oh-my-codex 0.20.1 → 0.20.3

package/dist/team/tmux-session.js

@@ -1,16 +1,18 @@
 import { spawnSync, execFile } from 'child_process';
 import { promisify } from 'util';
-import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'fs';
+import { closeSync, chmodSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'fs';
 import { homedir } from 'os';
-import { dirname, isAbsolute, join, resolve } from 'path';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'path';
 import { CODEX_BYPASS_FLAG, CLAUDE_SKIP_PERMISSIONS_FLAG, MADMAX_FLAG, CONFIG_FLAG, LONG_CONFIG_FLAG, MODEL_FLAG, } from '../cli/constants.js';
 import { getAgent } from '../agents/definitions.js';
 import { buildCapturePaneArgv as sharedBuildCapturePaneArgv, buildVisibleCapturePaneArgv as sharedBuildVisibleCapturePaneArgv, normalizeTmuxCapture as sharedNormalizeTmuxCapture, paneHasActiveTask as sharedPaneHasActiveTask, paneIsBootstrapping as sharedPaneIsBootstrapping, paneShowsCodexViewport as sharedPaneShowsCodexViewport, paneLooksReady as sharedPaneLooksReady, } from '../scripts/tmux-hook-engine.js';
 import { readActiveProviderEnvOverrides } from '../config/models.js';
-import { extractModelProviderOverrideValue } from './model-contract.js';
+import { classifyTeamWorkerLaunchPolicy, extractModelProviderOverrideValue, normalizeTeamWorkerLaunchArgs, parseTeamWorkerLaunchArgs, } from './model-contract.js';
 import { sleep, sleepSync } from '../utils/sleep.js';
 import { buildPlatformCommandSpec, classifySpawnError, resolveCommandPathForPlatform, spawnPlatformCommandSync, } from '../utils/platform-command.js';
 import { resolveOmxCliEntryPath } from '../utils/paths.js';
+import { readExactPaneProof, readExactPaneProofsSync, readExactPaneProofSync } from './exact-pane.js';
+import { resolveCanonicalTeamStateRoot } from './state-root.js';
 const execFileAsync = promisify(execFile);
 import { HUD_RESIZE_RECONCILE_DELAY_SECONDS, HUD_TMUX_TEAM_HEIGHT_LINES } from '../hud/constants.js';
 import { OMX_TMUX_HUD_OWNER_ENV } from '../hud/reconcile.js';
@@ -18,6 +20,41 @@ import { findHudWatchPaneIds, hudPaneMatchesOwner, OMX_TMUX_HUD_LEADER_PANE_ENV
 const OMX_INSTANCE_OPTION = '@omx_instance_id';
 const OMX_PANE_INSTANCE_OPTION = '@omx_pane_instance_id';
 const OMX_TEAM_PANE_OWNER_OPTION = '@omx_team_pane_owner_id';
+/** `kill(pid, 0)` establishes absence only on ESRCH. */
+function probeProcessLiveness(pid) {
+    try {
+        process.kill(pid, 0);
+        return 'alive';
+    }
+    catch (error) {
+        return error.code === 'ESRCH' ? 'gone' : 'unknown';
+    }
+}
+/** Carries live tmux resources when creation cannot safely roll them back. */
+export class CreateTeamSessionPartialError extends Error {
+    partialSession;
+    proofUnavailable;
+    originalError;
+    cleanupErrors;
+    constructor(partialSession, proofUnavailable, originalError, 
+    /** Cleanup commands that failed after resources were created and must be retried. */
+    cleanupErrors = []) {
+        super('create_team_session_cleanup_incomplete');
+        this.partialSession = partialSession;
+        this.proofUnavailable = proofUnavailable;
+        this.originalError = originalError;
+        this.cleanupErrors = cleanupErrors;
+        this.name = 'CreateTeamSessionPartialError';
+    }
+}
+class ExactPaneProofUnavailableError extends Error {
+    proof;
+    constructor(proof) {
+        super(`exact_pane_proof_unavailable:${proof.paneId}:${proof.reason}`);
+        this.proof = proof;
+        this.name = 'ExactPaneProofUnavailableError';
+    }
+}
 const INJECTION_MARKER = '[OMX_TMUX_INJECT]';
 const MODEL_INSTRUCTIONS_FILE_KEY = 'model_instructions_file';
 const OMX_BYPASS_DEFAULT_SYSTEM_PROMPT_ENV = 'OMX_BYPASS_DEFAULT_SYSTEM_PROMPT';
@@ -74,6 +111,206 @@ function runTmux(args) {
     }
     return { ok: true, stdout: (result.stdout || '').trim() };
 }
+/** Preserve structured tmux fields, including an empty final field. */
+/** Preserve structured tmux fields, including an empty final field. */
+function runTmuxStructured(args) {
+    const { result } = spawnPlatformCommandSync('tmux', args, { encoding: 'utf-8' });
+    if (result.error)
+        return { ok: false, stderr: result.error.message };
+    if (result.status !== 0) {
+        return { ok: false, stderr: (result.stderr || '').trim() || `tmux exited ${result.status}` };
+    }
+    return { ok: true, stdout: (result.stdout || '').replace(/\r?\n$/, '') };
+}
+function restoredHudCleanupDebtPath(cwd, stateRoot) {
+    const canonicalStateRoot = resolveCanonicalTeamStateRoot(resolve(cwd));
+    if (typeof stateRoot !== 'string' || !stateRoot.trim()) {
+        return join(canonicalStateRoot, '.restored-hud-cleanup-debt.json');
+    }
+    const canonicalTeamsRoot = join(canonicalStateRoot, 'team');
+    const root = resolve(stateRoot);
+    const relativeRoot = relative(canonicalTeamsRoot, root);
+    if (!isAbsolute(stateRoot.trim())
+        || !relativeRoot
+        || relativeRoot === '..'
+        || relativeRoot.startsWith(`..${sep}`)
+        || isAbsolute(relativeRoot)
+        || relativeRoot.split(sep).length !== 1) {
+        throw new Error('restored_hud_cleanup_debt_state_root_invalid');
+    }
+    for (let candidate = root;; candidate = dirname(candidate)) {
+        try {
+            const metadata = lstatSync(candidate);
+            if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+                throw new Error('restored_hud_cleanup_debt_state_root_invalid');
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (candidate === canonicalTeamsRoot)
+            break;
+    }
+    return join(root, '.restored-hud-cleanup-debt.json');
+}
+function syncRestoredHudDebtParentSync(path) {
+    let descriptor;
+    try {
+        descriptor = openSync(dirname(path), 'r');
+        fsyncSync(descriptor);
+    }
+    catch (error) {
+        const code = error.code;
+        if (!(code === 'EPERM' && process.platform === 'win32'))
+            throw error;
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+function persistRestoredHudCleanupDebtSync(cwd, debt, stateRoot) {
+    const debtPath = restoredHudCleanupDebtPath(cwd, stateRoot);
+    mkdirSync(dirname(debtPath), { recursive: true });
+    // Recheck after mkdir: an untrusted Team root must still be canonical and
+    // non-symlinked immediately before the durable file mutation.
+    restoredHudCleanupDebtPath(cwd, stateRoot);
+    const temporaryPath = `${debtPath}.tmp.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`;
+    writeFileSync(temporaryPath, `${JSON.stringify(debt)}\n`, { mode: 0o600 });
+    const temporaryDescriptor = openSync(temporaryPath, 'r');
+    try {
+        fsyncSync(temporaryDescriptor);
+    }
+    finally {
+        closeSync(temporaryDescriptor);
+    }
+    renameSync(temporaryPath, debtPath);
+    syncRestoredHudDebtParentSync(debtPath);
+}
+function parseRestoredHudCleanupDebtSync(cwd, stateRoot) {
+    const debtPath = restoredHudCleanupDebtPath(cwd, stateRoot);
+    if (!existsSync(debtPath))
+        return null;
+    let debt;
+    try {
+        debt = JSON.parse(readFileSync(debtPath, 'utf8'));
+    }
+    catch {
+        throw new Error('restored_hud_cleanup_debt_malformed');
+    }
+    if (debt.schema_version !== 1 || debt.operation !== 'restored_hud_cleanup'
+        || !hasExplicitWorkerPaneId(debt.pane_id)
+        || !hasExplicitWorkerPaneId(debt.leader_pane_id)
+        || !Number.isSafeInteger(debt.leader_pane_pid) || debt.leader_pane_pid <= 0
+        || !(typeof debt.leader_pane_owner_id === 'string' || debt.leader_pane_owner_id === null)
+        || debt.hud_owner_leader_pane_id !== debt.leader_pane_id
+        || (debt.pane_pid !== null && (!Number.isSafeInteger(debt.pane_pid) || debt.pane_pid <= 0))) {
+        throw new Error('restored_hud_cleanup_debt_malformed');
+    }
+    return { path: debtPath, debt };
+}
+function removeRestoredHudCleanupDebtSync(path) {
+    unlinkSync(path);
+    syncRestoredHudDebtParentSync(path);
+}
+/**
+ * Replays a prior restored-HUD obligation. A live pane is killable only when
+ * its recorded PID, HUD command identity, and tagged leader identity all
+ * still match; PID-less and ambiguous records remain durable debt.
+ */
+export function reconcileRestoredHudCleanupDebtSync(cwd, stateRoot) {
+    const record = parseRestoredHudCleanupDebtSync(cwd, stateRoot);
+    if (!record)
+        return;
+    const { path, debt } = record;
+    const proof = readExactPaneProofSync(debt.pane_id);
+    if (proof.status === 'gone') {
+        removeRestoredHudCleanupDebtSync(path);
+        return;
+    }
+    if (proof.status !== 'live' || debt.pane_pid === null || proof.pid !== debt.pane_pid || !debt.leader_pane_owner_id) {
+        throw new Error(`restored_hud_cleanup_debt_unresolved:${debt.pane_id}`);
+    }
+    const leader = requireLiveTeamOwnedPaneSync(debt.leader_pane_id, debt.leader_pane_pid, debt.leader_pane_owner_id);
+    const topology = listPanesResult(leader);
+    const hudMatches = !topology.error && topology.panes.filter((pane) => pane.paneId === proof.paneId
+        && hudPaneMatchesOwner(pane, { leaderPaneId: debt.hud_owner_leader_pane_id })).length === 1;
+    if (!hudMatches)
+        throw new Error(`restored_hud_cleanup_debt_unresolved:${debt.pane_id}`);
+    killExactPaneSync(proof.paneId, debt.pane_pid, () => {
+        requireLiveTeamOwnedPaneSync(debt.leader_pane_id, debt.leader_pane_pid, debt.leader_pane_owner_id);
+    });
+    removeRestoredHudCleanupDebtSync(path);
+}
+/** Remove restored-HUD debt only after the canonical config transaction commits the same frozen identity. */
+export function finalizeRestoredHudCleanupDebtSync(cwd, paneId, panePid, stateRoot, _requireFreshHudIdentity) {
+    const record = parseRestoredHudCleanupDebtSync(cwd, stateRoot);
+    if (!record)
+        return;
+    const { debt } = record;
+    if (debt.pane_id !== paneId || debt.pane_pid !== panePid || !debt.leader_pane_owner_id) {
+        throw new Error(`restored_hud_cleanup_debt_unresolved:${debt.pane_id}`);
+    }
+    const leader = requireLiveTeamOwnedPaneSync(debt.leader_pane_id, debt.leader_pane_pid, debt.leader_pane_owner_id);
+    const topology = listPanesResult(leader);
+    const hudMatches = !topology.error && topology.panes.filter((pane) => pane.paneId === debt.pane_id
+        && hudPaneMatchesOwner(pane, { leaderPaneId: debt.hud_owner_leader_pane_id })).length === 1;
+    if (!hudMatches)
+        throw new Error(`restored_hud_cleanup_debt_unresolved:${debt.pane_id}`);
+    const finalProof = readExactPaneProofSync(debt.pane_id);
+    if (finalProof.status !== 'live' || finalProof.pid !== debt.pane_pid) {
+        throw new Error(`restored_hud_cleanup_debt_unresolved:${debt.pane_id}`);
+    }
+    removeRestoredHudCleanupDebtSync(record.path);
+}
+/**
+ * Kill only a pane that a fresh global snapshot proves live. Callers treat
+ * gone/dead rows as already cleaned and unavailable snapshots as fail-closed.
+ */
+function requireLiveExactPaneSync(paneId, expectedPid) {
+    const proof = readExactPaneProofSync(paneId);
+    if (proof.status === 'unavailable')
+        throw new ExactPaneProofUnavailableError(proof);
+    if (proof.status === 'gone')
+        throw new Error(`tmux pane is not proven live: ${paneId}`);
+    if (expectedPid !== undefined && proof.pid !== expectedPid) {
+        throw new Error(`tmux pane identity changed: ${paneId}`);
+    }
+    return proof.paneId;
+}
+function killExactPaneSync(paneId, expectedPid, assertAuthorization) {
+    const proof = readExactPaneProofSync(paneId);
+    if (proof.status === 'unavailable')
+        throw new ExactPaneProofUnavailableError(proof);
+    if (proof.status === 'gone')
+        return;
+    if (expectedPid !== undefined && proof.pid !== expectedPid) {
+        throw new Error(`tmux pane identity changed: ${paneId}`);
+    }
+    assertAuthorization?.();
+    // Authorization can read tmux. Re-prove immediately after it so a recycled
+    // pane ID cannot be targeted by the subsequent kill.
