oh-my-codex 0.20.2 → 0.20.3

package/dist/team/__tests__/tmux-session.test.js

@@ -4,13 +4,14 @@ import fs from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { syncBuiltinESMExports } from 'node:module';
 import { PassThrough } from 'node:stream';
-import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'fs/promises';
+import { chmod, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'fs/promises';
 import { dirname, join } from 'path';
 import { tmpdir } from 'os';
-import { buildClientAttachedReconcileHookName, assertTeamWorkerCliBinaryAvailable, buildWorkerProcessLaunchSpec, buildReconcileHudResizeArgs, buildRegisterClientAttachedReconcileArgs, buildRegisterResizeHookArgs, buildResizeHookName, buildResizeHookTarget, buildScheduleDelayedHudResizeArgs, buildUnregisterClientAttachedReconcileArgs, buildUnregisterResizeHookArgs, buildWorkerStartupCommand, trustWorkerMiseConfigIfAvailable, writeWorkerStartupScriptCommand, shouldSourceTeamWorkerShellRc, buildHudPaneTarget, chooseTeamLeaderPaneId, createTeamSession, enableMouseScrolling, isMsysOrGitBash, isNativeWindows, isTmuxAvailable, isWorkerPaneOpen, restoreStandaloneHudPane, translatePathForMsys, isWsl2, isWorkerAlive, killWorker, killWorkerByPaneId, teardownWorkerPanes, listTeamSessions, resolveTeamWorkerCli, resolveTeamWorkerLaunchMode, resolveWorkerCliForSend, resolveTeamWorkerCliPlan, buildWorkerSubmitPlan, sanitizeTeamName, shouldAttemptAdaptiveRetry, sendToWorker, sendToWorkerStdin, sleepFractionalSeconds, translateWorkerLaunchArgsForCli, waitForWorkerReady, waitForWorkerReadyAsync, paneIsBootstrapping, classifyWorkerStartupInjectSafety, checkWorkerStartupInjectSafety, dismissTrustPromptIfPresent, evaluateStartupDirectTriggerSafetyCapture, mitigateCopyModeUnderlineArtifacts, } from '../tmux-session.js';
+import { buildClientAttachedReconcileHookName, assertTeamWorkerCliBinaryAvailable, buildWorkerProcessLaunchSpec, buildReconcileHudResizeArgs, buildRegisterClientAttachedReconcileArgs, buildRegisterResizeHookArgs, buildResizeHookName, buildResizeHookTarget, buildScheduleDelayedHudResizeArgs, buildUnregisterClientAttachedReconcileArgs, buildUnregisterResizeHookArgs, buildWorkerStartupCommand, trustWorkerMiseConfigIfAvailable, writeWorkerStartupScriptCommand, shouldSourceTeamWorkerShellRc, buildHudPaneTarget, chooseTeamLeaderPaneId, createTeamSession, CreateTeamSessionPartialError, enableMouseScrolling, isMsysOrGitBash, isNativeWindows, isTmuxAvailable, isWorkerPaneOpen, restoreStandaloneHudPane, finalizeRestoredHudCleanupDebtSync, reconcileRestoredHudCleanupDebtSync, translatePathForMsys, isWsl2, isWorkerAlive, killWorker, getWorkerPanePid, killWorkerByPaneId, killWorkerByPaneIdAsync, teardownWorkerPanes, listTeamSessions, destroyTeamSession, queryDetachedTeamSession, requestDetachedTeamSessionDestroy, resolveTeamWorkerCli, resolveTeamWorkerLaunchMode, resolveWorkerCliForSend, resolveTeamWorkerCliPlan, buildWorkerSubmitPlan, sanitizeTeamName, shouldAttemptAdaptiveRetry, sendToWorker, sendToWorkerStdin, sleepFractionalSeconds, translateWorkerLaunchArgsForCli, waitForWorkerReady, waitForWorkerReadyAsync, paneIsBootstrapping, classifyWorkerStartupInjectSafety, checkWorkerStartupInjectSafety, dismissTrustPromptIfPresent, evaluateStartupDirectTriggerSafetyCapture, mitigateCopyModeUnderlineArtifacts, listPaneIds, } from '../tmux-session.js';
 import { HUD_RESIZE_RECONCILE_DELAY_SECONDS, HUD_TMUX_TEAM_HEIGHT_LINES } from '../../hud/constants.js';
 import * as tmuxSessionModule from '../tmux-session.js';
 import { OMX_ENTRY_PATH_ENV, OMX_STARTUP_CWD_ENV } from '../../utils/paths.js';
+import { readExactPaneProof, readExactPaneProofSync } from '../exact-pane.js';
 const fsMutable = fs;
 function withEmptyPath(fn) {
     const prev = process.env.PATH;
@@ -49,6 +50,18 @@ function withMockedStatSync(mock, fn) {
         syncBuiltinESMExports();
     }
 }
+function withMockedFsyncSync(mock, fn) {
+    const original = fsMutable.fsyncSync;
+    fsMutable.fsyncSync = mock;
+    syncBuiltinESMExports();
+    try {
+        return fn();
+    }
+    finally {
+        fsMutable.fsyncSync = original;
+        syncBuiltinESMExports();
+    }
+}
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -87,7 +100,33 @@ async function withMockTmuxFixture(dirPrefix, tmuxScript, run) {
     const tmuxStubPath = join(fakeBinDir, 'tmux');
     const previousPath = process.env.PATH;
     try {
-        await writeFile(tmuxStubPath, tmuxScript(logPath));
+        const fixtureScript = tmuxScript(logPath);
+        const needsStandaloneGlobalProof = dirPrefix.includes('standalone') && !fixtureScript.includes('list-panes)');
+        const needsTeamOwnerState = !fixtureScript.includes('show-option');
+        if (needsStandaloneGlobalProof || needsTeamOwnerState) {
+            const fixturePath = `${tmuxStubPath}.fixture`;
+            const ownerStateDir = `${tmuxStubPath}.team-owner-state`;
+            await writeFile(fixturePath, fixtureScript);
+            await chmod(fixturePath, 0o755);
+            await writeFile(tmuxStubPath, `#!/bin/sh
+if [ "${'$'}1" = "show-option" ] && [ "${'$'}{2:-}" = "-qv" ] && [ "${'$'}{3:-}" = "-p" ] && [ "${'$'}{4:-}" = "-t" ] && [ "${'$'}{6:-}" = "@omx_team_pane_owner_id" ]; then
+  if [ -f "${ownerStateDir}/${'$'}5" ]; then cat "${ownerStateDir}/${'$'}5"; exit 0; fi
+  exit 1
+fi
+if [ "${'$'}1" = "set-option" ] && [ "${'$'}{2:-}" = "-p" ] && [ "${'$'}{3:-}" = "-t" ] && [ "${'$'}{5:-}" = "@omx_team_pane_owner_id" ]; then
+  mkdir -p "${ownerStateDir}"
+  printf '%s' "${'$'}6" > "${ownerStateDir}/${'$'}4"
+fi
+${needsStandaloneGlobalProof ? `if [ "${'$'}1" = "list-panes" ] && [ "${'$'}{2:-}" = "-a" ]; then
+  printf '%%11\\t0\\t2000000011\\n%%44\\t0\\t2000000044\\n'
+  exit 0
+fi
+` : ''}exec "${fixturePath}" "${'$'}@"
+`);
+        }
+        else {
+            await writeFile(tmuxStubPath, fixtureScript);
+        }
         await chmod(tmuxStubPath, 0o755);
         process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
         return await run({ logPath });
@@ -153,7 +192,9 @@ describe('HUD resize hook command builders', () => {
         assert.equal(args[1], '-t');
         assert.equal(args[2], 'my-session:0');
         assert.match(args[3] ?? '', /^client-resized\[\d+\]$/);
-        assert.equal(args[4], `run-shell -b 'tmux resize-pane -t %1 -y ${HUD_TMUX_TEAM_HEIGHT_LINES} >/dev/null 2>&1 || true; sleep ${HUD_RESIZE_RECONCILE_DELAY_SECONDS}; tmux resize-pane -t %1 -y ${HUD_TMUX_TEAM_HEIGHT_LINES} >/dev/null 2>&1 || true'`);
+        assert.match(args[4] ?? '', /list-panes -a -F/);
+        assert.match(args[4] ?? '', /awk -F/);
+        assert.match(args[4] ?? '', new RegExp(`resize-pane -t %1 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
     });
     it('buildUnregisterResizeHookArgs removes the exact numeric hook slot', () => {
         const registered = buildRegisterResizeHookArgs('my-session:0', 'omx_resize_team_session_0_1', '%1');
@@ -170,7 +211,46 @@ describe('HUD resize hook command builders', () => {
         assert.equal(args[1], '-t');
         assert.equal(args[2], 'my-session:0');
         assert.match(args[3] ?? '', /^client-attached\[\d+\]$/);
-        assert.match(args[4] ?? '', /^run-shell -b 'tmux resize-pane -t %1 -y \d+ >\/dev\/null 2>&1 \|\| true; tmux set-hook -u -t my-session:0 client-attached\[\d+\]'$/);
+        assert.match(args[4] ?? '', /list-panes -a -F/);
+        assert.match(args[4] ?? '', /awk -F/);
+        assert.match(args[4] ?? '', /resize-pane -t %1 -y \d+/);
+        assert.match(args[4] ?? '', /set-hook -u -t my-session:0 client-attached\[\d+\]/);
+    });
+    it('pins Team hook and delayed HUD reconciliation to the created pane PID and owner', () => {
+        const expectedPid = 2000000123;
+        const expectedOwner = 'team:exact-owner';
+        const commands = [
+            buildRegisterResizeHookArgs('my-session:0', 'omx_resize_team_session_0_1', '%1', HUD_TMUX_TEAM_HEIGHT_LINES, expectedPid, expectedOwner),
+            buildRegisterClientAttachedReconcileArgs('my-session:0', 'omx_attached_team_session_0_1', '%1', HUD_TMUX_TEAM_HEIGHT_LINES, expectedPid, expectedOwner),
+            buildScheduleDelayedHudResizeArgs('%1', HUD_RESIZE_RECONCILE_DELAY_SECONDS, HUD_TMUX_TEAM_HEIGHT_LINES, expectedPid, expectedOwner),
+            buildReconcileHudResizeArgs('%1', HUD_TMUX_TEAM_HEIGHT_LINES, expectedPid, expectedOwner),
+        ];
+        for (const args of commands) {
+            const command = args.at(-1) ?? '';
+            assert.match(command, new RegExp(`\\$3 == "${expectedPid}"`));
+            assert.match(command, /show-option -qv -p -t %1 @omx_team_pane_owner_id/);
+            assert.match(command, /final_snapshot=/);
+            assert.match(command, /team:exact-owner/);
+        }
+    });
+    it('fails closed when a Team HUD hook observes an owner change between PID proofs', async () => {
+        await withMockTmuxFixture('omx-hud-hook-owner-change-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes) printf '%%7\\t0\\t2000000007\\n' ;;
+  show-option) printf '%s\\n' 'team:foreign' ;;
+  resize-pane) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+            const command = buildReconcileHudResizeArgs('%7', HUD_TMUX_TEAM_HEIGHT_LINES, 2000000007, 'team:expected')[1] ?? '';
+            const result = spawnSync('/bin/sh', ['-c', command], { encoding: 'utf-8' });
+            assert.equal(result.status, 0);
+            const commands = await readFile(logPath, 'utf-8');
+            assert.match(commands, /list-panes -a -F/);
+            assert.match(commands, /show-option -qv -p -t %7 @omx_team_pane_owner_id/);
+            assert.doesNotMatch(commands, /resize-pane/);
+        });
     });
     it('buildUnregisterClientAttachedReconcileArgs removes the exact numeric client-attached slot', () => {
         const registered = buildRegisterClientAttachedReconcileArgs('my-session:0', 'omx_attached_team_session_0_1', '%1');
@@ -201,13 +281,100 @@ describe('HUD resize hook command builders', () => {
         const d = buildRegisterClientAttachedReconcileArgs('s:0', name, '%1');
         assert.equal(c[3], d[3]);
     });
-    it('buildScheduleDelayedHudResizeArgs schedules tmux-side delayed reconcile', () => {
-        assert.deepEqual(buildScheduleDelayedHudResizeArgs('%1'), ['run-shell', '-b', `sleep ${HUD_RESIZE_RECONCILE_DELAY_SECONDS}; tmux resize-pane -t %1 -y ${HUD_TMUX_TEAM_HEIGHT_LINES} >/dev/null 2>&1 || true`]);
+    it('buildScheduleDelayedHudResizeArgs schedules a proof-bearing tmux-side delayed reconcile', () => {
+        const args = buildScheduleDelayedHudResizeArgs('%1');
+        assert.equal(args[0], 'run-shell');
+        assert.equal(args[1], '-b');
+        assert.match(args[2] ?? '', new RegExp(`sleep ${HUD_RESIZE_RECONCILE_DELAY_SECONDS};`));
+        assert.match(args[2] ?? '', /list-panes -a -F/);
+        assert.match(args[2] ?? '', /awk -F/);
+        assert.match(args[2] ?? '', new RegExp(`resize-pane -t %1 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
     });
-    it('buildReconcileHudResizeArgs executes a best-effort quiet resize command', () => {
+    it('buildReconcileHudResizeArgs executes only after a global exact-pane proof', () => {
         const args = buildReconcileHudResizeArgs('%7');
         assert.equal(args.join(' ').includes('split-window'), false);
-        assert.deepEqual(args, ['run-shell', `tmux resize-pane -t %7 -y ${HUD_TMUX_TEAM_HEIGHT_LINES} >/dev/null 2>&1 || true`]);
+        assert.equal(args[0], 'run-shell');
+        assert.match(args[1] ?? '', /list-panes -a -F/);
+        assert.match(args[1] ?? '', /awk -F/);
+        assert.match(args[1] ?? '', new RegExp(`resize-pane -t %7 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
+    });
+    it('fails closed in hook shell proofs without resizing malformed, duplicate, dead, absent, or unavailable panes', async () => {
+        const previousFixture = process.env.OMX_HUD_HOOK_FIXTURE;
+        try {
+            await withMockTmuxFixture('omx-hud-hook-proof-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    case "\${OMX_HUD_HOOK_FIXTURE:-}" in
+      missing) printf '%%7\\t0\\n' ;;
+      extra) printf '%%7\\t0\\t2000000007\\textra\\n' ;;
+      duplicate) printf '%%7\\t0\\t2000000007\\n%%7\\t0\\t2000000007\\n' ;;
+      dead) printf '%%7\\t1\\t2000000007\\n' ;;
+      absent) printf '%%8\\t0\\t2000000008\\n' ;;
+      query-failure) echo 'tmux query failed' >&2; exit 1 ;;
+    esac
+    ;;
+  resize-pane) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                const command = buildReconcileHudResizeArgs('%7')[1] ?? '';
+                for (const fixture of ['missing', 'extra', 'duplicate', 'dead', 'absent', 'query-failure']) {
+                    process.env.OMX_HUD_HOOK_FIXTURE = fixture;
+                    const result = spawnSync('/bin/sh', ['-c', command], { encoding: 'utf-8' });
+                    assert.equal(result.status, 0, fixture);
+                    const commands = await readFile(logPath, 'utf-8');
+                    assert.doesNotMatch(commands, /resize-pane/, fixture);
+                    await writeFile(logPath, '');
+                }
+            });
+        }
+        finally {
+            if (typeof previousFixture === 'string')
+                process.env.OMX_HUD_HOOK_FIXTURE = previousFixture;
+            else
+                delete process.env.OMX_HUD_HOOK_FIXTURE;
+        }
+    });
+    it('tolerates unrelated PID-less rows while rejecting malformed or duplicate HUD targets in generated hook proofs', async () => {
+        const previousFixture = process.env.OMX_HUD_HOOK_FIXTURE;
+        try {
+            await withMockTmuxFixture('omx-hud-hook-unrelated-pidless-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    case "\${OMX_HUD_HOOK_FIXTURE:-}" in
+      unrelated-pidless) printf '%%99\\t0\\t\\n%%7\\t0\\t2000000007\\n' ;;
+      target-malformed) printf '%%7\\t0\\t\\n%%99\\t0\\t2000000099\\n' ;;
+      target-duplicate) printf '%%7\\t0\\t2000000007\\n%%7\\t0\\t2000000007\\n' ;;
+    esac
+    ;;
+  show-option) printf 'team:expected\\n' ;;
+  resize-pane) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                const command = buildReconcileHudResizeArgs('%7', HUD_TMUX_TEAM_HEIGHT_LINES, 2000000007, 'team:expected')[1] ?? '';
+                for (const [fixture, shouldResize] of [
+                    ['unrelated-pidless', true],
+                    ['target-malformed', false],
+                    ['target-duplicate', false],
