baxian 1.2.59 → 1.2.60

package/dist/agent/pane-streamer-manager.d.ts

@@ -1,29 +1,99 @@
 import type { AgentConfig, HostConfig } from '../shared/index.js';
 import type { CommandRunner } from './runner.js';
+import { TmuxManager, type TmuxSessionRef, type TtySize } from './tmux.js';
 import { PaneStreamer, type PaneStreamerOptions } from './pane-streamer.js';
 export interface PaneStreamerManagerOptions {
     runnerFactory: (agent: AgentConfig) => CommandRunner;
     hostResolver?: (agent: AgentConfig) => HostConfig | undefined;
     streamerDefaults?: PaneStreamerOptions;
     inputBatchMs?: number;
+    geometryTimeoutMs?: number;
+    maxPendingGeometryLiveness?: number;
+    maxPendingGeometryPerAgent?: number;
+}
+export declare function raceDeadline<T>(p: Promise<T>, ms: number, onDeadline: () => void): Promise<T>;
+interface OwnerState {
+    agent: AgentConfig;
+    epoch: number;
+    fullHolds: number;
+    dirty: boolean;
+    scanPending: boolean;
+    gen: number;
+    lastWrittenGen: number | null;
+    fullTarget: TtySize | null;
+    statusLines: number;
+    identity: TmuxSessionRef | null;
+    claim: string | null;
+    ownerWriteCapability: 'full' | 'legacy' | null;
+    legacyUnsettledWrites: number;
+    timer: ReturnType<typeof setInterval> | null;
+    inFlight: boolean;
+    chain: Promise<void>;
+    resizeWriteQueued: boolean;
+    resizeWritePending: Promise<void> | null;
+    readFailing: boolean;
+    foreignWarned: boolean;
+    tmux: TmuxManager | null;
 }
 export declare class PaneStreamerManager {
     private readonly streamers;
     private readonly tmuxByAgent;
     private readonly inputChains;
     private readonly pendingInput;
+    private readonly owners;
+    private readonly ownerEpochs;
+    private pendingGlobal;
+    private readonly pendingByAgent;
     private readonly runnerFactory;
     private readonly hostResolver?;
     private readonly streamerDefaults?;
     private readonly inputBatchMs;
+    private readonly geometryTimeoutMs;
+    private readonly followIntervalMs;
+    private readonly maxPendingGlobal;
+    private readonly maxPendingPerAgent;
     constructor(opts: PaneStreamerManagerOptions);
+    private get settleDeadlineMs();
     ensure(agent: AgentConfig): PaneStreamer;
     has(agentId: string): boolean;
     destroy(agentId: string, opts?: {
         silent?: boolean;
     }): Promise<void>;
     destroyAll(): Promise<void>;
+    startupScan(agents: AgentConfig[]): void;
+    private ownerOf;
+    private ownerTmux;
+    private geometryHooksFor;
+    private acquireFullHold;
+    private syncReconcilerTimer;
+    private admitLiveness;
+    private registerLiveness;
+    private raceGeometryExec;
+    private raceProbeStart;
+    private readGeometryAdmitted;
+    private enqueueGeometry;
+    private issueOwnerWrite;
+    private fullBasis;
+    reconcileOnce(owner: OwnerState): Promise<void>;
+    private commitOwnerResize;
+    _geometryPendingForTest(): {
+        global: number;
+        byAgent: Map<string, number>;
+    };
+    _ownerForTest(agentId: string): {
+        fullHolds: number;
+        dirty: boolean;
+        gen: number;
+        fullTarget: TtySize | null;
+        ownerWriteCapability: 'full' | 'legacy' | null;
+        claim: string | null;
+        scanPending: boolean;
+        timerActive: boolean;
+        epoch: number;
+    } | null;
+    _reconcileNowForTest(agentId: string): Promise<void>;
     private readonly windowFlush;
     enqueueInput(agentId: string, data: string): Promise<void>;
 }
+export {};
 //# sourceMappingURL=pane-streamer-manager.d.ts.map

package/dist/agent/pane-streamer-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pane-streamer-manager.d.ts","sourceRoot":"","sources":["../../src/agent/pane-streamer-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,aAAa,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,UAAU,GAAG,SAAS,CAAC;IAC9D,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAUD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwC;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAiD;IAC/E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAsB;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,IAAI,EAAE,0BAA0B;IAO5C,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY;IAcxC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAKvB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAEhE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgD3D"}
