agent-coord-mcp 0.26.29 → 0.26.31

package/dist/transports/types.js

@@ -68,6 +68,22 @@ export function isTmuxKind(transport) {
 export function isLocallyProbeable(transport) {
     return transport === TMUX_PUSH;
 }
+/**
+ * ⟨q-f995c3c7⟩ THE PANE THIS PROCESS IS RUNNING IN, read from ITS OWN ENVIRONMENT — never from a
+ * caller's argument, which is what would make it spoofable.
+ *
+ * The first-claim guard's same-pane exception asked `process.env.TMUX_PANE` only, and a herdr seat
+ * has no TMUX_PANE: it has HERDR_PANE_ID. So a herdr seat restarting into its OWN pane could never
+ * satisfy the exception, and every one of them was refused against its own leftover marker. Measured
+ * 2026-09-23: 6 of 6 seats, cleared only by moving the markers aside by hand.
+ */
+export function ownPaneTarget(transport, env = process.env) {
+    if (transport === HERDR)
+        return env.HERDR_PANE_ID || undefined;
+    if (isLocallyProbeable(transport))
+        return env.TMUX_PANE || undefined;
+    return undefined;
+}
 /**
  * Is liveness for this marker decided by the registry heartbeat rather than by a
  * local pid? True only for the remote kind, whose pid is 0 on a foreign host.

package/dist/transports/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/transports/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;GAMG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,WAAoB,CAAC;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAA2B,CAAC;AAC5D,MAAM,CAAC,MAAM,KAAK,GAAG,OAAgB,CAAC;AAItC,MAAM,CAAC,MAAM,eAAe,GAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAU,CAAC;AAE5F;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAElE,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,SAA6B;IACtD,OAAO,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAA6B;IAC9D,OAAO,SAAS,KAAK,SAAS,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAA6B;IAC5D,OAAO,SAAS,KAAK,gBAAgB,CAAC;AACxC,CAAC;AAyDD;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAsD;IAC7E,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAmB,MAAS,EAAE,MAA0B;IAChF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAeD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAGnE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AAC3I,MAAM,CAAC,MAAM,aAAa,GAAwC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AAKxJ,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAU,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/transports/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;GAMG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,WAAoB,CAAC;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAA2B,CAAC;AAC5D,MAAM,CAAC,MAAM,KAAK,GAAG,OAAgB,CAAC;AAItC,MAAM,CAAC,MAAM,eAAe,GAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAU,CAAC;AAE5F;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAElE,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,SAA6B;IACtD,OAAO,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAA6B;IAC9D,OAAO,SAAS,KAAK,SAAS,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,SAA6B,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/F,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC,aAAa,IAAI,SAAS,CAAC;IAC/D,IAAI,kBAAkB,CAAC,SAAS,CAAC;QAAE,OAAO,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAA6B;IAC5D,OAAO,SAAS,KAAK,gBAAgB,CAAC;AACxC,CAAC;AAsED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAsD;IAC7E,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAmB,MAAS,EAAE,MAA0B;IAChF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAeD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAGnE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AAC3I,MAAM,CAAC,MAAM,aAAa,GAAwC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AAKxJ,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAU,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-coord-mcp",
-  "version": "0.26.29",
+  "version": "0.26.31",
   "description": "File-backed MCP server for coordinating multiple AI coding agents (Claude Code, Cursor, Cline, etc.). Local stdio or networked over Streamable HTTP.",
   "type": "module",
   "bin": {

package/scripts/check-test-count.mjs

@@ -93,18 +93,25 @@ function rel(file) {
   return file ? `test/${path.basename(file)}` : "(unattributed)";
 }
 
-if (failures.length) {
+// ⟨q-4b2362a8⟩ — A FAILING TEST MUST NOT MASK STRUCTURAL DRIFT. This used to report the failures and
+// exit, so an unrecorded test file stayed invisible behind any red: #393's `bind-list.test.mjs` was
+// missing from the record for days, hidden behind the quiet-fleet failure of merge-window. The
+// failures are still the headline — a count over a failing suite means little — but the drift that
+// does NOT depend on the counts (a file nobody recorded, a record entry with no file) is reported in
+// the same run, because one red hiding another is how both survive.
+const failed = failures.length > 0;
+if (failed) {
   console.error(`[check-test-count] ${failures.length} test(s) FAILED — the count is not the story here:`);
   for (const f of failures) console.error(`    ${f}`);
-  process.exit(1);
 }
 