+                ]) {
+                    process.env.OMX_HUD_HOOK_FIXTURE = fixture;
+                    const result = spawnSync('/bin/sh', ['-c', command], { encoding: 'utf-8' });
+                    assert.equal(result.status, 0, fixture);
+                    const commands = await readFile(logPath, 'utf-8');
+                    assert.equal(/resize-pane/.test(commands), shouldResize, `${fixture}: ${commands}`);
+                    await writeFile(logPath, '');
+                }
+            });
+        }
+        finally {
+            if (typeof previousFixture === 'string')
+                process.env.OMX_HUD_HOOK_FIXTURE = previousFixture;
+            else
+                delete process.env.OMX_HUD_HOOK_FIXTURE;
+        }
     });
     it('resolves the tmux executable for win32 hook shell snippets', async () => {
         const fakeBin = await mkdtemp(join(tmpdir(), 'omx-win32-hook-tmux-'));
@@ -257,7 +424,7 @@ describe('HUD resize hook command builders', () => {
             Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
             const args = buildRegisterClientAttachedReconcileArgs('my-session:0', 'omx_attached_team_session_0_1', '%1');
             const matches = (args[4] ?? '').match(new RegExp(escapeRegExp(tmuxPath), 'g')) || [];
-            assert.equal(matches.length, 2, 'client-attached hook should resolve tmux for both resize and unregister commands');
+            assert.equal(matches.length, 4, 'client-attached hook should resolve tmux for separate resize and hook-unregister proofs');
             assert.doesNotMatch(args[4] ?? '', /; tmux set-hook -u -t my-session:0 client-attached/);
         }
         finally {
@@ -3158,11 +3325,161 @@ describe('tmux-dependent functions when tmux is unavailable', () => {
             assert.throws(() => createTeamSession('My Team', 1, process.cwd()), /tmux is not available/i);
         });
     });
-    it('listTeamSessions returns empty', () => {
+    it('distinguishes a failed session query from a successful empty result', async () => {
         withEmptyPath(() => {
+            assert.equal(listTeamSessions(), null);
+        });
+        await withMockTmuxFixture('omx-empty-team-sessions-', () => `#!/bin/sh
+case "$1" in
+  list-sessions) exit 0 ;;
+  *) exit 1 ;;
+esac
+`, async () => {
             assert.deepEqual(listTeamSessions(), []);
         });
     });
+    it('classifies detached tmux incarnation evidence strictly', async () => {
+        const cases = [
+            { name: 'exact', output: 'omx-team-incarnation\t$41\t1700000001', expected: { status: 'exact', incarnation: { sessionId: '$41', sessionCreated: '1700000001' } } },
+            { name: 'session-id replacement', output: 'omx-team-incarnation\t$42\t1700000001', expected: { status: 'replacement', incarnation: { sessionId: '$42', sessionCreated: '1700000001' } } },
+            { name: 'creation replacement', output: 'omx-team-incarnation\t$41\t1700000002', expected: { status: 'replacement', incarnation: { sessionId: '$41', sessionCreated: '1700000002' } } },
+        ];
+        for (const entry of cases) {
+            await withMockTmuxFixture(`omx-detached-incarnation-${entry.name.replaceAll(' ', '-')}-`, () => `#!/bin/sh
+case "$1" in
+  list-sessions) printf '%s\\n' '${entry.output}' ;;
+  *) exit 1 ;;
+esac
+`, async () => {
+                assert.deepEqual(queryDetachedTeamSession('omx-team-incarnation', { sessionId: '$41', sessionCreated: '1700000001' }), entry.expected);
+            });
+        }
+    });
+    it('queues a stable-ID kill behind the exact server-side leader predicate', async () => {
+        await withMockTmuxFixture('omx-detached-incarnation-stable-kill-', (tmuxLogPath) => `#!/bin/sh
+printf '%s\\n' "$*" >> "${tmuxLogPath}"
+case "$1" in
+  list-sessions) printf '%s\\n' 'omx-team-incarnation	$41	1700000001' ;;
+  list-panes) case "$*" in *'#{session_name}'*) printf '%s\n' '%1	0	4241	omx-team-incarnation	$41	1700000001' ;; *) printf '%s\n' '%1	0	4241' ;; esac ;;
+  show-option|show-options) printf '%s\\n' 'team:incarnation' ;;
+  if-shell) : > "${tmuxLogPath}.session-killed" ;;
+  *) exit 1 ;;
+esac
+`, async ({ logPath }) => {
+            assert.equal(requestDetachedTeamSessionDestroy('omx-team-incarnation', {
+                sessionId: '$41', sessionCreated: '1700000001', leaderPaneId: '%1', leaderPanePid: 4241, ownerId: 'team:incarnation',
+            }), true);
+            const log = await readFile(logPath, 'utf-8');
+            assert.match(log, /if-shell -F -t %1/);
+            assert.match(log, /#\{==:#\{pane_dead\},0\}/);
+            assert.match(log, /#\{==:#\{pane_id\},%1\}/);
+            assert.match(log, /#\{==:#\{pane_pid\},4241\}/);
+            assert.match(log, /#\{==:#\{@omx_team_pane_owner_id\},team:incarnation\}/);
+            assert.match(log, /#\{==:#\{session_id\},\$41\}/);
+            assert.match(log, /#\{==:#\{session_created\},1700000001\}/);
+            assert.match(log, /kill-session -t \$41/);
+            assert.equal(await readFile(`${logPath}.session-killed`, 'utf8'), '');
+            assert.doesNotMatch(log, /^kill-session -t /m);
+        });
+    });
+    it('reports server-side predicate denial without retrying or accepting a detached kill', async () => {
+        await withMockTmuxFixture('omx-detached-incarnation-server-denial-', (tmuxLogPath) => `#!/bin/sh
+printf '%s\\n' "$*" >> "${tmuxLogPath}"
+case "$1" in
+  list-sessions) printf '%s\\n' 'omx-team-denied	$41	1700000001' ;;
+  list-panes) case "$*" in *'#{session_name}'*) printf '%s\\n' '%1	0	4241	omx-team-denied	$41	1700000001' ;; *) printf '%s\\n' '%1	0	4241' ;; esac ;;
+  show-option|show-options) printf '%s\\n' 'team:denied' ;;
+  if-shell) : > "${tmuxLogPath}.denied"; exit 1 ;;
+  kill-session) : > "${tmuxLogPath}.killed" ;;
+  *) exit 1 ;;
+esac
+`, async ({ logPath }) => {
+            assert.equal(requestDetachedTeamSessionDestroy('omx-team-denied', {
+                sessionId: '$41', sessionCreated: '1700000001', leaderPaneId: '%1', leaderPanePid: 4241, ownerId: 'team:denied',
+            }), false);
+            const log = await readFile(logPath, 'utf8');
+            assert.match(log, /if-shell -F -t %1/);
+            assert.match(log, /run-shell "exit 1"/);
+            assert.equal(fs.existsSync(`${logPath}.denied`), true);
+            assert.equal(fs.existsSync(`${logPath}.killed`), false);
+            assert.equal((log.match(/if-shell/g) ?? []).length, 1);
+        });
+    });
+    it('fails closed when destroy authority has already drifted', async () => {
+        const cases = [
+            { name: 'session', panePid: 4241, owner: 'team:final', session: '$42\t1700000002' },
+            { name: 'pid', panePid: 9999, owner: 'team:final', session: '$41\t1700000001' },
+            { name: 'owner', panePid: 4241, owner: 'foreign-owner', session: '$41\t1700000001' },
+        ];
+        for (const entry of cases) {
+            await withMockTmuxFixture(`omx-detached-final-composite-${entry.name}-`, (tmuxLogPath) => `#!/bin/sh
+printf '%s\\n' "$*" >> "${tmuxLogPath}"
+case "$1" in
+  list-sessions) printf 'omx-team-final\\t${entry.session}\\n' ;;
+  list-panes) case "$*" in *'#{session_name}'*) printf '%%1\\t0\\t${entry.panePid}\\tomx-team-final\\t$41\\t1700000001\\n' ;; *) printf '%%1\\t0\\t${entry.panePid}\\n' ;; esac ;;
+  show-option|show-options) printf '%s\\n' '${entry.owner}' ;;
+  if-shell) : > "${tmuxLogPath}.session-killed" ;;
+  *) exit 1 ;;
+esac
+`, async ({ logPath }) => {
+                assert.equal(requestDetachedTeamSessionDestroy('omx-team-final', {
+                    sessionId: '$41', sessionCreated: '1700000001', leaderPaneId: '%1', leaderPanePid: 4241, ownerId: 'team:final',
+                }), false);
+                const log = await readFile(logPath, 'utf8');
+                assert.doesNotMatch(log, /if-shell/);
+                assert.doesNotMatch(log, /kill-session/);
+                assert.equal(fs.existsSync(`${logPath}.session-killed`), false);
+            });
+        }
+    });
+    it('treats malformed and unavailable detached incarnation evidence as unavailable', async () => {
+        await withMockTmuxFixture('omx-detached-incarnation-malformed-', () => `#!/bin/sh
+case "$1" in
+  list-sessions) printf '%s\\n' 'omx-team-incarnation\\t$41' ;;
+  *) exit 1 ;;
+esac
+`, async () => assert.deepEqual(queryDetachedTeamSession('omx-team-incarnation'), {
+            status: 'unavailable', detail: 'malformed_session_incarnation',
+        }));
+        await withMockTmuxFixture('omx-detached-incarnation-unavailable-', () => `#!/bin/sh
+case "$1" in
+  list-sessions) printf '%s\\n' 'permission denied' >&2; exit 1 ;;
+  *) exit 1 ;;
+esac
+`, async () => assert.deepEqual(queryDetachedTeamSession('omx-team-incarnation'), {
+            status: 'unavailable', detail: 'permission denied',
+        }));
+    });
+    it('recognizes authoritative detached-session absence', async () => {
+        await withMockTmuxFixture('omx-detached-incarnation-absence-', () => `#!/bin/sh
+case "$1" in
+  list-sessions) exit 0 ;;
+  *) exit 1 ;;
+esac
+`, async () => assert.deepEqual(queryDetachedTeamSession('omx-team-incarnation'), { status: 'absent' }));
+    });
+    it('accepts final-session destruction when tmux reports its expected no-server absence', async () => {
+        await withMockTmuxFixture('omx-destroy-final-team-session-', () => `#!/bin/sh
+case "$1" in
+  kill-session) exit 0 ;;
+  list-sessions) printf '%s\\n' 'no server running on /tmp/tmux-1000/default' >&2; exit 1 ;;
+  *) exit 1 ;;
+esac
+`, async () => {
+            assert.equal(destroyTeamSession('omx-team-final-session'), true);
+        });
+    });
+    it('does not accept a session kill when the absence query fails for another reason', async () => {
+        await withMockTmuxFixture('omx-destroy-team-session-query-failure-', () => `#!/bin/sh
+case "$1" in
+  kill-session) exit 0 ;;
+  list-sessions) printf '%s\\n' 'permission denied' >&2; exit 1 ;;
+  *) exit 1 ;;
+esac
+`, async () => {
+            assert.equal(destroyTeamSession('omx-team-query-failure'), false);
+        });
+    });
     it('waitForWorkerReady uses visible capture-pane argv without tail flags', async () => {
         await withMockTmuxFixture('omx-tmux-worker-ready-visible-capture-', (logPath) => `#!/bin/sh
 set -eu
@@ -3626,7 +3943,9 @@ exit 0
         const prevTmuxPane = process.env.TMUX_PANE;
         const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
         try {
-            await withMockTmuxFixture('omx-tmux-redraw-leader-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-redraw-leader-', (logPath) => {
+                const proofStatePath = `${logPath}.leader-redraw-proof`;
+                return `#!/bin/sh
 set -eu
 printf '%s\n' "$*" >> "${logPath}"
 case "\${1:-}" in
@@ -3647,11 +3966,22 @@ case "\${1:-}" in
     ;;
   list-panes)
     case "$*" in
+      *"-a -F #{pane_id}"*)
+        proof_count=0
+        if [ -f "${proofStatePath}" ]; then proof_count=$(cat "${proofStatePath}"); fi
+        proof_count=$((proof_count + 1))
+        printf '%s' "$proof_count" > "${proofStatePath}"
+        if [ "$proof_count" -eq 100 ]; then
+          printf 'not-a-pane-snapshot\n'
+        else
+          printf "%%1\t0\t2000000001\n%%2\t0\t2000000002\n%%3\t0\t2000000003\n"
+        fi
+        ;;
       *"pane_current_command"*)
-        printf "%%1\\tnode\\t'codex'\\n"
+        if [ -f "${logPath}.hud" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n%%3\\tnode\\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE=%%1 node /omx.js hud --watch\\n"; elif [ -f "${logPath}.worker" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"; else printf "%%1\\tnode\\t'codex'\\n"; fi
         ;;
       *)
-        printf "%%1\\n"
+        if [ -f "${logPath}.hud" ]; then printf "%%1\\n%%2\\n%%3\\n"; elif [ -f "${logPath}.worker" ]; then printf "%%1\\n%%2\\n"; else printf "%%1\\n"; fi
         ;;
     esac
     exit 0
@@ -3659,9 +3989,11 @@ case "\${1:-}" in
   split-window)
     case "$*" in
       *" -h "*)
+        : > "${logPath}.worker"
         echo "%2"
         ;;
       *)
+        : > "${logPath}.hud"
         echo "%3"
         ;;
     esac
@@ -3674,7 +4006,8 @@ case "\${1:-}" in
     exit 0
     ;;
 esac
-        `, async ({ logPath }) => {
+        `;
+            }, async ({ logPath }) => {
                 const fakeBinDir = join(logPath, '..');
                 const geminiPath = join(fakeBinDir, 'gemini');
                 await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
@@ -3684,10 +4017,17 @@ esac
                 process.env.OMX_TEAM_WORKER_CLI = 'gemini';
                 createTeamSession('Diff Gutter Redraw', 1, cwd);
                 const tmuxLog = await readFile(logPath, 'utf-8');
+                const commands = tmuxLog.trim().split('\n').filter(Boolean);
                 assert.match(tmuxLog, /select-layout -t leader:0 main-vertical/);
                 assert.match(tmuxLog, /set-window-option -t leader:0 main-pane-width 60/);
-                assert.match(tmuxLog, /split-window -v -f -l 3 -t leader:0 -d -P -F #\{pane_id\}/);
-                assert.match(tmuxLog, /send-keys -t %1 C-l/, 'leader Codex pane must repaint after team splits/resizes so tmux does not auto-wrap diff continuation rows without the line-number gutter');
+                assert.match(tmuxLog, /split-window -v -f -l 3 -t %1 -d -P -F #\{pane_id\}/);
+                const redrawIndices = commands
+                    .map((command, index) => command === 'send-keys -t %1 C-l' ? index : -1)
+                    .filter((index) => index >= 0);
+                assert.equal(redrawIndices.length, 1);
+                const redrawIndex = redrawIndices[0];
+                assert.ok(redrawIndex > 0);
+                assert.match(commands[redrawIndex - 1] ?? '', /^list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}$/, 'leader Codex pane redraw must be immediately preceded by exact global live-pane proof');
             });
         }
         finally {
@@ -3706,6 +4046,92 @@ esac
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it('blocks window-wide layout when an extra pane appears during a later owner check', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-final-window-proof-'));
+        const previousTmux = process.env.TMUX;
+        const previousTmuxPane = process.env.TMUX_PANE;
+        const previousWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
+        try {
