
+	return nil
 }
 func awaitOutputContains(ctx context.Context, tr *harnessTransport, want string) error {
 	deadline, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
-	var received strings.Builder
+	visible := tr.probe.contains(want)
-	screen := vt.NewScreen(80, 24)
 	for {
 		frame, err := receiveWithTimeout(deadline, tr)
 		if err != nil {
 		if frame.Type != ports.MsgOutput {
 			continue
 		}
-		output, err := ports.UnmarshalOutput(frame.Payload)
+		if err := processOutputFrame(tr, frame); err != nil {
-		if err != nil {
-			return err
-		}
-		if err := acknowledgeOutput(tr, output); err != nil {
 			return err
 		}
-		received.Write(output.Data)
+		nowVisible := tr.probe.contains(want)
-		screen.Write(output.Data)
+		if !visible && nowVisible {
-		if strings.Contains(received.String(), want) || strings.Contains(harnessScreenText(screen), want) {
 			return nil
 		}
-		if received.Len() > 64<<10 {
+		visible = nowVisible
-			text := received.String()
-			received.Reset()
-			received.WriteString(text[len(text)-16<<10:])
-		}
 	}
 }
 func awaitRemotePickerPreview(ctx context.Context, tr *harnessTransport, marker string) error {
 	deadline, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
-	screen := vt.NewScreen(80, 24)
-	outputFrames := 0
 	sawLoading := false
+	markerVisible := tr.probe.contains(marker)
 	for {
 		frame, err := receiveWithTimeout(deadline, tr)
 		if err != nil {
-			return fmt.Errorf("no rendered remote preview after %d output frames (loading=%t): %w", outputFrames, sawLoading, err)
+			return fmt.Errorf("no rendered remote preview after %d output frames (loading=%t): %w", tr.probe.outputFrames, sawLoading, err)
 		}
 		if frame.Type != ports.MsgOutput {
 			continue
 		}
-		output, err := ports.UnmarshalOutput(frame.Payload)
+		if err := processOutputFrame(tr, frame); err != nil {
-		if err != nil {
-			return err
-		}
-		if err := acknowledgeOutput(tr, output); err != nil {
 			return err
 		}
-		outputFrames++
+		text := tr.probe.text()
-		screen.Write(output.Data)
+		sawLoading = sawLoading || strings.Contains(text, "loading remote preview")
-		text := harnessScreenText(screen)
+		nowMarkerVisible := strings.Contains(text, marker)
-		sawLoading = sawLoading || strings.Contains(text, "loading remote preview") || strings.Contains(string(output.Data), "loading remote preview")
+		if !markerVisible && nowMarkerVisible {
-		if strings.Contains(text, marker) || strings.Contains(string(output.Data), marker) {
 			return nil
 		}
+		markerVisible = nowMarkerVisible
 		if strings.Contains(text, "remote preview unavailable") {
 			return errors.New("remote preview unavailable")
 		}
 	}
 }
-func harnessScreenText(screen *vt.Screen) string {
-	var text strings.Builder
-	for y := range screen.Frame.Height {
-		for x := range screen.Frame.Width {
-			r := screen.Frame.At(x, y).Rune
-			if r == 0 {
-				r = ' '
-			}
-			text.WriteRune(r)
-		}
-		text.WriteByte('\n')
-	}
-	return text.String()
-}
 func remotePreviewContains(preview ports.RemotePreview, want string) bool {
 	var text strings.Builder
 	for _, cell := range preview.Cells {
 			return ports.Frame{}, err
 		}
 		if frame.Type == typ {
+			if typ == ports.MsgAttachTarget {
+				tr.probe.recordControl(probeEventAttachTarget)
+			}
 			return frame, nil
 		}
 		if frame.Type == ports.MsgOutput {
-			output, decodeErr := ports.UnmarshalOutput(frame.Payload)
+			if err := processOutputFrame(tr, frame); err != nil {
-			if decodeErr != nil {
+				return ports.Frame{}, err
-				return ports.Frame{}, decodeErr
-			}
-			if ackErr := acknowledgeOutput(tr, output); ackErr != nil {
-				return ports.Frame{}, ackErr
 			}
 		}
 	}
 	if err := tr.Send(ports.Frame{Type: ports.MsgInput, Payload: ports.MarshalInput(ports.Input{Data: []byte(command + "\n")})}); err != nil {
 		return err
 	}
-	var received strings.Builder
-	var outputFrames int
-	var outputBytes int
 	deadline, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
+	visible := tr.probe.contains(want)
 	for {
 		frame, err := receiveWithTimeout(deadline, tr)
 		if err != nil {
-			return fmt.Errorf("waiting for marker after %d output frames/%d bytes: %w", outputFrames, outputBytes, err)
+			return fmt.Errorf("waiting for marker after %d output frames/%d bytes: %w", tr.probe.outputFrames, tr.probe.outputBytes, err)
 		}
 		if frame.Type != ports.MsgOutput {
 			continue
 		}
-		output, err := ports.UnmarshalOutput(frame.Payload)
+		if err := processOutputFrame(tr, frame); err != nil {
-		if err != nil {
+			return fmt.Errorf("process output: %w", err)
-			return err
-		}
-		outputFrames++
-		outputBytes += len(output.Data)
-		if err := acknowledgeOutput(tr, output); err != nil {
-			return fmt.Errorf("ack output: %w", err)
 		}
-		received.Write(output.Data)
+		nowVisible := tr.probe.contains(want)
-		if strings.Contains(received.String(), want) {
+		if !visible && nowVisible {
 			return nil
 		}
-		if received.Len() > 64<<10 {
+		visible = nowVisible
-			text := received.String()
-			received.Reset()
-			received.WriteString(text[len(text)-16<<10:])
-		}
 	}
 }
 			return err
 		}
 		if frame.Type == ports.MsgOutput {
-			output, decodeErr := ports.UnmarshalOutput(frame.Payload)
+			if err := processOutputFrame(tr, frame); err != nil {
-			if decodeErr != nil {
+				return err
-				return decodeErr
-			}
-			if ackErr := acknowledgeOutput(tr, output); ackErr != nil {
-				return ackErr
 			}
 			continue
 		}

M scripts/remote-picker-harness/run.sh +20 -1


@@ -16,6 +16,9 @@ Environment:
16		already select the rootless daemon.	16		already select the rootless daemon.
