@junghanacs/entwurf 0.18.2 → 0.19.0

package/pi-extensions/lib/mux-placement.ts

@@ -8,11 +8,17 @@
  * session the operator is looking at. Inheriting the environment IS the addressing: this
  * module never takes a socket path or a session name from a caller.
  *
+ * That sentence is still exactly true of THIS leaf, and #105 is where it started to be worth
+ * saying precisely. The fresh-call composition above may now be handed one session NAME by its
+ * caller, but it resolves that name to a native `$id` through its own leaf before anything
+ * reaches here — `appendWindow` still appends only to the caller's own session, and no function
+ * in this file has ever seen or will see a session name.
+ *
  * Three actions, deliberately not four:
  *
  *   inspectPlacement()   the caller's own $session/@window/%pane, or a named refusal
  *   appendWindow()       one default-shell window at the end of that same session
- *   closeWindow()        that window, by stable id, in the context it was opened in
+ *   closeWindow()        that window, by stable id, on the server it was opened on
  *
  * What this module is NOT: a delivery transport, an address, a liveness fact, a launcher.
  * It opens a place. `entwurf_v2` still owns delivery (`V2-DELIVERY-EXCLUDES-MUX`), and
@@ -51,8 +57,20 @@
  * 4. BINDING. A `Placement` is a fact about one server and one session, and the environment
  *    passed to a later call could name a different — or restarted — server where the same
  *    `$3`/`@7` mean something else entirely. Every mutation re-reads the caller's placement
- *    and refuses unless the server pid and session id still match the ones the handle was
- *    born in.
+ *    before it runs.
+ *
+ *    The two mutations bind to DIFFERENT halves of that fact, because they are answering
+ *    different questions. `appendWindow` asks "is the target the caller gave me still the
+ *    caller's own seat?" and needs both halves — `isSameContext`. `closeWindow` asks "is this
+ *    handle still the window it was born as?" and needs only the SERVER half — a `@id` is
+ *    unique for the life of one server, so the session half adds nothing there. `[측정
+ *    2026-09-07, private server]` ids are handed out monotonically and are never recycled:
+ *    after `@2` was killed the next window was `@3`, and after a whole session holding `@4`
+ *    and `@5` was killed the next was `@6`. Requiring the handle's session to still exist
+ *    would also break the more informative answer below — a window whose session is gone is
+ *    `already-gone`, which is a fact the caller wants, not an error. Since #105 a launched
+ *    window may legitimately live in a session that is not the caller's, and that is exactly
+ *    when this distinction stops being academic.
  *
  * The machine-readable rows carry ONLY native ids and decimal numbers, joined by `|`. The
  * free-form fields tmux could also report (`socket_path`, `session_name`) are deliberately
@@ -124,10 +142,13 @@ export interface Placement {
 }
 
 /**
- * A window this module opened, carrying the context it was born in. `serverPid`/`sessionId`
- * are what let a later close prove it is acting on the same server and session rather than a
- * restarted one that happens to reuse the id. Index is reported for the human, never used as
- * a handle.
+ * A window this module opened, carrying the context it was born in. `serverPid` is what a later
+ * close binds to: a restarted tmux server hands out `@7` again, so without it a close could act
+ * on some other server's window. `sessionId` rides along as the RECEIPT of where the window was
+ * put — since #105 that may be a session other than the caller's — and it is deliberately not a
+ * close precondition, because `@id`s are unique for one server's whole life (measured: after
+ * `@2` was killed the next window was `@3`, and after a session holding `@4`/`@5` was killed the
+ * next was `@6`). Index is reported for the human, never used as a handle.
  */
 export interface WindowHandle {
 	serverPid: string;
@@ -358,6 +379,40 @@ export function requireSameContext(label: string, origin: PlacementContext, env:
 	}
 }
 