+    const finalProof = readExactPaneProofSync(proof.paneId);
+    if (finalProof.status === 'unavailable')
+        throw new ExactPaneProofUnavailableError(finalProof);
+    if (finalProof.status === 'gone')
+        return;
+    if (finalProof.pid !== proof.pid || (expectedPid !== undefined && finalProof.pid !== expectedPid)) {
+        throw new Error(`tmux pane identity changed: ${paneId}`);
+    }
+    const result = runTmux(['kill-pane', '-t', finalProof.paneId]);
+    if (!result.ok)
+        throw new Error(`failed to kill tmux pane ${finalProof.paneId}: ${result.stderr}`);
+    const afterKill = readExactPaneProofSync(finalProof.paneId);
+    if (afterKill.status === 'unavailable')
+        throw new ExactPaneProofUnavailableError(afterKill);
+    if (afterKill.status !== 'gone') {
+        if (afterKill.pid !== finalProof.pid)
+            throw new Error(`tmux pane identity changed: ${paneId}`);
+        throw new Error(`tmux pane remains live after kill: ${paneId}`);
+    }
+}
 function appendNoUnderlineStyleFlags(style) {
     const normalized = style
         .split(/[,\s]+/)
@@ -86,7 +323,8 @@ function appendNoUnderlineStyleFlags(style) {
     }
     return combined.join(',');
 }
-function sanitizeTmuxStyleOption(sessionTarget, optionName) {
+function sanitizeTmuxStyleOption(sessionTarget, optionName, beforeEffect) {
+    beforeEffect?.();
     const shown = runTmux(['show-options', '-gv', '-t', sessionTarget, optionName]);
     if (!shown.ok)
         return false;
@@ -96,36 +334,39 @@ function sanitizeTmuxStyleOption(sessionTarget, optionName) {
     const sanitized = appendNoUnderlineStyleFlags(current);
     if (sanitized === current)
         return true;
+    beforeEffect?.();
     const result = runTmux(['set-option', '-t', sessionTarget, optionName, sanitized]);
     return result.ok;
 }
-function tagPaneInstance(paneTarget, instanceId) {
+function tagPaneInstance(paneTarget, instanceId, expectedPanePid) {
     const target = paneTarget.trim();
     const sanitized = instanceId.trim();
     if (!target || !sanitized)
         return;
-    const result = runTmux(['set-option', '-p', '-t', target, OMX_PANE_INSTANCE_OPTION, sanitized]);
+    const provenTarget = requireLiveExactPaneSync(target, expectedPanePid);
+    const result = runTmux(['set-option', '-p', '-t', provenTarget, OMX_PANE_INSTANCE_OPTION, sanitized]);
     if (!result.ok) {
-        throw new Error(`failed to tag tmux pane ${target}: ${result.stderr}`);
+        throw new Error(`failed to tag tmux pane ${provenTarget}: ${result.stderr}`);
     }
 }
-export function tagPaneTeamOwner(paneTarget, teamOwnerId) {
+export function tagPaneTeamOwner(paneTarget, teamOwnerId, expectedPanePid) {
     const target = paneTarget.trim();
     const sanitized = teamOwnerId.trim();
     if (!target || !sanitized)
         return;
-    const result = runTmux(['set-option', '-p', '-t', target, OMX_TEAM_PANE_OWNER_OPTION, sanitized]);
+    const provenTarget = requireLiveExactPaneSync(target, expectedPanePid);
+    const result = runTmux(['set-option', '-p', '-t', provenTarget, OMX_TEAM_PANE_OWNER_OPTION, sanitized]);
     if (!result.ok) {
-        throw new Error(`failed to tag tmux pane ${target}: ${result.stderr}`);
+        throw new Error(`failed to tag tmux pane ${provenTarget}: ${result.stderr}`);
     }
 }
-export function mitigateCopyModeUnderlineArtifacts(sessionTarget) {
+export function mitigateCopyModeUnderlineArtifacts(sessionTarget, beforeEffect) {
     const normalizedTarget = sessionTarget.trim();
     if (normalizedTarget === '')
         return false;
     let applied = false;
     for (const optionName of TMUX_COPY_MODE_STYLE_OPTIONS) {
-        if (sanitizeTmuxStyleOption(normalizedTarget, optionName)) {
+        if (sanitizeTmuxStyleOption(normalizedTarget, optionName, beforeEffect)) {
             applied = true;
         }
     }
@@ -181,18 +422,97 @@ function baseSessionName(target) {
     return target.split(':')[0] || target;
 }
 function listPanes(target) {
-    const result = runTmux(['list-panes', '-t', target, '-F', '#{pane_id}\t#{pane_current_command}\t#{pane_start_command}']);
+    return listPanesResult(target).panes;
+}
+function listPanesResult(target) {
+    const result = runTmuxStructured(['list-panes', '-t', target, '-F', '#{pane_id}\t#{pane_current_command}\t#{pane_start_command}']);
     if (!result.ok)
-        return [];
-    return result.stdout
-        .split('\n')
-        .map((line) => line.trim())
-        .filter((line) => line.length > 0)
-        .map((line) => {
-        const [paneId = '', currentCommand = '', startCommand = ''] = line.split('\t');
-        return { paneId, currentCommand, startCommand };
-    })
-        .filter((pane) => pane.paneId.startsWith('%'));
+        return { panes: [], error: result.stderr };
+    const panes = [];
+    for (const rawLine of result.stdout.split('\n')) {
+        const line = rawLine.endsWith('\r') ? rawLine.slice(0, -1) : rawLine;
+        if (line.length === 0)
+            continue;
+        const firstSeparator = line.indexOf('\t');
+        const secondSeparator = firstSeparator >= 0 ? line.indexOf('\t', firstSeparator + 1) : -1;
+        const paneId = firstSeparator >= 0 ? line.slice(0, firstSeparator) : line;
+        if (firstSeparator < 0 || secondSeparator < 0 || !/^%[0-9]+$/.test(paneId)) {
+            return { panes: [], error: 'malformed pane topology' };
+        }
+        if (panes.some((pane) => pane.paneId === paneId)) {
+            return { panes: [], error: 'malformed pane topology' };
+        }
+        panes.push({
+            paneId,
+            currentCommand: line.slice(firstSeparator + 1, secondSeparator),
+            startCommand: line.slice(secondSeparator + 1),
+        });
+    }
+    return { panes, error: null };
+}
+/**
+ * Window-wide layout effects may only touch the exact startup pane set. A
+ * target-scoped topology read rejects foreign/new panes, and targeted global
+ * snapshots pin every surviving pane identity. The final scoped read happens
+ * immediately before the mutation so panes added during owner reads cannot
+ * inherit that authority.
+ */
+/**
+ * Re-prove an explicitly Team-owned pane immediately before an effect. The
+ * double PID proof keeps ownership and process identity continuous across an
+ * untrusted tmux option read.
+ */
+function requireLiveTeamOwnedPaneSync(paneId, expectedPanePid, expectedTeamOwnerId) {
+    const target = requireLiveExactPaneSync(paneId, expectedPanePid);
+    const owner = readPaneTeamOwnerTagResult(target);
+    if (owner.status !== 'value' || owner.value !== expectedTeamOwnerId) {
+        const detail = owner.status === 'error' ? owner.error : 'missing';
+        throw new Error(`tmux pane team owner changed: ${target}: ${detail}`);
+    }
+    return requireLiveExactPaneSync(target, expectedPanePid);
+}
+function requireFrozenWindowTopologySync(teamTarget, expectedPanePids, expectedPaneOwners) {
+    const topology = listPanesResult(teamTarget);
+    if (topology.error)
+        throw new Error(`failed to read tmux pane topology: ${topology.error}`);
+    const actualPaneIds = new Set(topology.panes.map((pane) => pane.paneId));
+    if (actualPaneIds.size !== expectedPanePids.size
+        || [...expectedPanePids.keys()].some((paneId) => !actualPaneIds.has(paneId))) {
+        throw new Error('tmux window topology changed before layout mutation');
+    }
+    for (const [paneId, expectedPanePid] of expectedPanePids) {
+        const expectedOwner = expectedPaneOwners?.get(paneId);
+        if (expectedOwner)
+            requireLiveTeamOwnedPaneSync(paneId, expectedPanePid, expectedOwner);
+        else {
+            const proof = readExactPaneProofSync(paneId);
+            if (proof.status === 'unavailable')
+                throw new ExactPaneProofUnavailableError(proof);
+            if (proof.status === 'gone')
+                throw new Error(`tmux pane is not proven live: ${proof.paneId}`);
+            if (proof.pid !== expectedPanePid)
+                throw new Error(`tmux pane identity changed: ${proof.paneId}`);
+        }
+    }
+    const finalProofs = readExactPaneProofsSync([...expectedPanePids.keys()]);
+    for (const [index, [paneId, expectedPanePid]] of [...expectedPanePids.entries()].entries()) {
+        const proof = finalProofs[index];
+        if (proof.status === 'unavailable')
+            throw new ExactPaneProofUnavailableError(proof);
+        if (proof.status === 'gone')
+            throw new Error(`tmux pane is not proven live: ${proof.paneId}`);
+        if (proof.paneId !== paneId || proof.pid !== expectedPanePid) {
+            throw new Error(`tmux pane identity changed: ${paneId}`);
+        }
+    }
+    const finalTopology = listPanesResult(teamTarget);
+    if (finalTopology.error)
+        throw new Error(`failed to read tmux pane topology: ${finalTopology.error}`);
+    const finalPaneIds = new Set(finalTopology.panes.map((pane) => pane.paneId));
+    if (finalPaneIds.size !== expectedPanePids.size
+        || [...expectedPanePids.keys()].some((paneId) => !finalPaneIds.has(paneId))) {
+        throw new Error('tmux window topology changed before layout mutation');
+    }
 }
 export function listPaneIds(target) {
     return listPanes(target).map((pane) => pane.paneId);
@@ -237,12 +557,6 @@ export function chooseTeamLeaderPaneId(panes, preferredPaneId) {
         return nonHud.paneId;
     return preferredPaneId;
 }
-function findHudPaneIds(target, leaderPaneId) {
-    return findHudWatchPaneIds(listPanes(target), leaderPaneId, { leaderPaneId });
-}
-function findOwnedHudPaneIds(target, leaderPaneId) {
-    return findHudWatchPaneIds(listPanes(target), leaderPaneId, { leaderPaneId });
-}
 function readPaneCurrentPath(paneId) {
     if (!paneId.startsWith('%'))
         return null;
@@ -281,7 +595,8 @@ function shouldAttemptRestoreCwdCandidate(candidate) {
     }
     return pathIsUsableDirectory(candidate.rawPath);
 }
-function resolveStandaloneHudRestoreCwdCandidates(leaderPaneId, fallbackCwd, explicitCwd) {
+function resolveStandaloneHudRestoreCwdCandidates(leaderPaneId, fallbackCwd, explicitCwd, beforeReadLiveLeaderCwd) {
+    beforeReadLiveLeaderCwd?.();
     const liveLeaderCwd = readPaneCurrentPath(leaderPaneId);
     return uniqueRestoreCwdCandidates([
         { source: 'explicit', rawPath: explicitCwd },
@@ -318,105 +633,161 @@ async function runTmuxAsync(args) {
         return { ok: false, stderr: (err.stderr || err.message || '').trim() || 'tmux command failed' };
     }
 }
-async function sendKeyAsync(target, key) {
+function hasExplicitWorkerPaneId(workerPaneId) {
+    return typeof workerPaneId === 'string' && workerPaneId.trim().length > 0;
+}
+function resolveWorkerPaneTargetSync(sessionName, workerIndex, workerPaneId) {
+    if (!hasExplicitWorkerPaneId(workerPaneId))
+        return paneTarget(sessionName, workerIndex);
+    const proof = readExactPaneProofSync(workerPaneId);
+    return proof.status === 'live' ? proof.paneId : null;
+}
+async function resolveWorkerPaneTargetAsync(sessionName, workerIndex, workerPaneId) {
+    if (!hasExplicitWorkerPaneId(workerPaneId))
+        return paneTarget(sessionName, workerIndex);
+    const proof = await readExactPaneProof(workerPaneId);
+    return proof.status === 'live' ? proof.paneId : null;
+}
+function createPinnedWorkerPaneTargetResolverSync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
+    if (!hasExplicitWorkerPaneId(workerPaneId)) {
+        return () => resolveWorkerPaneTargetSync(sessionName, workerIndex, workerPaneId);
+    }
+    const pinnedPid = expectedPanePid;
+    const expectedOwner = typeof expectedTeamOwnerId === 'string' ? expectedTeamOwnerId.trim() : '';
+    const canonicalHudPaneId = typeof hudPaneId === 'string' ? hudPaneId.trim() : '';
+    return () => {
+        if (typeof pinnedPid !== 'number' || !Number.isSafeInteger(pinnedPid) || pinnedPid <= 0)
+            return null;
+        if (!expectedOwner)
+            return null;
+        if (canonicalHudPaneId && workerPaneId === canonicalHudPaneId) {
+            throw new Error(`tmux worker pane is HUD target: ${workerPaneId}`);
+        }
+        const proof = readExactPaneProofSync(workerPaneId);
+        if (proof.status !== 'live')
+            return null;
+        if (proof.pid !== pinnedPid) {
+            throw new Error(`tmux pane identity changed: ${workerPaneId}`);
+        }
+        const owner = readPaneTeamOwnerTagResult(proof.paneId);
+        if (owner.status !== 'value' || owner.value !== expectedOwner)
+            return null;
+        const finalProof = readExactPaneProofSync(workerPaneId);
+        if (finalProof.status !== 'live')
+            return null;
+        if (finalProof.pid !== pinnedPid) {
+            throw new Error(`tmux pane identity changed: ${workerPaneId}`);
+        }
+        return finalProof.paneId;
+    };
+}
+function createPinnedWorkerPaneTargetResolver(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
+    if (!hasExplicitWorkerPaneId(workerPaneId)) {
+        return () => resolveWorkerPaneTargetAsync(sessionName, workerIndex, workerPaneId);
+    }
+    const pinnedPid = expectedPanePid;
+    const expectedOwner = typeof expectedTeamOwnerId === 'string' ? expectedTeamOwnerId.trim() : '';
+    const canonicalHudPaneId = typeof hudPaneId === 'string' ? hudPaneId.trim() : '';
+    let lastResolvedPid;
+    const resolveTarget = async () => {
+        if (typeof pinnedPid !== 'number' || !Number.isSafeInteger(pinnedPid) || pinnedPid <= 0)
+            return null;
+        if (!expectedOwner)
+            return null;
+        if (canonicalHudPaneId && workerPaneId === canonicalHudPaneId) {
+            throw new Error(`tmux worker pane is HUD target: ${workerPaneId}`);
+        }
+        const proof = await readExactPaneProof(workerPaneId);
+        if (proof.status !== 'live')
+            return null;
+        if (proof.pid !== pinnedPid) {
+            throw new Error(`tmux pane identity changed: ${workerPaneId}`);
+        }
+        const owner = readPaneTeamOwnerTagResult(proof.paneId);
+        if (owner.status !== 'value' || owner.value !== expectedOwner) {
+            const detail = owner.status === 'error' ? owner.error : 'missing';
+            throw new Error(`tmux pane team owner changed: ${workerPaneId}: ${detail}`);
+        }
+        // The option read is untrusted and can race pane ID reuse. Its immediately
+        // adjacent PID proof authorizes the following capture/control/input effect.