17		VEV_HARNESS_BASE_IMAGE Base image for the disposable containers	17		VEV_HARNESS_BASE_IMAGE Base image for the disposable containers
18		(default: ubuntu:24.04).	18		(default: ubuntu:24.04).
			19	+	VEV_HARNESS_ARTIFACT_DIR Host directory for the bounded probe artifact.
			20	+	The JSON report is copied there before container
			21	+	cleanup; no report is written when unset.
19		USAGE	22		USAGE
20		}	23		}
21			24

@@ -33,6 +36,11 @@ esac
33			36
34		repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"	37		repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
35		base_image="${VEV_HARNESS_BASE_IMAGE:-ubuntu:24.04}"	38		base_image="${VEV_HARNESS_BASE_IMAGE:-ubuntu:24.04}"
			39	+	artifact_dir="${VEV_HARNESS_ARTIFACT_DIR:-}"
			40	+	if [ -n "$artifact_dir" ]; then
			41	+	umask 077
			42	+	mkdir -p "$artifact_dir"
			43	+	fi
36		run_id="$(date +%s)-$$"	44		run_id="$(date +%s)-$$"
37		image="vev-remote-picker-harness:${run_id}"	45		image="vev-remote-picker-harness:${run_id}"
38		network="vev-remote-picker-harness-${run_id}"	46		network="vev-remote-picker-harness-${run_id}"

@@ -106,4 +114,15 @@ if ! docker exec --user test -e HOME=/home/test "$local_container" ssh -o BatchM
106		fi	114		fi
107			115
108		printf 'remote picker harness: running acceptance checks\n'	116		printf 'remote picker harness: running acceptance checks\n'
109	-	docker exec --user test -e HOME=/home/test "$local_container" /usr/local/bin/remote-picker-harness	117	+	harness_status=0
			118	+	if [ -n "$artifact_dir" ]; then
			119	+	docker exec --user test -e HOME=/home/test -e VEV_HARNESS_ARTIFACT_DIR=/tmp/vev-harness-artifact "$local_container" /usr/local/bin/remote-picker-harness \|\| harness_status=$?
			120	+	if ! docker cp "$local_container:/tmp/vev-harness-artifact/remote-picker-harness.json" "$artifact_dir/remote-picker-harness.json"; then
			121	+	echo 'remote picker harness: failed to collect probe artifact' >&2
			122	+	exit 1
			123	+	fi
			124	+	chmod 0600 "$artifact_dir/remote-picker-harness.json"
			125	+	else
			126	+	docker exec --user test -e HOME=/home/test "$local_container" /usr/local/bin/remote-picker-harness \|\| harness_status=$?
			127	+	fi
			128	+	exit "$harness_status"

A scripts/remote-picker-harness/visual_probe.go +477 -0

@@ -0,0 +1,477 @@
	1	+	package main
	2	+
	3	+	import (
	4	+	"context"
	5	+	"encoding/json"
	6	+	"fmt"
	7	+	"os"
	8	+	"path/filepath"
	9	+	"strings"
	10	+
	11	+	"github.com/bnema/vev/internal/domain"
	12	+	"github.com/bnema/vev/internal/ports"
	13	+	"github.com/bnema/vev/pkg/vt"
	14	+	)
	15	+
	16	+	const (
	17	+	defaultProbeCols = 80
	18	+	defaultProbeRows = 24
	19	+
	20	+	maxProbeEvents = 128
	21	+	maxProbeCheckpoints = 16
	22	+	maxProbeTraces = 128
	23	+	maxArtifactBytes = 64 << 10
	24	+
	25	+	probeEventOutput = "output"
	26	+	probeEventWelcome = "welcome"
	27	+	probeEventAttachTarget = "attach_target"
	28	+	probeEventOutputReset = "output_reset_request"
	29	+	)
	30	+
	31	+	// visualOutputState mirrors the client's output dependency chain. A probe may
	32	+	// inspect output only after the frame's epoch, base, and view revision continue
	33	+	// the last accepted state.