 // `=0` disables; any other override asserts the old single global total.
-if (globalOverride === 0) {
+// Both early exits are skipped on a failing suite: a green there would report a pass over a red run.
+if (globalOverride === 0 && !failed) {
   console.log(`[check-test-count] disabled by AGENT_COORD_EXPECTED_TESTS=0 — ${total} test(s) passed, unchecked`);
   process.exit(0);
 }
-if (globalOverride !== null && Number.isFinite(globalOverride)) {
+if (globalOverride !== null && Number.isFinite(globalOverride) && !failed) {
   if (total !== globalOverride) {
     console.error(`[check-test-count] FAIL — ${total} tests passed, override expected ${globalOverride}.`);
     process.exit(1);
@@ -115,11 +122,15 @@ if (globalOverride !== null && Number.isFinite(globalOverride)) {
 
 // ── the real comparison, per file ──────────────────────────────────────────
 const drifted = [];
+// STRUCTURAL drift does not depend on the counts — which file is recorded at all, which record entry
+// has no file. It is the half that still means something when the suite is red (⟨q-4b2362a8⟩).
+const structural = [];
 for (const f of files) {
   const want = expected[f];
   const got = actual.get(f) ?? 0;
   if (want === undefined) {
-    drifted.push(`${f}: ran ${got} test(s) and is NOT in the record — a new test file must be recorded in the same commit`);
+    const line = `${f}: ran ${got} test(s) and is NOT in the record — a new test file must be recorded in the same commit`;
+    drifted.push(line); structural.push(line);
   } else if (got !== want) {
     drifted.push(`${f}: ran ${got}, record says ${want}`);
   }
@@ -134,15 +145,30 @@ for (const f of files) {
 // exists to exercise — the guard's own test caught it.
 for (const f of Object.keys(expected)) {
   if (!existsSync(path.join(pkgRoot, f))) {
-    drifted.push(`${f}: in the record but no such file exists — deleted, or renamed and its coverage lost`);
+    const line = `${f}: in the record but no such file exists — deleted, or renamed and its coverage lost`;
+    drifted.push(line); structural.push(line);
   } else if (files.includes(f) === false && GLOB === "test/*.test.mjs") {
-    drifted.push(`${f}: exists but did not run — the glob no longer selects it`);
+    const line = `${f}: exists but did not run — the glob no longer selects it`;
+    drifted.push(line); structural.push(line);
   }
 }
 // An unattributed pass would make every per-file number meaningless.
 const unattributed = actual.get("(unattributed)") ?? 0;
 if (unattributed) drifted.push(`${unattributed} test(s) passed with no file attribution — the per-file record cannot be verified against this run`);
 
+// On a red suite: report the structural half (never the counts, which a failing test legitimately
+// changes) and exit on the failures.
+if (failed) {
+  if (structural.length) {
+    console.error(`[check-test-count] AND, not masked by those failures — ${structural.length} structural drift(s) in the record:`);
+    for (const d of structural) console.error(`    ${d}`);
+    console.error(`  Record them with \`node scripts/check-test-count.mjs --write\` once the suite is green.`);
+  } else {
+    console.error(`[check-test-count] no structural record drift besides the failures above (per-file counts are not judged over a red suite)`);
+  }
+  process.exit(1);
+}
+
 if (!drifted.length) {
   console.log(
     `[check-test-count] ${total} test(s) across ${files.length} file(s), each matching its recorded count — ` +

package/src/capabilities.ts

@@ -60,6 +60,7 @@ import {
   type TransportKind,
 } from "./transports/index.js";
 import { readAllTransportMarkers, markerHoldsLiveProcess } from "./tools/registry.js";
+import { decideTokenMapRefresh } from "./store.js";
 import { queueWriteSchema } from "./tools/queue-write.js";
 import { treeProvenance } from "./tools/tree-provenance.js";
 import { detectSpread } from "./server-spread.js";
@@ -67,7 +68,7 @@ import { answeringServerIdentity } from "./tools/registry.js";
 import { HerdrTransport, herdrKeyName, interpretHerdrReply, submitModeOf, SUBMIT_MODE_ENV_VAR } from "./transports/herdr.js";
 import { tickVerdict } from "./tools/tick.js";
 import { ensureHerdrTail, herdrTailState, newContext, newMessagesIn, stopHerdrTail } from "./tools/herdr-tail.js";
-import { HERDR, TICK_READS_AS, TICK_STORED_AS, type TickState } from "./transports/types.js";
+import { HERDR, TMUX_PUSH, TICK_READS_AS, TICK_STORED_AS, ownPaneTarget, type TickState } from "./transports/types.js";
 
