create-claude-cabinet 0.45.0 → 0.46.0

package/templates/cabinet/skill-output-conventions.md

@@ -133,7 +133,41 @@ that format here; reference it.
 user's actual situation. This applies whether the choice is rendered via
 AskUserQuestion or prose — the primitive changes, the posture doesn't.
 
-## 9. Calibration Examples
+## 9. Operator-Facing Register: Plain English by Default
+
+When a skill addresses the operator about substantial work — a plan, an
+audit finding, a checkpoint decision, a status report — there are **two
+readers, and they need two registers:**
+
+- **The filed artifact** (the plan in pib-db, the finding's record, the
+  report on disk) stays **technical and complete** — exact file paths,
+  function names, fids, acceptance criteria. A future session executes
+  from it cold, so precision is the whole point.
+- **What you SAY to the operator** is **plain English** — concept first,
+  the stakes spelled out, any decision framed as options with tradeoffs.
+  Keep file paths and symbol names out of the spoken prose; they live in
+  the filed artifact, reachable on request or behind a collapsed
+  "full detail" pointer.
+
+The operator is the director, not the implementer (see the user-role
+brief): they decide *what* and *why* and must be able to weigh in without
+parsing every technical detail. A wall of paths and identifiers is noise
+to that judgment — it buries the one thing they're being asked to decide.
+Lead with what changed and why it matters; keep the file-and-line
+narrative for the record.
+
+This is the **default register** for operator-facing skill output. It
+does NOT relax the filed artifact's rigor — a plan still files
+QA-compliant notes, an audit still records exact locations. The split is
+between the *record* (technical) and the *briefing* (plain). When in
+doubt, write the briefing as if explaining to a sharp colleague who
+hasn't seen the code.
+
+This is a *register* rule (how to phrase), distinct from §5 (prose vs
+dialog as the *primitive*) and §8 (present-don't-prescribe as the
+*posture*) — all three compose.
+
+## 10. Calibration Examples
 
 **Before/after — engagement decision items** (the Tier 1 conversion):
 

package/templates/cabinet/watchtower-contracts.md

@@ -80,7 +80,10 @@ the section, Ring 1 writes its own ephemeral fallback ("Active: …" /
 last-commit line) and rebuilds it freely; once the marker is present,
 Ring 1 must carry the existing section forward verbatim. Without this,
 Ring 1's full-file rebuild deterministically clobbers Ring 3's summary
-within one cron tick (~5 minutes).
+within one cron tick (~5 minutes). Rebuild writes must go through
+`writeProjectStatePreservingRing3()` in `watchtower-lib.mjs` (re-read
+verify with retry), never a raw read→merge→write — the raw form has a
+read-then-write race that drops a Last Session Ring 3 authors mid-merge.
 
 ### Thread File Durability (disk wins over model)
 
@@ -111,6 +114,91 @@ standard files:
 `/inbox` reads these when `enrichment_status` is `"complete"`.
 Missing files degrade gracefully (null in the read result).
 