	34	+	type visualOutputState struct {
	35	+	epoch uint64
	36	+	state uint64
	37	+	viewRevision uint64
	38	+	initialized bool
	39	+	}
	40	+
	41	+	func (s visualOutputState) next(output ports.Output) (visualOutputState, bool) {
	42	+	if output.Epoch == 0 {
	43	+	return visualOutputState{}, false
	44	+	}
	45	+	if !s.initialized {
	46	+	if output.New == 0 {
	47	+	return s, true
	48	+	}
	49	+	if output.Base != 0 \|\| !output.Full {
	50	+	return visualOutputState{}, false
	51	+	}
	52	+	return visualOutputState{epoch: output.Epoch, state: output.New, viewRevision: output.ViewRevision, initialized: true}, true
	53	+	}
	54	+	if output.Epoch < s.epoch {
	55	+	return visualOutputState{}, false
	56	+	}
	57	+	if output.Epoch == s.epoch {
	58	+	if output.ViewRevision != s.viewRevision {
	59	+	return visualOutputState{}, false
	60	+	}
	61	+	if output.New == 0 {
	62	+	if output.Base != 0 \|\| output.Full {
	63	+	return visualOutputState{}, false
	64	+	}
	65	+	return s, true
	66	+	}
	67	+	if output.Full \|\| output.Base != s.state \|\| output.New != output.Base+1 {
	68	+	return visualOutputState{}, false
	69	+	}
	70	+	return visualOutputState{epoch: s.epoch, state: output.New, viewRevision: s.viewRevision, initialized: true}, true
	71	+	}
	72	+	if !output.Full \|\| output.Base != 0 \|\| output.New == 0 {
	73	+	return visualOutputState{}, false
	74	+	}
	75	+	return visualOutputState{epoch: output.Epoch, state: output.New, viewRevision: output.ViewRevision, initialized: true}, true
	76	+	}
	77	+
	78	+	type probeEvent struct {
	79	+	Sequence uint64
	80	+	Transport string
	81	+	Kind string
	82	+	Accepted bool
	83	+	StateBearing bool
	84	+	Acked bool
	85	+	Epoch uint64
	86	+	Base uint64
	87	+	New uint64
	88	+	ViewRevision uint64
	89	+	Full bool
	90	+	DataBytes int
	91	+	}
	92	+
	93	+	type probeTrace struct {
	94	+	events []*probeEvent
	95	+	}
	96	+
	97	+	func (t probeTrace) record(event probeEvent) {
	98	+	if t == nil \|\| event == nil {
	99	+	return
	100	+	}
	101	+	if len(t.events) == maxProbeTraces {
	102	+	t.events = t.events[1:]
	103	+	}
	104	+	t.events = append(t.events, event)
	105	+	}
	106	+
	107	+	type visualCheckpoint struct {
	108	+	event *probeEvent
	109	+	state visualOutputState
	110	+	snapshot vt.ScreenSnapshot
	111	+	}
	112	+
	113	+	type visualOutputResult struct {
	114	+	Accepted bool
	115	+	StateBearing bool
	116	+	Ack ports.Ack
	117	+	event *probeEvent
	118	+	}
	119	+
	120	+	// visualProbe is deliberately transport-local. A new physical transport gets
	121	+	// one screen and one output state; waiting for a particular marker never
	122	+	// creates a replacement screen and therefore cannot lose prior terminal state.
	123	+	type visualProbe struct {
	124	+	label string
	125	+
	126	+	screen *vt.Screen
	127	+	state visualOutputState
	128	+
	129	+	events []*probeEvent
	130	+	checkpoints []visualCheckpoint
	131	+	trace *probeTrace
	132	+	nextEvent uint64
	133	+
	134	+	outputFrames int
	135	+	outputBytes int
	136	+	resetPending bool
	137	+	}
	138	+
	139	+	type harnessArtifactContextKey struct{}
	140	+
	141	+	func withHarnessArtifact(ctx context.Context, artifact *harnessArtifact) context.Context {
	142	+	return context.WithValue(ctx, harnessArtifactContextKey{}, artifact)
	143	+	}
	144	+
	145	+	func harnessArtifactFromContext(ctx context.Context) *harnessArtifact {
	146	+	if ctx == nil {
	147	+	return nil
	148	+	}
	149	+	artifact, _ := ctx.Value(harnessArtifactContextKey{}).(*harnessArtifact)
	150	+	return artifact
	151	+	}
	152	+
	153	+	func newVisualProbe(size domain.Size) *visualProbe {
	154	+	width, height := size.Cols, size.Rows
	155	+	if width <= 0 {
	156	+	width = defaultProbeCols
	157	+	}
	158	+	if height <= 0 {
	159	+	height = defaultProbeRows
	160	+	}
	161	+	return &visualProbe{screen: vt.NewScreen(width, height)}
	162	+	}
	163	+
	164	+	func (p visualProbe) configure(label string, trace probeTrace) {
	165	+	if p == nil {
	166	+	return
	167	+	}
	168	+	p.label = label
	169	+	p.trace = trace
	170	+	}
	171	+
	172	+	func (p visualProbe) record(event probeEvent) probeEvent {
	173	+	if p == nil {
	174	+	return nil
	175	+	}
	176	+	p.nextEvent++
	177	+	event.Sequence = p.nextEvent
	178	+	event.Transport = p.label
	179	+	owned := &event
	180	+	if len(p.events) == maxProbeEvents {
	181	+	p.events = p.events[1:]
	182	+	}
	183	+	p.events = append(p.events, owned)
	184	+	if p.trace != nil {
	185	+	p.trace.record(owned)
	186	+	}
	187	+	return owned
	188	+	}
	189	+
	190	+	func (p *visualProbe) recordControl(kind string) {
	191	+	if p == nil {
	192	+	return
	193	+	}
	194	+	p.record(probeEvent{Kind: kind, Accepted: true})
	195	+	}
	196	+
	197	+	func (p *visualProbe) apply(output ports.Output) visualOutputResult {
	198	+	if p == nil {
	199	+	return visualOutputResult{}
	200	+	}
	201	+	p.outputFrames++
	202	+	p.outputBytes += len(output.Data)
	203	+	accepted := ports.ValidateOutput(output) == nil
	204	+	next := visualOutputState{}
	205	+	if accepted {
	206	+	next, accepted = p.state.next(output)
	207	+	}
	208	+	event := p.record(probeEvent{
	209	+	Kind: probeEventOutput,
	210	+	Accepted: accepted,
	211	+	StateBearing: output.New != 0,
	212	+	Epoch: output.Epoch,
	213	+	Base: output.Base,
	214	+	New: output.New,
	215	+	ViewRevision: output.ViewRevision,
	216	+	Full: output.Full,
	217	+	DataBytes: len(output.Data),
	218	+	})
	219	+	if !accepted {
	220	+	return visualOutputResult{event: event}
	221	+	}
	222	+
	223	+	// The client writes side effects as well as state-bearing frames, but only
	224	+	// state-bearing frames advance the dependency chain and receive an ACK.