+/**
+ * Same server, whatever the session. The close-side half of boundary 4, kept as its own pure
+ * predicate for the same reason `isSameContext` is one: the decision is what a deterministic
+ * gate can pin, and the re-read around it is not.
+ */
+export function isSameServer(origin: PlacementContext, now: PlacementContext): boolean {
+	return origin.serverPid === now.serverPid;
+}
+
+/**
+ * Re-read the caller's placement and refuse unless the handle was born on the SAME SERVER. The
+ * close-side half of boundary 4, and deliberately NOT `requireSameContext`: since #105 a handle
+ * can name a window in a session that is not the caller's, and the session half would refuse a
+ * legitimate close. What it must still refuse is a handle from a DIFFERENT — or restarted —
+ * server, where `@7` names some other window entirely.
+ *
+ * The session half is not lost, it is covered better: `@id`s are unique for one server's whole
+ * life (measured — see boundary 4), so on a matching server the id alone identifies the window,
+ * and a window whose session has since been killed is proven absent by `closeWindow`'s own
+ * `list-windows -a` read and reported as `already-gone`.
+ */
+export function requireSameServer(label: string, origin: PlacementContext, env: NodeJS.ProcessEnv): void {
+	const now = inspectPlacement(env);
+	if (!now.ok) {
+		throw new Error(`mux-placement: ${label} refused — the caller's placement is not resolvable (${now.reason})`);
+	}
+	if (!isSameServer(origin, now.placement)) {
+		throw new Error(
+			`mux-placement: ${label} refused — server changed (handle was born on server ${origin.serverPid}, ` +
+				`this environment names server ${now.placement.serverPid})`,
+		);
+	}
+}
+
 /** One detached default-shell window at the end of the caller's own session. */
 export function appendWindow(placement: Placement, env: NodeJS.ProcessEnv = process.env): WindowHandle {
 	requireSameContext("appendWindow", placement, env);
@@ -367,11 +422,11 @@ export function appendWindow(placement: Placement, env: NodeJS.ProcessEnv = proc
 }
 
 /**
- * Close one window by stable id, in the context it was opened in. Reports whether it was
- * closed or had already gone.
+ * Close one window by stable id, on the server it was opened on. Reports whether it was closed
+ * or had already gone. The binding is the server, not the session — see `requireSameServer`.
  */
 export function closeWindow(handle: WindowHandle, env: NodeJS.ProcessEnv = process.env): CloseOutcome {
-	requireSameContext("closeWindow", handle, env);
+	requireSameServer("closeWindow", handle, env);
 	const run = runTmux(buildCloseArgs(handle.windowId), env);
 	if (run.status === 0) return "closed";
 	// A signal kill is not a "tmux said no" — it is the call failing, and it carries no