+            await withMockTmuxFixture('omx-tmux-final-window-proof-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "\${1:-}" in
+  -V) echo 'tmux 3.4' ;;
+  display-message)
+    case "$*" in *'#{window_width}'*) echo 120 ;; *) echo 'leader:0 %1' ;; esac
+    ;;
+  list-panes)
+    case "$*" in
+      *'-a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}'*)
+        if [ -f "${logPath}.replace" ]; then
+          printf '%%1\\t0\\t2000000001\\n%%2\\t0\\t2000000002\\n%%3\\t0\\t2000000003\\n'
+        else
+          printf '%%1\\t0\\t2000000001\\n%%2\\t0\\t2000000002\\n'
+        fi
+        ;;
+      *'pane_current_command'*)
+        if [ -f "${logPath}.replace" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n%%3\\tzsh\\tzsh\\n"; elif [ -f "${logPath}.worker" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"; else printf "%%1\\tnode\\t'codex'\\n"; fi
+        ;;
+      *)
+        if [ -f "${logPath}.replace" ]; then printf '%%1\\n%%2\\n%%3\\n'; elif [ -f "${logPath}.worker" ]; then printf '%%1\\n%%2\\n'; else printf '%%1\\n'; fi
+        ;;
+    esac
+    ;;
+  split-window) : > "${logPath}.worker"; echo '%2' ;;
+  show-option)
+    case "$*" in
+      *' -t %1 @omx_team_pane_owner_id') echo 'team:final-window-proof' ;;
+      *' -t %2 @omx_team_pane_owner_id') : > "${logPath}.replace"; echo 'team:final-window-proof' ;;
+      *) exit 1 ;;
+    esac
+    ;;
+  set-option|resize-pane|select-pane|set-hook|run-shell|send-keys) ;;
+  kill-pane|select-layout|set-window-option) exit 97 ;;
+esac
+`, async ({ logPath }) => {
+                const fakeBinDir = join(logPath, '..');
+                const geminiPath = join(fakeBinDir, 'gemini');
+                await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
+                await chmod(geminiPath, 0o755);
+                process.env.TMUX = 'leader-session,stub,0';
+                process.env.TMUX_PANE = '%1';
+                process.env.OMX_TEAM_WORKER_CLI = 'gemini';
+                assert.throws(() => createTeamSession('Final Window Proof', 1, cwd, [], undefined, {
+                    teamPaneOwnerId: 'team:final-window-proof',
+                }), (error) => {
+                    assert.ok(error instanceof CreateTeamSessionPartialError);
+                    assert.ok(error.originalError instanceof Error);
+                    assert.match(error.originalError.message, /tmux window topology changed before layout mutation/);
+                    assert.equal(error.partialSession.name, 'leader:0');
+                    assert.equal(error.partialSession.teamPaneOwnerId, 'team:final-window-proof');
+                    assert.deepEqual(error.partialSession.workerPaneIds, ['%2']);
+                    assert.deepEqual(error.partialSession.workerPanePidsByIndex, [2000000002]);
+                    assert.deepEqual(error.proofUnavailable, []);
+                    assert.ok(error.cleanupErrors.some((message) => /failed to kill tmux pane %2/.test(message)));
+                    return true;
+                });
+                const commands = await readFile(logPath, 'utf-8');
+                assert.match(commands, /show-option -qv -p -t %2 @omx_team_pane_owner_id/);
+                assert.doesNotMatch(commands, /select-layout|set-window-option/);
+                assert.match(commands, /kill-pane -t %2/);
+            });
+        }
+        finally {
+            if (typeof previousTmux === 'string')
+                process.env.TMUX = previousTmux;
+            else
+                delete process.env.TMUX;
+            if (typeof previousTmuxPane === 'string')
+                process.env.TMUX_PANE = previousTmuxPane;
+            else
+                delete process.env.TMUX_PANE;
+            if (typeof previousWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = previousWorkerCli;
+            else
+                delete process.env.OMX_TEAM_WORKER_CLI;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it('tags leader, worker, and HUD panes with pane-scoped instance ownership', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-team-pane-tags-'));
         const prevTmux = process.env.TMUX;
@@ -3734,16 +4160,20 @@ case "\${1:-}" in
     ;;
   list-panes)
     case "$*" in
+      *"-a -F #{pane_id}"*)
+        printf "%%1\t0\t2000000001\n%%2\t0\t2000000002\n%%3\t0\t2000000003\n"
+        ;;
       *"pane_current_command"*)
-        printf "%%1\\tnode\\t'codex'\\n"
+        if [ -f "${logPath}.worker" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"; else printf "%%1\\tnode\\t'codex'\\n"; fi
         ;;
       *)
-        printf "%%1\\n"
+        if [ -f "${logPath}.worker" ]; then printf "%%1\\n%%2\\n"; else printf "%%1\\n"; fi
         ;;
     esac
     exit 0
     ;;
   split-window)
+    : > "${logPath}.worker"
     case "$*" in
       *" -h "*)
         echo "%2"
@@ -3784,6 +4214,20 @@ esac
                 assert.match(tmuxLog, /set-option -p -t %2 @omx_team_pane_owner_id team:pane-tags/);
                 assert.match(tmuxLog, /set-option -p -t %3 @omx_team_pane_owner_id team:pane-tags/);
                 assert.match(tmuxLog, /exec env OMX_SESSION_ID='omx-pane-scope' OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%1' .*hud --watch/);
+                const commands = tmuxLog.trim().split('\n').filter(Boolean);
+                const globalExactPanePidProof = /^list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}$/;
+                const targetScopedExactPaneSetProof = /^list-panes -t shared:0 -F #\{pane_id\}\t#\{pane_current_command\}\t#\{pane_start_command\}$/;
+                const exactPaneEffects = /^(set-option -p -t %|split-window .* -t %|resize-pane -t %|select-pane -t %|send-keys -t %)/;
+                for (const [index, command] of commands.entries()) {
+                    if (!exactPaneEffects.test(command))
+                        continue;
+                    const immediatelyPrevious = commands[index - 1] ?? '';
+                    const previousProof = commands[index - 2] ?? '';
+                    const hasAdjacentAuthority = globalExactPanePidProof.test(immediatelyPrevious)
+                        || (targetScopedExactPaneSetProof.test(immediatelyPrevious)
+                            && globalExactPanePidProof.test(previousProof));
+                    assert.equal(hasAdjacentAuthority, true, `exact-pane effect must be immediately preceded by an authoritative exact-pane proof: ${command}`);
+                }
             });
         }
         finally {
@@ -3806,6 +4250,71 @@ esac
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it('fails closed when a tagged worker keeps its PID but loses Team owner continuity before a later split', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-owner-change-'));
+        const prevTmux = process.env.TMUX;
+        const prevTmuxPane = process.env.TMUX_PANE;
+        const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
+        try {
+            await withMockTmuxFixture('omx-tmux-owner-change-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "${logPath}"
+case "\${1:-}" in
+  -V) echo "tmux 3.4" ;;
+  display-message)
+    case "$*" in *"#{window_width}"*) echo "120" ;; *) echo "leader:0 %1" ;; esac
+    ;;
+  list-panes)
+    case "$*" in
+      *"-a -F #{pane_id}"*) printf "%%1\\t0\\t2000000001\\n%%2\\t0\\t2000000002\\n" ;;
+      *"pane_current_command"*)
+        if [ -f "${logPath}.worker" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"; else printf "%%1\\tnode\\t'codex'\\n"; fi
+        ;;
+      *) if [ -f "${logPath}.worker" ]; then printf "%%1\\n%%2\\n"; else printf "%%1\\n"; fi ;;
+    esac
+    ;;
+  split-window) : > "${logPath}.worker"; echo "%2" ;;
+  set-option)
+    case "$*" in
+      *"-p -t %2 @omx_team_pane_owner_id"*)
+        printf '%s' 'team:foreign' > "$(dirname "${logPath}")/tmux.team-owner-state/%2"
+        ;;
+    esac
+    ;;
+  *) ;;
+esac
+`, async ({ logPath }) => {
+                const fakeBinDir = join(logPath, '..');
+                const geminiPath = join(fakeBinDir, 'gemini');
+                await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
+                await chmod(geminiPath, 0o755);
+                process.env.TMUX = 'leader-session,stub,0';
+                process.env.TMUX_PANE = '%1';
+                process.env.OMX_TEAM_WORKER_CLI = 'gemini';
+                assert.throws(() => createTeamSession('Owner Change', 2, cwd), (error) => error instanceof CreateTeamSessionPartialError
+                    && error.originalError instanceof Error
+                    && /tmux pane team owner changed: %2/.test(error.originalError.message));
+                const effects = await readFile(logPath, 'utf-8');
+                assert.match(effects, /split-window -h -t %1/);
+                assert.doesNotMatch(effects, /split-window -v|select-layout|set-window-option|resize-pane|select-pane|send-keys|set-hook|run-shell/);
+            });
+        }
+        finally {
+            if (typeof prevTmux === 'string')
+                process.env.TMUX = prevTmux;
+            else
+                delete process.env.TMUX;
+            if (typeof prevTmuxPane === 'string')
+                process.env.TMUX_PANE = prevTmuxPane;
+            else
+                delete process.env.TMUX_PANE;
+            if (typeof prevWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = prevWorkerCli;
+            else
+                delete process.env.OMX_TEAM_WORKER_CLI;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it('does not reuse the Team pane owner token as the HUD logical session id', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-team-hud-session-boundary-'));
         const prevTmux = process.env.TMUX;
@@ -3834,19 +4343,23 @@ case "\${1:-}" in
     ;;
   list-panes)
     case "$*" in
+      *"-a -F #{pane_id}"*)
+        printf "%%1\t0\t2000000001\n%%2\t0\t2000002222\n%%3\t0\t2000000003\n"
+        ;;
       *"-t %2 -F #{pane_pid}"*)
         echo "2000002222"
         ;;
       *"pane_current_command"*)
-        printf "%%1\\tnode\\t'codex'\\n"
+        if [ -f "${logPath}.worker" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"; else printf "%%1\\tnode\\t'codex'\\n"; fi
         ;;
       *)
-        printf "%%1\\n"
+        if [ -f "${logPath}.worker" ]; then printf "%%1\\n%%2\\n"; else printf "%%1\\n"; fi
         ;;
     esac
     exit 0
     ;;
   split-window)
+    : > "${logPath}.worker"
     case "$*" in
       *" -h "*)
         echo "%2"
@@ -3906,7 +4419,7 @@ esac
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('removes only HUD panes owned by the current leader during team startup', async () => {
+    it('rejects an unowned pane in startup topology before any window-wide mutation', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-team-owned-hud-startup-'));
         const prevTmux = process.env.TMUX;
         const prevTmuxPane = process.env.TMUX_PANE;
@@ -3934,6 +4447,10 @@ case "\${1:-}" in
     ;;
   list-panes)
     case "$*" in
+      *"-a -F #{pane_id}"*)
+        printf "%%1\t0\t2000000001\n%%3\t0\t2000000003\n%%4\t0\t2000000004\n%%7\t0\t2000000007\n%%8\t0\t2000000008\n"
+        if [ ! -f "${logPath}.killed-%2" ]; then printf "%%2\t0\t2000000002\n"; fi
+        ;;
       *"pane_current_command"*)
         printf "%%1\\tnode\\t'codex'\\n"
         printf "%%7\\tnode\\t'codex neighbor'\\n"
@@ -3957,7 +4474,11 @@ case "\${1:-}" in
     esac
     exit 0
     ;;
-  set-option|resize-pane|select-layout|set-window-option|select-pane|set-hook|run-shell|send-keys|kill-pane)
+  kill-pane)
+    : > "${logPath}.killed-$3"
+    exit 0
+    ;;
+  set-option|resize-pane|select-layout|set-window-option|select-pane|set-hook|run-shell|send-keys)
     exit 0
     ;;
   *)
@@ -3973,13 +4494,9 @@ esac
                 process.env.TMUX_PANE = '%1';
                 process.env.OMX_SESSION_ID = 'leader-session-a';
                 process.env.OMX_TEAM_WORKER_CLI = 'gemini';
-                const session = createTeamSession('Owned HUD Startup', 1, cwd);
-                assert.equal(session.leaderPaneId, '%1');
-                assert.equal(session.hudPaneId, '%4');
+                assert.throws(() => createTeamSession('Owned HUD Startup', 1, cwd), /tmux window topology changed before layout mutation/);
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, /kill-pane -t %2/);
-                assert.doesNotMatch(tmuxLog, /kill-pane -t %8/);
-                assert.match(tmuxLog, /split-window -v -f -l 3 -t shared:0 -d -P -F #\{pane_id\}/);
+                assert.doesNotMatch(tmuxLog, /set-option|kill-pane|split-window|resize-pane|select-layout|set-window-option|select-pane|send-keys/);
             });
         }
         finally {
@@ -4002,71 +4519,64 @@ esac
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('uses tmux 3.2a-compatible client-resized hook registration for team HUD resize', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-resize-hook-fallback-'));
-        const prevTmux = process.env.TMUX;
-        const prevTmuxPane = process.env.TMUX_PANE;
-        const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
-        const prevWarn = console.warn;
-        const warnings = [];
+    it('preserves rollback debt when a successfully tagged pane owner changes before cleanup', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-partial-rollback-proof-'));
+        const previousTmux = process.env.TMUX;
+        const previousTmuxPane = process.env.TMUX_PANE;
+        const previousWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
         try {
-            await withMockTmuxFixture('omx-tmux-resize-hook-fallback-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-partial-rollback-proof-', (logPath) => `#!/bin/sh
 set -eu
-printf '%s\n' "$*" >> "${logPath}"
-case "\${1:-}" in
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
   -V)
-    echo "tmux 3.2a"
+    echo "tmux 3.4"
     exit 0
     ;;
   display-message)
     case "$*" in
-      *"#{window_width}"*)
-        echo "120"
-        ;;
-      *)
-        echo "leader:0 %1"
-        ;;
+      *"#{window_width}"*) echo "120" ;;
+      *) echo "leader:0 %1" ;;
     esac
     exit 0
     ;;
   list-panes)
     case "$*" in
+      *"-a -F #{pane_id}"*)
+        proof_count=0
+        if [ -f "${logPath}.proof-count" ]; then proof_count=$(cat "${logPath}.proof-count"); fi
+        proof_count=$((proof_count + 1))
+        printf '%s' "$proof_count" > "${logPath}.proof-count"
+        if [ "$proof_count" -gt 11 ]; then printf 'not-a-pane-snapshot\n'; else printf "%%1\t0\t2000000001\n%%2\t0\t2000000002\n"; fi