+        const finalProof = await readExactPaneProof(workerPaneId);
+        if (finalProof.status !== 'live')
+            return null;
+        if (finalProof.pid !== pinnedPid) {
+            throw new Error(`tmux pane identity changed: ${workerPaneId}`);
+        }
+        lastResolvedPid = finalProof.pid;
+        return finalProof.paneId;
+    };
+    resolveTarget.lastResolvedPid = () => lastResolvedPid;
+    return resolveTarget;
+}
+async function requireAsyncPaneTarget(resolveTarget) {
+    const target = await resolveTarget();
+    if (!target)
+        throw new Error('tmux pane is not proven live');
+    return target;
+}
+async function sendKeyAsync(resolveTarget, key) {
+    const target = await requireAsyncPaneTarget(resolveTarget);
     const result = await runTmuxAsync(['send-keys', '-t', target, key]);
     if (!result.ok) {
         throw new Error(`sendKeyAsync: failed to send ${key}: ${result.stderr}`);
     }
 }
-async function capturePaneAsync(target) {
+async function capturePaneAsync(resolveTarget) {
+    const target = await resolveTarget();
+    if (!target)
+        return '';
     const result = await runTmuxAsync(sharedBuildCapturePaneArgv(target, 80));
     if (!result.ok)
         return '';
     return result.stdout;
 }
-async function captureVisiblePaneAsync(target) {
+/** Capture an explicit Team worker pane only after PID-owner-PID authorization. */
+export async function captureWorkerPane(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
+    const resolveTarget = createPinnedWorkerPaneTargetResolver(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
+    return capturePaneAsync(resolveTarget);
+}
+async function captureVisiblePaneAsync(resolveTarget) {
+    const target = await resolveTarget();
+    if (!target)
+        return '';
     const result = await runTmuxAsync(sharedBuildVisibleCapturePaneArgv(target));
     if (!result.ok)
         return '';
     return result.stdout;
 }
-async function isWorkerAliveAsync(sessionName, workerIndex, workerPaneId) {
-    if (workerPaneId?.startsWith('%')) {
-        const paneStatus = await readPaneLivenessByIdAsync(workerPaneId);
-        if (paneStatus !== null)
-            return paneStatus;
+async function isWorkerAliveAsync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId, resolveTarget) {
+    if (hasExplicitWorkerPaneId(workerPaneId)) {
+        const resolver = resolveTarget ?? createPinnedWorkerPaneTargetResolver(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
+        const target = await resolver();
+        const pid = resolver.lastResolvedPid?.() ?? expectedPanePid;
+        if (!target || typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid <= 0)
+            return 'unknown';
+        return probeProcessLiveness(pid);
     }
     const result = await runTmuxAsync([
         'list-panes',
-        '-t', paneTarget(sessionName, workerIndex, workerPaneId),
+        '-t', paneTarget(sessionName, workerIndex),
         '-F',
         '#{pane_dead} #{pane_pid}',
     ]);
     if (!result.ok)
-        return false;
+        return 'unknown';
     const line = result.stdout.split('\n')[0]?.trim();
     if (!line)
-        return false;
+        return 'unknown';
     const parts = line.split(/\s+/);
     if (parts.length < 2)
-        return false;
+        return 'unknown';
     const paneDead = parts[0];
     const pid = Number.parseInt(parts[1], 10);
     if (paneDead === '1')
-        return false;
-    if (!Number.isFinite(pid))
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function parsePaneLivenessLine(line, allowMissingPid) {
-    const parts = line.trim().split(/\s+/);
-    if (parts.length < 1 || parts[0] === '')
-        return null;
-    const paneDead = parts[0];
-    const pid = Number.parseInt(parts[1] ?? '', 10);
-    if (paneDead === '1')
-        return false;
+        return 'gone';
     if (!Number.isFinite(pid))
-        return allowMissingPid ? true : false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return allowMissingPid;
-    }
-}
-function readPaneLivenessById(paneId) {
-    const result = runTmux(['list-panes', '-a', '-F', '#{pane_id} #{pane_dead} #{pane_pid}']);
-    if (!result.ok)
-        return null;
-    for (const line of result.stdout.split('\n')) {
-        const trimmed = line.trim();
-        if (!trimmed)
-            continue;
-        const [id = '', ...rest] = trimmed.split(/\s+/);
-        if (id !== paneId)
-            continue;
-        return parsePaneLivenessLine(rest.join(' '), true);
-    }
-    return null;
-}
-async function readPaneLivenessByIdAsync(paneId) {
-    const result = await runTmuxAsync(['list-panes', '-a', '-F', '#{pane_id} #{pane_dead} #{pane_pid}']);
-    if (!result.ok)
-        return null;
-    for (const line of result.stdout.split('\n')) {
-        const trimmed = line.trim();
-        if (!trimmed)
-            continue;
-        const [id = '', ...rest] = trimmed.split(/\s+/);
-        if (id !== paneId)
-            continue;
-        return parsePaneLivenessLine(rest.join(' '), true);
-    }
-    return null;
+        return 'unknown';
+    return probeProcessLiveness(pid);
 }
 function shellQuoteSingle(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -510,6 +881,20 @@ function buildNestedTmuxShellCommand(command) {
 function buildBestEffortShellCommand(command) {
     return `${command} >/dev/null 2>&1 || true`;
 }
+function buildAuthoritativeHudResizeShellCommand(hudPaneId, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES, expectedPanePid, expectedPaneOwnerId, effectCommand = buildNestedTmuxShellCommand(buildHudResizeCommand(buildHudPaneTarget(hudPaneId), heightLines))) {
+    const target = buildHudPaneTarget(hudPaneId);
+    const snapshot = buildNestedTmuxShellCommand("list-panes -a -F '#{pane_id}\\t#{pane_dead}\\t#{pane_pid}'");
+    const expectedPid = typeof expectedPanePid === 'number' && Number.isSafeInteger(expectedPanePid) && expectedPanePid > 0
+        ? ` && $3 == "${expectedPanePid}"`
+        : '';
+    const proof = `awk -F '\\t' -v pane='${target}' 'NF != 3 || $1 !~ /^%[0-9]+$/ || ($2 != "0" && $2 != "1") || (seen[$1]++) || ($1 == pane && ($3 !~ /^[1-9][0-9]*$/ || length($3) > 16 || (length($3) == 16 && ("x" $3) > "x9007199254740991"))) || ($1 != pane && $3 != "" && ($3 !~ /^[1-9][0-9]*$/ || length($3) > 16 || (length($3) == 16 && ("x" $3) > "x9007199254740991"))) { bad = 1 } $1 == pane && $2 == "0"${expectedPid} { live = 1 } END { exit bad || !live }'`;
+    const expectedOwner = expectedPaneOwnerId?.trim();
+    if (!expectedOwner) {
+        return `if snapshot=$(${snapshot}); then printf '%s\\n' "$snapshot" | ${proof} && ${effectCommand}; fi`;
+    }
+    const owner = buildNestedTmuxShellCommand(`show-option -qv -p -t ${target} ${OMX_TEAM_PANE_OWNER_OPTION}`);
+    return `if snapshot=$(${snapshot}); then printf '%s\\n' "$snapshot" | ${proof} && owner=$(${owner}) && [ "$owner" = ${shellQuoteSingle(expectedOwner)} ] && final_snapshot=$(${snapshot}) && printf '%s\\n' "$final_snapshot" | ${proof} && ${effectCommand}; fi`;
+}
 /** Upper bound for tmux hook indices (signed 32-bit max). */
 const TMUX_HOOK_INDEX_MAX = 2147483647;
 function buildResizeHookSlot(hookName) {
@@ -526,8 +911,8 @@ function buildClientAttachedHookSlot(hookName) {
     }
     return `client-attached[${Math.abs(hash) % TMUX_HOOK_INDEX_MAX}]`;
 }
-export function buildRegisterResizeHookArgs(hookTarget, hookName, hudPaneId, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES) {
-    const resizeCommand = buildBestEffortShellCommand(buildNestedTmuxShellCommand(buildHudResizeCommand(hudPaneId, heightLines)));
+export function buildRegisterResizeHookArgs(hookTarget, hookName, hudPaneId, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES, expectedPanePid, expectedPaneOwnerId) {
+    const resizeCommand = buildBestEffortShellCommand(buildAuthoritativeHudResizeShellCommand(hudPaneId, heightLines, expectedPanePid, expectedPaneOwnerId));
     const hookCommand = shellQuoteSingle(`${resizeCommand}; sleep ${HUD_RESIZE_RECONCILE_DELAY_SECONDS}; ${resizeCommand}`);
     return ['set-hook', '-t', hookTarget, buildResizeHookSlot(hookName), `run-shell -b ${hookCommand}`];
 }
@@ -543,9 +928,11 @@ export function buildClientAttachedReconcileHookName(teamName, sessionName, wind
         normalizeHudPaneToken(hudPaneId),
     ].join('_');
 }
-export function buildRegisterClientAttachedReconcileArgs(hookTarget, hookName, hudPaneId, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES) {
+export function buildRegisterClientAttachedReconcileArgs(hookTarget, hookName, hudPaneId, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES, expectedPanePid, expectedPaneOwnerId) {
     const hookSlot = buildClientAttachedHookSlot(hookName);
-    const oneShotCommand = shellQuoteSingle(`${buildBestEffortShellCommand(buildNestedTmuxShellCommand(buildHudResizeCommand(hudPaneId, heightLines)))}; ${buildNestedTmuxShellCommand(`set-hook -u -t ${hookTarget} ${hookSlot}`)}`);
+    const resizeCommand = buildBestEffortShellCommand(buildAuthoritativeHudResizeShellCommand(hudPaneId, heightLines, expectedPanePid, expectedPaneOwnerId));
+    const unregisterCommand = buildBestEffortShellCommand(buildAuthoritativeHudResizeShellCommand(hudPaneId, heightLines, expectedPanePid, expectedPaneOwnerId, buildNestedTmuxShellCommand(`set-hook -u -t ${hookTarget} ${hookSlot}`)));
+    const oneShotCommand = shellQuoteSingle(`${resizeCommand}; ${unregisterCommand}`);
     return ['set-hook', '-t', hookTarget, hookSlot, `run-shell -b ${oneShotCommand}`];
 }
 export function buildUnregisterClientAttachedReconcileArgs(hookTarget, hookName) {
@@ -555,18 +942,19 @@ export function unregisterResizeHook(hookTarget, hookName) {
     const result = runTmux(buildUnregisterResizeHookArgs(hookTarget, hookName));
     return result.ok;
 }
-export function buildScheduleDelayedHudResizeArgs(hudPaneId, delaySeconds = HUD_RESIZE_RECONCILE_DELAY_SECONDS, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES) {
+export function buildScheduleDelayedHudResizeArgs(hudPaneId, delaySeconds = HUD_RESIZE_RECONCILE_DELAY_SECONDS, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES, expectedPanePid, expectedPaneOwnerId) {
     const delay = Number.isFinite(delaySeconds) && delaySeconds > 0 ? delaySeconds : HUD_RESIZE_RECONCILE_DELAY_SECONDS;
-    return ['run-shell', '-b', `sleep ${delay}; ${buildBestEffortShellCommand(buildNestedTmuxShellCommand(buildHudResizeCommand(hudPaneId, heightLines)))}`];
+    return ['run-shell', '-b', `sleep ${delay}; ${buildBestEffortShellCommand(buildAuthoritativeHudResizeShellCommand(hudPaneId, heightLines, expectedPanePid, expectedPaneOwnerId))}`];
 }
-export function buildReconcileHudResizeArgs(hudPaneId, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES) {
-    return ['run-shell', buildBestEffortShellCommand(buildNestedTmuxShellCommand(buildHudResizeCommand(hudPaneId, heightLines)))];
+export function buildReconcileHudResizeArgs(hudPaneId, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES, expectedPanePid, expectedPaneOwnerId) {
+    return ['run-shell', buildBestEffortShellCommand(buildAuthoritativeHudResizeShellCommand(hudPaneId, heightLines, expectedPanePid, expectedPaneOwnerId))];
 }
-function redrawLeaderPaneAfterTeamLayout(leaderPaneId) {
+function redrawLeaderPaneAfterTeamLayout(leaderPaneId, expectedPanePid, expectedTeamOwnerId) {
     const target = leaderPaneId.trim();
     if (!target.startsWith('%'))
         return;
-    runTmux(['send-keys', '-t', target, 'C-l']);
+    const provenTarget = requireLiveTeamOwnedPaneSync(target, expectedPanePid, expectedTeamOwnerId);
+    runTmux(['send-keys', '-t', provenTarget, 'C-l']);
 }
 const ZSH_CANDIDATE_PATHS = ['/bin/zsh', '/usr/bin/zsh', '/usr/local/bin/zsh', '/opt/local/bin/zsh', '/opt/homebrew/bin/zsh'];
 const BASH_CANDIDATE_PATHS = ['/bin/bash', '/usr/bin/bash'];
@@ -613,24 +1001,35 @@ function escapeTomlString(value) {
 function isModelInstructionsOverride(value) {
     return new RegExp(`^${MODEL_INSTRUCTIONS_FILE_KEY}\\s*=`).test(value.trim());
 }
-function hasModelInstructionsOverride(args) {
-    for (let i = 0; i < args.length; i++) {
-        const arg = args[i];
+function someConfigOverrideBeforeEndOfOptions(args, matches) {
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--')
+            break;
+        let value;
         if (arg === CONFIG_FLAG || arg === LONG_CONFIG_FLAG) {
-            const maybeValue = args[i + 1];
-            if (typeof maybeValue === 'string' && isModelInstructionsOverride(maybeValue)) {
-                return true;
-            }
-            continue;
+            value = args[index + 1];
+            if (value === '--')
+                break;
+            index += 1;
         }
-        if (arg.startsWith(`${LONG_CONFIG_FLAG}=`)) {
-            const inlineValue = arg.slice(`${LONG_CONFIG_FLAG}=`.length);
-            if (isModelInstructionsOverride(inlineValue))
-                return true;
+        else if (arg.startsWith(`${CONFIG_FLAG}=`)) {
+            value = arg.slice(`${CONFIG_FLAG}=`.length);
         }
+        else if (arg.startsWith(`${LONG_CONFIG_FLAG}=`)) {
+            value = arg.slice(`${LONG_CONFIG_FLAG}=`.length);
+        }
+        else {
+            continue;
+        }
+        if (typeof value === 'string' && matches(value))
+            return true;
     }
     return false;
 }
+function hasModelInstructionsOverride(args) {
+    return someConfigOverrideBeforeEndOfOptions(args, isModelInstructionsOverride);
+}
 function normalizeTeamWorkerCliMode(raw, sourceEnv = OMX_TEAM_WORKER_CLI_ENV) {
     const normalized = String(raw ?? 'auto').trim().toLowerCase();
     if (normalized === '' || normalized === 'auto')
@@ -651,6 +1050,8 @@ function extractModelOverride(args) {
     let model = null;
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
+        if (arg === '--')
+            break;
         if (arg === MODEL_FLAG) {
             const maybeValue = args[i + 1];
             if (typeof maybeValue === 'string' && maybeValue.trim() !== '' && !maybeValue.startsWith('-')) {
@@ -764,6 +1165,18 @@ function shouldGrantExecutionBypassForRole(workerRole) {
         return true;
     return agent.tools === 'execution';
 }
+export function assertTeamWorkerCliPolicyCompatibility(workerCli, launchArgs) {
+    const policy = classifyTeamWorkerLaunchPolicy(launchArgs);
+    if ((workerCli === 'claude' || workerCli === 'gemini') && (policy === 'direct-policy' || policy === 'mixed-policy')) {
+        throw new Error(`Selected team worker CLI "${workerCli}" is incompatible with an explicit approval or sandbox policy.`);
+    }
+}
+export function assertTeamWorkerLaunchPolicyInvariant(workerCli, launchArgs) {
+    assertTeamWorkerCliPolicyCompatibility(workerCli, launchArgs);
+    if (workerCli === 'codex' && classifyTeamWorkerLaunchPolicy(launchArgs) === 'mixed-policy') {
+        throw new Error('internal_mixed_codex_worker_policy_argv');
+    }
+}
 export function translateWorkerLaunchArgsForCli(workerCli, args, initialPrompt, workerRole) {
     if (workerCli === 'codex')
         return [...args];
@@ -858,23 +1271,10 @@ export function scrubTeamWorkerHudOwnershipEnv(env) {
     return scrubbed;
 }
 function hasConfigOverride(args, key) {
-    const prefix = `${key}=`;
-    for (let index = 0; index < args.length; index += 1) {
-        const arg = args[index];
-        if (arg === CONFIG_FLAG || arg === LONG_CONFIG_FLAG) {
-            const value = args[index + 1];
-            if (typeof value === 'string' && value.trim().startsWith(prefix))
-                return true;
-            index += 1;
-            continue;
-        }
-        if (typeof arg === 'string' && arg.startsWith(`${LONG_CONFIG_FLAG}=`)) {
-            const value = arg.slice(`${LONG_CONFIG_FLAG}=`.length);
-            if (value.trim().startsWith(prefix))
-                return true;
-        }
-    }
-    return false;
+    return someConfigOverrideBeforeEndOfOptions(args, (value) => {
+        const trimmed = value.trim();
+        return trimmed.startsWith(key) && /^\s*=/.test(trimmed.slice(key.length));
+    });
 }
 function shouldDisableOmxMcpForTeamWorker(env) {
     const raw = env[OMX_TEAM_WORKER_MCP_COMPAT_ENV]?.trim().toLowerCase();
@@ -907,17 +1307,42 @@ function appendTeamWorkerMcpDisableOverrides(args, env) {
         const key = `mcp_servers.${server}.enabled`;
         if (hasConfigOverride(args, key))
             continue;
-        args.push(CONFIG_FLAG, `${key}=false`);
+        const endOfOptionsIndex = args.indexOf('--');
+        args.splice(endOfOptionsIndex < 0 ? args.length : endOfOptionsIndex, 0, CONFIG_FLAG, `${key}=false`);
     }
 }
+function insertArgsBeforeEndOfOptions(args, insertedArgs) {
+    const endOfOptionsIndex = args.indexOf('--');
+    if (endOfOptionsIndex < 0)
+        return [...args, ...insertedArgs];
+    return [...args.slice(0, endOfOptionsIndex), ...insertedArgs, ...args.slice(endOfOptionsIndex)];
+}
+function insertCanonicalCodexBypassBeforeEndOfOptions(args) {
+    const endOfOptionsIndex = args.indexOf('--');
+    const preMarkerArgs = endOfOptionsIndex < 0 ? args : args.slice(0, endOfOptionsIndex);
+    const postMarkerArgs = endOfOptionsIndex < 0 ? [] : args.slice(endOfOptionsIndex);
+    return [
+        ...preMarkerArgs.filter((arg) => arg !== CODEX_BYPASS_FLAG && arg !== MADMAX_FLAG),
+        CODEX_BYPASS_FLAG,
+        ...postMarkerArgs,
+    ];
+}
 function resolveWorkerLaunchArgs(extraArgs = [], cwd = process.cwd(), env = process.env) {
-    const merged = [...extraArgs];
-    const wantsBypass = process.argv.includes(CODEX_BYPASS_FLAG) || process.argv.includes(MADMAX_FLAG);
-    if (wantsBypass && !merged.includes(CODEX_BYPASS_FLAG)) {
-        merged.push(CODEX_BYPASS_FLAG);
+    let merged = [...extraArgs];
+    const initialPolicy = classifyTeamWorkerLaunchPolicy(merged);
+    if (initialPolicy === 'direct-policy') {
+        merged = normalizeTeamWorkerLaunchArgs(merged);
+    }
+    const policy = classifyTeamWorkerLaunchPolicy(merged);
+    const ambientWantsBypass = parseTeamWorkerLaunchArgs(process.argv, 'ambient process arguments', { directPolicyMode: 'ignore' }).wantsBypass;
+    if (policy === 'none' || policy === 'bypass') {
+        const wantsBypass = ambientWantsBypass || policy === 'bypass';
+        if (wantsBypass) {
+            merged = insertCanonicalCodexBypassBeforeEndOfOptions(merged);
+        }
     }
     if (shouldBypassDefaultSystemPrompt(env) && !hasModelInstructionsOverride(merged)) {
-        merged.push(CONFIG_FLAG, buildModelInstructionsOverride(cwd, env));
+        merged = insertArgsBeforeEndOfOptions(merged, [CONFIG_FLAG, buildModelInstructionsOverride(cwd, env)]);
     }
     return merged;
 }
@@ -1040,11 +1465,15 @@ function buildWorkerProcessLaunchSpecForMode(mode, teamName, workerIndex, launch
     const effectiveEnv = { ...process.env, ...extraEnv };
     const fullLaunchArgs = resolveWorkerLaunchArgs(launchArgs, cwd, effectiveEnv);
     const workerCli = workerCliOverride ?? resolveTeamWorkerCli(fullLaunchArgs, effectiveEnv);
+    assertTeamWorkerLaunchPolicyInvariant(workerCli, fullLaunchArgs);
     const cliLaunchArgs = translateWorkerLaunchArgsForCli(workerCli, fullLaunchArgs, initialPrompt, workerRole);
+    const launchPolicy = workerCli === 'codex'
+        ? classifyTeamWorkerLaunchPolicy(cliLaunchArgs)
+        : 'none';
     const effectiveCliLaunchArgs = workerCli === 'codex'
         && shouldGrantExecutionBypassForRole(workerRole)
-        && !cliLaunchArgs.includes(CODEX_BYPASS_FLAG)
-        ? [...cliLaunchArgs, CODEX_BYPASS_FLAG]
+        && launchPolicy === 'none'
+        ? insertCanonicalCodexBypassBeforeEndOfOptions(cliLaunchArgs)
         : cliLaunchArgs;
     const workerCodexHomeOverride = typeof effectiveEnv.CODEX_HOME === 'string'
         ? effectiveEnv.CODEX_HOME.trim()
@@ -1160,16 +1589,35 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
     }
     const normalizedWorkerLaunchArgs = resolveWorkerLaunchArgs(workerLaunchArgs, cwd);
     const defaultWorkerCliPlan = resolveTeamWorkerCliPlan(workerCount, normalizedWorkerLaunchArgs, process.env);
-    const workerCliPlan = workerStartups.length > 0
-        ? workerStartups.map((startup, index) => startup.workerCli ?? defaultWorkerCliPlan[index])
-        : defaultWorkerCliPlan;
+    const workerCliPlan = Array.from({ length: workerCount }, (_, index) => workerStartups[index]?.workerCli ?? defaultWorkerCliPlan[index]);
     for (const workerCli of new Set(workerCliPlan)) {
         assertTeamWorkerCliBinaryAvailable(workerCli);
     }
+    const workerLaunchPolicyPlan = Array.from({ length: workerCount }, (_, index) => {
+        const startup = workerStartups[index] ?? {};
+        const workerCwd = startup.cwd || cwd;
+        const workerEnv = startup.env || {};
+        const launchArgs = startup.launchArgs || workerLaunchArgs;
+        const effectiveLaunchArgs = resolveWorkerLaunchArgs(launchArgs, workerCwd, { ...process.env, ...workerEnv });
+        assertTeamWorkerLaunchPolicyInvariant(workerCliPlan[index], effectiveLaunchArgs);
+        return Object.freeze([...launchArgs]);
+    });
     const safeTeamName = sanitizeTeamName(teamName);
     let registeredResizeHook = null;
     let registeredClientAttachedHook = null;
-    const rollbackPaneIds = [];
+    const rollbackPanes = new Map();
+    // An owner-tag command may have succeeded even if tmux reports an ambiguous
+    // failure; rollback can only kill panes whose owner is re-authorized.