	225	+	p.screen.Write(output.Data)
	226	+	p.state = next
	227	+	checkpoint := visualCheckpoint{event: event, state: p.state, snapshot: p.screen.Snapshot()}
	228	+	if len(p.checkpoints) == maxProbeCheckpoints {
	229	+	p.checkpoints = p.checkpoints[1:]
	230	+	}
	231	+	p.checkpoints = append(p.checkpoints, checkpoint)
	232	+	result := visualOutputResult{Accepted: true, StateBearing: output.New != 0, event: event}
	233	+	if result.StateBearing {
	234	+	result.Ack = ports.Ack{Epoch: output.Epoch, State: output.New}
	235	+	}
	236	+	return result
	237	+	}
	238	+
	239	+	func (p *visualProbe) text() string {
	240	+	if p == nil \|\| p.screen == nil {
	241	+	return ""
	242	+	}
	243	+	return visualScreenText(p.screen)
	244	+	}
	245	+
	246	+	func (p *visualProbe) contains(want string) bool {
	247	+	return strings.Contains(p.text(), want)
	248	+	}
	249	+
	250	+	func (p *visualProbe) markAcked(result visualOutputResult) {
	251	+	if result.event != nil && result.StateBearing && result.Accepted {
	252	+	result.event.Acked = true
	253	+	}
	254	+	}
	255	+
	256	+	func visualScreenText(screen *vt.Screen) string {
	257	+	if screen == nil {
	258	+	return ""
	259	+	}
	260	+	var text strings.Builder
	261	+	for y := range screen.Frame.Height {
	262	+	for x := range screen.Frame.Width {
	263	+	r := screen.Frame.At(x, y).Rune
	264	+	if r == 0 {
	265	+	r = ' '
	266	+	}
	267	+	text.WriteRune(r)
	268	+	}
	269	+	text.WriteByte('\n')
	270	+	}
	271	+	return text.String()
	272	+	}
	273	+
	274	+	func validateHandoffEventOrdering(events []*probeEvent) error {
	275	+	acceptedState := func(event *probeEvent) bool {
	276	+	return event != nil && event.Kind == probeEventOutput && event.Accepted && event.StateBearing && event.Acked
	277	+	}
	278	+	localOutput := eventIndex(events, func(event *probeEvent) bool {
	279	+	return event.Transport == "local-picker" && acceptedState(event)
	280	+	})
	281	+	handoff := eventIndex(events, func(event *probeEvent) bool {
	282	+	return event.Transport == "local-picker" && event.Kind == probeEventAttachTarget
	283	+	})
	284	+	selectedWelcome := eventIndex(events, func(event *probeEvent) bool {
	285	+	return event.Transport == "selected-remote" && event.Kind == probeEventWelcome
	286	+	})
	287	+	selectedOutput := eventIndex(events, func(event *probeEvent) bool {
	288	+	return event.Transport == "selected-remote" && acceptedState(event)
	289	+	})
	290	+	if localOutput < 0 \|\| handoff < 0 \|\| selectedWelcome < 0 \|\| selectedOutput < 0 {
	291	+	return fmt.Errorf("handoff trace omitted local output, direct handoff, selected welcome, or selected output")
	292	+	}
	293	+	if !(localOutput < handoff && handoff < selectedWelcome && selectedWelcome < selectedOutput) {
	294	+	return fmt.Errorf("handoff trace order was not local output, direct handoff, selected welcome, selected output")
	295	+	}
	296	+	return nil
	297	+	}
	298	+
	299	+	func eventIndex(events []probeEvent, match func(probeEvent) bool) int {
	300	+	for i, event := range events {
	301	+	if event != nil && match(event) {
	302	+	return i
	303	+	}
	304	+	}
	305	+	return -1
	306	+	}
	307	+
	308	+	type harnessArtifact struct {
	309	+	dir string
	310	+	probes []*visualProbe
	311	+	traces []*probeTrace
	312	+	}
	313	+
	314	+	func newHarnessArtifact(dir string) *harnessArtifact {
	315	+	if dir == "" {
	316	+	return nil
	317	+	}
	318	+	return &harnessArtifact{dir: dir}
	319	+	}
	320	+
	321	+	func (a harnessArtifact) registerProbe(probe visualProbe) {
	322	+	if a == nil \|\| probe == nil {
	323	+	return
	324	+	}
	325	+	a.probes = append(a.probes, probe)
	326	+	}
	327	+
	328	+	func (a harnessArtifact) registerTrace(trace probeTrace) {
	329	+	if a == nil \|\| trace == nil {
	330	+	return
	331	+	}
	332	+	a.traces = append(a.traces, trace)
	333	+	}
	334	+
	335	+	type artifactEvent struct {
	336	+	Sequence uint64 `json:"sequence"`
	337	+	Transport string `json:"transport"`
	338	+	Kind string `json:"kind"`
	339	+	Accepted bool `json:"accepted"`
	340	+	StateBearing bool `json:"state_bearing"`
	341	+	Acked bool `json:"acked"`
	342	+	Epoch uint64 `json:"epoch,omitempty"`