 export type ProbeResult = {
   id: string;
@@ -431,6 +432,42 @@ const PROBES: Probe[] = [
     // artefact except the one that calls it. ⟨q-9e0072b3⟩ was filed because the tree carried this
     // change while the registry did not, and nothing in either could say so — the version label was
     // identical on both sides of a behaviour difference.
+    // ⟨q-54adf191⟩ The daemon read tokens.json ONCE at startup and had no watcher, so a token minted
+    // while it ran was refused with a 401 that looks exactly like a broken daemon. A version label
+    // cannot answer "does this daemon pick up a new token" — only calling the decision can.
+    //
+    // ⛔ THE PROBE DRIVES THE REAL RULE WITH A SCRIPTED FILESYSTEM, and touches no tokens.json: the
+    // decision is one pure function shared with the live path, so this cannot pass while the daemon
+    // behaves differently. The NEGATIVES are the property: a refusal must keep the previous map.
+    id: "token-map-reloads-on-change",
+    since: "0.26.31",
+    run: () => {
+      const map = (n: number) => new Map(Array.from({ length: n }, (_, i) => [`tk${i}`, `a${i}`] as const));
+      const state = { map: map(1), stamp: "s1", checkedAt: 0 };
+      const io = (stamp: string | null, read: () => Map<string, string> | null) => ({ stamp: () => stamp, read });
+      const opts = { force: true, now: 1 };
+
+      const changed = decideTokenMapRefresh(state, io("s2", () => map(2)), opts);
+      const unchanged = decideTokenMapRefresh(state, io("s1", () => map(9)), opts);
+      const malformed = decideTokenMapRefresh(state, io("s2", () => { throw new Error("not valid JSON"); }), opts);
+      const vanished = decideTokenMapRefresh(state, io(null, () => null), opts);
+      const limited = decideTokenMapRefresh({ ...state, checkedAt: 1000 }, io("s2", () => map(2)), { now: 1001 });
+
+      const picksUp = changed.result.changed === true && changed.result.count === 2 && changed.next.map?.size === 2;
+      const quiet = unchanged.result.changed === false && unchanged.result.reason === "unchanged";
+      const keepsOnBadFile =
+        malformed.result.changed === false && malformed.result.reason === "malformed" && malformed.next.map === state.map && malformed.next.stamp === "s1";
+      const keepsOnGone = vanished.result.reason === "vanished" && vanished.next.map === state.map;
+      const rateLimited = limited.result.reason === "rate-limited" && limited.next.map === state.map;
+
+      const present = picksUp && quiet && keepsOnBadFile && keepsOnGone && rateLimited;
+      return {
+        present,
+        evidence: `changed -> reloaded ${changed.result.count} agents=${picksUp} · same stamp -> no read=${quiet} · KEEPS THE OLD MAP: malformed=${keepsOnBadFile} (stamp not advanced), vanished=${keepsOnGone} · rate-limited=${rateLimited} -> present=${present}`,
+      };
+    },
+  },
+  {
     id: "transport-source-is-machine-scoped",
     since: "0.26.28",
     run: () => {
@@ -623,6 +660,54 @@ const PROBES: Probe[] = [
       return { present, evidence: `module ${me.serverModule ?? "UNRESOLVED"} · dead stamp -> unknown: ${staleUnknown} · split + unstamped seat -> ${split?.state ?? "n/a"} -> present=${present}` };
     },
   },
+  {
+    // ⟨q-caa2959e⟩ (0.26.30) — the merge-window live control's APPLICABILITY is own landings in the
+    // horizon, never its own window count. A quiet fleet (record commits, no landing) is NOT
+    // APPLICABLE and says so with both counts; a landing whose PR announced no window is a problem,
+    // which is the violation the control exists to catch and the one a count-based rule would skip
+    // green. Asked of the running function, so a server on the pre-fix build answers false.
+    id: "merge-window-applies-on-own-landings",
+    since: "0.26.30",
+    run: () => {
+      const T = Date.parse("2026-09-20T12:00:00Z");
+      const landing = { sha: "a".repeat(40), at: T, author: "seat", subject: "docs(done): close it (#900)", mergeOf: 900 };
+      const plain = { sha: "b".repeat(40), at: T, author: "seat", subject: "docs(board): claim a row", mergeOf: null };
+      const opts = { now: T + 60_000, floorMs: T - 60_000 };
+      const unannounced = mergeWindowLivePopulation({ logText: "", writes: [landing], ...opts });
+      const quiet = mergeWindowLivePopulation({ logText: "", writes: [plain], ...opts });
+      const windowsOnly = mergeWindowLivePopulation({ logText: `{"ts":${T},"from":"qa","to":"#k","text":"QA GATE: PASS #900\nMERGE WINDOW: #900 — hold queue/board writes"}`, writes: [], ...opts });
+      const present =
+        unannounced.applicable === true && unannounced.missingWindow.length === 1 &&
+        quiet.applicable === false && /landed nothing in the horizon/.test(quiet.reason) && /0 own landing\(s\)/.test(quiet.reason) &&
+        windowsOnly.applicable === false;
+      return {
+        present,
+        evidence:
+          `landing with no window -> applicable=${unannounced.applicable} missingWindow=${unannounced.missingWindow.length} · ` +
+          `record commit, no landing -> applicable=${quiet.applicable} (names both counts: ${/0 own landing\(s\)/.test(quiet.reason)}) · ` +
+          `windows but no landing -> applicable=${windowsOnly.applicable} -> present=${present}`,
+      };
+    },
+  },
+  {
+    // ⟨q-f995c3c7⟩ — a seat re-claiming its OWN pane is not an intruder. The same-pane exception read
+    // process.env.TMUX_PANE only, which a herdr seat never has, so no herdr seat could match its own
+    // marker and every restart was refused (8 occurrences by 2026-09-23, David's own seat among them).
+    // Probed through the function the guard calls, so a server on the pre-fix build answers false.
+    id: "own-pane-reclaim-accepted",
+    since: "0.26.31",
+    run: () => {
+      const pane = "wA3:p4";
+      const mine = ownPaneTarget(HERDR, { HERDR_PANE_ID: pane } as NodeJS.ProcessEnv);
+      const tmuxSeat = ownPaneTarget(TMUX_PUSH, { TMUX_PANE: "%7" } as NodeJS.ProcessEnv);
+      const noHerdrPane = ownPaneTarget(HERDR, { TMUX_PANE: "%7" } as NodeJS.ProcessEnv);
+      const present = mine === pane && tmuxSeat === "%7" && noHerdrPane === undefined;
+      return {
+        present,
+        evidence: `herdr seat's own pane -> ${mine ?? "undefined"} · tmux seat -> ${tmuxSeat ?? "undefined"} · herdr with only TMUX_PANE -> ${noHerdrPane ?? "undefined"} (the pre-fix read) -> present=${present}`,
+      };
+    },
+  },
   {
     id: "record-authority",
     since: "0.24.0",
@@ -806,7 +891,7 @@ export function probeCapabilities(context: { module: string; versionLabel: strin
 