+    const rollbackTaggedPaneOwnerIds = new Map();
+    let partialTeamTarget = null;
+    let partialLeaderPaneId = null;
+    let partialLeaderPanePid;
+    let partialTeamPaneOwnerId = '';
+    const partialWorkerPaneIds = [];
+    const partialWorkerPaneIdsByIndex = Array.from({ length: workerCount }, () => null);
+    const partialWorkerPanePidsByIndex = Array.from({ length: workerCount }, () => null);
+    let partialHudPaneId = null;
+    let partialHudPanePid = null;
     try {
         const tmuxPaneTarget = process.env.TMUX_PANE;
         const displayArgs = tmuxPaneTarget
@@ -1186,42 +1634,71 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             throw new Error(`failed to parse current tmux target: ${context.stdout}`);
         }
         const teamTarget = `${sessionName}:${windowIndex}`;
+        partialTeamTarget = teamTarget;
         const ownerSessionId = (options.ownerSessionId ?? process.env.OMX_SESSION_ID ?? '').trim();
         const teamPaneOwnerId = (options.teamPaneOwnerId ?? `team:${safeTeamName}`).trim();
+        partialTeamPaneOwnerId = teamPaneOwnerId;
+        const paneListResult = listPanesResult(teamTarget);
+        if (paneListResult.error)
+            throw new Error(`failed to read tmux pane topology: ${paneListResult.error}`);
+        const leaderPaneId = chooseTeamLeaderPaneId(paneListResult.panes, detectedLeaderPaneId);
+        const leaderProof = readExactPaneProofSync(leaderPaneId);
+        if (leaderProof.status === 'unavailable')
+            throw new ExactPaneProofUnavailableError(leaderProof);
+        if (leaderProof.status === 'gone')
+            throw new Error(`tmux pane is not proven live: ${leaderPaneId}`);
+        const leaderPanePid = leaderProof.pid;
+        partialLeaderPaneId = leaderPaneId;
+        partialLeaderPanePid = leaderPanePid;
+        const initialHudPaneIds = findHudWatchPaneIds(paneListResult.panes, leaderPaneId, { leaderPaneId });
+        const initialWindowPanePids = new Map([[leaderPaneId, leaderPanePid]]);
+        const omxEntry = resolveOmxCliEntryPath();
+        const canRecreateTeamHud = Boolean(omxEntry && omxEntry.trim() !== '');
+        // Freeze every HUD owned by this leader even when startup cannot recreate
+        // it; the untouched pane remains part of the authorized topology.
+        for (const hudPaneId of initialHudPaneIds) {
+            const proof = readExactPaneProofSync(hudPaneId);
+            if (proof.status === 'unavailable')
+                throw new ExactPaneProofUnavailableError(proof);
+            if (proof.status === 'gone')
+                throw new Error(`tmux pane is not proven live: ${hudPaneId}`);
+            initialWindowPanePids.set(hudPaneId, proof.pid);
+        }
+        // Team mode prioritizes leader + worker visibility. Remove HUD panes only
+        // when we can recreate the team HUD. Otherwise keep the existing HUD alive
+        // instead of making it disappear on team startup failures or broken installs.
+        requireFrozenWindowTopologySync(teamTarget, initialWindowPanePids);
         if (ownerSessionId) {
             const tagResult = runTmux(['set-option', '-t', sessionName, OMX_INSTANCE_OPTION, ownerSessionId]);
             if (!tagResult.ok) {
                 throw new Error(`failed to tag tmux session ${sessionName}: ${tagResult.stderr}`);
             }
         }
-        const panes = listPanes(teamTarget);
-        const leaderPaneId = chooseTeamLeaderPaneId(panes, detectedLeaderPaneId);
-        tagPaneInstance(leaderPaneId, ownerSessionId);
-        tagPaneTeamOwner(leaderPaneId, teamPaneOwnerId);
-        const initialHudPaneIds = findHudPaneIds(teamTarget, leaderPaneId);
-        const omxEntry = resolveOmxCliEntryPath();
-        const canRecreateTeamHud = Boolean(omxEntry && omxEntry.trim() !== '');
-        // Team mode prioritizes leader + worker visibility. Remove HUD panes only
-        // when we can recreate the team HUD. Otherwise keep the existing HUD alive
-        // instead of making it disappear on team startup failures or broken installs.
+        tagPaneInstance(leaderPaneId, ownerSessionId, leaderPanePid);
+        tagPaneTeamOwner(leaderPaneId, teamPaneOwnerId, leaderPanePid);
         if (canRecreateTeamHud) {
-            for (const hudPaneId of initialHudPaneIds) {
-                runTmux(['kill-pane', '-t', hudPaneId]);
+            for (const [hudPaneId, hudPanePid] of initialWindowPanePids) {
+                if (hudPaneId !== leaderPaneId)
+                    killExactPaneSync(hudPaneId, hudPanePid);
             }
         }
         const workerPaneIds = [];
+        const workerPanePidsByIndex = Array.from({ length: workerCount }, () => null);
         let rightStackRootPaneId = null;
+        let rightStackRootPanePid = null;
+        const frozenWindowPanePids = new Map([[leaderPaneId, leaderPanePid]]);
+        const frozenWindowPaneOwners = new Map([[leaderPaneId, teamPaneOwnerId]]);
         for (let i = 1; i <= workerCount; i++) {
             const startup = workerStartups[i - 1] || {};
             const workerCwd = startup.cwd || cwd;
             const tmuxWorkerCwd = translatePathForMsys(workerCwd);
             const workerEnv = startup.env || {};
-            const launchArgsForWorker = startup.launchArgs || workerLaunchArgs;
+            const launchArgsForWorker = [...(workerLaunchPolicyPlan[i - 1] ?? workerLaunchArgs)];
             trustWorkerMiseConfigIfAvailable(workerCwd);
             const cmd = writeWorkerStartupScriptCommand(safeTeamName, i, launchArgsForWorker, workerCwd, workerEnv, workerCliPlan[i - 1], startup.initialPrompt, startup.workerRole) ?? buildWorkerStartupCommand(safeTeamName, i, launchArgsForWorker, workerCwd, workerEnv, workerCliPlan[i - 1], startup.initialPrompt, startup.workerRole);
             // First split creates the right side from leader. Remaining splits stack on the right.
             const splitDirection = i === 1 ? '-h' : '-v';
-            const splitTarget = i === 1 ? leaderPaneId : (rightStackRootPaneId ?? leaderPaneId);
+            const splitTarget = requireLiveTeamOwnedPaneSync(i === 1 ? leaderPaneId : (rightStackRootPaneId ?? leaderPaneId), i === 1 ? leaderPanePid : (rightStackRootPanePid ?? leaderPanePid), teamPaneOwnerId);
             const split = runTmux([
                 'split-window',
                 splitDirection,
@@ -1242,17 +1719,37 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             if (!paneId || !paneId.startsWith('%')) {
                 throw new Error(`failed to capture worker pane id for worker ${i}`);
             }
-            rollbackPaneIds.push(paneId);
+            // The pane exists once split-window returns its concrete ID. Persist it in
+            // rollback/partial state before its first proof: a malformed or unavailable
+            // topology must retain cleanup debt, but cannot authorize an effect.
+            rollbackPanes.set(paneId, null);
+            partialWorkerPaneIds.push(paneId);
+            partialWorkerPaneIdsByIndex[i - 1] = paneId;
+            const paneProof = readExactPaneProofSync(paneId);
+            if (paneProof.status === 'unavailable')
+                throw new ExactPaneProofUnavailableError(paneProof);
+            if (paneProof.status === 'gone')
+                throw new Error(`tmux pane is not proven live: ${paneId}`);
+            const panePid = paneProof.pid;
+            rollbackPanes.set(paneId, panePid);
+            partialWorkerPanePidsByIndex[i - 1] = panePid;
+            workerPanePidsByIndex[i - 1] = panePid;
+            frozenWindowPanePids.set(paneId, panePid);
             if (isNativeWindows() && !waitForPaneToRemainPresent(teamTarget, paneId)) {
                 throw new Error(`worker pane ${i} did not remain present after tmux split-window returned ${paneId}`);
             }
-            tagPaneInstance(paneId, ownerSessionId);
-            tagPaneTeamOwner(paneId, teamPaneOwnerId);
+            tagPaneInstance(paneId, ownerSessionId, panePid);
+            rollbackTaggedPaneOwnerIds.set(paneId, teamPaneOwnerId);
+            tagPaneTeamOwner(paneId, teamPaneOwnerId, panePid);
+            frozenWindowPaneOwners.set(paneId, teamPaneOwnerId);
             workerPaneIds.push(paneId);
-            if (i === 1)
+            if (i === 1) {
                 rightStackRootPaneId = paneId;
+                rightStackRootPanePid = panePid;
+            }
         }
         // Keep leader as full left/main pane; workers stay stacked on the right.
+        requireFrozenWindowTopologySync(teamTarget, frozenWindowPanePids, frozenWindowPaneOwners);
         runTmux(['select-layout', '-t', teamTarget, 'main-vertical']);
         // Force leader pane to use half the window width.
         const windowWidthResult = runTmux(['display-message', '-p', '-t', teamTarget, '#{window_width}']);
@@ -1260,7 +1757,9 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             const width = Number.parseInt(windowWidthResult.stdout.split('\n')[0]?.trim() || '', 10);
             if (Number.isFinite(width) && width >= 40) {
                 const half = String(Math.floor(width / 2));
+                requireFrozenWindowTopologySync(teamTarget, frozenWindowPanePids, frozenWindowPaneOwners);
                 runTmux(['set-window-option', '-t', teamTarget, 'main-pane-width', half]);
+                requireFrozenWindowTopologySync(teamTarget, frozenWindowPanePids, frozenWindowPaneOwners);
                 runTmux(['select-layout', '-t', teamTarget, 'main-vertical']);
             }
         }
@@ -1274,23 +1773,39 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
         if (canRecreateTeamHud && omxEntry) {
             const hudCmd = `exec env ${formatHudEnvAssignments(process.env, { sessionId: ownerSessionId, leaderPaneId })} node ${shellQuoteSingle(translatePathForMsys(omxEntry))} hud --watch`;
             const hudCwd = translatePathForMsys(cwd);
+            requireFrozenWindowTopologySync(teamTarget, frozenWindowPanePids, frozenWindowPaneOwners);
+            const hudSplitTarget = leaderPaneId;
             const hudResult = runTmux([
-                'split-window', '-v', '-f', '-l', String(HUD_TMUX_TEAM_HEIGHT_LINES), '-t', teamTarget, '-d', '-P', '-F', '#{pane_id}', '-c', hudCwd, hudCmd,
+                'split-window', '-v', '-f', '-l', String(HUD_TMUX_TEAM_HEIGHT_LINES), '-t', hudSplitTarget, '-d', '-P', '-F', '#{pane_id}', '-c', hudCwd, hudCmd,
             ]);
             if (hudResult.ok) {
                 const id = hudResult.stdout.split('\n')[0]?.trim() ?? '';
                 if (id.startsWith('%')) {
-                    rollbackPaneIds.push(id);
+                    // split-window has created a concrete pane even though no proof has
+                    // authorized an effect yet. Retain PID-less cleanup debt first.