	343	+	Base uint64 `json:"base,omitempty"`
	344	+	New uint64 `json:"new,omitempty"`
	345	+	ViewRevision uint64 `json:"view_revision,omitempty"`
	346	+	Full bool `json:"full,omitempty"`
	347	+	DataBytes int `json:"data_bytes,omitempty"`
	348	+	}
	349	+
	350	+	type artifactCheckpoint struct {
	351	+	Sequence uint64 `json:"sequence"`
	352	+	Epoch uint64 `json:"epoch,omitempty"`
	353	+	State uint64 `json:"state,omitempty"`
	354	+	ViewRevision uint64 `json:"view_revision,omitempty"`
	355	+	Columns int `json:"columns"`
	356	+	Rows int `json:"rows"`
	357	+	CursorRow int `json:"cursor_row"`
	358	+	CursorColumn int `json:"cursor_column"`
	359	+	AlternateScreen bool `json:"alternate_screen"`
	360	+	BracketedPaste bool `json:"bracketed_paste"`
	361	+	SynchronizedUpdate bool `json:"synchronized_update"`
	362	+	}
	363	+
	364	+	type artifactProbe struct {
	365	+	Transport string `json:"transport"`
	366	+	Events []artifactEvent `json:"events"`
	367	+	Checkpoints []artifactCheckpoint `json:"checkpoints"`
	368	+	}
	369	+
	370	+	type artifactDocument struct {
	371	+	Version int `json:"version"`
	372	+	Passed bool `json:"passed"`
	373	+	Probes []artifactProbe `json:"probes"`
	374	+	Traces [][]artifactEvent `json:"traces,omitempty"`
	375	+	}
	376	+
	377	+	func (a *harnessArtifact) document(passed bool) artifactDocument {
	378	+	document := artifactDocument{Version: 1, Passed: passed}
	379	+	for _, probe := range a.probes {
	380	+	if probe == nil {
	381	+	continue
	382	+	}
	383	+	item := artifactProbe{Transport: probe.label}
	384	+	for _, event := range probe.events {
	385	+	if event == nil {
	386	+	continue
	387	+	}
	388	+	item.Events = append(item.Events, artifactEventFrom(event))
	389	+	}
	390	+	for _, checkpoint := range probe.checkpoints {
	391	+	snapshot := checkpoint.snapshot
	392	+	cursor := snapshot.Cursor()
	393	+	modes := snapshot.Modes()
	394	+	item.Checkpoints = append(item.Checkpoints, artifactCheckpoint{
	395	+	Sequence: checkpoint.event.Sequence,
	396	+	Epoch: checkpoint.state.epoch,
	397	+	State: checkpoint.state.state,
	398	+	ViewRevision: checkpoint.state.viewRevision,
	399	+	Columns: snapshot.Columns(),
	400	+	Rows: snapshot.Rows(),
	401	+	CursorRow: cursor.Row,
	402	+	CursorColumn: cursor.Col,
	403	+	AlternateScreen: modes.AlternateScreen,
	404	+	BracketedPaste: modes.BracketedPaste,
	405	+	SynchronizedUpdate: modes.SynchronizedUpdate,
	406	+	})
	407	+	}
	408	+	document.Probes = append(document.Probes, item)
	409	+	}
	410	+	for _, trace := range a.traces {
	411	+	if trace == nil {
	412	+	continue
	413	+	}
	414	+	var events []artifactEvent
	415	+	for _, event := range trace.events {
	416	+	if event != nil {
	417	+	events = append(events, artifactEventFrom(event))
	418	+	}
	419	+	}
	420	+	document.Traces = append(document.Traces, events)
	421	+	}
	422	+	return document
	423	+	}
	424	+
	425	+	func artifactEventFrom(event *probeEvent) artifactEvent {
	426	+	return artifactEvent{
	427	+	Sequence: event.Sequence,
	428	+	Transport: event.Transport,
	429	+	Kind: event.Kind,
	430	+	Accepted: event.Accepted,
	431	+	StateBearing: event.StateBearing,
	432	+	Acked: event.Acked,
	433	+	Epoch: event.Epoch,
	434	+	Base: event.Base,
	435	+	New: event.New,
	436	+	ViewRevision: event.ViewRevision,
	437	+	Full: event.Full,
	438	+	DataBytes: event.DataBytes,
	439	+	}
	440	+	}
	441	+
	442	+	func (a *harnessArtifact) write(passed bool) error {
	443	+	if a == nil \|\| a.dir == "" {
	444	+	return nil
	445	+	}
	446	+	data, err := json.MarshalIndent(a.document(passed), "", " ")
	447	+	if err != nil {
	448	+	return fmt.Errorf("marshal harness artifact: %w", err)
	449	+	}
	450	+	if len(data) > maxArtifactBytes {
	451	+	return fmt.Errorf("harness artifact exceeds %d bytes", maxArtifactBytes)
	452	+	}
	453	+	if err := os.MkdirAll(a.dir, 0o700); err != nil {
	454	+	return fmt.Errorf("create harness artifact directory: %w", err)
	455	+	}
	456	+	tmp, err := os.CreateTemp(a.dir, ".remote-picker-harness-*.tmp")
	457	+	if err != nil {
	458	+	return fmt.Errorf("create harness artifact: %w", err)
	459	+	}
	460	+	tmpName := tmp.Name()