package/pi-extensions/lib/resolve-tmux-session.ts

@@ -0,0 +1,137 @@
+/**
+ * resolve-tmux-session — the ONE resolution of a caller-supplied tmux SESSION NAME into the
+ * native `$id` a placement may target. Narrow leaf of the fresh-call composition (#105); it
+ * owns the name grammar and the name→id lookup and NOTHING else — it never runs tmux (the
+ * runner is injected), never phrases a hint (each consumer owns its own wording), never
+ * creates a session, and has no fallback session.
+ *
+ * Same shape and same discipline as `classify-tmux-cwd.ts`: this file imports nothing at all,
+ * not even a node builtin, so it stays deletable on its own and cannot acquire an opinion
+ * about mux, entwurf, identity or delivery. The injected runner is matched STRUCTURALLY to
+ * `mux-placement.TmuxRun` rather than by a type import, for the same reason.
+ *
+ * Every rule below is a MEASURED tmux 3.6a behaviour (2026-09-07, private `-S` servers; the
+ * research lane's two independent reproductions are in issue #105's thread), and each one is a
+ * way a lookup would look successful while addressing the wrong thing:
+ *
+ *   1. `-t '=NAME'` performs NO format expansion — `=a}b`, `=a|b`, `=a b`, `=a,b` all resolve
+ *      exactly. The `-f '#{==:#{session_name},NAME}'` FILTER engine does the opposite: a `}`
+ *      inside the name closes the comparison early, the filter becomes a truthy string, and
+ *      EVERY session matches (6/6 measured). So the engine here is `-t '='`, never a filter.
+ *   2. absence is reported by EXIT CODE, not by output. `list-windows -t '=nosuch'` exits 1
+ *      with `can't find session: nosuch`, while `display-message -p -t '=NAME'` exits 0 with
+ *      EMPTY output for a name that exists AND for one that does not — it is unusable as a
+ *      probe. Only an rc=0 answer is ever parsed here.
+ *   3. some names cannot be addressed at all, for two different measured reasons. `#` is
+ *      FORMAT-EXPANDED when `new-session -s` stores it (`a#{x}` stored as `a`), so the
+ *      requested name never exists; and `.`/`:` are tmux's own PANE/WINDOW separators inside a
+ *      `-t` target, so the requested name is SPLIT before any session is matched. Measured
+ *      with this leaf's own engine: `list-windows -t '=my.project'` → rc=1
+ *      `can't find pane: project`, and `list-windows -t '=my:project'` → rc=1
+ *      `can't find session: my`. The exact wording is NOT contract — it moves with which
+ *      sessions happen to exist (`can't find window: project` once a session `my` is there) —
+ *      the fact is that the split happens at all. Both characters are ALSO normalised to `_`
+ *      when stored, so `a.b` and `a:b` are the same stored name `a_b` and whichever is created
+ *      second is a `duplicate session` error rather than a second seat. The lookup half is the
+ *      load-bearing one: whatever tmux stored, the REQUESTED name can never address it.
+ *      NOTE the difference from `classify-tmux-cwd.ts`: there `#(…)`
+ *      was observed EXECUTING inside a `-c` value; here it expands but does NOT execute (a
+ *      `q#(touch …)q` name stored as `qq` and wrote no file). Do not copy that leaf's
+ *      rationale into this one, or relaxing one will silently relax the other.
+ *   4. `=` protects a name against `%9`/`@1` id syntax but NOT against `$`: with a session
+ *      NAMED `$0` beside one whose ID is `$0`, `-t '=$0'` resolves the ID (measured — the
+ *      name-holder was `$1` and the lookup returned `$0`). And a session literally named
+ *      `=foo` needs `==foo`. An escaping layer here would be a second parser to keep true.
+ *
+ * The grammar is `^[A-Za-z0-9][A-Za-z0-9_-]*$`, and it is WIDER than what rules 3-4 force. Say
+ * that plainly rather than letting the reasons above cover the whole refusal set: `a}b`, `a|b`,
+ * `a b`, `a;b`, `a,b` and `_a` are all created verbatim AND resolved exactly by `-t '=NAME'`
+ * (measured 2026-09-07, one server, six sessions, six exact ids). They are refused anyway, and
+ * the reason is a DECISION, not a tmux limit — this is the grammar entwurf would need to CREATE
+ * a session safely, kept symmetric for lookup, with the remaining foreign-name width closed
+ * until an operator need for it is actually observed. That is why the refusal is
+ * `tmux-session-name-invalid` ("this rail does not address that shape") and not
+ * `tmux-session-missing` ("no such session here"): the caller's repair differs, and telling an
+ * operator their perfectly findable session "could never be found" would be a false cause.
+ *
+ * ONE BOUNDED IMPRECISION, STATED RATHER THAN LAUNDERED: rc≠0 also covers "no server running
+ * on <socket>" (measured). This leaf reads every rc≠0 as `tmux-session-missing`, so a server
+ * that died between the caller's context proof and this lookup is reported under the narrower
+ * word. That is safe — both readings are refusals that mutate nothing, and the consumer's hint
+ * names both — and it is preferred over matching tmux's own stderr text, which would pin this
+ * leaf to one vendor version's wording.
+ */
+
+/** Why a caller-named session could not become a target. Two stable literals — the consuming
+ * composition widens its own reject union with this type, so the strings are contract. */
+export type TmuxSessionRejectReason = "tmux-session-name-invalid" | "tmux-session-missing";
+
+/** What the injected runner returns. Structurally identical to `mux-placement.TmuxRun`; kept
+ * as its own declaration so this leaf imports nothing. */
+export interface TmuxSessionLookupRun {
+	status: number | null;
+	stdout: string;
+	stderr: string;
+}
+
+export type TmuxSessionLookupResult = { ok: true; sessionId: string } | { ok: false; reason: TmuxSessionRejectReason };
+
+const SESSION_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+const SESSION_ID = /^\$[0-9]+$/;
+
+/**
+ * Classify a candidate session NAME. Separate from the lookup because the operator's next move
+ * differs: an out-of-grammar name is a shape this rail does not address — some of those tmux
+ * genuinely cannot resolve (rules 3-4), others it resolves fine and this rail declines anyway —
+ * while a missing session is something the operator creates and retries.
+ */
+export function classifyTmuxSessionName(name: string): "tmux-session-name-invalid" | null {
+	return SESSION_NAME.test(name) ? null : "tmux-session-name-invalid";
+}
+
+/** The lookup argv. `-t '=NAME'` is the exact-name selector; `list-windows` is the engine that
+ * answers with an exit code for absence. The builder re-validates rather than trusting its
+ * caller, the same way the fresh-call argv builder re-checks a cwd. */
+export function buildTmuxSessionLookupArgs(name: string): string[] {
+	if (classifyTmuxSessionName(name)) {
+		throw new Error(`resolve-tmux-session: refusing to build a lookup for an unresolvable session name: ${name}`);
+	}
+	return ["list-windows", "-t", `=${name}`, "-F", "#{session_id}"];
+}
+
+/**
+ * Resolve a session name to its native `$id` on whatever server the runner's environment names.
+ * The id is the ONLY thing a caller-supplied name is allowed to become: everything downstream
+ * targets `$id`, never the name again.
+ *
+ * A session always holds at least one window, so an rc=0 answer prints one `$id` line per
+ * window and they are all the same id. An rc=0 that cannot be read that way is an operational
+ * anomaly, not an answer about the session, and is raised rather than turned into a refusal.
+ */
+export function resolveTmuxSessionId(
+	name: string,
+	run: (args: string[]) => TmuxSessionLookupRun,
+): TmuxSessionLookupResult {
+	const badName = classifyTmuxSessionName(name);
+	if (badName) return { ok: false, reason: badName };
+	const result = run(buildTmuxSessionLookupArgs(name));
+	// A signalled call is not tmux answering — it carries no information about the session at
+	// all, so it must never be read as absence.
+	if (result.status === null) {
+		throw new Error(
+			`resolve-tmux-session: the lookup for session "${name}" was killed by a signal: ${result.stderr.trim()}`,
+		);
+	}
+	if (result.status !== 0) return { ok: false, reason: "tmux-session-missing" };
+	const lines = result.stdout
+		.split("\n")
+		.map((line) => line.trim())
+		.filter((line) => line.length > 0);
+	const first = lines[0];
+	if (first === undefined || !SESSION_ID.test(first) || lines.some((line) => line !== first)) {
+		throw new Error(
+			`resolve-tmux-session: tmux answered rc=0 for session "${name}" with something that is not one native session id: ${JSON.stringify(result.stdout)}`,
+		);
+	}
+	return { ok: true, sessionId: first };
+}