+
+        ;;
       *"pane_current_command"*)
-        printf "%%1\tnode\t'codex'\n"
+        if [ -f "${logPath}.worker" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"; else printf "%%1\\tnode\\t'codex'\\n"; fi
         ;;
       *)
-        printf "%%1\n"
+        if [ -f "${logPath}.worker" ]; then printf "%%1\\n%%2\\n"; else printf "%%1\\n"; fi
         ;;
     esac
     exit 0
     ;;
-  split-window)
-    case "$*" in
-      *" -h "*)
-        echo "%2"
-        ;;
-      *)
-        echo "%3"
-        ;;
-    esac
+  show-option)
+    if [ -f "${logPath}.worker" ]; then echo "team:foreign"; else echo "team:partial-rollback-proof"; fi
     exit 0
     ;;
-  set-hook)
-    case "$*" in
-      *"window-resized["*)
-        echo "invalid option: window-resized[]" >&2
-        exit 1
-        ;;
-      *" -w "*)
-        echo "invalid option: -w" >&2
-        exit 1
-        ;;
-      *)
-        exit 0
-        ;;
-    esac
+  split-window)
+    : > "${logPath}.worker"
+    is_horizontal=0
+    for arg in "$@"; do
+      if [ "$arg" = "-h" ]; then is_horizontal=1; fi
+    done
+    if [ "$is_horizontal" = "1" ]; then
+      echo "%2"
+    else
+      echo "second worker rejected" >&2
+      exit 1
+    fi
     ;;
-  set-option|resize-pane|select-layout|set-window-option|select-pane|run-shell)
+  set-option|select-layout|set-window-option|select-pane|set-hook|run-shell|kill-pane)
     exit 0
     ;;
   *)
@@ -4081,82 +4591,164 @@ esac
                 process.env.TMUX = 'leader-session,stub,0';
                 process.env.TMUX_PANE = '%1';
                 process.env.OMX_TEAM_WORKER_CLI = 'gemini';
-                console.warn = (...args) => { warnings.push(args.map(String).join(' ')); };
-                const session = createTeamSession('Resize Hook Fallback', 1, cwd);
-                assert.equal(session.hudPaneId, '%3');
-                assert.ok(session.resizeHookName);
-                assert.equal(session.resizeHookTarget, 'leader:0');
-                assert.equal(warnings.join('\n'), '');
+                assert.throws(() => createTeamSession('Partial Rollback Proof', 2, cwd), (error) => {
+                    assert.ok(error instanceof Error);
+                    assert.equal(error.name, 'CreateTeamSessionPartialError');
+                    const partial = error;
+                    assert.equal(partial.partialSession.name, 'leader:0');
+                    assert.equal(partial.partialSession.workerCount, 2);
+                    assert.deepEqual(partial.partialSession.workerPaneIds, ['%2']);
+                    assert.ok(partial.proofUnavailable.length > 0 || partial.cleanupErrors.length > 0);
+                    return true;
+                });
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, /set-hook -t leader:0 client-resized\[\d+\]/);
-                assert.doesNotMatch(tmuxLog, /window-resized\[/);
-                assert.doesNotMatch(tmuxLog, /set-hook -w /);
-                assert.match(tmuxLog, /set-hook -t leader:0 client-attached\[\d+\]/);
-                assert.match(tmuxLog, new RegExp(`run-shell -b sleep ${HUD_RESIZE_RECONCILE_DELAY_SECONDS}; .*resize-pane -t %3 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
-                assert.match(tmuxLog, new RegExp(`run-shell .*resize-pane -t %3 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
+                assert.match(tmuxLog, /list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}/);
                 assert.doesNotMatch(tmuxLog, /kill-pane -t %2/);
-                assert.doesNotMatch(tmuxLog, /kill-pane -t %3/);
             });
         }
         finally {
-            console.warn = prevWarn;
-            if (typeof prevTmux === 'string')
-                process.env.TMUX = prevTmux;
+            if (typeof previousTmux === 'string')
+                process.env.TMUX = previousTmux;
             else
                 delete process.env.TMUX;
-            if (typeof prevTmuxPane === 'string')
-                process.env.TMUX_PANE = prevTmuxPane;
+            if (typeof previousTmuxPane === 'string')
+                process.env.TMUX_PANE = previousTmuxPane;
             else
                 delete process.env.TMUX_PANE;
-            if (typeof prevWorkerCli === 'string')
-                process.env.OMX_TEAM_WORKER_CLI = prevWorkerCli;
+            if (typeof previousWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = previousWorkerCli;
             else
                 delete process.env.OMX_TEAM_WORKER_CLI;
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('degrades HUD run-shell resize failures to warnings during team startup', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-runshell-fallback-'));
-        const prevTmux = process.env.TMUX;
-        const prevTmuxPane = process.env.TMUX_PANE;
-        const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
-        const prevWarn = console.warn;
-        const warnings = [];
-        try {
-            await withMockTmuxFixture('omx-tmux-runshell-fallback-', (logPath) => `#!/bin/sh
+    for (const firstProofFailure of ['malformed', 'unavailable']) {
+        it(`preserves unproven split pane debt when its first proof is ${firstProofFailure}`, async () => {
+            const cwd = await mkdtemp(join(tmpdir(), `omx-team-first-split-${firstProofFailure}-`));
+            const previousTmux = process.env.TMUX;
+            const previousTmuxPane = process.env.TMUX_PANE;
+            const previousWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
+            try {
+                await withMockTmuxFixture(`omx-tmux-first-split-${firstProofFailure}-`, (logPath) => `#!/bin/sh
 set -eu
-printf '%s\n' "$*" >> "${logPath}"
-case "\${1:-}" in
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
   -V)
     echo "tmux 3.4"
-    exit 0
     ;;
   display-message)
     case "$*" in
       *"#{window_width}"*) echo "120" ;;
       *) echo "leader:0 %1" ;;
     esac
-    exit 0
     ;;
   list-panes)
     case "$*" in
+      *"-a -F #{pane_id}"*)
+        if [ -f "${logPath}.worker-created" ]; then
+          ${firstProofFailure === 'malformed'
+                    ? "printf 'not-a-pane-snapshot\\n'"
+                    : "echo 'topology unavailable' >&2; exit 1"}
+        else
+          printf "%%1\\t0\\t2000000001\\n"
+        fi
+        ;;
       *"pane_current_command"*) printf "%%1\\tnode\\t'codex'\\n" ;;
       *) printf "%%1\\n" ;;
     esac
-    exit 0
+    ;;
+  show-option)
+    echo "team:first-split-proof"
     ;;
   split-window)
+    : > "${logPath}.worker-created"
+    echo "%2"
+    ;;
+  set-option|select-layout|set-window-option|select-pane|set-hook|run-shell|kill-pane|send-keys|resize-pane)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, async ({ logPath }) => {
+                    const fakeBinDir = join(logPath, '..');
+                    const geminiPath = join(fakeBinDir, 'gemini');
+                    await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
+                    await chmod(geminiPath, 0o755);
+                    process.env.TMUX = 'leader-session,stub,0';
+                    process.env.TMUX_PANE = '%1';
+                    process.env.OMX_TEAM_WORKER_CLI = 'gemini';
+                    assert.throws(() => createTeamSession('First Split Proof', 1, cwd, [], undefined, {
+                        teamPaneOwnerId: 'team:first-split-proof',
+                    }), (error) => {
+                        assert.ok(error instanceof CreateTeamSessionPartialError);
+                        assert.deepEqual(error.partialSession.workerPaneIds, ['%2']);
+                        assert.deepEqual(error.partialSession.workerPaneIdsByIndex, ['%2']);
+                        assert.deepEqual(error.partialSession.workerPanePidsByIndex, [null]);
+                        assert.ok(error.proofUnavailable.length > 0);
+                        return true;
+                    });
+                    const tmuxLog = await readFile(logPath, 'utf-8');
+                    assert.match(tmuxLog, /split-window .* -t %1 .* -P -F #\{pane_id\}/);
+                    assert.doesNotMatch(tmuxLog, /(?:kill-pane|send-keys|resize-pane|select-pane|set-option) .* -t %2/, tmuxLog);
+                });
+            }
+            finally {
+                if (typeof previousTmux === 'string')
+                    process.env.TMUX = previousTmux;
+                else
+                    delete process.env.TMUX;
+                if (typeof previousTmuxPane === 'string')
+                    process.env.TMUX_PANE = previousTmuxPane;
+                else
+                    delete process.env.TMUX_PANE;
+                if (typeof previousWorkerCli === 'string')
+                    process.env.OMX_TEAM_WORKER_CLI = previousWorkerCli;
+                else
+                    delete process.env.OMX_TEAM_WORKER_CLI;
+                await rm(cwd, { recursive: true, force: true });
+            }
+        });
+    }
+    it('does not report partial session metadata when proof loss occurs before a worker pane exists', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-no-resource-proof-'));
+        const previousTmux = process.env.TMUX;
+        const previousTmuxPane = process.env.TMUX_PANE;
+        const previousWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
+        const previousEntryPath = process.env[OMX_ENTRY_PATH_ENV];
+        const previousArgv = process.argv;
+        try {
+            await withMockTmuxFixture('omx-tmux-no-resource-proof-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  -V)
+    echo "tmux 3.4"
+    exit 0
+    ;;
+  display-message)
     case "$*" in
-      *" -h "*) echo "%2" ;;
-      *) echo "%3" ;;
+      *"#{window_width}"*) echo "120" ;;
+      *) echo "leader:0 %1" ;;
     esac
     exit 0
     ;;
-  run-shell)
-    echo "Unsupported tmux compatibility command: run-shell" >&2
-    exit 1
+  list-panes)
+    case "$*" in
+      *"-a -F #{pane_id}"*)
+        proof_count=0
+        if [ -f "${logPath}.proof-count" ]; then proof_count=$(cat "${logPath}.proof-count"); fi
+        proof_count=$((proof_count + 1))
+        printf '%s' "$proof_count" > "${logPath}.proof-count"
+        if [ "$proof_count" -le 4 ]; then printf "%%1\t0\t2000000001\n"; else printf 'not-a-pane-snapshot\n'; fi
+        ;;
+      *"pane_current_command"*) printf '%s\n' "%1\tnode\tcodex" ;;
+      *) printf "%%1\n" ;;
+    esac
+    exit 0
     ;;
-  set-option|resize-pane|select-layout|set-window-option|select-pane|set-hook|send-keys)
+  set-option)
     exit 0
     ;;
   *)
@@ -4164,299 +4756,495 @@ case "\${1:-}" in
     ;;
 esac
 `, async ({ logPath }) => {
-                const fakeBinDir = join(logPath, '..');
-                const geminiPath = join(fakeBinDir, 'gemini');
-                await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
-                await chmod(geminiPath, 0o755);
+                const codexStubPath = join(dirname(logPath), 'codex');
+                await writeFile(codexStubPath, '#!/bin/sh\nexit 0\n');
+                await chmod(codexStubPath, 0o755);
                 process.env.TMUX = 'leader-session,stub,0';
                 process.env.TMUX_PANE = '%1';
-                process.env.OMX_TEAM_WORKER_CLI = 'gemini';
-                console.warn = (...args) => { warnings.push(args.map(String).join(' ')); };
-                const session = createTeamSession('Run Shell Fallback', 1, cwd);
-                assert.equal(session.hudPaneId, '%3');
-                assert.match(warnings.join('\n'), /HUD resize/);
-                assert.match(warnings.join('\n'), /Unsupported tmux compatibility command: run-shell/);
+                process.env.OMX_TEAM_WORKER_CLI = 'codex';
+                process.env[OMX_ENTRY_PATH_ENV] = join(cwd, 'omx.js');
+                process.argv = [previousArgv[0] || 'node', join(cwd, 'omx.js')];
+                let caught;
+                try {
+                    createTeamSession('No Resource Proof Loss', 1, cwd);
+                }
+                catch (error) {
+                    caught = error;
+                }
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, /run-shell -b sleep/);
-                assert.doesNotMatch(tmuxLog, /kill-pane -t %2/);
-                assert.doesNotMatch(tmuxLog, /kill-pane -t %3/);
+                assert.equal(caught.message, 'exact_pane_proof_unavailable:%1:malformed_snapshot', tmuxLog);
+                assert.ok(!(caught instanceof CreateTeamSessionPartialError));
+                assert.match(tmuxLog, /list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}/);
+                assert.doesNotMatch(tmuxLog, /split-window|resize-pane|select-pane|send-keys/);
             });
         }
         finally {
-            console.warn = prevWarn;
-            if (typeof prevTmux === 'string')
-                process.env.TMUX = prevTmux;
+            if (typeof previousTmux === 'string')
+                process.env.TMUX = previousTmux;
             else
                 delete process.env.TMUX;
-            if (typeof prevTmuxPane === 'string')
-                process.env.TMUX_PANE = prevTmuxPane;
+            if (typeof previousTmuxPane === 'string')
+                process.env.TMUX_PANE = previousTmuxPane;
             else
                 delete process.env.TMUX_PANE;
-            if (typeof prevWorkerCli === 'string')
-                process.env.OMX_TEAM_WORKER_CLI = prevWorkerCli;
+            if (typeof previousWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = previousWorkerCli;
             else
                 delete process.env.OMX_TEAM_WORKER_CLI;
+            if (typeof previousEntryPath === 'string')
+                process.env[OMX_ENTRY_PATH_ENV] = previousEntryPath;
+            else
+                delete process.env[OMX_ENTRY_PATH_ENV];
+            process.argv = previousArgv;
             await rm(cwd, { recursive: true, force: true });
         }
     });
-});
-describe('native Windows HUD reconciliation', () => {
-    it('allows team startup on native Windows when current tmux client is reachable without TMUX env vars', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-win32-no-env-'));
-        const prevTmux = process.env.TMUX;
-        const prevTmuxPane = process.env.TMUX_PANE;
-        const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
-        const prevMsystem = process.env.MSYSTEM;
-        const prevOstype = process.env.OSTYPE;