	461	+	defer os.Remove(tmpName)
	462	+	if err := tmp.Chmod(0o600); err != nil {
	463	+	_ = tmp.Close()
	464	+	return fmt.Errorf("protect harness artifact: %w", err)
	465	+	}
	466	+	if _, err := tmp.Write(data); err != nil {
	467	+	_ = tmp.Close()
	468	+	return fmt.Errorf("write harness artifact: %w", err)
	469	+	}
	470	+	if err := tmp.Close(); err != nil {
	471	+	return fmt.Errorf("close harness artifact: %w", err)
	472	+	}
	473	+	if err := os.Rename(tmpName, filepath.Join(a.dir, "remote-picker-harness.json")); err != nil {
	474	+	return fmt.Errorf("publish harness artifact: %w", err)
	475	+	}
	476	+	return nil
	477	+	}

A scripts/remote-picker-harness/visual_probe_test.go +319 -0

@@ -0,0 +1,319 @@
	1	+	package main
	2	+
	3	+	import (
	4	+	"encoding/json"
	5	+	"errors"
	6	+	"os"
	7	+	"strings"
	8	+	"testing"
	9	+
	10	+	"github.com/bnema/vev/internal/domain"
	11	+	"github.com/bnema/vev/internal/ports"
	12	+	)
	13	+
	14	+	const (
	15	+	probeTestCols = 32
	16	+	probeTestRows = 2
	17	+	)
	18	+
	19	+	type probeTestTransport struct {
	20	+	sent []ports.Frame
	21	+	}
	22	+
	23	+	func (t *probeTestTransport) Send(frame ports.Frame) error {
	24	+	t.sent = append(t.sent, frame)
	25	+	return nil
	26	+	}
	27	+
	28	+	func (*probeTestTransport) Recv() (ports.Frame, error) { return ports.Frame{}, errors.New("not used") }
	29	+	func (*probeTestTransport) Close() error { return nil }
	30	+
	31	+	func probeTestOutput(t *testing.T, output ports.Output) ports.Frame {
	32	+	t.Helper()
	33	+	payload, err := ports.MarshalOutput(output)
	34	+	if err != nil {
	35	+	t.Fatalf("marshal output: %v", err)
	36	+	}
	37	+	return ports.Frame{Type: ports.MsgOutput, Payload: payload}
	38	+	}
	39	+
	40	+	func TestVisualProbePersistsFullAndIncrementalOutput(t *testing.T) {
	41	+	size := domain.Size{Cols: probeTestCols, Rows: probeTestRows}
	42	+	probe := newVisualProbe(size)
	43	+	for _, tt := range []struct {
	44	+	name string
	45	+	output ports.Output
	46	+	want string
	47	+	state uint64
	48	+	}{
	49	+	{
	50	+	name: "full",
	51	+	output: ports.Output{Epoch: 1, New: 1, Full: true, ViewRevision: 4, Size: size, Data: []byte("full")},
	52	+	want: "full",
	53	+	state: 1,
	54	+	},
	55	+	{
	56	+	name: "incremental",
	57	+	output: ports.Output{Epoch: 1, Base: 1, New: 2, ViewRevision: 4, Size: size, Data: []byte(" incremental")},
	58	+	want: "full incremental",
	59	+	state: 2,
	60	+	},
	61	+	} {
	62	+	t.Run(tt.name, func(t *testing.T) {
	63	+	result := probe.apply(tt.output)
	64	+	if !result.Accepted \|\| !result.StateBearing {
	65	+	t.Fatalf("result = %+v, want accepted state-bearing output", result)
	66	+	}
	67	+	if result.Ack.Epoch != tt.output.Epoch \|\| result.Ack.State != tt.state {
	68	+	t.Fatalf("ack = %+v, want epoch=%d state=%d", result.Ack, tt.output.Epoch, tt.state)
	69	+	}
	70	+	if !strings.Contains(probe.text(), tt.want) {
	71	+	t.Fatalf("screen = %q, want %q", probe.text(), tt.want)
	72	+	}
	73	+	if probe.state.state != tt.state {
	74	+	t.Fatalf("state = %d, want %d", probe.state.state, tt.state)
	75	+	}
	76	+	})
	77	+	}
	78	+	if got := len(probe.checkpoints); got != 2 {
	79	+	t.Fatalf("checkpoints = %d, want 2", got)
	80	+	}
	81	+	if got := len(probe.events); got != 2 {
	82	+	t.Fatalf("events = %d, want 2", got)
	83	+	}
	84	+	}
	85	+
	86	+	func TestVisualProbeRejectsOutputWithoutMutationOrAck(t *testing.T) {
	87	+	size := domain.Size{Cols: probeTestCols, Rows: probeTestRows}
	88	+	for _, tt := range []struct {
	89	+	name string
	90	+	output ports.Output
	91	+	}{
	92	+	{
	93	+	name: "base gap",
	94	+	output: ports.Output{Epoch: 1, Base: 0, New: 3, Full: true, ViewRevision: 4, Size: size, Data: []byte("rejected")},
	95	+	},
	96	+	{
	97	+	name: "revision gap",
	98	+	output: ports.Output{Epoch: 1, Base: 1, New: 2, ViewRevision: 5, Size: size, Data: []byte("rejected")},
	99	+	},
	100	+	{
	101	+	name: "stale epoch",
	102	+	output: ports.Output{Epoch: 0, Base: 1, New: 2, ViewRevision: 4, Size: size, Data: []byte("rejected")},
	103	+	},
	104	+	} {
	105	+	t.Run(tt.name, func(t *testing.T) {
	106	+	probe := newVisualProbe(size)