+                    rollbackPanes.set(id, null);
+                    partialHudPaneId = id;
+                    partialHudPanePid = null;
+                    const hudProof = readExactPaneProofSync(id);
+                    if (hudProof.status === 'unavailable')
+                        throw new ExactPaneProofUnavailableError(hudProof);
+                    if (hudProof.status === 'gone')
+                        throw new Error(`tmux pane is not proven live: ${id}`);
+                    const hudPanePid = hudProof.pid;
+                    frozenWindowPanePids.set(id, hudPanePid);
+                    rollbackPanes.set(id, hudPanePid);
+                    partialHudPanePid = hudPanePid;
                     if (isNativeWindows() && !waitForPaneToRemainPresent(teamTarget, id)) {
                         throw new Error(`HUD pane did not remain present after tmux split-window returned ${id}`);
                     }
-                    tagPaneInstance(id, ownerSessionId);
-                    tagPaneTeamOwner(id, teamPaneOwnerId);
+                    tagPaneInstance(id, ownerSessionId, hudPanePid);
+                    rollbackTaggedPaneOwnerIds.set(id, teamPaneOwnerId);
+                    tagPaneTeamOwner(id, teamPaneOwnerId, hudPanePid);
+                    frozenWindowPaneOwners.set(id, teamPaneOwnerId);
                     hudPaneId = id;
                     if (isNativeWindows()) {
-                        // Native Windows tmux support may flow through psmux; issuing a
-                        // direct control-plane resize avoids nested run-shell PATH drift.
-                        const reconcile = runTmux(buildHudResizeArgs(hudPaneId));
+                        const provenHudPaneId = requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
+                        const reconcile = runTmux(buildHudResizeArgs(provenHudPaneId));
                         if (!reconcile.ok) {
                             throw new Error(`failed to reconcile HUD resize: ${reconcile.stderr}`);
                         }
@@ -1298,36 +1813,50 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
                     else {
                         const hookTarget = buildResizeHookTarget(sessionName, windowIndex);
                         const hookName = buildResizeHookName(safeTeamName, sessionName, windowIndex, hudPaneId);
-                        const registerHook = runTmux(buildRegisterResizeHookArgs(hookTarget, hookName, hudPaneId));
+                        requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
+                        const registerHook = runTmux(buildRegisterResizeHookArgs(hookTarget, hookName, hudPaneId, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
                         const clientAttachedHookName = buildClientAttachedReconcileHookName(safeTeamName, sessionName, windowIndex, hudPaneId);
                         if (registerHook.ok) {
                             resizeHookTarget = hookTarget;
                             resizeHookName = hookName;
-                            registeredResizeHook = { name: resizeHookName, target: resizeHookTarget };
+                            registeredResizeHook = {
+                                name: resizeHookName,
+                                target: resizeHookTarget,
+                                leaderPaneId,
+                                leaderPanePid,
+                                hudPaneId,
+                                hudPanePid,
+                                teamPaneOwnerId,
+                            };
                         }
                         else {
-                            // tmux versions/builds that reject indexed client-resized hooks should not
-                            // abort madmax/team startup after panes were successfully created. Keep the
-                            // fallback narrow: skip only the long-lived resize hook metadata, then
-                            // still try the one-shot client-attached reconcile plus the explicit
-                            // delayed/direct resize checks below so real tmux/run-shell failures
-                            // still surface.
                             console.warn(`[omx] tmux resize hook unavailable for ${hookTarget} (${hookName}): ${registerHook.stderr}; `
                                 + 'continuing with best-effort HUD resize fallback.');
                         }
-                        const registerClientAttachedHook = runTmux(buildRegisterClientAttachedReconcileArgs(hookTarget, clientAttachedHookName, hudPaneId));
+                        requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
+                        const registerClientAttachedHook = runTmux(buildRegisterClientAttachedReconcileArgs(hookTarget, clientAttachedHookName, hudPaneId, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
                         if (registerClientAttachedHook.ok) {
-                            registeredClientAttachedHook = { name: clientAttachedHookName, target: hookTarget };
+                            registeredClientAttachedHook = {
+                                name: clientAttachedHookName,
+                                target: hookTarget,
+                                leaderPaneId,
+                                leaderPanePid,
+                                hudPaneId,
+                                hudPanePid,
+                                teamPaneOwnerId,
+                            };
                         }
                         else {
                             console.warn(`[omx] tmux client-attached resize fallback unavailable for ${hookTarget} `
                                 + `(${clientAttachedHookName}): ${registerClientAttachedHook.stderr}; continuing with delayed HUD resize fallback.`);
                         }
-                        const delayed = runTmux(buildScheduleDelayedHudResizeArgs(hudPaneId));
+                        requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
+                        const delayed = runTmux(buildScheduleDelayedHudResizeArgs(hudPaneId, HUD_RESIZE_RECONCILE_DELAY_SECONDS, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
                         if (!delayed.ok) {
                             console.warn(`[omx] tmux delayed HUD resize unavailable for ${hudPaneId}: ${delayed.stderr}; continuing.`);
                         }
-                        const reconcile = runTmux(buildReconcileHudResizeArgs(hudPaneId));
+                        requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
+                        const reconcile = runTmux(buildReconcileHudResizeArgs(hudPaneId, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
                         if (!reconcile.ok) {
                             console.warn(`[omx] tmux HUD resize reconcile unavailable for ${hudPaneId}: ${reconcile.stderr}; continuing.`);
                         }
@@ -1335,21 +1864,31 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
                 }
             }
         }
-        runTmux(['select-pane', '-t', leaderPaneId]);
-        redrawLeaderPaneAfterTeamLayout(leaderPaneId);
+        runTmux(['select-pane', '-t', requireLiveTeamOwnedPaneSync(leaderPaneId, leaderPanePid, teamPaneOwnerId)]);
+        redrawLeaderPaneAfterTeamLayout(leaderPaneId, leaderPanePid, teamPaneOwnerId);
         sleepSeconds(0.5);
         // Enable mouse scrolling so agent output panes can be scrolled with the
         // mouse wheel without conflicting with keyboard up/down arrow-key input
         // history navigation in the Codex CLI input field. (issue #103)
         // Opt-out: set OMX_TEAM_MOUSE=0 in the environment.
         if (process.env.OMX_TEAM_MOUSE !== '0') {
-            enableMouseScrolling(sessionName);
+            enableMouseScrolling(sessionName, () => { requireLiveTeamOwnedPaneSync(leaderPaneId, leaderPanePid, teamPaneOwnerId); });
+        }
+        const sessionIncarnation = teamTarget.includes(':') ? null : queryDetachedTeamSession(sessionName);
+        if (sessionIncarnation && sessionIncarnation.status !== 'exact') {
+            throw new Error(`tmux_session_incarnation_unavailable:${sessionName}`);
         }
         return {
             name: teamTarget,
+            tmuxSessionId: sessionIncarnation?.incarnation.sessionId,
+            tmuxSessionCreated: sessionIncarnation?.incarnation.sessionCreated,
             workerCount,
             cwd,
             workerPaneIds,
+            workerPaneIdsByIndex: [...workerPaneIds],
+            workerPanePidsByIndex,
+            leaderPanePid,
+            hudPanePid: partialHudPanePid,
             leaderPaneId,
             hudPaneId,
             resizeHookName,
@@ -1358,14 +1897,82 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
         };
     }
     catch (error) {
-        if (registeredClientAttachedHook) {
-            runTmux(buildUnregisterClientAttachedReconcileArgs(registeredClientAttachedHook.target, registeredClientAttachedHook.name));
+        const cleanupErrors = [];
+        const unregisterAuthorizedHook = (hook, unregister, label) => {
+            try {
+                requireLiveTeamOwnedPaneSync(hook.leaderPaneId, hook.leaderPanePid, hook.teamPaneOwnerId);
+                requireLiveTeamOwnedPaneSync(hook.hudPaneId, hook.hudPanePid, hook.teamPaneOwnerId);
+                const unregistered = runTmux(unregister(hook.target, hook.name));
+                if (unregistered.ok)
+                    return true;
+                cleanupErrors.push(`failed to unregister tmux ${label} hook ${hook.name}: ${unregistered.stderr}`);
+            }
+            catch (cleanupError) {
+                cleanupErrors.push(`unable to authorize tmux ${label} hook cleanup ${hook.name}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+            }
+            return false;
+        };
+        if (registeredClientAttachedHook && unregisterAuthorizedHook(registeredClientAttachedHook, buildUnregisterClientAttachedReconcileArgs, 'client-attached')) {
+            registeredClientAttachedHook = null;
         }
-        if (registeredResizeHook) {
-            runTmux(buildUnregisterResizeHookArgs(registeredResizeHook.target, registeredResizeHook.name));
+        if (registeredResizeHook && unregisterAuthorizedHook(registeredResizeHook, buildUnregisterResizeHookArgs, 'resize')) {
+            registeredResizeHook = null;
         }
-        for (const paneId of rollbackPaneIds) {
-            runTmux(['kill-pane', '-t', paneId]);
+        const proofUnavailable = [];
+        if (error instanceof ExactPaneProofUnavailableError)
+            proofUnavailable.push(error.proof);
+        const unresolvedPaneIds = new Set(rollbackPanes.keys());
+        for (const [paneId, panePid] of rollbackPanes) {
+            // split-window IDs without a positive exact PID proof are cleanup debt,
+            // never authorization to affect a potentially recycled pane ID.
+            if (panePid === null)
+                continue;
+            try {
+                const expectedOwnerId = rollbackTaggedPaneOwnerIds.get(paneId);
+                killExactPaneSync(paneId, panePid, expectedOwnerId
+                    ? () => { requireLiveTeamOwnedPaneSync(paneId, panePid, expectedOwnerId); }
+                    : undefined);
+                unresolvedPaneIds.delete(paneId);
+            }
+            catch (cleanupError) {
+                if (cleanupError instanceof ExactPaneProofUnavailableError) {
+                    proofUnavailable.push(cleanupError.proof);
+                    break;
+                }
+                else {
+                    cleanupErrors.push(cleanupError instanceof Error ? cleanupError.message : String(cleanupError));
+                }
+            }
+        }
+        const unresolvedWorkerPaneIds = partialWorkerPaneIds.filter((paneId) => unresolvedPaneIds.has(paneId));
+        const unresolvedWorkerPaneIdsByIndex = partialWorkerPaneIdsByIndex
+            .map((paneId) => paneId && unresolvedPaneIds.has(paneId) ? paneId : null);
+        const unresolvedWorkerPanePidsByIndex = partialWorkerPanePidsByIndex
+            .map((panePid, index) => partialWorkerPaneIdsByIndex[index] && unresolvedPaneIds.has(partialWorkerPaneIdsByIndex[index]) ? panePid : null);
+        const unresolvedHudPaneId = partialHudPaneId && (unresolvedPaneIds.has(partialHudPaneId)
+            || registeredResizeHook !== null
+            || registeredClientAttachedHook !== null)
+            ? partialHudPaneId
+            : null;
+        const hasRecoverablePartialArtifact = unresolvedPaneIds.size > 0
+            || registeredResizeHook !== null
+            || registeredClientAttachedHook !== null;
+        if (hasRecoverablePartialArtifact && partialTeamTarget && partialLeaderPaneId) {
+            throw new CreateTeamSessionPartialError({
+                name: partialTeamTarget,
+                workerCount,
+                cwd,
+                workerPaneIds: unresolvedWorkerPaneIds,
+                workerPaneIdsByIndex: unresolvedWorkerPaneIdsByIndex,
+                workerPanePidsByIndex: unresolvedWorkerPanePidsByIndex,
+                leaderPanePid: partialLeaderPanePid,
+                hudPanePid: unresolvedHudPaneId ? partialHudPanePid : null,
+                leaderPaneId: partialLeaderPaneId,
+                hudPaneId: unresolvedHudPaneId,
+                resizeHookName: registeredResizeHook?.name ?? null,
+                resizeHookTarget: registeredResizeHook?.target ?? null,
+                teamPaneOwnerId: partialTeamPaneOwnerId,
+            }, proofUnavailable, error, cleanupErrors);
         }
         throw error;
     }
@@ -1374,34 +1981,73 @@ export function restoreStandaloneHudPane(leaderPaneId, cwd, options = {}) {
     const normalizedLeaderPaneId = normalizePaneTarget(leaderPaneId);
     if (!normalizedLeaderPaneId)
         return null;
+    // The split is irreversible without a durable cleanup obligation. Validate
+    // its canonical Team-root location before authorizing any pane effect.
+    restoredHudCleanupDebtPath(cwd, options.stateRoot);
     const omxEntry = resolveOmxCliEntryPath();
     if (!omxEntry || omxEntry.trim() === '')
         return null;
-    const [existingHudPaneId, ...duplicateHudPaneIds] = findOwnedHudPaneIds(normalizedLeaderPaneId, normalizedLeaderPaneId);
+    const leaderPanePid = (() => {
+        const proof = readExactPaneProofSync(normalizedLeaderPaneId);
+        if (proof.status === 'unavailable')
+            throw new ExactPaneProofUnavailableError(proof);
+        if (proof.status === 'gone')
+            throw new Error(`tmux pane is not proven live: ${normalizedLeaderPaneId}`);
+        if (options.expectedLeaderPanePid !== undefined && proof.pid !== options.expectedLeaderPanePid) {
+            throw new Error(`tmux pane identity changed: ${normalizedLeaderPaneId}`);
+        }
+        return proof.pid;
+    })();
+    const requireAuthorizedLeaderPane = () => {
+        options.assertLeaderPaneAuthorization?.();
+        return requireLiveExactPaneSync(normalizedLeaderPaneId, options.expectedLeaderPanePid ?? leaderPanePid);
+    };
+    requireAuthorizedLeaderPane();
+    const paneListResult = listPanesResult(normalizedLeaderPaneId);
+    if (paneListResult.error)
+        throw new Error(`failed to read tmux pane topology: ${paneListResult.error}`);
+    const [existingHudPaneId, ...duplicateHudPaneIds] = findHudWatchPaneIds(paneListResult.panes, normalizedLeaderPaneId, { leaderPaneId: normalizedLeaderPaneId });
+    const ownedHudPanePids = new Map();
+    for (const paneId of [existingHudPaneId, ...duplicateHudPaneIds]) {
+        if (!paneId)
+            continue;
+        const proof = readExactPaneProofSync(paneId);
+        if (proof.status === 'unavailable')
+            throw new ExactPaneProofUnavailableError(proof);
+        if (proof.status === 'gone')
+            throw new Error(`tmux pane is not proven live: ${paneId}`);
+        ownedHudPanePids.set(paneId, proof.pid);
+    }
     for (const paneId of duplicateHudPaneIds) {
-        runTmux(['kill-pane', '-t', paneId]);
+        killExactPaneSync(paneId, ownedHudPanePids.get(paneId), requireAuthorizedLeaderPane);
     }
     if (existingHudPaneId) {
         if (isNativeWindows()) {
-            runTmux(buildHudResizeArgs(existingHudPaneId));
+            const exactHudPaneId = requireLiveExactPaneSync(existingHudPaneId, ownedHudPanePids.get(existingHudPaneId));
+            requireAuthorizedLeaderPane();
+            const reconcile = runTmux(buildHudResizeArgs(exactHudPaneId));
+            if (!reconcile.ok)
+                throw new Error(`failed to reconcile standalone HUD resize: ${reconcile.stderr}`);
         }
         else {
-            runTmux(buildScheduleDelayedHudResizeArgs(existingHudPaneId));
-            runTmux(buildReconcileHudResizeArgs(existingHudPaneId));
+            requireAuthorizedLeaderPane();
+            runTmux(buildScheduleDelayedHudResizeArgs(existingHudPaneId, HUD_RESIZE_RECONCILE_DELAY_SECONDS, HUD_TMUX_TEAM_HEIGHT_LINES, ownedHudPanePids.get(existingHudPaneId)));
+            requireAuthorizedLeaderPane();
+            runTmux(buildReconcileHudResizeArgs(existingHudPaneId, HUD_TMUX_TEAM_HEIGHT_LINES, ownedHudPanePids.get(existingHudPaneId)));
         }
-        runTmux(['select-pane', '-t', normalizedLeaderPaneId]);
+        runTmux(['select-pane', '-t', requireAuthorizedLeaderPane()]);
         return existingHudPaneId;
     }
     const hudCmd = `exec env ${formatHudEnvAssignments(process.env, { sessionId: options.sessionId, leaderPaneId: normalizedLeaderPaneId })} ${shellQuoteSingle(translatePathForMsys(resolveLeaderNodePath()))} ${shellQuoteSingle(translatePathForMsys(omxEntry))} hud --watch`;
     let hudResult = null;
-    for (const restoreCwd of resolveStandaloneHudRestoreCwdCandidates(normalizedLeaderPaneId, cwd, options.cwd)) {
+    for (const restoreCwd of resolveStandaloneHudRestoreCwdCandidates(normalizedLeaderPaneId, cwd, options.cwd, requireAuthorizedLeaderPane)) {
         const candidateResult = runTmux([
             'split-window',
             '-v',
             '-l',
             String(HUD_TMUX_TEAM_HEIGHT_LINES),
             '-t',
-            normalizedLeaderPaneId,
+            requireAuthorizedLeaderPane(),
             '-d',
             '-P',
             '-F',
@@ -1420,14 +2066,48 @@ export function restoreStandaloneHudPane(leaderPaneId, cwd, options = {}) {
     const paneId = hudResult.stdout.split('\n')[0]?.trim() ?? '';
     if (!paneId.startsWith('%'))
         return null;
+    persistRestoredHudCleanupDebtSync(cwd, {
+        schema_version: 1,
+        operation: 'restored_hud_cleanup',
+        pane_id: paneId,
+        pane_pid: null,
+        leader_pane_id: normalizedLeaderPaneId,
+        leader_pane_pid: options.expectedLeaderPanePid ?? leaderPanePid,
+        leader_pane_owner_id: options.expectedLeaderPaneOwnerId?.trim() || null,
+        hud_owner_leader_pane_id: normalizedLeaderPaneId,
+    }, options.stateRoot);
+    const hudPanePid = (() => {
+        const proof = readExactPaneProofSync(paneId);
+        if (proof.status === 'unavailable')
+            throw new ExactPaneProofUnavailableError(proof);
+        if (proof.status === 'gone')
+            throw new Error(`tmux pane is not proven live: ${paneId}`);
+        return proof.pid;
+    })();
+    persistRestoredHudCleanupDebtSync(cwd, {
+        schema_version: 1,
+        operation: 'restored_hud_cleanup',
+        pane_id: paneId,
+        pane_pid: hudPanePid,
+        leader_pane_id: normalizedLeaderPaneId,
+        leader_pane_pid: options.expectedLeaderPanePid ?? leaderPanePid,
+        leader_pane_owner_id: options.expectedLeaderPaneOwnerId?.trim() || null,
+        hud_owner_leader_pane_id: normalizedLeaderPaneId,
+    }, options.stateRoot);
     if (isNativeWindows()) {
-        runTmux(buildHudResizeArgs(paneId));
+        const exactHudPaneId = requireLiveExactPaneSync(paneId, hudPanePid);
+        requireAuthorizedLeaderPane();
+        const reconcile = runTmux(buildHudResizeArgs(exactHudPaneId));
+        if (!reconcile.ok)
+            throw new Error(`failed to reconcile standalone HUD resize: ${reconcile.stderr}`);
     }
     else {
-        runTmux(buildScheduleDelayedHudResizeArgs(paneId));
-        runTmux(buildReconcileHudResizeArgs(paneId));
+        requireAuthorizedLeaderPane();
+        runTmux(buildScheduleDelayedHudResizeArgs(paneId, HUD_RESIZE_RECONCILE_DELAY_SECONDS, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid));
+        requireAuthorizedLeaderPane();
+        runTmux(buildReconcileHudResizeArgs(paneId, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid));
     }
-    runTmux(['select-pane', '-t', normalizedLeaderPaneId]);
+    runTmux(['select-pane', '-t', requireAuthorizedLeaderPane()]);
     return paneId;
 }
 /**
@@ -1439,21 +2119,21 @@ export function restoreStandaloneHudPane(leaderPaneId, cwd, options = {}) {
  * oh-my-tmux, or other sessions. Returns true if the session mouse option
  * was set successfully, false otherwise.