+## Routine Dispatch (declared interactive routines)
+
+Projects declare interactive customs as **routines** in `config.json`,
+under their project entry:
+
+```json
+"projects": {
+  "flow": {
+    "path": "/Users/x/flow",
+    "routines": [
+      {
+        "name": "morning-briefing",
+        "description": "Walk the operator through the day's landscape",
+        "trigger": { "type": "time-of-day", "at": "08:30" },
+        "script": ".claude/routines/morning-briefing.md",
+        "urgency": "normal",
+        "stale_after_hours": 24
+      }
+    ]
+  }
+}
+```
+
+- `name` — kebab-case slug, unique within the project.
+- `trigger.type` — `time-of-day` (`at: "HH:MM"`, local, fires once per
+  day), `interval` (`minutes`, >= 5), `path-nonempty` (`path` relative
+  to the project root or absolute; `cooldown_minutes` default 60), or
+  `session-close` (fires when Ring 3 closes a session for the project;
+  worktree sessions resolve to the main project; `cooldown_minutes`
+  default 0).
+- `script` — project-authored phase file (the established CC phase
+  convention) holding the routine's conversation script. The receiving
+  session reads it and runs it; watchtower never parses it.
+- `stale_after_hours` (default 24) — how long a pending dispatch stays
+  blocking before a fresh firing supersedes it.
+
+Ownership: `watchtower-routines.mjs` owns trigger evaluation, firing
+state (`state/routine-state.json`), and dispatch. Ring 1 ticks the
+mechanical triggers; Ring 3 raises session-close events. Both are
+feature-flagged by `defaults.routine_dispatch`. A firing files an inbox
+item (category `routine` — the durable record) and pushes a descriptor
+through `mux qa dispatch`, the SAME hardened desk-dispatch path as
+qa-handoffs (act:796fe6dc) — never a parallel one. Terminal exits on
+any dispatched-category item (qa-handoff, routine) clear the matching
+mux descriptor; routine items resolve normally (no QA gate, normal
+expiry — expiry also clears the descriptor). A pending routine item
+blocks refiring of the same routine until resolved or stale.
+
+## Session Advisor Pass (re-homed standing advisors)
+
+The standing session advisors (historian, system-advocate,
+user-advocate, anthropic-insider) hold two session-boundary seats, both
+index-driven via `.claude/skills/_index.json` — the roster is whoever
+declares the mandate, never a hardcoded list (act:aded4fc9):
+
+- **Close side (automatic):** Ring 3's Phase 2m runs every member whose
+  `standingMandate` includes `session-close` against the compressed
+  session transcript, scoped by `directives.session-close`. Findings
+  file as `advisor-finding` inbox items (max 2 per member per session,
+  deduped against pending + resolved/dismissed corpora). Feature-flagged
+  by `defaults.session_advisors`. Cost: reuses Ring 3's pinned-sonnet
+  run — no Claude Code spawn.
+- **Start side (pull, intent-aware):** `/briefing` full mode spawns
+  every member whose `standingMandate` includes `briefing`, scoped by
+  `directives.briefing`, with the briefing's gathered portfolio context.
+  Observations route through the curator's Step 3b selection and Step 4
+  close — never a permanent section (anti-accretion invariant).
+- **Consultation side (skill-level):** the /orient and /debrief
+  cabinet-consultations phases persist their members' ACTIONABLE
+  findings through this same channel before the briefing/report
+  renders (act:84daa7bc) — `advisor-finding` items with
+  `filed_by: "manual"` and `evidence.directive_key: "orient"` or
+  `"debrief"`, capped at 2 per member per session like Phase 2m.
+  Same dedup-vs-pending discipline (an existing pending item is
+  referenced, not re-filed), same /briefing re-surfacing — never a
+  parallel path. Projects without watchtower fall back to a pib-db
+  action; with neither available, the finding is marked UNTRACKED in
+  the rendered output so the non-persistence is loud.
+
+`advisor-finding` is ungated and undispatched: normal expiry applies
+(findings decay naturally), and `/briefing` weighs fresh ones near the
+top of the owning project's chunk — the re-surfacing the close pass
+promises. A `session-close`/`briefing` mandate without the matching
+directive key is a data error: consumers skip the member and log it.
+
 ## Deferred Schemas
 
 The following are specified in project notes but NOT formalized until

package/templates/engagement/pib-db-patches/pib-db-lib.mjs

@@ -8,10 +8,19 @@
 // None of them do console.log — callers decide how to present output.
 
 import { existsSync, readFileSync } from 'node:fs';
-import { ENGAGEMENT_EVENTS_CREATE, ENGAGEMENT_EVENTS_INDEXES } from '../.claude/engagement/sql-constants.mjs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 
+// sql-constants lives in the installed engagement runtime (.claude/engagement/),
+// which is gitignored in the CC source repo — absent on every fresh checkout/CI,
+// where npm test must still pass (act:d64feaac). Fall back to the committed
+// template source of truth. Same code in template and installed copies — no fork.
+const { ENGAGEMENT_EVENTS_CREATE, ENGAGEMENT_EVENTS_INDEXES } =
+  await import('../.claude/engagement/sql-constants.mjs').catch((err) => {
+    if (err.code !== 'ERR_MODULE_NOT_FOUND') throw err;
+    return import('../templates/engagement/sql-constants.mjs');
+  });
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------

package/templates/mux/__tests__/mux-fail-loud.fixture.sh

@@ -249,6 +249,50 @@ assert "loud fall-through names why" grep -q "No worktree isolation" <<<"$out"
 assert "main landing carries NO @mux_worktree" \
   test -z "$(win_opt seeded-plain @mux_worktree)"
 