package/scripts/check-fresh-cut-gate.sh

@@ -403,12 +403,44 @@ fi
 # #86 A5 credential tripwire: the retired sync_auth mutation (OAuth alias copy +
 # auth.json.bak) must never resurrect as an invocable surface in run.sh. Comments
 # documenting the removal are allowed; a function definition or call is not.
-if awk '!/^[[:space:]]*#/' "$REPO/run.sh" | grep -q 'sync_auth'; then
+# THE PREDICATE IS A FUNCTION so the self-test below can run the SAME code against a planted
+# fixture. A self-test that re-typed this pipeline would keep passing while the real one went
+# blind, which is precisely the failure this cell exists to prevent.
+#
+# `grep -c`, never `grep -q`. This file runs under pipefail, and a `-q` grep exits at the FIRST
+# match, closing the pipe while `awk` is still writing the remaining ~200KB of a 433KB run.sh.
+# `awk` dies of SIGPIPE (141), pipefail promotes that to the pipeline's status, and the `if`
+# takes the ELSE branch — so this tripwire went blind EXACTLY when a sync_auth surface existed
+# and reported "no credential surface remains". Unlike the omp doctor's load-dependent race this
+# one was deterministic, because the producer is far larger than the pipe buffer.
+sync_auth_surface_count() {
+  awk '!/^[[:space:]]*#/' "$1" | grep -c 'sync_auth' || true
+}
+sync_auth_hits="$(sync_auth_surface_count "$REPO/run.sh")"
+if [ "${sync_auth_hits:-0}" -gt 0 ]; then
   bad "D4b the retired sync_auth credential mutation reappeared as code in run.sh"
 else
   ok "D4b no sync_auth credential surface remains in run.sh (comments only)"
 fi
 
+# D4b-self. The cell above is green on a clean run.sh — which is exactly the state in which a
+# blind tripwire and a working one are indistinguishable. This plants the surface it exists to
+# catch and requires the SAME predicate to see it. The plant goes NEAR THE TOP of the real,
+# large run.sh on purpose: the defect only appears when the consumer can exit while the producer
+# still has bulk left to write, so a small synthetic fixture would pass even with `grep -q` and
+# would prove nothing. It is a copy under mktemp; run.sh is never written.
+fc_probe="$(mktemp -t fresh-cut-syncauth-probe.XXXXXX)"
+awk 'NR==2{print "sync_auth() { cp \"$HOME/.claude/.credentials.json\" \"$HOME/.claude/auth.json.bak\"; }"}1' \
+  "$REPO/run.sh" >"$fc_probe"
+fc_planted="$(sync_auth_surface_count "$fc_probe")"
+fc_clean="$(sync_auth_surface_count "$REPO/run.sh")"
+rm -f "$fc_probe"
+if [ "${fc_planted:-0}" -gt 0 ] && [ "${fc_clean:-0}" -eq 0 ]; then
+  ok "D4b-self the tripwire actually FIRES on a planted sync_auth surface (planted=$fc_planted clean=$fc_clean)"
+else
+  bad "[QK:FRESHCUT-SYNCAUTH-TRIPWIRE-FIRES] D4b's predicate did not see a planted sync_auth surface (planted=$fc_planted clean=$fc_clean) — the credential tripwire is blind and a green D4b means nothing"
+fi
+
 ilp_gate=$(awk '/^install_local_package\(\)/,/^}/{ if ($0 ~ /preflight_v3_store install/) { print NR; exit } }' "$REPO/run.sh")
 ilp_write=$(awk '/^install_local_package\(\)/,/^}/{ if ($0 ~ /register-pi-package.py|mkdir -p "\$project_dir/) { print NR; exit } }' "$REPO/run.sh")
 if [ -n "$ilp_gate" ] && [ -n "$ilp_write" ] && [ "$ilp_gate" -lt "$ilp_write" ]; then
@@ -425,12 +457,32 @@ else
   bad "D6 meta-bridge-install.sh's doctor call is missing or sits after the state snapshot (doctor=$mb_gate prepare=$mb_write)"
 fi
 