 import { resolveServerIdentity } from "./server-identity.js";
 import { seatBuildOf, installedFrom, psReader, type SeatBuild } from "./tools/seat-build.js";
-import { isInFlightStatus, gateClaimsIn } from "./tools/stall.js";
+import { isInFlightStatus, gateClaimsIn, mergeWindowLivePopulation } from "./tools/stall.js";
 import { parseWorkDoc, queueItemsOf, stampQueueIds } from "@davidbalzan/groundwork-seam";
 
 export const capabilitiesSchema = {} as const;

package/src/server.ts

@@ -18,7 +18,10 @@ import { capabilitiesSchema, capabilitiesTool } from "./capabilities.js";
 import {
   ensureDirs,
   getTokenMap,
+  TOKENS_FILE,
   reloadTokenMapSync,
+  refreshTokenMapIfChanged,
+  type TokenMapRefresh,
   sessionFile,
   listSessionFiles,
   readJson,
@@ -306,7 +309,10 @@ function buildServer(initialBound?: string, opts: { trackSession?: boolean } = {
           leakLine +
           ` A live incumbent can only be superseded with ITS OWN TOKEN now (mint one: scripts/coord-token.mjs add ${claimed}, then SIGHUP the bus) — ` +
           `\`force:true\` binds a SECOND session to one identity rather than stopping the first, which is the defect this refusal exists to prevent, not a step past it. ` +
-          `If you ARE '${claimed}' restarting, re-join from its own tmux pane${leaks.length ? " once nothing else holds it" : ""}. ` +
+          `If you ARE '${claimed}' restarting, re-join from its own pane${leaks.length ? " once nothing else holds it" : ""} — ` +
+          `⟨q-f995c3c7⟩ ANY SERVER RESTART REACHES THIS, including ones no operator sees: \`/model\` restarts this MCP server, ` +
+          `and so do a reconnect, a config reload and a crash-restart. The seat is then a NEW process meeting its own leftover ` +
+          `record, which is why this fired on seats nobody had touched. ` +
           `If you are diagnosing, use status/ping (read-only, they never bind) or your own id.`,
       );
     }
@@ -1076,15 +1082,39 @@ async function startHttp(port: number): Promise<void> {
     return transport;
   }
 