+echo "== T10: prompt-bearing launch stages the prompt as the CLI initial-prompt arg"
+# queue_claude_start writes the prompt to a per-window seed file and launches
+# `claude "$(cat <seedfile>)"` — auto-submit with no keystroke timing. We assert
+# on that synchronous file (the pane's async `claude` run is not raced).
+SEED_DIR="$FAKE_HOME/.local/share/mux/seed-prompts"
+# A clean lead sentence + ". " gives slugify a valid window name; the gnarly
+# body (newlines, quotes, $, backticks) still rides the seed file verbatim —
+# queue_claude_start stages the full prompt, not the slug.
+PROMPT=$'Fix the parser. Body line with "double quotes", a $DOLLAR and a `backtick`.\nSecond body line.'
+printf '%s' "$PROMPT" > "$SANDBOX/expected-body.txt"
+before=$(win_count)
+out=$(run_mux "$PROJ" new "$PROMPT" 2>&1); rc=$?
+assert "mux new with a prompt exits 0 ($rc)" test "$rc" -eq 0
+assert "a worktree window opened" test "$(win_count)" -eq $((before + 1))
+seedf=$(ls -t "$SEED_DIR"/sess-*.txt 2>/dev/null | head -1)
+assert "a seed-prompt file was written" test -n "$seedf"
+if [[ -n "$seedf" ]]; then
+  assert "auto_orient=1 prepends the orient instruction as line 1" \
+    bash -c "head -1 '$seedf' | grep -qx 'Run /orient-quick first to load state, then:'"
+  tail -n +3 "$seedf" > "$SANDBOX/got-body.txt"
+  assert "multi-line prompt body preserved byte-identical (quotes/\$/backticks intact)" \
+    diff "$SANDBOX/expected-body.txt" "$SANDBOX/got-body.txt"
+fi
+
+echo "== T12: the prompt is an ARG to claude, never executed as shell (auto-submit safety)"
+# The motivating hazard the reviewers flagged: auto-submitting by pasting the
+# prompt into the pane and pressing Enter would EXECUTE it as shell commands if
+# `claude` isn't up. Passing it as `claude "<prompt>"` makes that impossible —
+# if claude can't launch the prompt is just an unused argument. There is no
+# real `claude` on PATH here, so the launch fails; the sentinel proves the
+# prompt's embedded command never ran.
+SENTINEL="$SANDBOX/PROMPT_WAS_EXECUTED"
+rm -f "$SENTINEL"
+# Lead sentence + ". " for a valid slug; the touch sits on its own line, so if
+# this ever regressed to paste-into-shell + Enter, line 2 WOULD run and create
+# the sentinel. As a `claude "<arg>"` argument it never executes.
+PWN_PROMPT=$'Reproduce the bug. \ntouch "'"$SENTINEL"$'"'
+before=$(win_count)
+out=$(run_mux "$PROJ" new "$PWN_PROMPT" 2>&1); rc=$?
+assert "mux new with a command-shaped prompt exits 0 ($rc)" test "$rc" -eq 0
+sleep 1   # let the pane's shell attempt `cd … && claude "$(cat …)"`
+assert "prompt content was NOT executed as shell (no sentinel created)" \
+  test ! -e "$SENTINEL"
+
 echo ""
 echo "RESULT: $pass passed, $fail failed (sandbox: $SANDBOX)"
 exit $fail