-if grep -n 'preflight_v3_store()' -A 40 "$REPO/run.sh" | grep -qE 'run_ts scripts/meta-bridge-fresh-cut\.ts'; then
+# Same hazard as D4b. This producer happens to emit less than one pipe buffer today, so
+# no SIGPIPE window exists — but that is a size coincidence, not a property, and it moves
+# the moment run.sh grows another match. Counted rather than short-circuited.
+preflight_cut_count() {
+  grep -n 'preflight_v3_store()' -A 40 "$1" | grep -cE 'run_ts scripts/meta-bridge-fresh-cut\.ts' || true
+}
+cut_in_preflight="$(preflight_cut_count "$REPO/run.sh")"
+if [ "${cut_in_preflight:-0}" -gt 0 ]; then
   bad "D7 the preflight invokes fresh-cut — an install must never cut a generation by itself"
 else
   ok "D7 the preflight only ever asks the doctor (never runs the cut)"
 fi
 
+# D7-self, same argument as D4b-self: a forbidding cell that is green on a clean tree proves
+# nothing until it is shown catching the thing it forbids. A synthetic fixture is enough here
+# because this producer has no SIGPIPE window to reproduce — what is being proven is detection.
+d7_probe="$(mktemp -t fresh-cut-preflight-probe.XXXXXX)"
+printf '%s\n' 'preflight_v3_store() {' '  run_ts scripts/meta-bridge-fresh-cut.ts' '}' >"$d7_probe"
+d7_planted="$(preflight_cut_count "$d7_probe")"
+rm -f "$d7_probe"
+if [ "${d7_planted:-0}" -gt 0 ] && [ "${cut_in_preflight:-0}" -eq 0 ]; then
+  ok "D7-self the cell actually FIRES on a preflight that does call fresh-cut (planted=$d7_planted real=$cut_in_preflight)"
+else
+  bad "[QK:FRESHCUT-PREFLIGHT-CUT-DETECTED] D7's predicate did not see a planted fresh-cut call in a preflight (planted=$d7_planted real=$cut_in_preflight)"
+fi
+
 if [ -e "$FRESH_CUT_GATE_CLAUDE_SENTINEL" ]; then
   bad "D8 an offline gate drive crossed the store refusal and invoked Claude" "$(cat "$FRESH_CUT_GATE_CLAUDE_SENTINEL")"
 else

package/scripts/check-gate-qualification.ts

@@ -834,20 +834,20 @@ let manifestCount: number;
 		"copilot-birth": 19,
 		"copilot-launch": 14,
 		"copilot-receive": 18,
-		"fresh-cut": 1,
+		"fresh-cut": 3,
 		"gate-qualification": 2,
 		"meta-facts": 4,
 		"meta-hook-session-switch": 17,
 		"meta-identity": 4,
 		"meta-retire": 3,
-		"mux-boundary": 14,
-		"mux-fresh-call": 37,
+		"mux-boundary": 16,
+		"mux-fresh-call": 44,
 		"mux-launcher-fence": 7,
 		"mux-parent-artifact": 3,
 		"pack-install": 2,
 		"pi-package-ownership": 6,
 		"mux-resume-call": 12,
-		"omp-birth": 11,
+		"omp-birth": 12,
 		"omp-fresh": 24,
 		"omp-receive": 11,
 		"probe-ordering": 1,

package/scripts/check-mux-launch-tmux.ts

@@ -24,6 +24,9 @@
  *     is still listed on an immediate re-read — which is why no post-launch presence check is
  *     performed and why the precondition runs before the window exists
  *   - a precondition refusal opens NO window at all
+ *   - the #105 seat, through the real `freshCall`: an absent seat refuses and creates nothing,
+ *     an existing one puts the window in THAT session with a receipt naming the resolved
+ *     target, and the resulting handle closes through `closeWindow` from outside that session
  */
 
 import assert from "node:assert/strict";
@@ -97,7 +100,7 @@ function alive(pid: string): boolean {
 	}
 }
 