-        const prevWsl = process.env.WSL_DISTRO_NAME;
-        const prevWslInterop = process.env.WSL_INTEROP;
-        const origPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+    it('rejects duplicate pane IDs in successful create topology before mutation', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-duplicate-topology-'));
+        const previousTmux = process.env.TMUX;
+        const previousTmuxPane = process.env.TMUX_PANE;
+        const previousWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
         try {
-            await withMockTmuxFixture('omx-tmux-win32-no-env-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-duplicate-topology-', (logPath) => `#!/bin/sh
 set -eu
 printf '%s\\n' "$*" >> "${logPath}"
-case "\${1:-}" in
-  -V)
-    echo "tmux 3.4"
-    exit 0
-    ;;
-  display-message)
-    case "$*" in
-      *"#{window_width}"*)
-        echo "120"
-        ;;
-      *)
-        echo "leader:0 %1"
-        ;;
-    esac
-    exit 0
-    ;;
+case "$1" in
+  -V) echo "tmux 3.4" ;;
+  display-message) echo "leader:0 %1" ;;
   list-panes)
     case "$*" in
-      *"pane_current_command"*)
-        printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n%%3\\tnode\\t'node omx hud --watch'\\n"
-        ;;
-      *)
-        printf "%%1\\n%%2\\n%%3\\n"
-        ;;
-    esac
-    exit 0
-    ;;
-  split-window)
-    case "$*" in
-      *" -h "*)
-        echo "%2"
-        ;;
-      *)
-        echo "%3"
-        ;;
+      *"pane_current_command"*) printf '%%1\\tnode\\tcodex\\n%%1\\tnode\\tcodex\\n' ;;
+      *) printf '%%1\\n' ;;
     esac
-    exit 0
-    ;;
-  resize-pane|select-layout|set-window-option|select-pane|kill-pane|set-hook|run-shell)
-    exit 0
-    ;;
-  *)
-    exit 0
     ;;
+  *) exit 0 ;;
 esac
 `, async ({ logPath }) => {
-                const fakeBinDir = join(logPath, '..');
-                const geminiPath = join(fakeBinDir, 'gemini');
+                const geminiPath = join(dirname(logPath), 'gemini');
                 await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
                 await chmod(geminiPath, 0o755);
-                delete process.env.TMUX;
-                delete process.env.TMUX_PANE;
+                process.env.TMUX = 'leader-session,stub,0';
+                process.env.TMUX_PANE = '%1';
                 process.env.OMX_TEAM_WORKER_CLI = 'gemini';
-                delete process.env.MSYSTEM;
-                delete process.env.OSTYPE;
-                delete process.env.WSL_DISTRO_NAME;
-                delete process.env.WSL_INTEROP;
-                Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
-                const session = createTeamSession('Windows Team', 1, cwd);
-                assert.equal(session.name, 'leader:0');
-                assert.equal(session.leaderPaneId, '%1');
-                assert.equal(session.hudPaneId, '%3');
+                assert.throws(() => createTeamSession('Duplicate topology', 1, cwd), /failed to read tmux pane topology: malformed pane topology/);
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, /display-message -p #\{session_name\}:#\{window_index\} #\{pane_id\}/);
-                assert.match(tmuxLog, /powershell\.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand/);
-                assert.doesNotMatch(tmuxLog, /\/bin\/sh -lc/);
-                assert.match(tmuxLog, new RegExp(`resize-pane -t %3 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
+                assert.doesNotMatch(tmuxLog, /set-option|split-window|resize-pane|select-pane|send-keys/);
             });
         }
         finally {
-            if (origPlatform)
-                Object.defineProperty(process, 'platform', origPlatform);
-            if (typeof prevTmux === 'string')
-                process.env.TMUX = prevTmux;
+            if (typeof previousTmux === 'string')
+                process.env.TMUX = previousTmux;
             else
                 delete process.env.TMUX;
-            if (typeof prevTmuxPane === 'string')
-                process.env.TMUX_PANE = prevTmuxPane;
+            if (typeof previousTmuxPane === 'string')
+                process.env.TMUX_PANE = previousTmuxPane;
             else
                 delete process.env.TMUX_PANE;
-            if (typeof prevWorkerCli === 'string')
-                process.env.OMX_TEAM_WORKER_CLI = prevWorkerCli;
+            if (typeof previousWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = previousWorkerCli;
             else
                 delete process.env.OMX_TEAM_WORKER_CLI;
-            if (typeof prevMsystem === 'string')
-                process.env.MSYSTEM = prevMsystem;
-            else
-                delete process.env.MSYSTEM;
-            if (typeof prevOstype === 'string')
-                process.env.OSTYPE = prevOstype;
-            else
-                delete process.env.OSTYPE;
-            if (typeof prevWsl === 'string')
-                process.env.WSL_DISTRO_NAME = prevWsl;
-            else
-                delete process.env.WSL_DISTRO_NAME;
-            if (typeof prevWslInterop === 'string')
-                process.env.WSL_INTEROP = prevWslInterop;
-            else
-                delete process.env.WSL_INTEROP;
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('avoids nested tmux run-shell hooks during team HUD startup on native Windows', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-win32-hud-'));
-        const prevTmux = process.env.TMUX;
-        const prevTmuxPane = process.env.TMUX_PANE;
-        const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
-        const prevMsystem = process.env.MSYSTEM;
-        const prevOstype = process.env.OSTYPE;
-        const prevWsl = process.env.WSL_DISTRO_NAME;
-        const prevWslInterop = process.env.WSL_INTEROP;
-        const origPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+    it('guards duplicate standalone HUD removal with a fresh global pane proof', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-duplicate-hud-global-proof-'));
         try {
-            await withMockTmuxFixture('omx-tmux-win32-hud-reconcile-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-duplicate-hud-global-proof-', (logPath) => {
+                const proofStatePath = `${logPath}.proof-state`;
+                return `#!/bin/sh
 set -eu
 printf '%s\\n' "$*" >> "${logPath}"
-case "\${1:-}" in
-  -V)
-    echo "tmux 3.4"
-    exit 0
-    ;;
-  display-message)
+case "$1" in
+  list-panes)
     case "$*" in
-      *"#{window_width}"*)
-        echo "120"
+      *"-a -F #{pane_id}"*)
+        proof_count=0
+        if [ -f "${proofStatePath}" ]; then proof_count=$(cat "${proofStatePath}"); fi
+        proof_count=$((proof_count + 1))
+        printf '%s' "$proof_count" > "${proofStatePath}"
+        if [ "$proof_count" -eq 15 ]; then
+          printf 'not-a-pane-snapshot\n'
+        else
+          printf "%%11\t0\t2000000011\n%%44\t0\t2000000044\n"
+          if [ ! -f "${logPath}.killed-%45" ]; then printf "%%45\t0\t2000000045\n"; fi
+        fi
         ;;
       *)
-        echo "leader:0 %1"
+        printf "%%11\\tzsh\\tzsh\\n"
+        printf "%%44\\tnode\\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%%11' /node /omx.js hud --watch\\n"
+        printf "%%45\\tnode\\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%%11' /node /omx.js hud --watch\\n"
         ;;
     esac
     exit 0
     ;;
-  list-panes)
-    case "$*" in
-      *"pane_current_command"*)
-        printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n%%3\\tnode\\t'node omx hud --watch'\\n"
-        ;;
-      *)
-        printf "%%1\\n%%2\\n%%3\\n"
-        ;;
-    esac
+  kill-pane)
+    : > "${logPath}.killed-$3"
     exit 0
     ;;
-  split-window)
-    case "$*" in
-      *" -h "*)
-        echo "%2"
-        ;;
-      *)
-        echo "%3"
-        ;;
-    esac
+  run-shell|select-pane|resize-pane)
     exit 0
     ;;
-  resize-pane|select-layout|set-window-option|select-pane|kill-pane)
+  *)
     exit 0
     ;;
-  set-hook|run-shell)
+esac
+`;
+            }, async ({ logPath }) => {
+                assert.equal(restoreStandaloneHudPane('%11', cwd), '%44');
+                assert.throws(() => restoreStandaloneHudPane('%11', cwd), /exact_pane_proof_unavailable:%45:malformed_snapshot/);
+                const commands = (await readFile(logPath, 'utf-8')).trim().split('\n').filter(Boolean);
+                const duplicateHudKill = commands.indexOf('kill-pane -t %45');
+                assert.ok(duplicateHudKill > 0);
+                assert.match(commands[duplicateHudKill - 1] ?? '', /^list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}$/);
+                assert.equal(commands.filter((command) => command === 'kill-pane -t %45').length, 1);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('rejects a replaced leader PID or owner before standalone HUD topology discovery', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-hud-entry-authorization-'));
+        try {
+            await withMockTmuxFixture('omx-tmux-standalone-hud-entry-authorization-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      proof_count=0
+      [ -f "${logPath}.proof-count" ] && proof_count=$(cat "${logPath}.proof-count")
+      proof_count=$((proof_count + 1))
+      printf '%s' "$proof_count" > "${logPath}.proof-count"
+      if [ "$proof_count" -eq 1 ]; then printf '%%11\\t0\\t2000000011\\n'; else printf '%%11\\t0\\t2000000099\\n'; fi
+    else
+      printf '%%11\\tzsh\\tzsh\\n%%44\\tnode\\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE=%%11 node /omx.js hud --watch\\n'
+    fi
+    ;;
+  split-window) printf '%%45\\n' ;;
+  *) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                let ownerAuthorizationChecks = 0;
+                assert.throws(() => restoreStandaloneHudPane('%11', cwd, {
+                    expectedLeaderPanePid: 2000000011,
+                    assertLeaderPaneAuthorization: () => {
+                        ownerAuthorizationChecks += 1;
+                        throw new Error('leader owner changed');
+                    },
+                }), /leader owner changed/);
+                assert.equal(ownerAuthorizationChecks, 1);
+                const commands = await readFile(logPath, 'utf-8');
+                assert.doesNotMatch(commands, /list-panes -t %11|kill-pane|split-window|resize-pane|select-pane/);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('fails closed before standalone HUD effects when leader topology query fails', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-hud-topology-query-failure-'));
+        try {
+            await withMockTmuxFixture('omx-tmux-standalone-hud-topology-query-failure-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      printf '%%11\\t0\\t2000000011\\n'
+      exit 0
+    fi
+    printf 'leader topology unavailable\\n' >&2
+    exit 1
+    ;;
+  kill-pane|split-window|resize-pane|select-pane)
+    exit 99
+    ;;
+  *) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                assert.throws(() => restoreStandaloneHudPane('%11', cwd), /failed to read tmux pane topology: leader topology unavailable/);
+                const commands = await readFile(logPath, 'utf-8');
+                assert.doesNotMatch(commands, /kill-pane|split-window|resize-pane|select-pane/);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('fails closed before standalone HUD effects when leader topology is malformed', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-hud-topology-malformed-'));
+        try {
+            await withMockTmuxFixture('omx-tmux-standalone-hud-topology-malformed-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      printf '%%11\\t0\\t2000000011\\n'
+    else
+      printf '%%11\\tzsh\\n'
+    fi
     exit 0
     ;;
-  *)
+  kill-pane|split-window|resize-pane|select-pane)
+    exit 99
+    ;;
+  *) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                assert.throws(() => restoreStandaloneHudPane('%11', cwd), /failed to read tmux pane topology: malformed pane topology/);
+                const commands = await readFile(logPath, 'utf-8');
+                assert.doesNotMatch(commands, /kill-pane|split-window|resize-pane|select-pane/);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('fails closed before a standalone HUD split when the adjacent leader proof is unavailable', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-hud-proof-loss-'));
+        try {
+            await withMockTmuxFixture('omx-tmux-standalone-hud-proof-loss-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      count=0
+      if [ -f "${logPath}.proof-count" ]; then count=$(cat "${logPath}.proof-count"); fi
+      count=$((count + 1))
+      printf '%s' "$count" > "${logPath}.proof-count"
+      if [ "$count" -eq 1 ]; then printf '%%11\\t0\\t2000000011\\n'; else printf 'not-a-pane-snapshot\\n'; fi
+    fi
     exit 0
     ;;
+  split-window) echo '%44' ;;
+  *) exit 0 ;;
 esac
 `, async ({ logPath }) => {
-                const fakeBinDir = join(logPath, '..');
-                const geminiPath = join(fakeBinDir, 'gemini');
+                assert.throws(() => restoreStandaloneHudPane('%11', cwd), /exact_pane_proof_unavailable:%11:malformed_snapshot/);
+                const commands = (await readFile(logPath, 'utf-8')).trim().split('\n').filter(Boolean);
+                assert.doesNotMatch(commands.join('\n'), /split-window|resize-pane|select-pane/);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('does not adopt a leader PID replacement before standalone HUD topology discovery', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-hud-leader-pid-reuse-'));
+        try {
+            await withMockTmuxFixture('omx-tmux-standalone-hud-leader-pid-reuse-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      case "$*" in
+        *"#{pane_pid}"*)
+          count=0
+          [ -f "${logPath}.proof-count" ] && count=$(cat "${logPath}.proof-count")
+          count=$((count + 1))
+          printf '%s' "$count" > "${logPath}.proof-count"
+          if [ "$count" -eq 1 ]; then printf '%%11\\t0\\t2000000011\\n'; else printf '%%11\\t0\\t2000000099\\n'; fi
+          ;;
+        *) printf '%%11\\tzsh\\tzsh\\n' ;;
+      esac
+    fi
+    exit 0
+    ;;
+  split-window) printf '%%44\\n' ;;
+  *) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                assert.throws(() => restoreStandaloneHudPane('%11', cwd, { expectedLeaderPanePid: 2000000011 }), /tmux pane identity changed: %11/);