package/templates/mux/__tests__/station-liveness.fixture.sh

@@ -0,0 +1,234 @@
+#!/bin/bash
+# Sandboxed AC verification for act:ca5ac156 (ensure_main_station pane-liveness
+# hardening). The bug: ensure_main_station trusted the @mux_claude window
+# marker as the ONLY Claude-liveness signal, so a live pre-v0.44 Claude with
+# no marker got the qa_launch_fresh keystrokes (C-u + `cd … && claude` +
+# Enter) typed INTO its input box.
+#
+# Everything runs under a mktemp dir with HOME overridden AND a private
+# throwaway tmux server (tmux -L mux-stl-test-$$ -f /dev/null) — it never
+# touches the real ~/.mux/worktrees, ~/.config/mux, or the operator's live
+# tmux server. Fake Claudes are REAL node processes printing Claude Code's UI
+# footer, so pane_current_command and the pane snapshot both look authentic.
+# The test server is killed in cleanup even on assertion failure.
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+SANDBOX=$(mktemp -d /tmp/cc-mux-station-test.XXXXXX)
+FAKE_HOME="$SANDBOX/home"
+PROJ="$SANDBOX/proj"
+WT_DIR="$FAKE_HOME/.mux/worktrees"
+MUX="$REPO_ROOT/templates/mux/bin/mux"
+NODE_BIN="$(command -v node)"
+
+pass=0; fail=0
+ok()  { echo "  PASS: $1"; pass=$((pass+1)); }
+bad() { echo "  FAIL: $1"; fail=$((fail+1)); }
+assert() { # assert <desc> <cmd...>
+  local desc="$1"; shift
+  if "$@" >/dev/null 2>&1; then ok "$desc"; else bad "$desc"; fi
+}
+
+# --- private throwaway tmux server -------------------------------------------
+unset TMUX TMUX_PANE
+SOCK="mux-stl-test-$$"
+TMX() { tmux -L "$SOCK" -f /dev/null "$@"; }
+cleanup() { TMX kill-server 2>/dev/null || true; rm -rf "$SANDBOX"; }
+trap cleanup EXIT
+
+# --- sandbox home -------------------------------------------------------------
+mkdir -p "$FAKE_HOME/.config/mux" "$WT_DIR" "$FAKE_HOME/.local/share/mux/wt-health" \
+         "$FAKE_HOME/.claude/projects" "$SANDBOX/bin"
+cp "$REPO_ROOT/templates/mux/config/worktree-session-health.sh" "$FAKE_HOME/.config/mux/"
+cp "$REPO_ROOT/templates/mux/config/worktree-dirty-check.sh" "$FAKE_HOME/.config/mux/"
+chmod +x "$FAKE_HOME/.config/mux/"*.sh
+
+# Stub claude FIRST in the panes' PATH so a relaunch never starts the real
+# Claude Code inside the test server.
+cat > "$SANDBOX/bin/claude" <<'SH'
+#!/bin/bash
+echo "stub-claude up — ? for shortcuts"
+exec tail -f /dev/null
+SH
+chmod +x "$SANDBOX/bin/claude"
+
+# Fake live Claude: a REAL node process whose visible pane shows Claude
+# Code's footer — pane_current_command = "node", snapshot matches the
+# pane_is_live_claude markers. No @mux_claude marker is ever set on it.
+cat > "$SANDBOX/fake-claude.js" <<'JS'
+console.log('╭──────────────────────────────╮');
+console.log('│ >                            │');
+console.log('╰──────────────────────────────╯');
+console.log('  ? for shortcuts');
+setInterval(() => {}, 1 << 30);
+JS
+# Noise process: also node, but with NO Claude UI markers — must classify
+# as "other", never get the marker backfilled, never get keystrokes.
+cat > "$SANDBOX/noise.js" <<'JS'
+console.log('dev server listening on :3000');
+setInterval(() => {}, 1 << 30);
+JS
+
+# Stub muxlib.py — answers only what cmd_new/cmd_qa/create_worktree ask.
+cat > "$FAKE_HOME/.config/mux/muxlib.py" <<'PY'
+import sys, os
+cmd = sys.argv[1] if len(sys.argv) > 1 else ""
+if cmd == "project-path":
+    p = os.environ.get("STUB_PROJ_PATH", "")
+    if p:
+        print(p)
+    else:
+        sys.exit(1)
+elif cmd == "project-names":
+    print("live")
+elif cmd in ("worktree-add", "worktree-remove", "narrate-mark"):
+    pass
+elif cmd == "worktree-is-active":
+    print("yes")
+elif cmd == "narrate-check":
+    print("yes")
+PY
+echo '{"active":[]}' > "$FAKE_HOME/.config/mux/worktrees.json"