-function main(): void {
+async function main(): Promise<void> {
 	if (spawnSync("tmux", ["-V"], { encoding: "utf8" }).status !== 0) {
 		skipLive(LABEL, "tmux is not installed — install tmux to run the launch acceptance");
 	}
@@ -298,6 +301,78 @@ function main(): void {
 			originalPanes.every((p) => panes().includes(p)),
 		);
 		ok("restored: focus never moved", windows().find((w) => w.endsWith("|1")) === activeBefore);
+
+		// ── the fresh-call composition, against a real server (#105) ──────────────────
+		// The seat's deterministic gate can prove the argv, the leaf and the refusals, but the
+		// two things that only exist once tmux has answered — WHICH session the window landed
+		// in, and what the receipt says about it — had no oracle independent of the production
+		// source. This cell is that oracle: the same hermetic runtime above, a SECOND session
+		// on this same private server, and the real `freshCall`, read through its return value
+		// and the server's own inventory.
+		{
+			const { freshCall } = await import("../pi-extensions/lib/mux-fresh-call.ts");
+			const { closeWindow } = await import("../pi-extensions/lib/mux-placement.ts");
+			const call = (placementInput?: { tmuxSession: string }) =>
+				freshCall(
+					{
+						backend: "pi",
+						model: "fixture/model",
+						task: "fixture task",
+						placement: placementInput,
+						callerGardenId: "20260101T000000-fixture",
+					},
+					inherited,
+				);
+			const inventory = (): string => fxLines("list-windows", "-a", "-F", "#{session_id}|#{window_id}").join(" ");
+
+			// (i) an ABSENT seat: named refusal, and the server is byte-identical afterwards.
+			const beforeAbsent = inventory();
+			const absent = call({ tmuxSession: "nosuchseat" });
+			ok(
+				"seat: an absent seat refuses as tmux-session-missing and creates NOTHING — no window, no session",
+				!absent.ok && absent.reason === "tmux-session-missing" && inventory() === beforeAbsent,
+			);
+
+			// (ii) an EXISTING seat on the same server: the window lands THERE, the caller's own
+			// session is untouched, and the receipt names the resolved target rather than the caller.
+			assert.equal(fx("new-session", "-d", "-s", `${SESSION}-seat`).status, 0, "fixture seat session");
+			const seatId = fxLines("list-windows", "-t", `=${SESSION}-seat`, "-F", "#{session_id}")[0];
+			const callerWindowsBefore = fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").join(" ");
+			const seated = call({ tmuxSession: `${SESSION}-seat` });
+			assert.ok(seated.ok, `the seated fresh call must succeed: ${seated.ok ? "" : seated.reason}`);
+			const receipt = seated.receipt;
+			ok(
+				"seat: the receipt reports the RESOLVED target session and echoes the REQUESTED name — not the caller's session",
+				receipt.sessionId === seatId &&
+					receipt.sessionId !== placement.sessionId &&
+					receipt.tmuxSession === `${SESSION}-seat`,
+			);
+			ok(
+				"seat: tmux agrees — the window is in the seat, and the caller's own session is byte-identical",
+				fxLines("list-windows", "-t", seatId, "-F", "#{window_id}").includes(receipt.windowId) &&
+					fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").join(" ") === callerWindowsBefore,
+			);
+			ok(
+				"seat: an omitted seat still lands in the caller's own session and the receipt names none",
+				(() => {
+					const own = call();
+					if (!own.ok) return false;
+					const here = own.receipt.sessionId === placement.sessionId && own.receipt.tmuxSession === undefined;
+					process.kill(Number(own.receipt.panePid), "SIGKILL");
+					return here;
+				})(),
+			);
+
+			// (iii) the close side: that handle closes through the production verb, in a session
+			// that is NOT the caller's — the reason close binds to the server half.
+			ok(
+				"seat: the placed window closes through its own handle and tmux stops listing it",
+				closeWindow(receipt, inherited) === "closed" &&
+					!fxLines("list-windows", "-a", "-F", "#{window_id}").includes(receipt.windowId),
+			);
+			fx("kill-session", "-t", seatId);
+			ok("seat: the fixture is back to one session", sessionCount() === 1);
+		}
 	} finally {
 		fx("kill-server");
 		if (fs.existsSync(SOCKET)) fs.rmSync(SOCKET, { force: true });
@@ -313,4 +388,4 @@ function main(): void {
 	console.log(`\n${LABEL}: ${passed} checks passed`);
 }
 