  */
-export function enableMouseScrolling(sessionTarget) {
+export function enableMouseScrolling(sessionTarget, beforeEffect) {
+    beforeEffect?.();
     const result = runTmux(['set-option', '-t', sessionTarget, 'mouse', 'on']);
     if (!result.ok)
         return false;
     // Enable OSC 52 so copy-selection-and-cancel propagates selected text to
     // the terminal's clipboard without requiring xclip or pbcopy. (closes #206)
+    beforeEffect?.();
     runTmux(['set-option', '-t', sessionTarget, 'set-clipboard', 'on']);
     // Mouse selection enters tmux copy-mode. Keep the mitigation session-scoped
     // so OMX does not mutate users' global tmux style defaults. (issue #1448)
-    mitigateCopyModeUnderlineArtifacts(sessionTarget);
+    mitigateCopyModeUnderlineArtifacts(sessionTarget, beforeEffect);
     return true;
 }
-function paneTarget(sessionName, workerIndex, workerPaneId) {
-    if (workerPaneId && workerPaneId.startsWith('%'))
-        return workerPaneId;
+function paneTarget(sessionName, workerIndex) {
     if (sessionName.includes(':')) {
         return `${sessionName}.${workerIndex}`;
     }
@@ -1499,24 +2179,50 @@ export function evaluateStartupDirectTriggerSafetyCapture(captured, workerCli) {
 export async function evaluateStartupDirectTriggerSafety(sessionName, workerIndex, workerPaneId, workerCli) {
     if (!isTmuxAvailable())
         return { safe: false, reason: 'tmux_unavailable' };
-    const target = paneTarget(sessionName, workerIndex, workerPaneId);
+    const target = await resolveWorkerPaneTargetAsync(sessionName, workerIndex, workerPaneId);
+    if (!target)
+        return { safe: false, reason: 'capture_failed' };
     const result = await runTmuxAsync(sharedBuildVisibleCapturePaneArgv(target));
     if (!result.ok)
         return { safe: false, reason: 'capture_failed' };
     return evaluateStartupDirectTriggerSafetyCapture(result.stdout, workerCli);
 }
-function acceptClaudeBypassPermissionsPrompt(target) {
-    runTmux(['send-keys', '-t', target, '-l', '--', '2']);
+function acceptClaudeBypassPermissionsPrompt(resolveTarget) {
+    const literalTarget = resolveTarget();
+    if (!literalTarget)
+        return false;
+    runTmux(['send-keys', '-t', literalTarget, '-l', '--', '2']);
     sleepFractionalSeconds(0.12);
-    runTmux(['send-keys', '-t', target, 'C-m']);
+    const submitTarget = resolveTarget();
+    if (!submitTarget)
+        return false;
+    runTmux(['send-keys', '-t', submitTarget, 'C-m']);
+    return true;
 }
-function dismissClaudeBypassPermissionsPromptIfPresent(target, captured) {
+function dismissClaudeBypassPermissionsPromptIfPresent(resolveTarget, captured) {
     if (process.env.OMX_TEAM_AUTO_ACCEPT_BYPASS === '0')
         return false;
     if (!paneHasClaudeBypassPermissionsPrompt(captured))
         return false;
-    acceptClaudeBypassPermissionsPrompt(target);
-    return true;
+    return acceptClaudeBypassPermissionsPrompt(resolveTarget);
+}
+async function dismissClaudeBypassPermissionsPromptIfPresentAsync(resolveTarget, captured) {
+    if (process.env.OMX_TEAM_AUTO_ACCEPT_BYPASS === '0')
+        return false;
+    if (!paneHasClaudeBypassPermissionsPrompt(captured))
+        return false;
+    const literalTarget = await resolveTarget();
+    if (!literalTarget)
+        return false;
+    const literalSend = await runTmuxAsync(['send-keys', '-t', literalTarget, '-l', '--', '2']);
+    if (!literalSend.ok)
+        return false;
+    await sleep(120);
+    const submitTarget = await resolveTarget();
+    if (!submitTarget)
+        return false;
+    const submitSend = await runTmuxAsync(['send-keys', '-t', submitTarget, 'C-m']);
+    return submitSend.ok;
 }
 export const paneHasActiveTask = sharedPaneHasActiveTask;
 export function classifyWorkerStartupInjectSafety(captured) {
@@ -1533,8 +2239,8 @@ export function classifyWorkerStartupInjectSafety(captured) {
     return 'safe';
 }
 export async function checkWorkerStartupInjectSafety(sessionName, workerIndex, workerPaneId) {
-    const target = paneTarget(sessionName, workerIndex, workerPaneId);
-    const visibleCapture = await captureVisiblePaneAsync(target);
+    const resolveTarget = () => resolveWorkerPaneTargetAsync(sessionName, workerIndex, workerPaneId);
+    const visibleCapture = await captureVisiblePaneAsync(resolveTarget);
     const visibleSafety = classifyWorkerStartupInjectSafety(visibleCapture);
     if (visibleSafety === 'safe')
         return { safe: true, reason: 'safe' };
@@ -1543,7 +2249,7 @@ export async function checkWorkerStartupInjectSafety(sessionName, workerIndex, w
     if (!sharedPaneShowsCodexViewport(visibleCapture)) {
         return { safe: false, reason: visibleSafety };
     }
-    const scrollbackCapture = await capturePaneAsync(target);
+    const scrollbackCapture = await capturePaneAsync(resolveTarget);
     const scrollbackSafety = classifyWorkerStartupInjectSafety(scrollbackCapture);
     return scrollbackSafety === 'safe'
         ? { safe: true, reason: 'safe' }
@@ -1621,8 +2327,9 @@ export function shouldAttemptAdaptiveRetry(strategy, paneBusyAtStart, allowAdapt
         return false;
     return true;
 }
-function sendLiteralTextOrThrow(target, text) {
-    const send = runTmux(['send-keys', '-t', target, '-l', '--', text]);
+async function sendLiteralTextOrThrow(resolveTarget, text) {
+    const target = await requireAsyncPaneTarget(resolveTarget);
+    const send = await runTmuxAsync(['send-keys', '-t', target, '-l', '--', text]);
     if (!send.ok) {
         throw new Error(`sendToWorker: failed to send text: ${send.stderr}`);
     }
@@ -1634,18 +2341,18 @@ function paneHasQueuedCodexSubmission(captured) {
     return /messages to be submitted after next tool call/i.test(normalized)
         || /press esc to interrupt and send immediately/i.test(normalized);
 }
-async function attemptSubmitRounds(target, text, rounds, queueFirstRound, submitKeyPressesPerRound) {
+async function attemptSubmitRounds(resolveTarget, text, rounds, queueFirstRound, submitKeyPressesPerRound) {
     const presses = Math.max(1, Math.floor(submitKeyPressesPerRound));
     for (let round = 0; round < rounds; round++) {
         await sleep(100);
         if (round === 0 && queueFirstRound) {
-            await sendKeyAsync(target, 'Tab');
+            await sendKeyAsync(resolveTarget, 'Tab');
             await sleep(80);
-            await sendKeyAsync(target, 'C-m');
+            await sendKeyAsync(resolveTarget, 'C-m');
         }
         else {
             for (let press = 0; press < presses; press++) {
-                await sendKeyAsync(target, 'C-m');
+                await sendKeyAsync(resolveTarget, 'C-m');
                 if (press < presses - 1) {
                     await sleep(200);
                 }
@@ -1653,8 +2360,8 @@ async function attemptSubmitRounds(target, text, rounds, queueFirstRound, submit
         }
         await sleep(140);
         const [captured, visibleCapture] = await Promise.all([
-            capturePaneAsync(target),
-            captureVisiblePaneAsync(target),
+            capturePaneAsync(resolveTarget),
+            captureVisiblePaneAsync(resolveTarget),
         ]);
         const normalizedCapture = normalizeWorkerTriggerForDraftMatch(captured);
         if (!normalizedCapture.includes(normalizeWorkerTriggerForDraftMatch(text))
@@ -1665,26 +2372,34 @@ async function attemptSubmitRounds(target, text, rounds, queueFirstRound, submit
     }
     return false;
 }
-export function waitForWorkerReady(sessionName, workerIndex, timeoutMs = 30_000, workerPaneId) {
+export function waitForWorkerReady(sessionName, workerIndex, timeoutMs = 30_000, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
     const initialBackoffMs = 150;
     const maxBackoffMs = 8000;
     const startedAt = Date.now();
     let blockedByTrustPrompt = false;
     let promptDismissed = false;
+    const resolveTarget = createPinnedWorkerPaneTargetResolverSync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
     const sendRobustEnter = () => {
-        const target = paneTarget(sessionName, workerIndex, workerPaneId);
         // Trust + follow-up splash can require two submits in Codex TUI.
         // Use C-m (carriage return) for raw-mode compatibility.
-        runTmux(['send-keys', '-t', target, 'C-m']);
+        const firstTarget = resolveTarget();
+        if (!firstTarget)
+            return;
+        runTmux(['send-keys', '-t', firstTarget, 'C-m']);
         sleepFractionalSeconds(0.12);
-        runTmux(['send-keys', '-t', target, 'C-m']);
+        const secondTarget = resolveTarget();
+        if (!secondTarget)
+            return;
+        runTmux(['send-keys', '-t', secondTarget, 'C-m']);
     };
     const check = () => {
-        const target = paneTarget(sessionName, workerIndex, workerPaneId);
+        const target = resolveTarget();
+        if (!target)
+            return false;
         const result = runTmux(sharedBuildVisibleCapturePaneArgv(target));
         if (!result.ok)
             return false;
-        if (dismissClaudeBypassPermissionsPromptIfPresent(target, result.stdout)) {
+        if (dismissClaudeBypassPermissionsPromptIfPresent(resolveTarget, result.stdout)) {
             promptDismissed = true;
             return false;
         }
@@ -1709,7 +2424,10 @@ export function waitForWorkerReady(sessionName, workerIndex, timeoutMs = 30_000,
         // scrollback for the prompt/helper text that may have slipped below the fold.
         if (!sharedPaneShowsCodexViewport(result.stdout))
             return false;
-        const scrollbackResult = runTmux(sharedBuildCapturePaneArgv(target, 80));
+        const scrollbackTarget = resolveTarget();
+        if (!scrollbackTarget)
+            return false;
+        const scrollbackResult = runTmux(sharedBuildCapturePaneArgv(scrollbackTarget, 80));
         if (!scrollbackResult.ok)
             return false;
         return paneLooksReady(scrollbackResult.stdout);
@@ -1737,26 +2455,34 @@ export function waitForWorkerReady(sessionName, workerIndex, timeoutMs = 30_000,
 // Async twin of waitForWorkerReady for team startup fan-out. Keep the readiness
 // semantics mirrored with the synchronous helper above, but yield between polls
 // so one slow worker pane cannot block later workers' startup attempts.
-export async function waitForWorkerReadyAsync(sessionName, workerIndex, timeoutMs = 30_000, workerPaneId) {
+export async function waitForWorkerReadyAsync(sessionName, workerIndex, timeoutMs = 30_000, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
     const initialBackoffMs = 150;
     const maxBackoffMs = 8000;
     const startedAt = Date.now();
     let blockedByTrustPrompt = false;
     let promptDismissed = false;
+    const resolveTarget = createPinnedWorkerPaneTargetResolver(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
     const sendRobustEnter = async () => {
-        const target = paneTarget(sessionName, workerIndex, workerPaneId);
         // Trust + follow-up splash can require two submits in Codex TUI.
         // Use C-m (carriage return) for raw-mode compatibility.
-        await runTmuxAsync(['send-keys', '-t', target, 'C-m']);
+        const firstTarget = await resolveTarget();
+        if (!firstTarget)
+            return;
+        await runTmuxAsync(['send-keys', '-t', firstTarget, 'C-m']);
         await sleep(120);
-        await runTmuxAsync(['send-keys', '-t', target, 'C-m']);
+        const secondTarget = await resolveTarget();
+        if (!secondTarget)
+            return;
+        await runTmuxAsync(['send-keys', '-t', secondTarget, 'C-m']);
     };
     const check = async () => {
-        const target = paneTarget(sessionName, workerIndex, workerPaneId);
+        const target = await resolveTarget();
+        if (!target)
+            return false;
         const result = await runTmuxAsync(sharedBuildVisibleCapturePaneArgv(target));
         if (!result.ok)
             return false;
-        if (dismissClaudeBypassPermissionsPromptIfPresent(target, result.stdout)) {
+        if (await dismissClaudeBypassPermissionsPromptIfPresentAsync(resolveTarget, result.stdout)) {
             promptDismissed = true;
             return false;
         }
@@ -1781,7 +2507,10 @@ export async function waitForWorkerReadyAsync(sessionName, workerIndex, timeoutM
         // scrollback for the prompt/helper text that may have slipped below the fold.
         if (!sharedPaneShowsCodexViewport(result.stdout))
             return false;
-        const scrollbackResult = await runTmuxAsync(sharedBuildCapturePaneArgv(target, 80));
+        const scrollbackTarget = await resolveTarget();
+        if (!scrollbackTarget)
+            return false;
+        const scrollbackResult = await runTmuxAsync(sharedBuildCapturePaneArgv(scrollbackTarget, 80));
         if (!scrollbackResult.ok)
             return false;
         return paneLooksReady(scrollbackResult.stdout);
@@ -1811,21 +2540,30 @@ export async function waitForWorkerReadyAsync(sessionName, workerIndex, timeoutM
  * Returns true if a trust prompt was found and dismissed, false otherwise.