+echo '{}' > "$FAKE_HOME/.config/mux/projects.json"
+
+# --- fixture project ------------------------------------------------------------
+git init -q "$PROJ"
+git -C "$PROJ" config user.email t@t.t; git -C "$PROJ" config user.name t
+echo code > "$PROJ/file.txt"
+git -C "$PROJ" add -A && git -C "$PROJ" commit -qm init
+MAIN_SLUG=$(echo "$PROJ" | sed 's|[/.]|-|g')
+mkdir -p "$FAKE_HOME/.claude/projects/$MAIN_SLUG"
+
+# --- desks on the private server -------------------------------------------------
+# One session per scenario so marker backfill in one test can't leak into the
+# next. Window 0 is the main-station candidate (lowest-index non-worktree).
+#   live     → unmarked fake Claude (the act:ca5ac156 victim)
+#   noise    → unmarked node WITHOUT Claude markers ("other")
+#   dead     → bare shell (window 1's Claude died — relaunch is correct)
+#   marked   → fake Claude WITH @mux_claude=1 (pre-fix happy path, no-op)
+#   dispatch → unmarked idle fake Claude for the `mux qa dispatch` path
+HOME="$FAKE_HOME" PATH="$SANDBOX/bin:$PATH" \
+  TMX new-session -d -s live -x 200 -y 50 -c "$PROJ" "$NODE_BIN $SANDBOX/fake-claude.js" \
+  || { echo "FATAL: could not start private tmux server"; exit 1; }
+TMX new-session -d -s noise -x 200 -y 50 -c "$PROJ" "$NODE_BIN $SANDBOX/noise.js"
+TMX new-session -d -s dead -x 200 -y 50 -c "$PROJ"
+TMX new-session -d -s marked -x 200 -y 50 -c "$PROJ" "$NODE_BIN $SANDBOX/fake-claude.js"
+TMX set-window-option -t "marked:0" @mux_claude 1
+TMX new-session -d -s dispatch -x 200 -y 50 -c "$PROJ" "$NODE_BIN $SANDBOX/fake-claude.js"
+# verstr → unmarked fake Claude whose EXECUTABLE is named like a bare version
+# string ("2.1.169"): the macOS native installer execs a versioned binary, so
+# a real Claude pane reports pane_current_command as the version (live
+# finding, dec-c1dbcd8b QA). Symlinked node keeps the process authentic.
+mkdir -p "$SANDBOX/bin"
+ln -sf "$NODE_BIN" "$SANDBOX/bin/2.1.169"
+TMX new-session -d -s verstr -x 200 -y 50 -c "$PROJ" "$SANDBOX/bin/2.1.169 $SANDBOX/fake-claude.js"
+sleep 1  # let the fake-Claude footers render before any pane classification
+
+SOCKET_PATH=$(TMX display-message -p -t live '#{socket_path}')
+SERVER_PID=$(TMX display-message -p -t live '#{pid}')
+
+# Run mux "inside" a given desk: TMUX points at the test socket, TMUX_PANE at
+# that desk's window-0 pane so session resolution lands on the right desk.
+run_mux_in() { # run_mux_in <session> <args...>
+  local sess="$1"; shift
+  local pane; pane=$(TMX display-message -p -t "${sess}:0" '#{pane_id}')
+  env HOME="$FAKE_HOME" STUB_PROJ_PATH="$PROJ" \
+      TMUX="${SOCKET_PATH},${SERVER_PID},0" TMUX_PANE="$pane" \
+      bash "$MUX" "$@"
+}
+win_count() { TMX list-windows -t "$1" 2>/dev/null | wc -l | tr -d ' '; }
+win_opt()   { TMX show-options -wv -t "$1" "$2" 2>/dev/null; }
+# Pane snapshots and command output go through files — pane content contains
+# single quotes (`cd '…'`), which inline <<<'…' interpolation can't survive.
+SNAP="$SANDBOX/snap.txt"; OUT="$SANDBOX/out.txt"
+pane_snap() { TMX capture-pane -t "$1" -p -S -50 >"$SNAP" 2>/dev/null; }
+
+echo "== T1: live UNMARKED Claude => no keystroke injection + marker backfill (the act:ca5ac156 bug)"
+before=$(win_count live)
+run_mux_in live new "review the parser" >"$OUT" 2>&1; rc=$?
+sleep 0.5
+assert "mux new exits 0 ($rc)" test "$rc" -eq 0
+pane_snap "live:0"
+assert "NO launch keystrokes typed into the live Claude's input box" \
+  bash -c "! grep -qF \"cd '\" '$SNAP'"
+assert "@mux_claude=1 BACKFILLED on the unmarked live Claude" \
+  test "$(win_opt live:0 @mux_claude)" = "1"
+assert "work still routed to a new worktree window" \