+{"version":3,"file":"pane-streamer-manager.d.ts","sourceRoot":"","sources":["../../src/agent/pane-streamer-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAEL,WAAW,EAEX,KAAK,cAAc,EACnB,KAAK,OAAO,EAEb,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,YAAY,EAEZ,KAAK,mBAAmB,EAGzB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,aAAa,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,UAAU,GAAG,SAAS,CAAC;IAC9D,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAUD,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAe7F;AAQD,UAAU,UAAU;IAClB,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IAIf,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oBAAoB,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC/C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,GAAG,IAAI,CAAC;IAC7C,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;CAC1B;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAGxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAE5D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwC;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAiD;IAC/E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAsB;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;gBAEhC,IAAI,EAAE,0BAA0B;IAW5C,OAAO,KAAK,gBAAgB,GAE3B;IAED,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY;IAkBxC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAKvB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCxE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAajC,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI;IAmBxC,OAAO,CAAC,OAAO;IAiCf,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,gBAAgB;IAuCxB,OAAO,CAAC,eAAe;IAwBvB,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,gBAAgB;YAYV,gBAAgB;IAY9B,OAAO,CAAC,cAAc;YAiBR,oBAAoB;IAqBlC,OAAO,CAAC,eAAe;YAeT,eAAe;IAuC7B,OAAO,CAAC,SAAS;IAOX,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YA0FvC,iBAAiB;IA4B/B,uBAAuB,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAI3E,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG;QAC9B,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;QAC3E,oBAAoB,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrE,WAAW,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;KAC3D,GAAG,IAAI;IAgBR,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAEhE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgD3D"}

package/dist/agent/pane-streamer-manager.js

@@ -1,20 +1,68 @@
-import { TmuxManager } from './tmux.js';
-import { PaneStreamer, } from './pane-streamer.js';
+import { SessionAbsentError, TmuxManager, contentArea, } from './tmux.js';
+import { PaneStreamer, normalizeFollowIntervalMs, } from './pane-streamer.js';
 const DEFAULT_INPUT_BATCH_MS = 10;
+const DEFAULT_GEOMETRY_TIMEOUT_MS = 3000;
+// Runner timeout only SIGTERMs; SIGKILL follows after a 2000ms grace and the
+// promise settles on close. The geometry layer must not inherit that tail.
+const GEOMETRY_SETTLE_SLACK_MS = 3000;
+const DEFAULT_MAX_PENDING_GLOBAL = 16;
+const DEFAULT_MAX_PENDING_PER_AGENT = 4;
+export function raceDeadline(p, ms, onDeadline) {
+    return new Promise((resolve, reject) => {
+        let done = false;
+        const timer = setTimeout(() => {
+            if (done)
+                return;
+            done = true;
+            try {
+                onDeadline();
+            }
+            catch { }
+            reject(new Error(`geometry settle deadline (${ms}ms) exceeded`));
+        }, ms);
+        timer.unref?.();
+        p.then((v) => { if (!done) {
+            done = true;
+            clearTimeout(timer);
+            resolve(v);
+        } }, (e) => { if (!done) {
+            done = true;
+            clearTimeout(timer);
+            reject(e);
+        } });
+    });
+}
 export class PaneStreamerManager {
     streamers = new Map();
     tmuxByAgent = new Map();
     inputChains = new Map();
     pendingInput = new Map();
+    owners = new Map();
+    // Epochs outlive owner-state deletion: a deleted-and-recreated agent id must
+    // never validate closures/tasks captured against its previous life.