  * Opt-out: set OMX_TEAM_AUTO_TRUST=0 to disable auto-dismissal.
  */
-export function dismissTrustPromptIfPresent(sessionName, workerIndex, workerPaneId) {
+export function dismissTrustPromptIfPresent(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
     if (process.env.OMX_TEAM_AUTO_TRUST === '0')
         return false;
     if (!isTmuxAvailable())
         return false;
-    const target = paneTarget(sessionName, workerIndex, workerPaneId);
-    const result = runTmux(sharedBuildVisibleCapturePaneArgv(target));
+    const resolveTarget = createPinnedWorkerPaneTargetResolverSync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
+    const captureTarget = resolveTarget();
+    if (!captureTarget)
+        return false;
+    const result = runTmux(sharedBuildVisibleCapturePaneArgv(captureTarget));
     if (!result.ok)
         return false;
     if (!paneHasTrustPrompt(result.stdout))
         return false;
     // Trust prompt detected; send C-m twice to dismiss (trust + follow-up splash)
-    runTmux(['send-keys', '-t', target, 'C-m']);
+    const firstTarget = resolveTarget();
+    if (!firstTarget)
+        return false;
+    runTmux(['send-keys', '-t', firstTarget, 'C-m']);
     sleepFractionalSeconds(0.12);
-    runTmux(['send-keys', '-t', target, 'C-m']);
+    const secondTarget = resolveTarget();
+    if (!secondTarget)
+        return false;
+    runTmux(['send-keys', '-t', secondTarget, 'C-m']);
     return true;
 }
 export const normalizeTmuxCapture = sharedNormalizeTmuxCapture;
@@ -1856,49 +2594,49 @@ export function sendToWorkerStdin(stdin, text) {
 // Send SHORT text (<200 chars) to worker via tmux send-keys
 // Validates: text < 200 chars, no injection marker
 // Throws on violation
-export async function sendToWorker(sessionName, workerIndex, text, workerPaneId, workerCli) {
+export async function sendToWorker(sessionName, workerIndex, text, workerPaneId, workerCli, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
     assertWorkerTriggerText(text);
-    const target = paneTarget(sessionName, workerIndex, workerPaneId);
+    const resolveTarget = createPinnedWorkerPaneTargetResolver(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
     const strategy = resolveSendStrategyFromEnv();
     const resolvedWorkerCli = resolveWorkerCliForSend(workerIndex, workerCli);
     // Guard: if the trust prompt is still present, advance it first so our trigger text
     // doesn't get typed into the trust screen and ignored.
-    const capturedStr = await capturePaneAsync(target);
+    const capturedStr = await capturePaneAsync(resolveTarget);
     const paneBusy = paneHasActiveTask(capturedStr);
-    if (dismissClaudeBypassPermissionsPromptIfPresent(target, capturedStr)) {
+    if (await dismissClaudeBypassPermissionsPromptIfPresentAsync(resolveTarget, capturedStr)) {
         await sleep(200);
     }
     if (paneHasTrustPrompt(capturedStr)) {
-        await sendKeyAsync(target, 'C-m');
+        await sendKeyAsync(resolveTarget, 'C-m');
         await sleep(120);
-        await sendKeyAsync(target, 'C-m');
+        await sendKeyAsync(resolveTarget, 'C-m');
         await sleep(200);
     }
-    sendLiteralTextOrThrow(target, text);
+    await sendLiteralTextOrThrow(resolveTarget, text);
     // Allow the input buffer to settle before sending C-m
     await sleep(150);
     const allowAutoInterruptRetry = process.env[OMX_TEAM_AUTO_INTERRUPT_RETRY_ENV] !== '0';
     const submitPlan = buildWorkerSubmitPlan(strategy, resolvedWorkerCli, paneBusy, allowAutoInterruptRetry);
     if (submitPlan.shouldInterrupt) {
         // Explicit interrupt mode: abort current turn first, then submit the new command.
-        await sendKeyAsync(target, 'C-c');
+        await sendKeyAsync(resolveTarget, 'C-c');
         await sleep(100);
     }
     // Submit deterministically using CLI-specific plan:
     // - Codex: queue-first Tab+C-m when configured/busy, then double C-m rounds.
     // - Claude: direct C-m rounds only (never queue-first Tab).
-    if (await attemptSubmitRounds(target, text, submitPlan.rounds, submitPlan.queueFirstRound, submitPlan.submitKeyPressesPerRound))
+    if (await attemptSubmitRounds(resolveTarget, text, submitPlan.rounds, submitPlan.queueFirstRound, submitPlan.submitKeyPressesPerRound))
         return;
     // Adaptive escalation for "likely unsent trigger text at ready prompt" cases:
     // clear line, re-send trigger, then re-submit with deterministic C-m rounds.
-    const latestCapture = await capturePaneAsync(target);
+    const latestCapture = await capturePaneAsync(resolveTarget);
     if (shouldAttemptAdaptiveRetry(strategy, paneBusy, submitPlan.allowAdaptiveRetry, latestCapture || null, text)) {
         // Keep this branch non-interrupting to avoid canceling active turns on false positives.
-        await sendKeyAsync(target, 'C-u');
+        await sendKeyAsync(resolveTarget, 'C-u');
         await sleep(80);
-        sendLiteralTextOrThrow(target, text);
+        await sendLiteralTextOrThrow(resolveTarget, text);
         await sleep(120);
-        if (await attemptSubmitRounds(target, text, 4, false, submitPlan.submitKeyPressesPerRound))
+        if (await attemptSubmitRounds(resolveTarget, text, 4, false, submitPlan.submitKeyPressesPerRound))
             return;
     }
     // Fail-open by default: Codex may keep the last submitted line visible even after executing it.
@@ -1908,15 +2646,15 @@ export async function sendToWorker(sessionName, workerIndex, text, workerPaneId,
         throw new Error('sendToWorker: submit_failed (trigger text still visible after retries)');
     }
     // One last best-effort double C-m nudge, then verify.
-    await sendKeyAsync(target, 'C-m');
+    await sendKeyAsync(resolveTarget, 'C-m');
     await sleep(120);
-    await sendKeyAsync(target, 'C-m');
+    await sendKeyAsync(resolveTarget, 'C-m');
     // Post-submit verification: wait briefly and confirm the worker consumed the
     // trigger (draft disappeared or active-task indicator appeared). Fixes #391.
     await sleep(300);
     const [verifyCapture, verifyVisibleCapture] = await Promise.all([
-        capturePaneAsync(target),
-        captureVisiblePaneAsync(target),
+        capturePaneAsync(resolveTarget),
+        captureVisiblePaneAsync(resolveTarget),
     ]);
     if (verifyCapture) {
         if (paneHasActiveTask(verifyCapture))
@@ -1926,14 +2664,14 @@ export async function sendToWorker(sessionName, workerIndex, text, workerPaneId,
             return;
         }
         // Draft still visible and no active task — one more C-m attempt.
-        await sendKeyAsync(target, 'C-m');
+        await sendKeyAsync(resolveTarget, 'C-m');
         await sleep(150);
-        await sendKeyAsync(target, 'C-m');
-        const finalVisibleCapture = await captureVisiblePaneAsync(target);
+        await sendKeyAsync(resolveTarget, 'C-m');
+        const finalVisibleCapture = await captureVisiblePaneAsync(resolveTarget);
         if (paneHasQueuedCodexSubmission(finalVisibleCapture)) {
             throw new Error('sendToWorker: submit_queued_after_tool_call');
         }
-        const finalCapture = await capturePaneAsync(target);
+        const finalCapture = await capturePaneAsync(resolveTarget);
         if (normalizeWorkerTriggerForDraftMatch(finalCapture).includes(normalizeWorkerTriggerForDraftMatch(text))
             && !paneHasActiveTask(finalCapture)
             && paneLooksReady(finalCapture)) {
@@ -1952,8 +2690,12 @@ export function notifyLeaderStatus(sessionName, message) {
     return result.ok;
 }
 // Get PID of the shell process in a worker's tmux pane
-export function getWorkerPanePid(sessionName, workerIndex, workerPaneId) {
-    const result = runTmux(['list-panes', '-t', paneTarget(sessionName, workerIndex, workerPaneId), '-F', '#{pane_pid}']);
+export function getWorkerPanePid(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
+    if (hasExplicitWorkerPaneId(workerPaneId)) {
+        const target = createPinnedWorkerPaneTargetResolverSync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId)();
+        return target ? expectedPanePid ?? null : null;
+    }
+    const result = runTmux(['list-panes', '-t', paneTarget(sessionName, workerIndex), '-F', '#{pane_pid}']);
     if (!result.ok)
         return null;
     const firstLine = result.stdout.split('\n')[0]?.trim();
@@ -1965,15 +2707,16 @@ export function getWorkerPanePid(sessionName, workerIndex, workerPaneId) {
     return pid;
 }
 // Check if worker's tmux pane has a running process
-export function isWorkerAlive(sessionName, workerIndex, workerPaneId) {
-    if (workerPaneId?.startsWith('%')) {
-        const paneStatus = readPaneLivenessById(workerPaneId);
-        if (paneStatus !== null)
-            return paneStatus;
+export function isWorkerAlive(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
+    if (hasExplicitWorkerPaneId(workerPaneId)) {
+        const target = createPinnedWorkerPaneTargetResolverSync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId)();
+        if (!target || typeof expectedPanePid !== 'number')
+            return false;
+        return probeProcessLiveness(expectedPanePid) !== 'gone';
     }
     const result = runTmux([
         'list-panes',
-        '-t', paneTarget(sessionName, workerIndex, workerPaneId),
+        '-t', paneTarget(sessionName, workerIndex),
         '-F',
         '#{pane_dead} #{pane_pid}',
     ]);
@@ -1991,23 +2734,17 @@ export function isWorkerAlive(sessionName, workerIndex, workerPaneId) {
         return false;
     if (!Number.isFinite(pid))
         return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
+    // Unknown is conservatively live so callers cannot classify a permission or
+    // transient failure as stale cleanup authority.
+    return probeProcessLiveness(pid) !== 'gone';
 }
-export function isWorkerPaneOpen(sessionName, workerIndex, workerPaneId) {
-    if (workerPaneId?.startsWith('%')) {
-        const paneStatus = readPaneLivenessById(workerPaneId);
-        if (paneStatus !== null)
-            return paneStatus;
+export function isWorkerPaneOpen(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
+    if (hasExplicitWorkerPaneId(workerPaneId)) {
+        return createPinnedWorkerPaneTargetResolverSync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId)() !== null;
     }
     const result = runTmux([
         'list-panes',
-        '-t', paneTarget(sessionName, workerIndex, workerPaneId),
+        '-t', paneTarget(sessionName, workerIndex),
         '-F',
         '#{pane_dead}',
     ]);
@@ -2020,28 +2757,69 @@ export function isWorkerPaneOpen(sessionName, workerIndex, workerPaneId) {
 }
 // Kill a specific worker: send C-c, then C-d, then kill-pane if still alive.
 // leaderPaneId: when provided, the kill is skipped entirely if workerPaneId matches it.
-export async function killWorker(sessionName, workerIndex, workerPaneId, leaderPaneId) {
+export async function killWorker(sessionName, workerIndex, workerPaneId, leaderPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
     // Guard: never kill the leader's own pane.
     if (leaderPaneId && workerPaneId === leaderPaneId)
         return;
-    await runTmuxAsync(['send-keys', '-t', paneTarget(sessionName, workerIndex, workerPaneId), 'C-c']);
+    const resolveTarget = createPinnedWorkerPaneTargetResolver(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
+    const initialTarget = await resolveTarget();
+    if (!initialTarget)
+        return;
+    if (await isWorkerAliveAsync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId, resolveTarget) !== 'alive')
+        return;
+    await runTmuxAsync(['send-keys', '-t', initialTarget, 'C-c']);
     await sleep(1000);
-    if (await isWorkerAliveAsync(sessionName, workerIndex, workerPaneId)) {
-        await runTmuxAsync(['send-keys', '-t', paneTarget(sessionName, workerIndex, workerPaneId), 'C-d']);
-        await sleep(1000);
-    }
-    if (await isWorkerAliveAsync(sessionName, workerIndex, workerPaneId)) {
-        await runTmuxAsync(['kill-pane', '-t', paneTarget(sessionName, workerIndex, workerPaneId)]);
+    if (await isWorkerAliveAsync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId, resolveTarget) === 'alive') {
+        const exitTarget = await resolveTarget();
+        if (exitTarget) {
+            await runTmuxAsync(['send-keys', '-t', exitTarget, 'C-d']);
+            await sleep(1000);
+        }
     }
-}
-// leaderPaneId: when provided, the kill is skipped if workerPaneId matches it.
-export function killWorkerByPaneId(workerPaneId, leaderPaneId) {
-    if (!workerPaneId.startsWith('%'))
+    if (await isWorkerAliveAsync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId, resolveTarget) === 'alive') {
+        const killTarget = await resolveTarget();
+        if (!killTarget)
+            return;
+        const killed = await runTmuxAsync(['kill-pane', '-t', killTarget]);
+        if (!killed.ok)
+            throw new Error(`failed to kill tmux pane ${killTarget}: ${killed.stderr}`);
+        const absence = await readExactPaneProof(killTarget);
+        if (absence.status === 'unavailable')
+            throw new ExactPaneProofUnavailableError(absence);
+        if (absence.status !== 'gone')
+            throw new Error(`tmux pane remains live after kill: ${killTarget}`);
+    }
+}
+// Explicit pane targets require frozen PID, canonical Team owner, and HUD
+// exclusion. A successful kill is only accepted after a fresh absence proof.