+  test "$(win_count live)" -eq $((before + 1))
+
+echo "== T2: unmarked node WITHOUT Claude markers => 'other', refuse loudly, no backfill"
+before=$(win_count noise)
+run_mux_in noise new "tighten the linter" >"$OUT" 2>&1; rc=$?
+sleep 0.5
+assert "mux new exits 0 ($rc)" test "$rc" -eq 0
+pane_snap "noise:0"
+assert "NO launch keystrokes typed into the unknown program" \
+  bash -c "! grep -qF \"cd '\" '$SNAP'"
+assert "@mux_claude NOT backfilled on a non-Claude node process" \
+  test -z "$(win_opt noise:0 @mux_claude)"
+assert "refusal is loud and names the program" \
+  bash -c "grep -qF \"running 'node'\" '$OUT'"
+assert "work still routed to a new worktree window" \
+  test "$(win_count noise)" -eq $((before + 1))
+
+echo "== T3: bare shell (Claude died) => relaunch there (existing behavior preserved)"
+run_mux_in dead new "polish the docs" >"$OUT" 2>&1; rc=$?
+sleep 0.5
+assert "mux new exits 0 ($rc)" test "$rc" -eq 0
+pane_snap "dead:0"
+assert "launch keystrokes typed into the bare shell" \
+  bash -c "grep -qF \"cd '\" '$SNAP'"
+assert "relaunched station marked @mux_claude=1" \
+  test "$(win_opt dead:0 @mux_claude)" = "1"
+# The station relaunch is an EMPTY-prompt queue_claude_start: it must take the
+# plain `cd && claude` path and write NO initial-prompt seed file (a stray seed
+# arg would auto-submit garbage into the fresh station). The work prompt
+# ("polish the docs") rode a separate worktree window, which DOES get a seed.
+assert "empty-prompt station relaunch writes NO seed file for dead:0" \
+  test ! -f "$FAKE_HOME/.local/share/mux/seed-prompts/dead-0.txt"
+
+echo "== T4: marked live Claude => untouched no-op (pre-fix happy path preserved)"
+before=$(win_count marked)
+run_mux_in marked new "harden the cache" >"$OUT" 2>&1; rc=$?
+sleep 0.5
+assert "mux new exits 0 ($rc)" test "$rc" -eq 0
+pane_snap "marked:0"
+assert "NO keystrokes typed into the marked Claude" \
+  bash -c "! grep -qF \"cd '\" '$SNAP'"
+assert "work still routed to a new worktree window" \
+  test "$(win_count marked)" -eq $((before + 1))
+
+echo "== T5: qa dispatch reaches an unmarked-but-live IDLE Claude (shared classifier heals it)"
+DESC="$SANDBOX/handoff.json"
+cat > "$DESC" <<JSON
+{ "project": "dispatch", "project_path": "$PROJ", "item_id": "dec-test1234",
+  "what": "test handoff", "pickup_prompt": "pickup the QA handoff dec-test1234" }
+JSON
+# Run from the `live` desk's pane so the self-dispatch guard doesn't trip.
+run_mux_in live qa dispatch "$DESC" >"$OUT" 2>&1; rc=$?
+sleep 0.5
+assert "qa dispatch exits 0 ($rc)" test "$rc" -eq 0
+assert "dispatch INJECTED instead of queueing (unmarked Claude now visible)" \
+  bash -c "grep -qF 'injected into the idle main session' '$OUT'"
+pane_snap "dispatch:0"
+assert "pickup prompt landed in the Claude pane" \
+  bash -c "grep -qF 'pickup the QA handoff dec-test1234' '$SNAP'"
+assert "@mux_claude=1 backfilled by the dispatch path too" \
+  test "$(win_opt dispatch:0 @mux_claude)" = "1"
+
+echo "== T6: real-install process name is a bare version string => still positively verified (dec-c1dbcd8b live finding)"
+before=$(win_count verstr)
+run_mux_in verstr new "check version-named claude" >"$OUT" 2>&1; rc=$?
+sleep 0.5
+assert "mux new exits 0 ($rc)" test "$rc" -eq 0
+pane_snap "verstr:0"
+assert "NO launch keystrokes typed into the version-named live Claude" \
+  bash -c "! grep -qF \"cd '\" '$SNAP'"
+assert "@mux_claude=1 BACKFILLED despite digit-led process name" \
+  test "$(win_opt verstr:0 @mux_claude)" = "1"
+assert "work still routed to a new worktree window" \
+  test "$(win_count verstr)" -eq $((before + 1))
+
+echo ""
+echo "RESULT: $pass passed, $fail failed (sandbox: $SANDBOX)"
+exit $fail