+    ownerEpochs = new Map();
+    pendingGlobal = 0;
+    pendingByAgent = new Map();
     runnerFactory;
     hostResolver;
     streamerDefaults;
     inputBatchMs;
+    geometryTimeoutMs;
+    followIntervalMs;
+    maxPendingGlobal;
+    maxPendingPerAgent;
     constructor(opts) {
         this.runnerFactory = opts.runnerFactory;
         this.hostResolver = opts.hostResolver;
         this.streamerDefaults = opts.streamerDefaults;
         this.inputBatchMs = opts.inputBatchMs ?? DEFAULT_INPUT_BATCH_MS;
+        this.geometryTimeoutMs = opts.geometryTimeoutMs ?? DEFAULT_GEOMETRY_TIMEOUT_MS;
+        this.followIntervalMs = normalizeFollowIntervalMs(opts.streamerDefaults?.windowFollowIntervalMs);
+        this.maxPendingGlobal = opts.maxPendingGeometryLiveness ?? DEFAULT_MAX_PENDING_GLOBAL;
+        this.maxPendingPerAgent = opts.maxPendingGeometryPerAgent ?? DEFAULT_MAX_PENDING_PER_AGENT;
+    }
+    get settleDeadlineMs() {
+        return this.geometryTimeoutMs + GEOMETRY_SETTLE_SLACK_MS;
     }
     ensure(agent) {
         const existing = this.streamers.get(agent.id);
@@ -25,7 +73,11 @@ export class PaneStreamerManager {
             ? this.hostResolver(agent)
             : (typeof agent.host === 'object' ? agent.host : undefined));
         const tmux = new TmuxManager(runner);
-        const streamer = new PaneStreamer(agent, tmux, resolveHost, this.streamerDefaults);
+        const owner = this.ownerOf(agent);
+        const streamer = new PaneStreamer(agent, tmux, resolveHost, {
+            ...this.streamerDefaults,
+            geometry: this.geometryHooksFor(owner),
+        });
         this.streamers.set(agent.id, streamer);
         this.tmuxByAgent.set(agent.id, tmux);
         return streamer;
@@ -52,13 +104,443 @@ export class PaneStreamerManager {
         this.streamers.delete(agentId);
         if (streamer)
             streamer.destroy(opts);
+        // Agent removal discards functional owner state; any queued/in-flight geometry
+        // task or hold-release closure from the old epoch lands as a no-op, and remote
+        // residue stays inert behind the session-identity fence. Raw liveness entries
+        // in the global registry survive until their own settle.
+        const owner = this.owners.get(agentId);
+        if (owner) {
+            owner.epoch++;
+            this.ownerEpochs.set(agentId, owner.epoch);
+            if (owner.timer) {
+                clearInterval(owner.timer);
+                owner.timer = null;
+            }
+            // silent = planned shutdown (destroyAll): boot-time startupScan owns any
+            // leftover reconciliation, so a dirty owner is not worth a warning there.
+            if (owner.dirty && !opts.silent) {
+                console.warn(`[pane-streamer-manager] ${agentId} removed while owner state dirty; a rebuilt agent starts clean`);
+            }
+            this.owners.delete(agentId);
+        }
     }
     async destroyAll() {
-        const ids = [...this.streamers.keys()];
-        await Promise.all(ids.map((id) => this.destroy(id, { silent: true }).catch((err) => {
+        const ids = new Set([...this.streamers.keys(), ...this.owners.keys()]);
+        await Promise.all([...ids].map((id) => this.destroy(id, { silent: true }).catch((err) => {
             console.error(`[PaneStreamerManager] destroyAll: destroy ${id} failed:`, err);
         })));
     }
+    // Boot-time pass: process restarts lose in-memory owner state; one reconcile
+    // round per configured agent heals any manual left behind by a prior life.
+    // Sequential (bounded queue): a parallel fan-out would eat the global admission
+    // budget and deterministically starve agents past the cap. scanPending is the
+    // retry credential — a transient/backpressured round keeps it, the per-owner
+    // timer retries until the round succeeds or the session is provably absent.