+                const commands = await readFile(logPath, 'utf-8');
+                assert.doesNotMatch(commands, /list-panes -t %11|display-message|kill-pane|split-window|resize-pane|select-pane/);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('does not resize a PID-reused existing standalone HUD on POSIX', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-existing-hud-posix-pid-reuse-'));
+        try {
+            await withMockTmuxFixture('omx-tmux-standalone-existing-hud-posix-pid-reuse-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      count=0
+      if [ -f "${logPath}.proof-count" ]; then count=$(cat "${logPath}.proof-count"); fi
+      count=$((count + 1))
+      printf '%s' "$count" > "${logPath}.proof-count"
+      if [ "$count" -ge 4 ]; then
+        printf '%%11\\t0\\t2000000011\\n%%44\\t0\\t2000000099\\n'
+      else
+        printf '%%11\\t0\\t2000000011\\n%%44\\t0\\t2000000044\\n'
+      fi
+    else
+      printf '%%11\\tzsh\\tzsh\\n%%44\\tnode\\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE=%%11 node /omx.js hud --watch\\n'
+    fi
+    ;;
+  run-shell) /bin/sh -c "\${3:-$2}" ;;
+  resize-pane|select-pane) exit 0 ;;
+  *) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                assert.equal(restoreStandaloneHudPane('%11', cwd), '%44');
+                const commands = await readFile(logPath, 'utf-8');
+                assert.doesNotMatch(commands, /^resize-pane/m);
+                assert.match(commands, /\$3 == "2000000044"/);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('does not resize a PID-reused newly created standalone HUD on POSIX', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-new-hud-posix-pid-reuse-'));
+        try {
+            await withMockTmuxFixture('omx-tmux-standalone-new-hud-posix-pid-reuse-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      count=0
+      if [ -f "${logPath}.proof-count" ]; then count=$(cat "${logPath}.proof-count"); fi
+      count=$((count + 1))
+      printf '%s' "$count" > "${logPath}.proof-count"
+      if [ "$count" -ge 6 ]; then
+        printf '%%11\\t0\\t2000000011\\n%%44\\t0\\t2000000099\\n'
+      else
+        printf '%%11\\t0\\t2000000011\\n%%44\\t0\\t2000000044\\n'
+      fi
+    else
+      printf '%%11\\tzsh\\tzsh\\n'
+    fi
+    ;;
+  split-window) printf '%%44\\n' ;;
+  run-shell) /bin/sh -c "\${3:-$2}" ;;
+  resize-pane|select-pane) exit 0 ;;
+  *) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                assert.equal(restoreStandaloneHudPane('%11', cwd), '%44');
+                const commands = await readFile(logPath, 'utf-8');
+                assert.doesNotMatch(commands, /^resize-pane/m);
+                assert.match(commands, /\$3 == "2000000044"/);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('rejects standalone HUD PID reuse before native resize', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-hud-pid-reuse-'));
+        const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+        try {
+            await withMockTmuxFixture('omx-tmux-standalone-hud-pid-reuse-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      count=0
+      if [ -f "${logPath}.proof-count" ]; then count=$(cat "${logPath}.proof-count"); fi
+      count=$((count + 1))
+      printf '%s' "$count" > "${logPath}.proof-count"
+      if [ "$count" -ge 4 ]; then
+        printf '%%11\\t0\\t2000000011\\n%%44\\t0\\t2000000099\\n'
+      else
+        printf '%%11\\t0\\t2000000011\\n%%44\\t0\\t2000000044\\n'
+      fi
+    else
+      printf '%%11\\tzsh\\tzsh\\n%%44\\tnode\\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE=%%11 node /omx.js hud --watch\\n'
+    fi
+    exit 0
+    ;;
+  resize-pane|select-pane) exit 0 ;;
+  *) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+                assert.throws(() => restoreStandaloneHudPane('%11', cwd), /tmux pane identity changed: %44/);
+                const commands = await readFile(logPath, 'utf-8');
+                assert.doesNotMatch(commands, /resize-pane|select-pane/);
+            });
+        }
+        finally {
+            if (originalPlatform)
+                Object.defineProperty(process, 'platform', originalPlatform);
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('reports failed rollback pane teardown as retryable partial-session cleanup debt', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-kill-failure-partial-'));
+        const previousTmux = process.env.TMUX;
+        const previousTmuxPane = process.env.TMUX_PANE;
+        const previousWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
+        try {
+            await withMockTmuxFixture('omx-tmux-kill-failure-partial-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  display-message) echo 'leader:0 %1' ;;
+  list-panes)
+    if [ "$2" = "-a" ]; then printf '%%1\\t0\\t2000000001\\n%%2\\t0\\t2000000002\\n'; else printf '%%1\\tnode\\tcodex\\n'; fi
+    ;;
+  split-window)
+    case "$*" in *' -h '*) echo '%2' ;; *) echo 'second split rejected' >&2; exit 1 ;; esac
+    ;;
+  kill-pane) echo 'kill rejected' >&2; exit 1 ;;
+  *) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                const geminiPath = join(dirname(logPath), 'gemini');
                 await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
                 await chmod(geminiPath, 0o755);
                 process.env.TMUX = 'leader-session,stub,0';
                 process.env.TMUX_PANE = '%1';
                 process.env.OMX_TEAM_WORKER_CLI = 'gemini';
-                delete process.env.MSYSTEM;
-                delete process.env.OSTYPE;
-                delete process.env.WSL_DISTRO_NAME;
-                delete process.env.WSL_INTEROP;
-                Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
-                const session = createTeamSession('Windows Team', 1, cwd);
-                assert.equal(session.hudPaneId, '%3');
-                assert.equal(session.resizeHookName, null);
-                assert.equal(session.resizeHookTarget, null);
-                const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, new RegExp(`resize-pane -t %3 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
-                assert.doesNotMatch(tmuxLog, /set-hook -w /);
-                assert.doesNotMatch(tmuxLog, /window-resized\[/);
-                assert.doesNotMatch(tmuxLog, /set-hook -t leader:0 client-attached\[\d+\]/);
-                assert.doesNotMatch(tmuxLog, /run-shell -b sleep \d+; tmux resize-pane -t %3 -y \d+ >/);
-                assert.doesNotMatch(tmuxLog, /run-shell tmux resize-pane -t %3 -y \d+ >/);
+                assert.throws(() => createTeamSession('Kill Failure Partial', 2, cwd), (error) => error instanceof CreateTeamSessionPartialError
+                    && error.partialSession.workerPaneIds.includes('%2')
+                    && error.cleanupErrors.some((message) => message.includes('failed to kill tmux pane %2')));
             });
         }
         finally {
-            if (origPlatform)
-                Object.defineProperty(process, 'platform', origPlatform);
-            if (typeof prevTmux === 'string')
-                process.env.TMUX = prevTmux;
+            if (typeof previousTmux === 'string')
+                process.env.TMUX = previousTmux;
             else
                 delete process.env.TMUX;
-            if (typeof prevTmuxPane === 'string')
-                process.env.TMUX_PANE = prevTmuxPane;
+            if (typeof previousTmuxPane === 'string')
+                process.env.TMUX_PANE = previousTmuxPane;
             else
                 delete process.env.TMUX_PANE;
-            if (typeof prevWorkerCli === 'string')
-                process.env.OMX_TEAM_WORKER_CLI = prevWorkerCli;
+            if (typeof previousWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = previousWorkerCli;
             else
                 delete process.env.OMX_TEAM_WORKER_CLI;
-            if (typeof prevMsystem === 'string')
-                process.env.MSYSTEM = prevMsystem;
-            else
-                delete process.env.MSYSTEM;
-            if (typeof prevOstype === 'string')
-                process.env.OSTYPE = prevOstype;
-            else
-                delete process.env.OSTYPE;
-            if (typeof prevWsl === 'string')
-                process.env.WSL_DISTRO_NAME = prevWsl;
-            else
-                delete process.env.WSL_DISTRO_NAME;
-            if (typeof prevWslInterop === 'string')
-                process.env.WSL_INTEROP = prevWslInterop;
-            else
-                delete process.env.WSL_INTEROP;
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('rejects synthetic worker and HUD pane ids that never materialize on native Windows', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-win32-synthetic-pane-'));
+    it('uses tmux 3.2a-compatible client-resized hook registration for team HUD resize', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-resize-hook-fallback-'));
         const prevTmux = process.env.TMUX;
         const prevTmuxPane = process.env.TMUX_PANE;
         const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
-        const prevMsystem = process.env.MSYSTEM;
-        const prevOstype = process.env.OSTYPE;
-        const prevWsl = process.env.WSL_DISTRO_NAME;
-        const prevWslInterop = process.env.WSL_INTEROP;
-        const origPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+        const prevWarn = console.warn;
+        const warnings = [];
         try {
-            await withMockTmuxFixture('omx-tmux-win32-synthetic-pane-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-resize-hook-fallback-', (logPath) => `#!/bin/sh
 set -eu
-printf '%s\\n' "$*" >> "${logPath}"
+printf '%s\n' "$*" >> "${logPath}"
 case "\${1:-}" in
   -V)
-    echo "tmux 3.3.2"
+    echo "tmux 3.2a"
     exit 0
     ;;
   display-message)
@@ -4472,16 +5260,20 @@ case "\${1:-}" in
     ;;
   list-panes)
     case "$*" in
+      *"-a -F #{pane_id}"*)
+        printf "%%1\t0\t2000000001\n%%2\t0\t2000000002\n%%3\t0\t2000000003\n"
+        ;;
       *"pane_current_command"*)
-        printf "%%1\\tnode\\t'codex'\\n"
+        if [ -f "${logPath}.worker" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"; else printf "%%1\\tnode\\t'codex'\\n"; fi
         ;;
       *)
-        printf "%%1\\n"
+        if [ -f "${logPath}.worker" ]; then printf "%%1\\n%%2\\n"; else printf "%%1\\n"; fi
         ;;
     esac
     exit 0
     ;;
   split-window)
+    : > "${logPath}.worker"
     case "$*" in
       *" -h "*)
         echo "%2"
@@ -4492,9 +5284,24 @@ case "\${1:-}" in
     esac
     exit 0
     ;;
-  kill-pane|select-layout|set-window-option|select-pane|resize-pane|set-hook|run-shell)
-    exit 0
-    ;;
+  set-hook)
+    case "$*" in
+      *"window-resized["*)
+        echo "invalid option: window-resized[]" >&2
+        exit 1
+        ;;
+      *" -w "*)
+        echo "invalid option: -w" >&2
+        exit 1
+        ;;
+      *)
+        exit 0
+        ;;
+    esac
+    ;;
+  set-option|resize-pane|select-layout|set-window-option|select-pane|run-shell)
+    exit 0
+    ;;
   *)
     exit 0
     ;;
@@ -4502,28 +5309,30 @@ esac
 `, async ({ logPath }) => {
                 const fakeBinDir = join(logPath, '..');
                 const geminiPath = join(fakeBinDir, 'gemini');
-                const powershellExePath = join(fakeBinDir, 'powershell.exe');
                 await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
                 await chmod(geminiPath, 0o755);
-                await writeFile(powershellExePath, '');
                 process.env.TMUX = 'leader-session,stub,0';
                 process.env.TMUX_PANE = '%1';
                 process.env.OMX_TEAM_WORKER_CLI = 'gemini';
-                delete process.env.MSYSTEM;
-                delete process.env.OSTYPE;
-                delete process.env.WSL_DISTRO_NAME;
-                delete process.env.WSL_INTEROP;
-                Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
-                assert.throws(() => createTeamSession('Windows Team', 1, cwd), /worker pane 1 did not remain present/);
+                console.warn = (...args) => { warnings.push(args.map(String).join(' ')); };
+                const session = createTeamSession('Resize Hook Fallback', 1, cwd);
+                assert.equal(session.hudPaneId, '%3');
+                assert.ok(session.resizeHookName);
+                assert.equal(session.resizeHookTarget, 'leader:0');
+                assert.equal(warnings.join('\n'), '');
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                const listPaneCalls = tmuxLog.match(/list-panes -t leader:0 -F #\{pane_id\}\t#\{pane_current_command\}\t#\{pane_start_command\}/g) || [];
-                assert.ok(listPaneCalls.length >= 2, tmuxLog);
-                assert.match(tmuxLog, /kill-pane -t %2/);
+                assert.match(tmuxLog, /set-hook -t leader:0 client-resized\[\d+\]/);
+                assert.doesNotMatch(tmuxLog, /window-resized\[/);
+                assert.doesNotMatch(tmuxLog, /set-hook -w /);
+                assert.match(tmuxLog, /set-hook -t leader:0 client-attached\[\d+\]/);
+                assert.match(tmuxLog, new RegExp(`run-shell -b sleep ${HUD_RESIZE_RECONCILE_DELAY_SECONDS}; .*resize-pane -t %3 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
+                assert.match(tmuxLog, new RegExp(`run-shell .*resize-pane -t %3 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
+                assert.doesNotMatch(tmuxLog, /kill-pane -t %2/);
+                assert.doesNotMatch(tmuxLog, /kill-pane -t %3/);
             });
         }
         finally {
-            if (origPlatform)
-                Object.defineProperty(process, 'platform', origPlatform);
+            console.warn = prevWarn;
             if (typeof prevTmux === 'string')
                 process.env.TMUX = prevTmux;
             else
@@ -4536,162 +5345,257 @@ esac
                 process.env.OMX_TEAM_WORKER_CLI = prevWorkerCli;
             else
                 delete process.env.OMX_TEAM_WORKER_CLI;
-            if (typeof prevMsystem === 'string')
-                process.env.MSYSTEM = prevMsystem;
-            else
-                delete process.env.MSYSTEM;
-            if (typeof prevOstype === 'string')
-                process.env.OSTYPE = prevOstype;
-            else
-                delete process.env.OSTYPE;
-            if (typeof prevWsl === 'string')
-                process.env.WSL_DISTRO_NAME = prevWsl;