+  // ⟨q-54adf191⟩ ONE LINE PER RELOAD, AND ONE PER REFUSAL. A reload nobody can see is
+  // indistinguishable from the bug: the operator reads a 401 and suspects the daemon.
+  function reportTokenRefresh(r: TokenMapRefresh): void {
+    if (r.changed) {
+      console.error(`[agent-coord-mcp] token map reloaded (${r.count} agents) — ${TOKENS_FILE} ${r.reason}`);
+      return;
+    }
+    if (r.refused) {
+      console.error(
+        `[agent-coord-mcp] token map NOT reloaded: ${r.refused} — keeping the previous map (${r.count} agents)`,
+      );
+    }
+  }
+
   // Reverse-lookup: extract bearer from header, map → bound agent. Returns
   // undefined if no map is configured (advisory mode); throws-like return of
   // null if the bearer doesn't match any known agent (caller responds 401).
   function resolveBoundAgent(authHeader: string | undefined): { ok: boolean; agent?: string } {
     if (!authHeader || !authHeader.startsWith("Bearer ")) return { ok: false };
     const bearer = authHeader.slice("Bearer ".length);
+    // ⟨q-54adf191⟩ Pick up a tokens.json that changed while this daemon ran. Rate-limited, so the
+    // steady state is one stat; the file is read only when its stamp moved. Every outcome that is
+    // not "nothing happened" is SAID — a silent reload is the defect this row exists for.
+    reportTokenRefresh(refreshTokenMapIfChanged());
     const tokenMap = getTokenMap();
     if (tokenMap) {
-      const agent = tokenMap.get(bearer);
+      let agent = tokenMap.get(bearer);
+      if (!agent) {
+        // An unknown bearer is exactly the symptom of a token minted since the last check, so it
+        // forces one check past the rate limit. It cannot grant anything the file does not hold.
+        reportTokenRefresh(refreshTokenMapIfChanged({ force: true }));
+        agent = getTokenMap()?.get(bearer);
+      }
       // ⛔ THE ONLY PLACE A PRE-BOUND SEAT CAN GET A TAIL. The `startTailOnBind` sites in the tool
       // path all sit behind `bound === undefined` — the TOFU claim. Here identity arrives already
       // decided by the bearer, that branch is unreachable, and before this line NO tail ever

package/src/store.ts

@@ -1,4 +1,4 @@
-import { promises as fs, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { statSync, promises as fs, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import path from "node:path";
@@ -199,6 +199,10 @@ export function getTokenMap(): Map<string, string> | null {
   if (!tokenMapInitialized) {
     tokenMapCache = readTokenMapSync();
     tokenMapInitialized = true;
+    // Stamp the file we just read, or the first change check would report a map that never
+    // changed as newly "appeared" and re-read a file nobody touched.
+    tokenMapStamp = stampOf();
+    tokenMapCheckedAt = Date.now();
   }
   return tokenMapCache;
 }
@@ -209,9 +213,134 @@ export function getTokenMap(): Map<string, string> | null {
 export function reloadTokenMapSync(): Map<string, string> | null {
   tokenMapCache = readTokenMapSync();
   tokenMapInitialized = true;
+  // Keep the change-detection stamp in step, or the next stat would read the same file again.
+  tokenMapStamp = stampOf();
+  tokenMapCheckedAt = Date.now();
   return tokenMapCache;
 }
 