-main();
+await main();

package/scripts/check-mux-launch.ts

@@ -19,6 +19,7 @@
  *   MUX-LAUNCH-NO-SHELL-ARGV       the fixed runtime is passed after `--`, never as a string
  *   MUX-LAUNCH-NO-CARRIER          argv is the append shape plus the runtime, nothing else
  *   MUX-LAUNCH-CORE-IMPORT-FREE    the launch module and entwurf delivery never import each other
+ *   RESOLVE-TMUX-SESSION-IMPORT-FREE  the session-lookup leaf imports nothing at all
  */
 
 import assert from "node:assert/strict";
@@ -270,6 +271,22 @@ function main(): void {
 			"boundary: the placement leaf does not import the launch module — the leaf stays deletable on its own",
 			!importsLaunch("pi-extensions/lib/mux-placement.ts"),
 		);
+		// ── the session-lookup leaf imports NOTHING (docs §11, #105) ─────────────────
+		// It is the one leaf whose entire safety argument is that it cannot acquire an
+		// opinion: no tmux of its own (the runner is injected), no mux module, no entwurf
+		// core, and not even a node builtin. §11 states that; nothing held it, and the first
+		// `import { runTmux } from "./mux-placement.ts"` would quietly turn a decision leaf
+		// into a second place that can run tmux.
+		ok(
+			"[QK:RESOLVE-TMUX-SESSION-IMPORT-FREE] the session-lookup leaf imports nothing at all — not mux, not entwurf core, not even a node builtin — so the only power it has is the runner its caller injects",
+			importsOf(fs.readFileSync("pi-extensions/lib/resolve-tmux-session.ts", "utf8")).length === 0,
+		);
+		ok(
+			"boundary: the fresh-call composition is the ONLY shipped source that imports that leaf",
+			PRODUCTION_SOURCES.filter((m) =>
+				importsOf(fs.readFileSync(m, "utf8")).some((spec) => spec.includes("resolve-tmux-session")),
+			).join(",") === FRESH_CALL_MODULE,
+		);
 		// Prose is not behaviour: the module header names identity vocabulary precisely to say
 		// it owns none of it, so this assertion reads CODE with the comments stripped. A check
 		// that failed on its own documentation would push the boundary out of the docs.

package/scripts/check-mux-placement-tmux.ts

@@ -27,6 +27,8 @@
  *   - handles are stable @window/%pane
  *   - the rc=0 trap is real, and inspectPlacement refuses it instead of guessing
  *   - close reports `closed` for a live window and `already-gone` after a natural exit
+ *   - a window placed in ANOTHER session of the same server closes through its own handle,
+ *     while a handle from another SERVER is still refused (#105 close-side binding)
  */
 
 import assert from "node:assert/strict";
@@ -259,9 +261,10 @@ function main(): void {
 			/context changed/,
 			"appendWindow must refuse a placement from another session",
 		);
+		// Close binds to the SERVER half (#105), so its refusal names that half by its own word.
 		assert.throws(
 			() => closeWindow({ ...w4, serverPid: "999999" }, inherited),
-			/context changed/,
+			/server changed/,
 			"closeWindow must refuse a handle from another server",
 		);
 		ok("binding: append/close refuse a foreign server or session before mutating", windows().length === 4);
@@ -305,6 +308,63 @@ function main(): void {
 			originalPanes.every((p) => panes().includes(p)),
 		);
 		ok("restored: focus never moved", windows().find((w) => w.endsWith("|1")) === activeBefore);
+
+		// ── close binds to the SERVER, not the session (#105) ─────────────────────────
+		// Since #105 a launched window may live in a session that is not the caller's, so the
+		// close side had to stop requiring the session half. This is that decision judged
+		// against a real server: a SECOND session, a window opened into it from the caller's
+		// pane the way the fresh-call composition does, and a close through the same handle.
+		// Both foreign-server refusal and the two close outcomes above stay exactly as they
+		// were — the session half is what changed, and only for close.
+		assert.equal(fx("new-session", "-d", "-s", `${SESSION}-b`).status, 0, "fixture second session");
+		ok("cross-session: the fixture now holds two sessions", sessionCount() === 2);
+		const otherSessionId = fxLines("list-windows", "-t", `=${SESSION}-b`, "-F", "#{session_id}")[0];
+		ok("cross-session: the second session resolves to a native id by exact name", /^\$[0-9]+$/.test(otherSessionId));
+		const placedRow = fxLines(
+			"new-window",
+			"-d",
+			"-a",
+			"-t",
+			`${otherSessionId}:{end}`,
+			"-P",
+			"-F",
+			"#{window_id}|#{window_index}|#{pane_id}|#{pane_pid}",
+		)[0].split("|");
+		const placed = {
+			serverPid: placement.serverPid,
+			sessionId: otherSessionId,
+			windowId: placedRow[0],
+			windowIndex: placedRow[1],
+			paneId: placedRow[2],
+			panePid: placedRow[3],
+		};
+		ok(
+			"cross-session: the window really landed in the OTHER session, and the caller's session is untouched",
+			fxLines("list-windows", "-t", otherSessionId, "-F", "#{window_id}").includes(placed.windowId) &&
+				!fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").includes(placed.windowId),
+		);
+		ok(
+			"cross-session: the caller's own session still shows windows 1,2 and its focus is unmoved",
+			fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").length === 2 &&
+				windows().find((w) => w.endsWith("|1")) === activeBefore,
+		);
+		// The predicate change, stated as the two facts that had to move together.
+		assert.throws(
+			() => closeWindow({ ...placed, serverPid: "999999" }, inherited),
+			/server changed/,
+			"closeWindow must still refuse a handle from another server",
+		);
+		ok(
+			"cross-session: a window in another session of the SAME server closes through its own handle — the release lifecycle smoke's close path reaches a placed window",
+			closeWindow(placed, inherited) === "closed",
+		);
+		ok(
+			"cross-session: it is gone from the other session, and nothing else moved",
+			!fxLines("list-windows", "-a", "-F", "#{window_id}").includes(placed.windowId) &&
+				fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").length === 2,
+		);
+		fx("kill-session", "-t", otherSessionId);
+		ok("cross-session: the fixture is back to one session", sessionCount() === 1);
 	} finally {
 		fx("kill-server");
 		if (fs.existsSync(SOCKET)) fs.rmSync(SOCKET, { force: true });