package/templates/mux/__tests__/station-liveness.test.mjs

@@ -0,0 +1,47 @@
+// Guard test for ensure_main_station pane-liveness hardening (act:ca5ac156).
+//
+// The bug: ensure_main_station trusted the @mux_claude window marker as the
+// only Claude-liveness signal, so a live pre-v0.44 Claude with no marker got
+// the qa_launch_fresh keystrokes (C-u + `cd … && claude` + Enter) typed INTO
+// its input box — the "mux new isn't working" symptom, with the real risk of
+// injecting an unintended prompt into a live session.
+//
+// Drives station-liveness.fixture.sh against a PRIVATE throwaway tmux server
+// (tmux -L mux-stl-test-$$ -f /dev/null) with HOME sandboxed — it never
+// touches the operator's live tmux server, ~/.mux/worktrees, or
+// ~/.config/mux. Fake Claudes are real node processes printing Claude Code's
+// UI footer, so both liveness signals (pane_current_command + pane snapshot)
+// are authentic.
+//
+// Covers:
+//   - live UNMARKED Claude: no keystrokes injected, @mux_claude backfilled,
+//     work still routed to a worktree window
+//   - unmarked node WITHOUT Claude markers: classified "other", loud refusal
+//     naming the program, no backfill, no injection
+//   - bare shell (station Claude died): relaunch behavior preserved
+//   - marked live Claude: untouched no-op preserved
+//   - `mux qa dispatch` now reaches an unmarked-but-live idle Claude
+//     (qa_pane_state is the single shared classifier — the heal applies to
+//     every consumer, not just ensure_main_station)
+
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const fixture = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  'station-liveness.fixture.sh'
+);
+
+test('ensure_main_station pane liveness (sandboxed tmux fixture suite)', () => {
+  const res = spawnSync('bash', [fixture], { encoding: 'utf8', timeout: 120_000 });
+  const output = `${res.stdout}\n${res.stderr}`;
+  assert.strictEqual(
+    res.status,
+    0,
+    `fixture suite reported failures:\n${output}`
+  );
+  assert.match(output, /RESULT: \d+ passed, 0 failed/);
+});