+export function killWorkerByPaneId(workerPaneId, expectedPanePid, leaderPaneId, expectedTeamOwnerId, hudPaneId) {
+    const expectedOwner = typeof expectedTeamOwnerId === 'string' ? expectedTeamOwnerId.trim() : '';
+    if (!hasExplicitWorkerPaneId(workerPaneId)
+        || typeof expectedPanePid !== 'number'
+        || !Number.isSafeInteger(expectedPanePid)
+        || expectedPanePid <= 0
+        || !expectedOwner
+        || workerPaneId === hudPaneId)
         return;
-    // Guard: never kill the leader's own pane.
     if (leaderPaneId && workerPaneId === leaderPaneId)
         return;
-    runTmux(['kill-pane', '-t', workerPaneId]);
+    const proof = readExactPaneProofSync(workerPaneId);
+    if (proof.status !== 'live' || proof.pid !== expectedPanePid)
+        return;
+    const owner = readPaneTeamOwnerTagResult(proof.paneId);
+    if (owner.status !== 'value' || owner.value !== expectedOwner)
+        return;
+    const finalProof = readExactPaneProofSync(proof.paneId);
+    if (finalProof.status !== 'live' || finalProof.pid !== expectedPanePid)
+        return;
+    const result = runTmux(['kill-pane', '-t', finalProof.paneId]);
+    if (!result.ok)
+        throw new Error(`failed to kill tmux pane ${finalProof.paneId}: ${result.stderr}`);
+    const absence = readExactPaneProofSync(finalProof.paneId);
+    if (absence.status === 'unavailable')
+        throw new ExactPaneProofUnavailableError(absence);
+    if (absence.status !== 'gone')
+        throw new Error(`tmux pane remains live after kill: ${finalProof.paneId}`);
 }
 export function paneHasOmxInstanceTag(paneId, instanceId) {
     const normalizedPaneId = normalizePaneTarget(paneId);
@@ -2092,13 +2870,34 @@ export function readPaneTeamOwnerTagResult(paneId) {
         return { status: 'missing' };
     return { status: 'error', error: stderr || `tmux show-option exited ${result.status ?? 'unknown'}` };
 }
-export async function killWorkerByPaneIdAsync(workerPaneId, leaderPaneId) {
-    if (!workerPaneId.startsWith('%'))
+export async function killWorkerByPaneIdAsync(workerPaneId, expectedPanePid, leaderPaneId, expectedTeamOwnerId, hudPaneId) {
+    const expectedOwner = typeof expectedTeamOwnerId === 'string' ? expectedTeamOwnerId.trim() : '';
+    if (!hasExplicitWorkerPaneId(workerPaneId)
+        || typeof expectedPanePid !== 'number'
+        || !Number.isSafeInteger(expectedPanePid)
+        || expectedPanePid <= 0
+        || !expectedOwner
+        || workerPaneId === hudPaneId)
         return;
-    // Guard: never kill the leader's own pane.
     if (leaderPaneId && workerPaneId === leaderPaneId)
         return;
-    await runTmuxAsync(['kill-pane', '-t', workerPaneId]);
+    const proof = await readExactPaneProof(workerPaneId);
+    if (proof.status !== 'live' || proof.pid !== expectedPanePid)
+        return;
+    const owner = readPaneTeamOwnerTagResult(proof.paneId);
+    if (owner.status !== 'value' || owner.value !== expectedOwner)
+        return;
+    const finalProof = await readExactPaneProof(proof.paneId);
+    if (finalProof.status !== 'live' || finalProof.pid !== expectedPanePid)
+        return;
+    const result = await runTmuxAsync(['kill-pane', '-t', finalProof.paneId]);
+    if (!result.ok)
+        throw new Error(`failed to kill tmux pane ${finalProof.paneId}: ${result.stderr}`);
+    const absence = await readExactPaneProof(finalProof.paneId);
+    if (absence.status === 'unavailable')
+        throw new ExactPaneProofUnavailableError(absence);
+    if (absence.status !== 'gone')
+        throw new Error(`tmux pane remains live after kill: ${finalProof.paneId}`);
 }
 function normalizePaneTarget(value) {
     if (typeof value !== 'string')
@@ -2136,7 +2935,10 @@ function normalizePaneTargets(paneIds, options = {}) {
     return { killablePaneIds, excluded };
 }
 export function resolveSharedSessionShutdownTopology(sessionName, preferredLeaderPaneId, teamName) {
-    const panes = listPanes(sessionName);
+    const paneList = listPanesResult(sessionName);
+    if (paneList.error !== null)
+        return { status: 'unavailable', detail: paneList.error };
+    const panes = paneList.panes;
     const livePaneIds = panes
         .map((pane) => normalizePaneTarget(pane.paneId))
         .filter((paneId) => Boolean(paneId));
@@ -2144,6 +2946,7 @@ export function resolveSharedSessionShutdownTopology(sessionName, preferredLeade
     if (panes.length === 0) {
         return {
             livePaneIds,
+            status: 'available',
             teamWorkerPaneIds: [],
             leaderPaneId: fallbackLeaderPaneId,
             hudPaneIds: [],
@@ -2174,6 +2977,7 @@ export function resolveSharedSessionShutdownTopology(sessionName, preferredLeade
         : [];
     return {
         livePaneIds,
+        status: 'available',
         teamWorkerPaneIds: normalizedTeamWorkerPaneIds,
         leaderPaneId: resolvedLeaderPaneId,
         hudPaneIds,
@@ -2288,7 +3092,8 @@ function escapeRegExp(value) {
 }
 /**
  * Shared pane-id-direct teardown primitive for worker pane cleanup.
- * Must remain liveness-agnostic: do not gate on isWorkerAlive/killWorker.
+ * A fresh exact global proof is required before each kill; proven-gone panes
+ * are teardown-compatible while unavailable proofs remain fail-closed.
  */
 export async function teardownWorkerPanes(paneIds, options = {}) {
     const { killablePaneIds, excluded } = normalizePaneTargets(paneIds, options);
@@ -2299,45 +3104,247 @@ export async function teardownWorkerPanes(paneIds, options = {}) {
     const summary = {
         attemptedPaneIds: killablePaneIds,
         excluded,
+        provenGonePaneIds: [],
+        killedPaneIds: [],
+        proofUnavailable: [],
         kill: {
-            attempted: killablePaneIds.length,
+            attempted: 0,
             succeeded: 0,
             failed: 0,
+            failedPaneIds: [],
         },
     };
     for (const paneId of killablePaneIds) {
-        const result = await runTmuxAsync(['kill-pane', '-t', paneId]);
-        if (result.ok)
+        const proof = await readExactPaneProof(paneId);
+        const expectedPid = options.expectedPanePids?.[paneId];
+        if (proof.status === 'gone') {
+            summary.provenGonePaneIds.push(proof.paneId);
+            continue;
+        }
+        if (proof.status === 'unavailable') {
+            summary.proofUnavailable.push(proof);
+            break;
+        }
+        if (typeof expectedPid !== 'number' || !Number.isSafeInteger(expectedPid) || expectedPid <= 0) {
+            summary.proofUnavailable.push({
+                status: 'unavailable',
+                paneId,
+                reason: 'pane_pid_changed',
+                detail: 'expected positive pane PID is required before teardown kill',
+            });
+            break;
+        }
+        if (proof.pid !== expectedPid) {
+            summary.proofUnavailable.push({
+                status: 'unavailable',
+                paneId,
+                reason: 'pane_pid_changed',
+                detail: `expected ${expectedPid}, got ${proof.pid}`,
+            });
+            break;
+        }
+        if (options.authorizePaneKill && !options.authorizePaneKill(proof.paneId, proof)) {
+            summary.proofUnavailable.push({
+                status: 'unavailable',
+                paneId: proof.paneId,
+                reason: 'pane_pid_changed',
+                detail: 'pane owner authorization changed',
+            });
+            break;
+        }
+        // Owner authorization can read tmux. Re-prove the persisted identity after
+        // it and immediately before kill-pane.
+        const finalProof = await readExactPaneProof(proof.paneId);
+        if (finalProof.status === 'gone') {
+            summary.provenGonePaneIds.push(finalProof.paneId);
+            continue;
+        }
+        if (finalProof.status === 'unavailable') {
+            summary.proofUnavailable.push(finalProof);
+            break;
+        }
+        if (finalProof.pid !== expectedPid) {
+            summary.proofUnavailable.push({
+                status: 'unavailable',
+                paneId: finalProof.paneId,
+                reason: 'pane_pid_changed',
+                detail: `expected ${expectedPid}, got ${finalProof.pid}`,
+            });
+            break;
+        }
+        summary.kill.attempted += 1;
+        const result = await runTmuxAsync(['kill-pane', '-t', finalProof.paneId]);
+        if (!result.ok) {
+            summary.kill.failed += 1;
+            summary.kill.failedPaneIds.push(proof.paneId);
+            await sleep(perPaneGrace);
+            break;
+        }
+        const afterKill = await readExactPaneProof(finalProof.paneId);
+        if (afterKill.status === 'gone') {
             summary.kill.succeeded += 1;
-        else
+            summary.killedPaneIds.push(proof.paneId);
+        }
+        else if (afterKill.status === 'unavailable') {
+            summary.proofUnavailable.push(afterKill);
+            break;
+        }
+        else {
             summary.kill.failed += 1;
+            summary.kill.failedPaneIds.push(proof.paneId);
+            await sleep(perPaneGrace);
+            break;
+        }
         await sleep(perPaneGrace);
     }
     return summary;
 }
-export async function killWorkerPanes(paneIds, leaderPaneId, graceMs = 2000, hudPaneId) {
-    return teardownWorkerPanes(paneIds, { leaderPaneId, hudPaneId: hudPaneId ?? null, graceMs });
-}
-// Kill entire tmux session. Tolerates already-dead sessions.
-export function destroyTeamSession(sessionName) {
-    try {
-        runTmux(['kill-session', '-t', sessionName]);
-    }
-    catch {
-        // tolerate
-    }
+export async function killWorkerPanes(paneIds, leaderPaneId, graceMs = 2000, hudPaneId, expectedPanePids) {
+    return teardownWorkerPanes(paneIds, {
+        leaderPaneId,
+        hudPaneId: hudPaneId ?? null,
+        graceMs,
+        expectedPanePids,
+    });
 }
-// List all tmux sessions matching omx-team-* pattern
-export function listTeamSessions() {
-    const result = runTmux(['list-sessions', '-F', '#{session_name}']);
-    if (!result.ok)
-        return [];
-    return result.stdout
+// Kill an entire detached tmux session only when the caller has already
+// established ownership. Success requires tmux to accept the kill and a fresh
+// session-list proof that the exact base session is absent.
+function parseTeamSessionNames(stdout) {
+    return stdout
         .split('\n')
         .map(line => line.trim())
         .filter(Boolean)
         .map(baseSessionName);
 }
+function isFinalTmuxServerGone(result) {
+    return !result.ok && /^no server running on .+$/i.test(result.stderr);
+}
+/**
+ * Reads pane and session incarnation in one tmux snapshot. This prevents a
+ * same-name replacement from combining a stale session proof with a live pane.
+ */
+export function queryDetachedSessionLeaderBinding(paneId, pid, sessionName, expected) {
+    const result = runTmuxStructured(['list-panes', '-a', '-F', '#{pane_id}\t#{pane_dead}\t#{pane_pid}\t#{session_name}\t#{session_id}\t#{session_created}']);
+    if (!result.ok)
+        return null;
+    const seenPaneIds = new Set();
+    let binding = null;
+    for (const line of result.stdout.split('\n').filter(Boolean)) {
+        const fields = line.split('\t');
+        if (fields.length !== 6)
+            return null;
+        const [currentPaneId, dead, panePid, currentSessionName, sessionId, sessionCreated] = fields;
+        if (!/^%[0-9]+$/.test(currentPaneId) || seenPaneIds.has(currentPaneId) || (dead !== '0' && dead !== '1')
+            || !/^[0-9]+$/.test(panePid) || !Number.isSafeInteger(Number(panePid)) || Number(panePid) <= 0
+            || !currentSessionName || !/^\$[0-9]+$/.test(sessionId) || !/^[0-9]+$/.test(sessionCreated))
+            return null;
+        seenPaneIds.add(currentPaneId);
+        if (currentPaneId !== paneId)
+            continue;
+        if (dead !== '0' || Number(panePid) !== pid || currentSessionName !== sessionName
+            || sessionId !== expected.sessionId || sessionCreated !== expected.sessionCreated)
+            return null;
+        binding = { paneId: currentPaneId, pid: Number(panePid), sessionName: currentSessionName, incarnation: { sessionId, sessionCreated } };
+    }
+    return binding;
+}
+function parseDetachedSessionIncarnation(stdout, sessionName) {
+    const baseName = baseSessionName(sessionName);
+    const matches = [];
+    for (const line of stdout.split('\n').filter(Boolean)) {
+        const fields = line.split('\t');
+        if (fields.length !== 3)
+            return 'malformed';
+        const [name, sessionId, sessionCreated] = fields;
+        if (!name || !sessionId || !sessionCreated || !/^\$[0-9]+$/.test(sessionId) || !/^[0-9]+$/.test(sessionCreated))
+            return 'malformed';
+        if (baseSessionName(name) === baseName)
+            matches.push({ sessionId, sessionCreated });
+    }
+    return matches.length === 0 ? null : matches.length === 1 ? matches[0] : 'malformed';
+}
+/**
+ * Reads stable tmux incarnation evidence. Name-only presence is never effect
+ * authority: malformed or unavailable evidence fails closed, and an expected
+ * incarnation distinguishes an exact survivor from a recycled same-name session.
+ */
+export function queryDetachedTeamSession(sessionName, expected) {
+    const sessions = runTmuxStructured(['list-sessions', '-F', '#{session_name}\t#{session_id}\t#{session_created}']);
+    if (!sessions.ok) {
+        return isFinalTmuxServerGone(sessions)
+            ? { status: 'absent' }
+            : { status: 'unavailable', detail: sessions.stderr };
+    }
+    const incarnation = parseDetachedSessionIncarnation(sessions.stdout, sessionName);
+    if (incarnation === 'malformed')
+        return { status: 'unavailable', detail: 'malformed_session_incarnation' };
+    if (incarnation === null)
+        return { status: 'absent' };
+    if (expected && (incarnation.sessionId !== expected.sessionId || incarnation.sessionCreated !== expected.sessionCreated)) {
+        return { status: 'replacement', incarnation };
+    }
+    return { status: 'exact', incarnation };
+}
+/**
+ * Re-proves every stable authorization component at the destructive sink. The
+ * final tmux command queues an in-server predicate with the kill, so no client
+ * can replace the session or pane between authorization and the effect.
+ */
+function buildDetachedSessionDestroyArgs(expected) {
+    const leaderPaneId = expected.leaderPaneId.trim();
+    const ownerId = expected.ownerId.trim();
+    if (!/^%[0-9]+$/.test(leaderPaneId)
+        || !Number.isSafeInteger(expected.leaderPanePid)
+        || expected.leaderPanePid <= 0
+        || !/^\$[0-9]+$/.test(expected.sessionId)
+        || !/^[0-9]+$/.test(expected.sessionCreated)
+        || !/^[A-Za-z0-9._:@/-]+$/.test(ownerId))
+        return null;
+    const predicate = [
+        '#{==:#{pane_dead},0}',
+        `#{==:#{pane_id},${leaderPaneId}}`,
+        `#{==:#{pane_pid},${expected.leaderPanePid}}`,
+        `#{==:#{${OMX_TEAM_PANE_OWNER_OPTION}},${ownerId}}`,
+        `#{==:#{session_id},${expected.sessionId}}`,
+        `#{==:#{session_created},${expected.sessionCreated}}`,
+    ].reduce((combined, condition) => `#{&&:${combined},${condition}}`);
+    return ['if-shell', '-F', '-t', leaderPaneId, predicate, `kill-session -t ${expected.sessionId}`, 'run-shell "exit 1"'];
+}
+export function requestDetachedTeamSessionDestroy(sessionName, expected) {
+    const incarnation = { sessionId: expected.sessionId, sessionCreated: expected.sessionCreated };
+    if (queryDetachedTeamSession(sessionName, incarnation).status !== 'exact')
+        return false;
+    if (!queryDetachedSessionLeaderBinding(expected.leaderPaneId, expected.leaderPanePid, sessionName, incarnation))
+        return false;
+    const pane = readExactPaneProofSync(expected.leaderPaneId);
+    if (pane.status !== 'live' || pane.pid !== expected.leaderPanePid)
+        return false;
+    const owner = readPaneTeamOwnerTagResult(expected.leaderPaneId);
+    if (owner.status !== 'value' || owner.value !== expected.ownerId)
+        return false;
+    const args = buildDetachedSessionDestroyArgs(expected);
+    return args !== null && runTmux(args).ok;
+}
+export function destroyTeamSession(sessionName) {
+    const result = runTmux(['kill-session', '-t', sessionName]);
+    if (!result.ok)
+        return false;
+    const sessions = runTmux(['list-sessions', '-F', '#{session_name}']);
+    // Killing tmux's final session also terminates its server. Its documented
+    // no-server response is the only post-kill query failure that proves absence.
+    if (!sessions.ok)
+        return isFinalTmuxServerGone(sessions);
+    return !parseTeamSessionNames(sessions.stdout).includes(baseSessionName(sessionName));
+}
+// A failed query is not a successful empty session list. Destructive callers
+// must require the latter before treating a detached session as absent.
+export function listTeamSessions() {
+    const result = runTmux(['list-sessions', '-F', '#{session_name}']);
+    if (!result.ok)
+        return null;
+    return parseTeamSessionNames(result.stdout);
+}
 /**
  * Notify the leader through durable mailbox state only.
  *