+// ⟨q-54adf191⟩ RELOAD WHEN THE FILE CHANGES, AND SAY WHAT HAPPENED.
+//
+// The daemon read tokens.json once at startup and had no watcher, so a token minted while it ran
+// was refused with a 401 that looks exactly like a broken daemon — every file on disk correct. The
+// operator had to remember SIGHUP. This weakens nothing: the file is the authority either way, and
+// a reload cannot grant a bearer the file does not contain.
+//
+// THE TRIGGER IS A STAMP CHECK ON THE AUTH PATH, NOT A WATCHER AND NOT A TIMER.
+//   · a watcher (fs.watch) is per-platform and silently unreliable on network and virtualised
+//     filesystems — exactly where a shared bus dir often lives — and it would hold the event loop
+//     of an otherwise idle daemon;
+//   · a poll timer wakes a process that may serve nothing for hours, and still misses a change
+//     that lands between ticks;
+//   · a stat on a request the daemon is already serving costs one syscall, is rate-limited, and
+//     reads the file ONLY when the stamp moved. An unknown bearer forces one extra check, so a
+//     newly minted token authenticates on its first call rather than on the next tick.
+// SIGHUP stays as the explicit path and still forces a read.
+const TOKEN_RELOAD_MIN_MS = (() => {
+  const n = Number(process.env.AGENT_COORD_TOKEN_RELOAD_MS);
+  return Number.isFinite(n) && n >= 0 ? n : 1000;
+})();
+
+/** What a refresh did. `changed` means the in-process map was REPLACED. */
+export type TokenMapRefresh = {
+  changed: boolean;
+  reason: "unbound" | "rate-limited" | "unchanged" | "changed" | "appeared" | "malformed" | "vanished";
+  count: number | null;
+  /** Present only when the reload was REFUSED; the previous map still serves. */
+  refused?: string;
+};
+
+// The file identity we compare against: mtime, size AND inode.
+//
+// ⛔ THE INODE IS LOAD-BEARING, NOT BELT-AND-BRACES. `coord-token` rotates by writing a temp file and
+// renaming it into place, so the replacement is a DIFFERENT INODE that can carry the SAME mtime and
+// the SAME size (a rotated token is the same length as the one it replaces). Without the inode this
+// stamp reads "unchanged" and the daemon keeps serving the REVOKED bearer until someone remembers
+// SIGHUP — the exact defect ⟨q-54adf191⟩ exists to end. Pinned by "a rotation that keeps mtime AND
+// size" below, which goes red the moment the inode leaves this line.
+//
+// ⚠ STATED LIMIT, and the one case this stamp CANNOT see: a rewrite IN PLACE, at equal length, with
+// mtime forced back (`utimes`). Same inode, same size, same mtime is indistinguishable from no write
+// at all, so a bearer revoked that way keeps working until SIGHUP. Measured, and asserted below as a
+// known limit rather than left to be discovered.
+//
+// ⚠⚠ WHY WE ARE SAFE TODAY IS ANOTHER TOOL'S IMPLEMENTATION DETAIL, NOT A PROPERTY OF THIS ONE:
+// `coord-token` never writes this file in place — every write is temp+rename, which moves the inode.
+// The day anything else writes `tokens.json` in place (an editor with a truncating save, a config
+// manager, a hand-rolled script), this comment is the only warning that the reload will not see it.
+// A content hash would close it, at the cost of reading the whole file on every check instead of one
+// stat; that trade was not taken here and is the thing to revisit if that day comes.
+let tokenMapStamp: string | null = null;
+let tokenMapCheckedAt = 0;
+
+function stampOf(): string | null {
+  try {
+    const st = statSync(TOKENS_FILE);
+    return `${st.mtimeMs}:${st.size}:${st.ino}`;
+  } catch {
+    return null;
+  }
+}
+
+/** The state a refresh decides against: what is loaded, the file identity it came from, when it was last checked. */
+export type TokenMapState = { map: Map<string, string> | null; stamp: string | null; checkedAt: number };
+/** The filesystem, as the decision sees it. Injected so the rules can be exercised without a disk. */
+export type TokenMapIo = { stamp: () => string | null; read: () => Map<string, string> | null };
+
+/**
+ * THE WHOLE RULE, IN ONE PURE FUNCTION. The live path and the capability probe both call this, so
+ * there is no second implementation of "did it change, and may the new map replace the old one".
+ */
+export function decideTokenMapRefresh(
+  state: TokenMapState,
+  io: TokenMapIo,
+  opts: { force?: boolean; now?: number } = {},
+): { next: TokenMapState; result: TokenMapRefresh } {
+  const now = opts.now ?? Date.now();
+  const keep = (result: TokenMapRefresh, checkedAt = state.checkedAt) => ({ next: { ...state, checkedAt }, result });
+  // A daemon with no tokens.json is in advisory mode: there is no map to keep fresh, and a file
+  // APPEARING must not silently promote it into bound mode mid-flight.
+  if (state.map === null) return keep({ changed: false, reason: "unbound", count: null });
+  if (!opts.force && now - state.checkedAt < TOKEN_RELOAD_MIN_MS) {
+    return keep({ changed: false, reason: "rate-limited", count: state.map.size });
+  }
+  const size = state.map.size;
+  const stamp = io.stamp();
+  if (stamp === null) {
+    // ⛔ A VANISHED FILE IS A REFUSAL, NEVER A DOWNGRADE. Dropping to advisory mode because the file
+    // is missing would turn `rm tokens.json` into "every bearer is now accepted".
+    return keep({ changed: false, reason: "vanished", count: size, refused: `${TOKENS_FILE} is gone` }, now);
+  }
+  if (stamp === state.stamp) return keep({ changed: false, reason: "unchanged", count: size }, now);
+  try {
+    const next = io.read();
+    if (next === null) {
+      return keep({ changed: false, reason: "vanished", count: size, refused: `${TOKENS_FILE} is gone` }, now);
+    }
+    return {
+      next: { map: next, stamp, checkedAt: now },
+      result: { changed: true, reason: state.stamp === null ? "appeared" : "changed", count: next.size },
+    };
+  } catch (e) {
+    // The stamp is deliberately NOT advanced: a half-written file that is fixed in place, with no
+    // further change to mtime or size, must still be picked up on the next check.
+    return keep({ changed: false, reason: "malformed", count: size, refused: (e as Error).message }, now);
+  }
+}
+
+export function refreshTokenMapIfChanged(opts: { force?: boolean; now?: number } = {}): TokenMapRefresh {
+  if (!tokenMapInitialized) getTokenMap();
+  const { next, result } = decideTokenMapRefresh(
+    { map: tokenMapCache, stamp: tokenMapStamp, checkedAt: tokenMapCheckedAt },
+    { stamp: stampOf, read: readTokenMapSync },
+    opts,
+  );
+  tokenMapCache = next.map;
+  tokenMapStamp = next.stamp;
+  tokenMapCheckedAt = next.checkedAt;
+  return result;
+}
+
 // Atomically rotate the token entry for an agent rename (used by
 // rename_agent so the same bearer continues to authenticate the renamed
 // identity). No-op if the file is absent or the old id isn't in the map.