+    startupScan(agents) {
+        const queue = [];
+        for (const agent of agents) {
+            const owner = this.ownerOf(agent);
+            owner.scanPending = true;
+            this.syncReconcilerTimer(owner);
+            queue.push(owner);
+        }
+        void (async () => {
+            for (const owner of queue) {
+                try {
+                    await this.reconcileOnce(owner);
+                }
+                catch (err) {
+                    console.warn(`[pane-streamer-manager] startup scan round failed for ${owner.agent.id}:`, err);
+                }
+            }
+        })();
+    }
+    ownerOf(agent) {
+        const existing = this.owners.get(agent.id);
+        if (existing) {
+            existing.agent = agent;
+            return existing;
+        }
+        const owner = {
+            agent,
+            epoch: this.ownerEpochs.get(agent.id) ?? 0,
+            fullHolds: 0,
+            dirty: false,
+            scanPending: false,
+            gen: 0,
+            lastWrittenGen: null,
+            fullTarget: null,
+            statusLines: 1,
+            identity: null,
+            claim: null,
+            ownerWriteCapability: null,
+            legacyUnsettledWrites: 0,
+            timer: null,
+            inFlight: false,
+            chain: Promise.resolve(),
+            resizeWriteQueued: false,
+            resizeWritePending: null,
+            readFailing: false,
+            foreignWarned: false,
+            tmux: null,
+        };
+        this.owners.set(agent.id, owner);
+        return owner;
+    }
+    ownerTmux(owner) {
+        const live = this.tmuxByAgent.get(owner.agent.id);
+        if (live)
+            return live;
+        if (!owner.tmux)
+            owner.tmux = new TmuxManager(this.runnerFactory(owner.agent));
+        return owner.tmux;
+    }
+    geometryHooksFor(owner) {
+        const epoch = owner.epoch;
+        const agentId = owner.agent.id;
+        const current = () => {
+            const cur = this.owners.get(agentId);
+            return cur && cur.epoch === epoch ? cur : null;
+        };
+        return {
+            fullHolds: () => current()?.fullHolds ?? 0,
+            acquireFullHold: () => {
+                const cur = current();
+                if (!cur)
+                    return () => undefined;
+                return this.acquireFullHold(cur);
+            },
+            readGeometry: async () => {
+                const cur = current();
+                if (!cur)
+                    throw new Error(`agent ${agentId} owner state replaced`);
+                return this.readGeometryAdmitted(cur);
+            },
+            raceProbe: (start) => this.raceProbeStart(agentId, start),
+            noteManualSeen: () => {
+                const cur = current();
+                if (!cur || cur.fullHolds > 0)
+                    return;
+                cur.dirty = true;
+                this.syncReconcilerTimer(cur);
+                void this.reconcileOnce(cur);
+            },
+            recordFullTarget: (size) => {
+                const cur = current();
+                if (cur)
+                    cur.fullTarget = size;
+            },
+            commitOwnerResize: () => {
+                const cur = current();
+                if (!cur)
+                    return Promise.reject(new Error(`agent ${agentId} owner state replaced; resize dropped`));
+                return this.commitOwnerResize(cur);
+            },
+        };
+    }
+    acquireFullHold(owner) {
+        owner.fullHolds++;
+        if (owner.fullHolds === 1) {
+            owner.dirty = true;
+            this.syncReconcilerTimer(owner);
+            void this.reconcileOnce(owner);
+        }
+        const epoch = owner.epoch;
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            const cur = this.owners.get(owner.agent.id);
+            if (!cur || cur.epoch !== epoch)
+                return;
+            cur.fullHolds = Math.max(0, cur.fullHolds - 1);
+            if (cur.fullHolds === 0) {
+                cur.fullTarget = null;
+                cur.dirty = true;
+                this.syncReconcilerTimer(cur);
+                void this.reconcileOnce(cur);
+            }
+        };
+    }
+    syncReconcilerTimer(owner) {