-            else
-                delete process.env.WSL_DISTRO_NAME;
-            if (typeof prevWslInterop === 'string')
-                process.env.WSL_INTEROP = prevWslInterop;
-            else
-                delete process.env.WSL_INTEROP;
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('restores standalone HUD panes with direct resize on native Windows', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-win32-hud-'));
-        const prevLeaderNodePath = process.env.OMX_LEADER_NODE_PATH;
-        const prevMsystem = process.env.MSYSTEM;
-        const prevOstype = process.env.OSTYPE;
-        const prevWsl = process.env.WSL_DISTRO_NAME;
-        const prevWslInterop = process.env.WSL_INTEROP;
-        const origPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+    it('unregisters only the successfully registered HUD hook after partial hook registration failure', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-partial-hook-registration-'));
+        const previousTmux = process.env.TMUX;
+        const previousTmuxPane = process.env.TMUX_PANE;
+        const previousWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
+        const previousWarn = console.warn;
         try {
-            await withMockTmuxFixture('omx-tmux-win32-standalone-hud-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-partial-hook-registration-', (logPath) => `#!/bin/sh
 set -eu
+registration_failed_file="${logPath}.registration-failed"
 printf '%s\\n' "$*" >> "${logPath}"
 case "\${1:-}" in
-  split-window)
-    echo "%44"
-    exit 0
+  -V)
+    echo 'tmux 3.4'
     ;;
-  resize-pane|select-pane)
-    exit 0
+  display-message)
+    case "$*" in
+      *'#{window_width}'*) echo '120' ;;
+      *) echo 'leader:0 %1' ;;
+    esac
     ;;
-  set-hook|run-shell)
-    exit 0
+  list-panes)
+    case "$*" in
+      *'pane_current_command'*)
+        if [ -f "${logPath}.hud" ]; then
+          printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n%%3\\tnode\\t'hud --watch'\\n"
+        elif [ -f "${logPath}.worker" ]; then
+          printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"
+        else
+          printf "%%1\\tnode\\t'codex'\\n"
+        fi
+        ;;
+      *'-a -F #{pane_id}'*)
+        if [ -f "$registration_failed_file" ]; then
+          printf 'malformed snapshot\n'
+        else
+          printf '%%1\t0\t2000000001\n%%2\t0\t2000000002\n%%3\t0\t2000000003\n'
+        fi
+        ;;
+      *) if [ -f "${logPath}.hud" ]; then printf '%%1\n%%2\n%%3\n'; elif [ -f "${logPath}.worker" ]; then printf '%%1\n%%2\n'; else printf '%%1\n'; fi ;;
+    esac
     ;;
-  *)
-    exit 0
+  split-window)
+    case "$*" in
+      *' -h '*) : > "${logPath}.worker"; echo '%2' ;;
+      *) : > "${logPath}.hud"; echo '%3' ;;
+    esac
+    ;;
+  set-hook)
+    case "$*" in
+      *'client-attached['*) : > "$registration_failed_file"; echo 'client-attached hook registration failed' >&2; exit 1 ;;
+    esac
     ;;
 esac
 `, async ({ logPath }) => {
-                delete process.env.MSYSTEM;
-                delete process.env.OSTYPE;
-                delete process.env.WSL_DISTRO_NAME;
-                delete process.env.WSL_INTEROP;
-                process.env.OMX_LEADER_NODE_PATH = 'C:\\Program Files\\nodejs\\node.exe';
-                Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
-                const paneId = restoreStandaloneHudPane('%11', cwd);
-                assert.equal(paneId, '%44');
-                const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, /'C:\\Program Files\\nodejs\\node\.exe'/);
-                assert.match(tmuxLog, new RegExp(`resize-pane -t %44 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
-                assert.match(tmuxLog, /select-pane -t %11/);
-                assert.doesNotMatch(tmuxLog, /run-shell -b sleep \d+; tmux resize-pane -t %44 -y \d+ >/);
-                assert.doesNotMatch(tmuxLog, /run-shell tmux resize-pane -t %44 -y \d+ >/);
-                assert.doesNotMatch(tmuxLog, /set-hook -t /);
+                const geminiPath = join(dirname(logPath), 'gemini');
+                await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
+                await chmod(geminiPath, 0o755);
+                process.env.TMUX = 'leader-session,stub,0';
+                process.env.TMUX_PANE = '%1';
+                process.env.OMX_TEAM_WORKER_CLI = 'gemini';
+                console.warn = () => { };
+                let caught;
+                try {
+                    createTeamSession('Partial hook registration', 1, cwd);
+                }
+                catch (error) {
+                    caught = error;
+                }
+                assert.ok(caught instanceof CreateTeamSessionPartialError);
+                assert.equal(caught.partialSession.hudPaneId, '%3');
+                assert.equal(caught.partialSession.hudPanePid, 2000000003);
+                assert.ok(caught.partialSession.resizeHookName);
+                const commands = (await readFile(logPath, 'utf-8')).trim().split('\n').filter(Boolean);
+                const registeredResize = commands.filter((command) => command.startsWith('set-hook ') && command.includes('client-resized[') && !command.startsWith('set-hook -u '));
+                const registeredAttached = commands.filter((command) => command.startsWith('set-hook ') && command.includes('client-attached[') && !command.startsWith('set-hook -u '));
+                const unregisteredResize = commands.filter((command) => command.startsWith('set-hook -u ') && command.includes('client-resized['));
+                const unregisteredAttached = commands.filter((command) => command.startsWith('set-hook -u ') && command.includes('client-attached['));
+                assert.equal(registeredResize.length, 1);
+                assert.equal(registeredAttached.length, 1);
+                assert.equal(unregisteredResize.length, 0);
+                assert.equal(unregisteredAttached.length, 0);
             });
         }
         finally {
-            if (origPlatform)
-                Object.defineProperty(process, 'platform', origPlatform);
-            if (typeof prevLeaderNodePath === 'string')
-                process.env.OMX_LEADER_NODE_PATH = prevLeaderNodePath;
-            else
-                delete process.env.OMX_LEADER_NODE_PATH;
-            if (typeof prevMsystem === 'string')
-                process.env.MSYSTEM = prevMsystem;
-            else
-                delete process.env.MSYSTEM;
-            if (typeof prevOstype === 'string')
-                process.env.OSTYPE = prevOstype;
+            console.warn = previousWarn;
+            if (typeof previousTmux === 'string')
+                process.env.TMUX = previousTmux;
             else
-                delete process.env.OSTYPE;
-            if (typeof prevWsl === 'string')
-                process.env.WSL_DISTRO_NAME = prevWsl;
+                delete process.env.TMUX;
+            if (typeof previousTmuxPane === 'string')
+                process.env.TMUX_PANE = previousTmuxPane;
             else
-                delete process.env.WSL_DISTRO_NAME;
-            if (typeof prevWslInterop === 'string')
-                process.env.WSL_INTEROP = prevWslInterop;
+                delete process.env.TMUX_PANE;
+            if (typeof previousWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = previousWorkerCli;
             else
-                delete process.env.WSL_INTEROP;
+                delete process.env.OMX_TEAM_WORKER_CLI;
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('reuses an existing standalone HUD pane across repeated restore calls', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-reuse-hud-'));
+    it('degrades HUD run-shell resize failures to warnings during team startup', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-runshell-fallback-'));
+        const prevTmux = process.env.TMUX;
+        const prevTmuxPane = process.env.TMUX_PANE;
+        const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
+        const prevWarn = console.warn;
+        const warnings = [];
         try {
-            await withMockTmuxFixture('omx-tmux-reuse-standalone-hud-', (logPath) => {
-                const statePath = `${logPath}.state`;
-                return `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-runshell-fallback-', (logPath) => `#!/bin/sh
 set -eu
-printf '%s\\n' "$*" >> "${logPath}"
+printf '%s\n' "$*" >> "${logPath}"
 case "\${1:-}" in
+  -V)
+    echo "tmux 3.4"
+    exit 0
+    ;;
+  display-message)
+    case "$*" in
+      *"#{window_width}"*) echo "120" ;;
+      *) echo "leader:0 %1" ;;
+    esac
+    exit 0
+    ;;
   list-panes)
-    printf '%%11\\tzsh\\tzsh\\n'
-    if [ -f "${statePath}" ]; then
-      printf "%%44\\tnode\\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%%11' /node /omx.js hud --watch\\n"
-    fi
+    case "$*" in
+      *"-a -F #{pane_id}"*)
+        printf "%%1\t0\t2000000001\n%%2\t0\t2000000002\n%%3\t0\t2000000003\n"
+        ;;
+      *"pane_current_command"*) if [ -f "${logPath}.worker" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"; else printf "%%1\\tnode\\t'codex'\\n"; fi ;;
+      *) if [ -f "${logPath}.worker" ]; then printf "%%1\\n%%2\\n"; else printf "%%1\\n"; fi ;;
+    esac
     exit 0
     ;;
   split-window)
-    : > "${statePath}"
-    echo "%44"
+    : > "${logPath}.worker"
+    case "$*" in
+      *" -h "*) echo "%2" ;;
+      *) echo "%3" ;;
+    esac
     exit 0
     ;;
-  run-shell|select-pane|resize-pane|set-hook|kill-pane)
+  run-shell)
+    echo "Unsupported tmux compatibility command: run-shell" >&2
+    exit 1
+    ;;
+  set-option|resize-pane|select-layout|set-window-option|select-pane|set-hook|send-keys)
     exit 0
     ;;
   *)
     exit 0
     ;;
 esac
-`;
-            }, async ({ logPath }) => {
-                const firstPaneId = restoreStandaloneHudPane('%11', cwd);
-                const secondPaneId = restoreStandaloneHudPane('%11', cwd);
-                assert.equal(firstPaneId, '%44');
-                assert.equal(secondPaneId, '%44');
+`, async ({ logPath }) => {
+                const fakeBinDir = join(logPath, '..');
+                const geminiPath = join(fakeBinDir, 'gemini');
+                await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
+                await chmod(geminiPath, 0o755);
+                process.env.TMUX = 'leader-session,stub,0';
+                process.env.TMUX_PANE = '%1';
+                process.env.OMX_TEAM_WORKER_CLI = 'gemini';
+                console.warn = (...args) => { warnings.push(args.map(String).join(' ')); };
+                const session = createTeamSession('Run Shell Fallback', 1, cwd);
+                assert.equal(session.hudPaneId, '%3');
+                assert.match(warnings.join('\n'), /HUD resize/);
+                assert.match(warnings.join('\n'), /Unsupported tmux compatibility command: run-shell/);
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                const splitCount = (tmuxLog.match(/(^|\n)split-window /g) ?? []).length;
-                assert.equal(splitCount, 1);
-                assert.doesNotMatch(tmuxLog, /kill-pane -t %44/);
-                assert.match(tmuxLog, /list-panes -t %11 -F #\{pane_id\}\t#\{pane_current_command\}\t#\{pane_start_command\}/);
+                assert.match(tmuxLog, /run-shell -b sleep/);
+                assert.doesNotMatch(tmuxLog, /kill-pane -t %2/);
+                assert.doesNotMatch(tmuxLog, /kill-pane -t %3/);
             });
         }
         finally {
+            console.warn = prevWarn;
+            if (typeof prevTmux === 'string')
+                process.env.TMUX = prevTmux;
+            else
+                delete process.env.TMUX;
+            if (typeof prevTmuxPane === 'string')
+                process.env.TMUX_PANE = prevTmuxPane;
+            else
+                delete process.env.TMUX_PANE;
+            if (typeof prevWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = prevWorkerCli;
+            else
+                delete process.env.OMX_TEAM_WORKER_CLI;
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('restores standalone HUD panes from the live leader pane cwd with explicit session ownership', async () => {
-        const teamLaunchCwd = await mkdtemp(join(tmpdir(), 'omx-standalone-team-launch-cwd-'));
-        const leaderPaneCwd = await mkdtemp(join(tmpdir(), 'omx-standalone-leader-pane-cwd-'));
+});
+describe('native Windows HUD reconciliation', () => {
+    it('allows team startup on native Windows when current tmux client is reachable without TMUX env vars', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-win32-no-env-'));
+        const prevTmux = process.env.TMUX;
+        const prevTmuxPane = process.env.TMUX_PANE;
+        const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
+        const prevMsystem = process.env.MSYSTEM;
+        const prevOstype = process.env.OSTYPE;
+        const prevWsl = process.env.WSL_DISTRO_NAME;
+        const prevWslInterop = process.env.WSL_INTEROP;
+        const origPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
         try {
-            await withMockTmuxFixture('omx-tmux-leader-cwd-standalone-hud-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-win32-no-env-', (logPath) => `#!/bin/sh
 set -eu
 printf '%s\\n' "$*" >> "${logPath}"
 case "\${1:-}" in
+  -V)
+    echo "tmux 3.4"
+    exit 0
+    ;;
   display-message)
     case "$*" in
-      *"#{pane_current_path}"*)
-        echo "${leaderPaneCwd}"
+      *"#{window_width}"*)
+        echo "120"
+        ;;
+      *)
+        echo "leader:0 %1"
+        ;;
+    esac
+    exit 0
+    ;;
+  list-panes)
+    case "$*" in
+      *"-a -F #{pane_id}"*)
+        printf "%%1\\t0\\t2000000001\\n%%2\\t0\\t2000000002\\n%%3\\t0\\t2000000003\\n"
+        ;;
+      *"pane_current_command"*)
+        if [ -f "${logPath}.hud" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n%%3\\tnode\\t'node omx hud --watch'\\n"; elif [ -f "${logPath}.worker" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"; else printf "%%1\\tnode\\t'codex'\\n"; fi
+        ;;
+      *)
+        if [ -f "${logPath}.hud" ]; then printf "%%1\\n%%2\\n%%3\\n"; elif [ -f "${logPath}.worker" ]; then printf "%%1\\n%%2\\n"; else printf "%%1\\n"; fi
         ;;
     esac
     exit 0
     ;;
   split-window)
-    echo "%44"
+    if [ "$2" = "-h" ]; then : > "${logPath}.worker"; else : > "${logPath}.hud"; fi
+    case "$*" in
+      *" -h "*)
+        echo "%2"