package/src/tools/registry.ts

@@ -1,5 +1,5 @@
 import { detachAgentTool } from "./transport.js";
-import { isLocallyProbeable, isRemoteTmuxKind, targetOf, HERDR, HerdrTransport, activeTransport } from "../transports/index.js";
+import { isLocallyProbeable, isRemoteTmuxKind, ownPaneTarget, targetOf, HERDR, HerdrTransport, activeTransport } from "../transports/index.js";
 import { readAway, secondCoordinatorRefusal } from "./away.js";
 import { randomUUID } from "node:crypto";
 import { existsSync, openSync, statSync, watch } from "node:fs";
@@ -655,13 +655,14 @@ export async function liveClaimEvidence(agentId: string, now: number): Promise<C
     reasons.push(
       `live ${marker.transport} transport (pid ${marker.pid}${targetOf(marker) ? `, pane ${targetOf(marker)}` : ""})`,
     );
-    if (
-      isLocallyProbeable(marker.transport) &&
-      targetOf(marker) &&
-      process.env.TMUX_PANE &&
-      targetOf(marker) === process.env.TMUX_PANE
-    ) {
+    // ⟨q-f995c3c7⟩ THE SAME SEAT RESTARTING INTO ITS OWN PANE, for herdr as well as tmux. This read
+    // `process.env.TMUX_PANE` alone, which a herdr seat never has, so the exception could not fire
+    // for the fleet that runs on herdr: every seat was refused by its own leftover marker (6 of 6 on
+    // 2026-09-23). The pane comes from THIS process's environment, never from the caller's argument.
+    const ownPane = ownPaneTarget(marker.transport);
+    if (targetOf(marker) && ownPane && targetOf(marker) === ownPane) {
       samePane = true;
+      reasons.push(`the marker names THIS process's own pane (${ownPane})`);
     }
   }
 

package/src/tools/stall.ts

@@ -512,6 +512,57 @@ export function mergeWindowChecks(input: { logText: string; writes: RecordWrite[
   return { hits: withAudience(hits), windows: out, unmeasurable };
 }
 
+/**
+ * ⟨q-caa2959e⟩ — WHETHER THE MERGE-WINDOW CONVENTION CAN BE JUDGED ON THIS BUS RIGHT NOW,
+ * decided from OWN LANDINGS IN THE HORIZON and never from the window count.
+ *
+ * The live check used to assert `windows.length > 0`. A stand-down left the fleet quiet: 0 window
+ * announcements inside the horizon while record commits remained, so a control pinned to a live
+ * baseline failed for everyone — it expired when the fleet went quiet, not when anything broke.
+ *
+ * ⛔ AND APPLICABILITY IS NEVER READ OFF THE PREDICATE'S OWN COUNT. Deciding it from `windows.length`
+ * is the by-mention trap ⟨q-552b9912⟩ taught us, inverted: a fleet that landed PRs and announced NO
+ * window — precisely the violation this check exists to catch — would skip itself green. The
+ * population is what the fleet DID (its landings); the windows are what it is judged ON.
+ *
+ * Applicable when the horizon holds at least one landing of this fleet's (a squash carrying the
+ * forge's `(#N)` marker). Then every one of them MUST carry a window announcement, and a missing one
+ * is a problem. With no landing there is nothing to judge: NOT APPLICABLE, named with both counts.
+ */
+export function mergeWindowLivePopulation(input: { logText: string; writes: RecordWrite[] | null; now: number; floorMs?: number; horizonMs?: number }): {
+  applicable: boolean;
+  reason: string;
+  population: string;
+  landings: RecordWrite[];
+  missingWindow: { sha: string; pr: number }[];
+  windows: ReturnType<typeof mergeWindowChecks>["windows"];
+  hits: ReturnType<typeof mergeWindowChecks>["hits"];
+} {
+  const floor = input.floorMs ?? MERGE_WINDOW_ADOPTED_MS;
+  const horizon = input.horizonMs ?? CONVENTION_WINDOW_MS;
+  const r = mergeWindowChecks(input);
+  const since = new Date(input.now - horizon).toISOString();
+  const head = `horizon ${since} → ${new Date(input.now).toISOString()}, floor ${new Date(floor).toISOString()}`;
+  if (input.writes === null) {
+    const reason = `NOT APPLICABLE: record-document writes could not be read from the shared branch — ${head}. UNMEASURED is not the same as kept.`;
+    return { applicable: false, reason, population: reason, landings: [], missingWindow: [], windows: r.windows, hits: r.hits };
+  }
+  const inHorizon = input.writes.filter((c) => Number.isFinite(c.at) && c.at >= input.now - horizon);
+  const landings = inHorizon.filter((c) => c.mergeOf !== null);
+  const population = `${head}: ${inHorizon.length} record commit(s), ${landings.length} own landing(s), ${r.windows.length} window(s), ${r.hits.length} hit(s)`;
+  if (landings.length === 0) {
+    return {
+      applicable: false,
+      reason: `NOT APPLICABLE: this fleet landed nothing in the horizon, so there is no window to require — ${population}. (A quiet fleet, not a broken convention; the window count is never what decides this.)`,
+      population, landings, missingWindow: [], windows: r.windows, hits: r.hits,
+    };
+  }
+  const missingWindow = landings
+    .filter((c) => !r.windows.some((w) => w.pr === c.mergeOf))
+    .map((c) => ({ sha: c.sha, pr: c.mergeOf as number }));
+  return { applicable: true, reason: `APPLICABLE — ${population}`, population, landings, missingWindow, windows: r.windows, hits: r.hits };
+}
+
 export function conventionChecks(input: {
   recentMerges: RecentMerge[] | null | undefined;
   /** PRs the caller knows merged express. Nothing populates this yet — see isDocsOnlyMerge. */