+        const needed = this.owners.get(owner.agent.id) === owner
+            && (owner.dirty || owner.fullHolds > 0 || owner.scanPending);
+        if (needed && !owner.timer) {
+            owner.timer = setInterval(() => { void this.reconcileOnce(owner); }, this.followIntervalMs);
+            owner.timer.unref?.();
+        }
+        else if (!needed && owner.timer) {
+            clearInterval(owner.timer);
+            owner.timer = null;
+        }
+    }
+    admitLiveness(agentId) {
+        const per = this.pendingByAgent.get(agentId) ?? 0;
+        return this.pendingGlobal < this.maxPendingGlobal && per < this.maxPendingPerAgent;
+    }
+    registerLiveness(agentId, settled) {
+        this.pendingGlobal++;
+        this.pendingByAgent.set(agentId, (this.pendingByAgent.get(agentId) ?? 0) + 1);
+        const release = () => {
+            this.pendingGlobal = Math.max(0, this.pendingGlobal - 1);
+            const next = (this.pendingByAgent.get(agentId) ?? 1) - 1;
+            if (next <= 0)
+                this.pendingByAgent.delete(agentId);
+            else
+                this.pendingByAgent.set(agentId, next);
+        };
+        settled.then(release, release);
+    }
+    async raceGeometryExec(agentId, start) {
+        if (!this.admitLiveness(agentId)) {
+            throw new Error(`geometry liveness capacity reached (${agentId}); backing off`);
+        }
+        const raw = start();
+        this.registerLiveness(agentId, raw.then(() => undefined, () => undefined));
+        return raceDeadline(raw, this.settleDeadlineMs, () => undefined);
+    }
+    // Admission is reserved BEFORE the probe live-body exists (lazy start): a
+    // capacity-refused probe creates nothing, and a created probe is registered
+    // before it can race — no PTY ever lives outside the global registry.
+    raceProbeStart(agentId, start) {
+        if (!this.admitLiveness(agentId)) {
+            return Promise.reject(new Error(`geometry liveness capacity reached (${agentId}); probe not admitted`));
+        }
+        const handle = start();
+        this.registerLiveness(agentId, handle.settled.then(() => undefined, () => undefined));
+        return raceDeadline(handle.result, this.settleDeadlineMs, () => {
+            try {
+                handle.onDeadline();
+            }
+            catch (err) {
+                // The registry entry stays until the probe's own exit is observed — the
+                // occupied slot IS the retry credential; the operator just needs to know.
+                console.warn(`[pane-streamer-manager] ${agentId} capability probe kill failed (slot stays occupied until it exits):`, err);
+            }
+        });
+    }
+    async readGeometryAdmitted(owner) {
+        const tmux = this.ownerTmux(owner);
+        const geom = await this.raceGeometryExec(owner.agent.id, () => tmux.getWindowGeometry(owner.agent.id, { timeout: this.geometryTimeoutMs }));
+        owner.statusLines = geom.statusLines;
+        if (owner.identity && (owner.identity.sessionId !== geom.ref.sessionId
+            || owner.identity.serverPid !== geom.ref.serverPid
+            || owner.identity.serverStart !== geom.ref.serverStart)) {
+            // A rebuilt session has no relation to the previous full target or writes.
+            owner.fullTarget = null;
+            owner.lastWrittenGen = null;
+        }
+        owner.identity = geom.ref;
+        owner.claim = geom.claim;
+        owner.ownerWriteCapability = geom.ownerWriteCapability;
+        if (geom.ownerGen !== null && geom.ownerGen > owner.gen)
+            owner.gen = geom.ownerGen;
+        return geom;
+    }
+    enqueueGeometry(owner, epoch, task) {
+        const run = owner.chain.then(async () => {
+            const cur = this.owners.get(owner.agent.id);
+            if (cur !== owner || owner.epoch !== epoch) {
+                throw new Error(`agent ${owner.agent.id} owner state replaced; geometry task dropped`);
+            }
+            return task();
+        });
+        owner.chain = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    // Every owner write is server-side guarded by session triple ∧ claim; 'full'
+    // capability adds the numeric generation compare. 'null' capability (unproven
+    // either way) issues NOTHING — fail closed, retry after the next read.