package/scripts/check-mux-placement.ts

@@ -22,6 +22,7 @@
  *   MUX-TMUX-FAILURE-LOUD    a nonzero/signalled tmux run is raised, never read as a fact
  *   MUX-APPEND-END-DETACHED  append is `-d -a -t <session_id>:{end}`, no carrier
  *   MUX-CONTEXT-BOUND-MUTATION a mutation matches the server pid AND the session id
+ *   MUX-CLOSE-SERVER-BOUND   a close binds to the server half only — same server, any session
  *   MUX-CLOSE-BY-WINDOW-ID   close targets `@window`, and absence needs positive proof
  */
 
@@ -38,6 +39,7 @@ import {
 	isDecimal,
 	isPaneId,
 	isSameContext,
+	isSameServer,
 	isSessionId,
 	isWindowId,
 	parsePlacement,
@@ -254,6 +256,37 @@ function main(): void {
 			);
 		})(),
 	);
+	// ── a close binds to the server, and the session half is covered by id uniqueness ────
+	// `appendWindow` and `closeWindow` are answering different questions, so they bind to
+	// different halves of the same fact. Append asks "is this target still the caller's own
+	// seat?" and needs both. Close asks "is this handle still the window it was born as?" —
+	// and since #105 a launched window may legitimately live in a session that is not the
+	// caller's, so requiring the session half would refuse a legitimate close. `[측정
+	// 2026-09-07]` window ids are handed out monotonically and never recycled within one
+	// server's life (after `@2` was killed the next was `@3`; after a whole session holding
+	// `@4`/`@5` was killed the next was `@6`), so on a matching server the `@id` alone
+	// identifies the window. What must still be refused is a handle from a DIFFERENT or
+	// restarted server, where the same id names something else.
+	ok(
+		"[QK:MUX-CLOSE-SERVER-BOUND] a close-side context matches on the server pid ALONE — another session on the same server is accepted, and every foreign server is refused however familiar its session id looks",
+		(() => {
+			const origin = { serverPid: "8150", sessionId: "$11" };
+			return (
+				isSameServer(origin, { serverPid: "8150", sessionId: "$11" }) &&
+				isSameServer(origin, { serverPid: "8150", sessionId: "$12" }) &&
+				!isSameServer(origin, { serverPid: "9999", sessionId: "$11" }) &&
+				!isSameServer(origin, { serverPid: "9999", sessionId: "$12" })
+			);
+		})(),
+	);
+	ok(
+		"binding: the two predicates are different contracts — append's refuses a foreign session that close's accepts, so neither may be expressed in terms of the other",
+		(() => {
+			const origin = { serverPid: "8150", sessionId: "$11" };
+			const otherSession = { serverPid: "8150", sessionId: "$12" };
+			return !isSameContext(origin, otherSession) && isSameServer(origin, otherSession);
+		})(),
+	);
 	ok(
 		"binding: a window handle carries the context it was born in",
 		(() => {