	107	+	first := ports.Output{Epoch: 1, New: 1, Full: true, ViewRevision: 4, Size: size, Data: []byte("keep")}
	108	+	if result := probe.apply(first); !result.Accepted {
	109	+	t.Fatal("seed output was rejected")
	110	+	}
	111	+	beforeText, beforeState, beforeCheckpoints := probe.text(), probe.state, len(probe.checkpoints)
	112	+	result := probe.apply(tt.output)
	113	+	if result.Accepted \|\| result.StateBearing \|\| result.Ack != (ports.Ack{}) {
	114	+	t.Fatalf("result = %+v, want rejected output without ACK", result)
	115	+	}
	116	+	if got := probe.text(); got != beforeText {
	117	+	t.Fatalf("screen changed from %q to %q", beforeText, got)
	118	+	}
	119	+	if probe.state != beforeState {
	120	+	t.Fatalf("state = %+v, want unchanged %+v", probe.state, beforeState)
	121	+	}
	122	+	if len(probe.checkpoints) != beforeCheckpoints {
	123	+	t.Fatalf("checkpoints = %d, want %d", len(probe.checkpoints), beforeCheckpoints)
	124	+	}
	125	+	})
	126	+	}
	127	+	}
	128	+
	129	+	func TestVisualProbeSideEffectsApplyWithoutAck(t *testing.T) {
	130	+	size := domain.Size{Cols: probeTestCols, Rows: probeTestRows}
	131	+	for _, tt := range []struct {
	132	+	name string
	133	+	seed *ports.Output
	134	+	effect ports.Output
	135	+	}{
	136	+	{
	137	+	name: "before state-bearing output",
	138	+	effect: ports.Output{Epoch: 1, Size: size, Data: []byte("side effect")},
	139	+	},
	140	+	{
	141	+	name: "after state-bearing output",
	142	+	seed: &ports.Output{Epoch: 1, New: 1, Full: true, ViewRevision: 4, Size: size, Data: []byte("seed")},
	143	+	effect: ports.Output{Epoch: 1, ViewRevision: 4, Size: size, Data: []byte(" side effect")},
	144	+	},
	145	+	} {
	146	+	t.Run(tt.name, func(t *testing.T) {
	147	+	probe := newVisualProbe(size)
	148	+	if tt.seed != nil && !probe.apply(*tt.seed).Accepted {
	149	+	t.Fatal("seed output was rejected")
	150	+	}
	151	+	beforeState, beforeCheckpoints := probe.state, len(probe.checkpoints)
	152	+	result := probe.apply(tt.effect)
	153	+	if !result.Accepted \|\| result.StateBearing \|\| result.Ack != (ports.Ack{}) {
	154	+	t.Fatalf("result = %+v, want accepted side effect without ACK", result)
	155	+	}
	156	+	if !strings.Contains(probe.text(), string(tt.effect.Data)) {
	157	+	t.Fatalf("screen = %q, want side effect %q", probe.text(), tt.effect.Data)
	158	+	}
	159	+	if probe.state != beforeState {
	160	+	t.Fatalf("state = %+v, want unchanged %+v", probe.state, beforeState)
	161	+	}
	162	+	if len(probe.checkpoints) != beforeCheckpoints+1 {
	163	+	t.Fatalf("checkpoints = %d, want %d", len(probe.checkpoints), beforeCheckpoints+1)
	164	+	}
	165	+	})
	166	+	}
	167	+	}
	168	+
	169	+	func TestProcessOutputFrameACKsOnlyAcceptedStateBearingFrames(t *testing.T) {
	170	+	size := domain.Size{Cols: probeTestCols, Rows: probeTestRows}
	171	+	for _, tt := range []struct {
	172	+	name string
	173	+	output ports.Output
	174	+	wantAck bool
	175	+	wantReset bool
	176	+	}{
	177	+	{
	178	+	name: "accepted full",
	179	+	output: ports.Output{Epoch: 1, New: 1, Full: true, ViewRevision: 4, Size: size, Data: []byte("full")},
	180	+	wantAck: true,
	181	+	},
	182	+	{
	183	+	name: "accepted side effect",
	184	+	output: ports.Output{Epoch: 1, Size: size, Data: []byte("side effect")},
	185	+	},
	186	+	{
	187	+	name: "rejected state",
	188	+	output: ports.Output{Epoch: 1, New: 3, Full: true, ViewRevision: 4, Size: size, Data: []byte("gap")},
	189	+	wantReset: true,
	190	+	},
	191	+	} {
	192	+	t.Run(tt.name, func(t *testing.T) {
	193	+	transport := &probeTestTransport{}
	194	+	tr := &harnessTransport{Transport: transport, probe: newVisualProbe(size)}
	195	+	if tt.name == "rejected state" {
	196	+	seed := probeTestOutput(t, ports.Output{Epoch: 1, New: 1, Full: true, ViewRevision: 4, Size: size, Data: []byte("seed")})
	197	+	if err := processOutputFrame(tr, seed); err != nil {
	198	+	t.Fatal(err)
	199	+	}
	200	+	transport.sent = nil
	201	+	}
	202	+	if err := processOutputFrame(tr, probeTestOutput(t, tt.output)); err != nil {
	203	+	t.Fatal(err)
	204	+	}
	205	+	var ackCount, resetCount int
	206	+	for _, frame := range transport.sent {
	207	+	switch frame.Type {