+    async issueOwnerWrite(owner, mode, resizeTo) {
+        if (owner.identity === null) {
+            throw new Error(`agent ${owner.agent.id} owner identity unknown; no write issued`);
+        }
+        if (owner.claim !== owner.agent.id) {
+            throw new Error(`agent ${owner.agent.id} session claim is ${JSON.stringify(owner.claim)}; refusing to write to a foreign/unclaimed session`);
+        }
+        const capability = owner.ownerWriteCapability;
+        if (capability === null) {
+            throw new Error(`agent ${owner.agent.id} owner write capability unproven; no write issued`);
+        }
+        const tmux = this.ownerTmux(owner);
+        const opts = { timeout: this.geometryTimeoutMs };
+        if (capability === 'full') {
+            const gen = owner.gen = Math.max(Date.now(), owner.gen + 1);
+            await this.raceGeometryExec(owner.agent.id, () => tmux.ownerWrite(owner.agent.id, owner.identity, owner.agent.id, gen, mode, resizeTo, opts));
+            owner.lastWrittenGen = gen;
+            return;
+        }
+        // Legacy server (<3.2, no format arithmetic): triple ∧ claim guard still holds;
+        // only the generation compare is unavailable, so same-session out-of-order
+        // writes remain possible. dirty must not clear while one is unsettled.
+        await this.raceGeometryExec(owner.agent.id, () => {
+            owner.legacyUnsettledWrites++;
+            const raw = tmux.ownerWrite(owner.agent.id, owner.identity, owner.agent.id, null, mode, resizeTo, opts);
+            const dec = () => { owner.legacyUnsettledWrites = Math.max(0, owner.legacyUnsettledWrites - 1); };
+            raw.then(dec, dec);
+            return raw;
+        });
+        owner.lastWrittenGen = null;
+    }
+    fullBasis(owner) {
+        if (owner.fullTarget)
+            return owner.fullTarget;
+        const streamer = this.streamers.get(owner.agent.id);
+        if (streamer && !streamer.isDestroyed())
+            return streamer.size;
+        return null;
+    }
+    async reconcileOnce(owner) {
+        if (owner.inFlight)
+            return;
+        owner.inFlight = true;
+        try {
+            if (this.owners.get(owner.agent.id) !== owner)
+                return;
+            if (!owner.dirty && owner.fullHolds === 0 && !owner.scanPending)
+                return;
+            const epoch = owner.epoch;
+            let geom;
+            try {
+                geom = await this.readGeometryAdmitted(owner);
+                if (owner.readFailing) {
+                    owner.readFailing = false;
+                    console.log(`[pane-streamer-manager] ${owner.agent.id} owner geometry read recovered`);
+                }
+            }
+            catch (err) {
+                if (err instanceof SessionAbsentError) {
+                    // A PROVEN-absent session has nothing to reconcile; a rebuilt one starts
+                    // at tmux defaults and is re-armed by ensure()/startupScan(). Transient
+                    // failures (SSH flake, exit 255, admission backpressure) land in the
+                    // other branch and keep every retry credential.
+                    owner.scanPending = false;
+                    if (owner.fullHolds === 0 && owner.dirty)
+                        owner.dirty = false;
+                    this.syncReconcilerTimer(owner);
+                    return;
+                }
+                if (!owner.readFailing) {
+                    owner.readFailing = true;
+                    const detail = err instanceof Error ? err.message : String(err);
+                    console.warn(`[pane-streamer-manager] ${owner.agent.id} owner geometry read failing: ${detail}`);
+                }
+                return;
+            }
+            if (owner.epoch !== epoch || this.owners.get(owner.agent.id) !== owner)
+                return;
+            // The read succeeded: the boot-scan credential is spent regardless of what
+            // the state machine decides next (dirty carries any follow-up work).