package/src/transports/types.ts

@@ -76,6 +76,21 @@ export function isLocallyProbeable(transport: string | undefined): boolean {
   return transport === TMUX_PUSH;
 }
 
+/**
+ * ⟨q-f995c3c7⟩ THE PANE THIS PROCESS IS RUNNING IN, read from ITS OWN ENVIRONMENT — never from a
+ * caller's argument, which is what would make it spoofable.
+ *
+ * The first-claim guard's same-pane exception asked `process.env.TMUX_PANE` only, and a herdr seat
+ * has no TMUX_PANE: it has HERDR_PANE_ID. So a herdr seat restarting into its OWN pane could never
+ * satisfy the exception, and every one of them was refused against its own leftover marker. Measured
+ * 2026-09-23: 6 of 6 seats, cleared only by moving the markers aside by hand.
+ */
+export function ownPaneTarget(transport: string | undefined, env: NodeJS.ProcessEnv = process.env): string | undefined {
+  if (transport === HERDR) return env.HERDR_PANE_ID || undefined;
+  if (isLocallyProbeable(transport)) return env.TMUX_PANE || undefined;
+  return undefined;
+}
+
 /**
  * Is liveness for this marker decided by the registry heartbeat rather than by a
  * local pid? True only for the remote kind, whose pid is 0 on a foreign host.
@@ -137,6 +152,19 @@ export type TransportMarker = {
    * unasked question as full capability is the defect this field removes.
    */
   rooms?: boolean;
+  /**
+   * ⟨q-ec020f6a⟩(A) herdr ONLY: the `agent_session.value` herdr itself reported for this
+   * marker's pane at ATTACH TIME (`herdr pane get <target>` — populated from the pane's own
+   * live process, e.g. a Claude Code resume-session-id; never asserted by the attaching
+   * caller). This is what makes the pane a checkable identity rather than a trusted claim:
+   * `resolveBoundAgent`'s pane path re-reads the pane's CURRENT `agent_session.value` on
+   * every request and refuses if it no longer matches what was recorded here — the same
+   * pane_id with a DIFFERENT live session behind it (a restart, a reused pane, a swap) is
+   * exactly the class ⟨q-e439e4ad⟩/⟨q-8c23e5a3⟩ named. Absent means unknown (herdr had no
+   * session for that pane at attach time, or this marker predates the field) — never treated
+   * as a match.
+   */
+  herdrAgentSession?: string;
 };
 
 /**
@@ -284,4 +312,12 @@ export interface Transport {
    * that can PUBLISH state to its external observer exposes it here.
    */
   publishTick?(marker: TransportMarker, state: TickState, opts?: { message?: string; source?: string }): Promise<{ ok: boolean; error?: string }>;
+
+  /**
+   * ⟨q-ec020f6a⟩(A) — OPTIONAL, and its absence is the honest answer for tmux (a pane's live
+   * "session" concept is a herdr feature; tmux has no equivalent to re-check). Declaring the
+   * method optional is what keeps a pane-identity caller from inventing a match for a
+   * transport that has no way of asking one. See `HerdrTransport.verifyPaneSession`.
+   */
+  verifyPaneSession?(target: string, expectedSession: string | undefined): boolean | null;
 }