	208	+	case ports.MsgAck:
	209	+	ackCount++
	210	+	case ports.MsgOutputResetRequest:
	211	+	resetCount++
	212	+	}
	213	+	}
	214	+	if (ackCount > 0) != tt.wantAck {
	215	+	t.Fatalf("ACK count = %d, want ACK = %t", ackCount, tt.wantAck)
	216	+	}
	217	+	if (resetCount > 0) != tt.wantReset {
	218	+	t.Fatalf("reset count = %d, want reset = %t", resetCount, tt.wantReset)
	219	+	}
	220	+	})
	221	+	}
	222	+	}
	223	+
	224	+	func TestHandoffEventOrdering(t *testing.T) {
	225	+	event := func(transport, kind string, accepted bool) *probeEvent {
	226	+	result := &probeEvent{Transport: transport, Kind: kind, Accepted: accepted}
	227	+	if kind == probeEventOutput && accepted {
	228	+	result.StateBearing = true
	229	+	result.Acked = true
	230	+	}
	231	+	return result
	232	+	}
	233	+	for _, tt := range []struct {
	234	+	name string
	235	+	events []*probeEvent
	236	+	wantErr bool
	237	+	}{
	238	+	{
	239	+	name: "direct handoff order",
	240	+	events: []*probeEvent{
	241	+	event("local-picker", probeEventWelcome, true),
	242	+	event("local-picker", probeEventOutput, true),
	243	+	event("local-picker", probeEventAttachTarget, true),
	244	+	event("selected-remote", probeEventWelcome, true),
	245	+	event("selected-remote", probeEventOutput, true),
	246	+	},
	247	+	},
	248	+	{
	249	+	name: "selected output arrived before welcome",
	250	+	events: []*probeEvent{
	251	+	event("local-picker", probeEventOutput, true),
	252	+	event("local-picker", probeEventAttachTarget, true),
	253	+	event("selected-remote", probeEventOutput, true),
	254	+	event("selected-remote", probeEventWelcome, true),
	255	+	},
	256	+	wantErr: true,
	257	+	},
	258	+	{
	259	+	name: "rejected local output does not characterize handoff",
	260	+	events: []*probeEvent{
	261	+	event("local-picker", probeEventOutput, false),
	262	+	event("local-picker", probeEventAttachTarget, true),
	263	+	event("selected-remote", probeEventWelcome, true),
	264	+	event("selected-remote", probeEventOutput, true),
	265	+	},
	266	+	wantErr: true,
	267	+	},
	268	+	{
	269	+	name: "unacknowledged local output does not characterize handoff",
	270	+	events: []*probeEvent{
	271	+	{Transport: "local-picker", Kind: probeEventOutput, Accepted: true},
	272	+	event("local-picker", probeEventAttachTarget, true),
	273	+	event("selected-remote", probeEventWelcome, true),
	274	+	event("selected-remote", probeEventOutput, true),
	275	+	},
	276	+	wantErr: true,
	277	+	},
	278	+	} {
	279	+	t.Run(tt.name, func(t *testing.T) {
	280	+	err := validateHandoffEventOrdering(tt.events)
	281	+	if (err != nil) != tt.wantErr {
	282	+	t.Fatalf("error = %v, want error = %t", err, tt.wantErr)
	283	+	}
	284	+	})
	285	+	}
	286	+	}
	287	+
	288	+	func TestHarnessArtifactIsBoundedAndContainsOnlyMetadata(t *testing.T) {
	289	+	dir := t.TempDir()
	290	+	artifact := newHarnessArtifact(dir)
	291	+	probe := newVisualProbe(domain.Size{Cols: probeTestCols, Rows: probeTestRows})
	292	+	probe.configure("local-picker", nil)
	293	+	artifact.registerProbe(probe)
	294	+	secret := "not-for-artifact"
	295	+	if result := probe.apply(ports.Output{Epoch: 1, New: 1, Full: true, Size: domain.Size{Cols: probeTestCols, Rows: probeTestRows}, Data: []byte(secret)}); !result.Accepted {
	296	+	t.Fatal("probe output was rejected")
	297	+	}
	298	+	if err := artifact.write(true); err != nil {
	299	+	t.Fatal(err)
	300	+	}
	301	+	path := dir + "/remote-picker-harness.json"
	302	+	data, err := os.ReadFile(path)
	303	+	if err != nil {
	304	+	t.Fatal(err)
	305	+	}
	306	+	if len(data) > maxArtifactBytes {
	307	+	t.Fatalf("artifact bytes = %d, want <= %d", len(data), maxArtifactBytes)
	308	+	}
	309	+	if strings.Contains(string(data), secret) {
	310	+	t.Fatal("artifact contained raw output")
	311	+	}
	312	+	var document artifactDocument
	313	+	if err := json.Unmarshal(data, &document); err != nil {
	314	+	t.Fatalf("artifact JSON: %v", err)
	315	+	}
	316	+	if !document.Passed \|\| len(document.Probes) != 1 \|\| len(document.Probes[0].Checkpoints) != 1 {
	317	+	t.Fatalf("artifact document = %+v, want one passed probe checkpoint", document)
	318	+	}
	319	+	}