+            owner.scanPending = false;
+            if (geom.claim !== owner.agent.id) {
+                if (!owner.foreignWarned) {
+                    owner.foreignWarned = true;
+                    console.warn(`[pane-streamer-manager] ${owner.agent.id} same-name session is claimed by ${JSON.stringify(geom.claim)}; owner writes withheld`);
+                }
+                this.syncReconcilerTimer(owner);
+                return;
+            }
+            if (owner.foreignWarned) {
+                owner.foreignWarned = false;
+                console.log(`[pane-streamer-manager] ${owner.agent.id} session claim recovered`);
+            }
+            const desired = owner.fullHolds > 0 ? 'manual' : 'latest';
+            const basis = desired === 'manual' ? this.fullBasis(owner) : null;
+            const wantArea = basis ? contentArea(basis, owner.statusLines) : null;
+            const modeOk = geom.sizeMode === desired;
+            const genOk = owner.ownerWriteCapability === 'full'
+                ? (owner.lastWrittenGen === null || geom.ownerGen === owner.lastWrittenGen)
+                : true;
+            const sizeOk = desired === 'latest' || wantArea === null
+                || (geom.width === wantArea.cols && geom.height === wantArea.rows);
+            if (modeOk && genOk && sizeOk) {
+                if (owner.legacyUnsettledWrites === 0 && owner.dirty) {
+                    owner.dirty = false;
+                }
+                this.syncReconcilerTimer(owner);
+                return;
+            }
+            owner.dirty = true;
+            this.syncReconcilerTimer(owner);
+            try {
+                await this.enqueueGeometry(owner, epoch, async () => {
+                    const mode = owner.fullHolds > 0 ? 'manual' : 'latest';
+                    const commitBasis = mode === 'manual' ? this.fullBasis(owner) : null;
+                    const resizeTo = mode === 'manual' && commitBasis
+                        ? contentArea(commitBasis, owner.statusLines)
+                        : undefined;
+                    if (mode === 'manual' && !commitBasis && geom.sizeMode === 'manual')
+                        return;
+                    await this.issueOwnerWrite(owner, mode, resizeTo);
+                });
+            }
+            catch (err) {
+                const detail = err instanceof Error ? err.message : String(err);
+                console.warn(`[pane-streamer-manager] ${owner.agent.id} owner write failed (will retry): ${detail}`);
+            }
+        }
+        finally {
+            owner.inFlight = false;
+        }
+    }
+    async commitOwnerResize(owner) {
+        owner.dirty = true;
+        this.syncReconcilerTimer(owner);
+        const epoch = owner.epoch;
+        if (owner.identity === null || owner.ownerWriteCapability === null) {
+            await this.readGeometryAdmitted(owner);
+            if (owner.epoch !== epoch || this.owners.get(owner.agent.id) !== owner) {
+                throw new Error(`agent ${owner.agent.id} owner state replaced; resize dropped`);
+            }
+        }
+        if (owner.resizeWriteQueued && owner.resizeWritePending)
+            return owner.resizeWritePending;
+        owner.resizeWriteQueued = true;
+        const run = this.enqueueGeometry(owner, epoch, async () => {
+            owner.resizeWriteQueued = false;
+            // Released or retargeted while queued: the reconciler owns 'latest'; a newer
+            // resize target is picked up here because we read fullTarget at run time.
+            if (owner.fullHolds === 0)
+                return;
+            const target = owner.fullTarget;
+            if (!target)
+                return;
+            await this.issueOwnerWrite(owner, 'manual', contentArea(target, owner.statusLines));
+        });
+        const shared = run.finally(() => {
+            if (owner.resizeWritePending === shared)
+                owner.resizeWritePending = null;
+        });
+        owner.resizeWritePending = shared;
+        return shared;
+    }
+    _geometryPendingForTest() {
+        return { global: this.pendingGlobal, byAgent: new Map(this.pendingByAgent) };
+    }
+    _ownerForTest(agentId) {
+        const o = this.owners.get(agentId);
+        if (!o)
+            return null;
+        return {
+            fullHolds: o.fullHolds,
+            dirty: o.dirty,
+            gen: o.gen,
+            fullTarget: o.fullTarget,
+            ownerWriteCapability: o.ownerWriteCapability,
+            claim: o.claim,
+            scanPending: o.scanPending,
+            timerActive: o.timer !== null,
+            epoch: o.epoch,
+        };
+    }
+    _reconcileNowForTest(agentId) {
+        const owner = this.owners.get(agentId);
+        if (!owner)
+            return Promise.resolve();
+        owner.scanPending = true;
+        return this.reconcileOnce(owner);
+    }
     windowFlush = new Map();
     enqueueInput(agentId, data) {
         if (data.length === 0)