+        ;;
+      *)
+        echo "%3"
+        ;;
+    esac
     exit 0
     ;;
-  run-shell|select-pane|resize-pane|set-hook)
+  resize-pane|select-layout|set-window-option|select-pane|kill-pane|set-hook|run-shell)
     exit 0
     ;;
   *)
@@ -4699,56 +5603,123 @@ case "\${1:-}" in
     ;;
 esac
 `, async ({ logPath }) => {
-                const paneId = restoreStandaloneHudPane('%11', teamLaunchCwd, {
-                    sessionId: 'current-session-for-hud',
-                });
-                assert.equal(paneId, '%44');
+                const fakeBinDir = join(logPath, '..');
+                const geminiPath = join(fakeBinDir, 'gemini');
+                await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
+                await chmod(geminiPath, 0o755);
+                delete process.env.TMUX;
+                delete process.env.TMUX_PANE;
+                process.env.OMX_TEAM_WORKER_CLI = 'gemini';
+                delete process.env.MSYSTEM;
+                delete process.env.OSTYPE;
+                delete process.env.WSL_DISTRO_NAME;
+                delete process.env.WSL_INTEROP;
+                Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+                const session = createTeamSession('Windows Team', 1, cwd);
+                assert.equal(session.name, 'leader:0');
+                assert.equal(session.leaderPaneId, '%1');
+                assert.equal(session.hudPaneId, '%3');
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, /display-message -p -t %11 #\{pane_current_path\}/);
-                assert.match(tmuxLog, new RegExp(`split-window -v -l ${HUD_TMUX_TEAM_HEIGHT_LINES} -t %11 -d -P -F #\\{pane_id\\} -c ${escapeRegExp(leaderPaneCwd)} `));
-                assert.doesNotMatch(tmuxLog, new RegExp(`split-window .* -c ${escapeRegExp(teamLaunchCwd)} `));
-                assert.match(tmuxLog, /exec env OMX_SESSION_ID='current-session-for-hud' OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%11' .*hud --watch/);
+                assert.match(tmuxLog, /display-message -p #\{session_name\}:#\{window_index\} #\{pane_id\}/);
+                assert.match(tmuxLog, /powershell\.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand/);
+                assert.doesNotMatch(tmuxLog, /\/bin\/sh -lc/);
+                assert.match(tmuxLog, new RegExp(`resize-pane -t %3 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
             });
         }
         finally {
-            await rm(teamLaunchCwd, { recursive: true, force: true });
-            await rm(leaderPaneCwd, { recursive: true, force: true });
+            if (origPlatform)
+                Object.defineProperty(process, 'platform', origPlatform);
+            if (typeof prevTmux === 'string')
+                process.env.TMUX = prevTmux;
+            else
+                delete process.env.TMUX;
+            if (typeof prevTmuxPane === 'string')
+                process.env.TMUX_PANE = prevTmuxPane;
+            else
+                delete process.env.TMUX_PANE;
+            if (typeof prevWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = prevWorkerCli;
+            else
+                delete process.env.OMX_TEAM_WORKER_CLI;
+            if (typeof prevMsystem === 'string')
+                process.env.MSYSTEM = prevMsystem;
+            else
+                delete process.env.MSYSTEM;
+            if (typeof prevOstype === 'string')
+                process.env.OSTYPE = prevOstype;
+            else
+                delete process.env.OSTYPE;
+            if (typeof prevWsl === 'string')
+                process.env.WSL_DISTRO_NAME = prevWsl;
+            else
+                delete process.env.WSL_DISTRO_NAME;
+            if (typeof prevWslInterop === 'string')
+                process.env.WSL_INTEROP = prevWslInterop;
+            else
+                delete process.env.WSL_INTEROP;
+            await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('falls back to the team launch cwd when the live leader pane cwd is unusable', async () => {
-        const teamLaunchCwd = await mkdtemp(join(tmpdir(), 'omx-standalone-team-launch-cwd-fallback-'));
-        const deletedLeaderPaneCwd = await mkdtemp(join(tmpdir(), 'omx-standalone-deleted-leader-pane-cwd-'));
-        await rm(deletedLeaderPaneCwd, { recursive: true, force: true });
+    it('avoids nested tmux run-shell hooks during team HUD startup on native Windows', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-win32-hud-'));
+        const prevTmux = process.env.TMUX;
+        const prevTmuxPane = process.env.TMUX_PANE;
+        const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
+        const prevMsystem = process.env.MSYSTEM;
+        const prevOstype = process.env.OSTYPE;
+        const prevWsl = process.env.WSL_DISTRO_NAME;
+        const prevWslInterop = process.env.WSL_INTEROP;
+        const origPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
         try {
-            await withMockTmuxFixture('omx-tmux-deleted-leader-cwd-standalone-hud-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-win32-hud-reconcile-', (logPath) => `#!/bin/sh
 set -eu
 printf '%s\\n' "$*" >> "${logPath}"
 case "\${1:-}" in
+  -V)
+    echo "tmux 3.4"
+    exit 0
+    ;;
   display-message)
     case "$*" in
-      *"#{pane_current_path}"*)
-        echo "${deletedLeaderPaneCwd}"
+      *"#{window_width}"*)
+        echo "120"
+        ;;
+      *)
+        echo "leader:0 %1"
         ;;
     esac
     exit 0
     ;;
-  split-window)
+  list-panes)
     case "$*" in
-      *"-c ${teamLaunchCwd} "*)
-        echo "%44"
-        exit 0
+      *"-a -F #{pane_id}"*)
+        printf "%%1\\t0\\t2000000001\\n%%2\\t0\\t2000000002\\n%%3\\t0\\t2000000003\\n"
         ;;
-      *"-c ${deletedLeaderPaneCwd} "*)
-        echo "deleted cwd should not be used" >&2
-        exit 1
+      *"pane_current_command"*)
+        if [ -f "${logPath}.hud" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n%%3\\tnode\\t'node omx hud --watch'\\n"; elif [ -f "${logPath}.worker" ]; then printf "%%1\\tnode\\t'codex'\\n%%2\\tgemini\\t'gemini'\\n"; else printf "%%1\\tnode\\t'codex'\\n"; fi
         ;;
       *)
-        echo "unexpected cwd: $*" >&2
-        exit 1
+        if [ -f "${logPath}.hud" ]; then printf "%%1\\n%%2\\n%%3\\n"; elif [ -f "${logPath}.worker" ]; then printf "%%1\\n%%2\\n"; else printf "%%1\\n"; fi
         ;;
     esac
+    exit 0
     ;;
-  run-shell|select-pane|resize-pane|set-hook)
+  split-window)
+    if [ "$2" = "-h" ]; then : > "${logPath}.worker"; else : > "${logPath}.hud"; fi
+    case "$*" in
+      *" -h "*)
+        echo "%2"
+        ;;
+      *)
+        echo "%3"
+        ;;
+    esac
+    exit 0
+    ;;
+  resize-pane|select-layout|set-window-option|select-pane|kill-pane)
+    exit 0
+    ;;
+  set-hook|run-shell)
     exit 0
     ;;
   *)
@@ -4756,71 +5727,126 @@ case "\${1:-}" in
     ;;
 esac
 `, async ({ logPath }) => {
-                const paneId = restoreStandaloneHudPane('%11', teamLaunchCwd, {
-                    sessionId: 'current-session-for-hud',
-                });
-                assert.equal(paneId, '%44');
+                const fakeBinDir = join(logPath, '..');
+                const geminiPath = join(fakeBinDir, 'gemini');
+                await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
+                await chmod(geminiPath, 0o755);
+                process.env.TMUX = 'leader-session,stub,0';
+                process.env.TMUX_PANE = '%1';
+                process.env.OMX_TEAM_WORKER_CLI = 'gemini';
+                delete process.env.MSYSTEM;
+                delete process.env.OSTYPE;
+                delete process.env.WSL_DISTRO_NAME;
+                delete process.env.WSL_INTEROP;
+                Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+                const session = createTeamSession('Windows Team', 1, cwd);
+                assert.equal(session.hudPaneId, '%3');
+                assert.equal(session.resizeHookName, null);
+                assert.equal(session.resizeHookTarget, null);
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, /display-message -p -t %11 #\{pane_current_path\}/);
-                assert.match(tmuxLog, new RegExp(`split-window -v -l ${HUD_TMUX_TEAM_HEIGHT_LINES} -t %11 -d -P -F #\\{pane_id\\} -c ${escapeRegExp(teamLaunchCwd)} `));
-                assert.doesNotMatch(tmuxLog, new RegExp(`split-window .* -c ${escapeRegExp(deletedLeaderPaneCwd)} `));
-                assert.match(tmuxLog, /select-pane -t %11/);
+                assert.match(tmuxLog, new RegExp(`resize-pane -t %3 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
+                assert.doesNotMatch(tmuxLog, /set-hook -w /);
+                assert.doesNotMatch(tmuxLog, /window-resized\[/);
+                assert.doesNotMatch(tmuxLog, /set-hook -t leader:0 client-attached\[\d+\]/);
+                assert.doesNotMatch(tmuxLog, /run-shell -b sleep \d+; tmux resize-pane -t %3 -y \d+ >/);
+                assert.doesNotMatch(tmuxLog, /run-shell tmux resize-pane -t %3 -y \d+ >/);
             });
         }
         finally {
-            await rm(teamLaunchCwd, { recursive: true, force: true });
+            if (origPlatform)
+                Object.defineProperty(process, 'platform', origPlatform);
+            if (typeof prevTmux === 'string')
+                process.env.TMUX = prevTmux;
+            else
+                delete process.env.TMUX;
+            if (typeof prevTmuxPane === 'string')
+                process.env.TMUX_PANE = prevTmuxPane;
+            else
+                delete process.env.TMUX_PANE;
+            if (typeof prevWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = prevWorkerCli;
+            else
+                delete process.env.OMX_TEAM_WORKER_CLI;
+            if (typeof prevMsystem === 'string')
+                process.env.MSYSTEM = prevMsystem;
+            else
+                delete process.env.MSYSTEM;
+            if (typeof prevOstype === 'string')
+                process.env.OSTYPE = prevOstype;
+            else
+                delete process.env.OSTYPE;
+            if (typeof prevWsl === 'string')
+                process.env.WSL_DISTRO_NAME = prevWsl;
+            else
+                delete process.env.WSL_DISTRO_NAME;
+            if (typeof prevWslInterop === 'string')
+                process.env.WSL_INTEROP = prevWslInterop;
+            else
+                delete process.env.WSL_INTEROP;
+            await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('keeps MSYS drive-style live leader cwd candidates without raw stat prefiltering', async () => {
-        const liveLeaderCwd = '/c/live';
-        const fallbackCwd = 'C:\\fallback';
-        const fakeCygpathDir = await mkdtemp(join(tmpdir(), 'omx-msys-live-cygpath-'));
-        const previousPath = process.env.PATH;
-        const previousMsystem = process.env.MSYSTEM;
-        const previousOstype = process.env.OSTYPE;
-        const previousWsl = process.env.WSL_DISTRO_NAME;
-        const previousWslInterop = process.env.WSL_INTEROP;
-        const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
-        const statCalls = [];
+    it('rejects synthetic worker and HUD pane ids that never materialize on native Windows', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-win32-synthetic-pane-'));
+        const prevTmux = process.env.TMUX;
+        const prevTmuxPane = process.env.TMUX_PANE;
+        const prevWorkerCli = process.env.OMX_TEAM_WORKER_CLI;
+        const prevMsystem = process.env.MSYSTEM;
+        const prevOstype = process.env.OSTYPE;
+        const prevWsl = process.env.WSL_DISTRO_NAME;
+        const prevWslInterop = process.env.WSL_INTEROP;
+        const origPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
         try {
-            const cygpathPath = join(fakeCygpathDir, 'cygpath');
-            await writeFile(cygpathPath, '#!/bin/sh\nprintf "%s\\n" "$2"\n');
-            await chmod(cygpathPath, 0o755);
-            process.env.PATH = `${fakeCygpathDir}:${previousPath ?? ''}`;
-            process.env.MSYSTEM = 'MINGW64';
-            process.env.OSTYPE = 'msys';
-            delete process.env.WSL_DISTRO_NAME;
-            delete process.env.WSL_INTEROP;
-            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
-            await withMockTmuxFixture('omx-tmux-msys-live-cwd-standalone-hud-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-win32-synthetic-pane-', (logPath) => `#!/bin/sh
 set -eu
 printf '%s\\n' "$*" >> "${logPath}"
 case "\${1:-}" in
+  -V)
+    echo "tmux 3.3.2"
+    exit 0
+    ;;
   display-message)
     case "$*" in
-      *"#{pane_current_path}"*)
-        echo "${liveLeaderCwd}"
+      *"#{window_width}"*)
+        echo "120"
+        ;;
+      *)
+        echo "leader:0 %1"
         ;;
     esac
     exit 0
     ;;
-  split-window)
+  list-panes)
     case "$*" in
-      *"-c ${liveLeaderCwd} "*)
-        echo "%44"
-        exit 0
+      *"-a -F #{pane_id}"*)
+        printf "%%1\t0\t2000000001\n"
+        if [ ! -f "${logPath}.killed-%2" ]; then printf "%%2\t0\t2000000002\n"; fi
         ;;
-      *"-c ${fallbackCwd} "*)
-        echo "fallback cwd should not be used when MSYS live cwd succeeds" >&2
-        exit 1
+      *"pane_current_command"*)
+        printf "%%1\\tnode\\t'codex'\\n"
         ;;
       *)
-        echo "unexpected cwd: $*" >&2
-        exit 1
+        printf "%%1\\n"
         ;;
     esac
+    exit 0
     ;;
-  run-shell|select-pane|resize-pane|set-hook)
+  split-window)
+    case "$*" in
+      *" -h "*)
+        echo "%2"
+        ;;
+      *)
+        echo "%3"
+        ;;
+    esac
+    exit 0
+    ;;
+  kill-pane)
+    : > "${logPath}.killed-$3"
+    exit 0
+    ;;
+  select-layout|set-window-option|select-pane|resize-pane|set-hook|run-shell)
     exit 0
     ;;
   *)
@@ -4828,99 +5854,86 @@ case "\${1:-}" in
     ;;
 esac
 `, async ({ logPath }) => {
-                const paneId = withMockedStatSync(((pathLike) => {
-                    const value = String(pathLike);
-                    statCalls.push(value);
-                    if (value === fallbackCwd)
-                        return { isDirectory: () => true };
-                    return { isDirectory: () => false };
-                }), () => restoreStandaloneHudPane('%11', fallbackCwd, { sessionId: 'current-session-for-hud' }));
-                assert.equal(paneId, '%44');
-                assert.equal(statCalls.includes(liveLeaderCwd), false);
-                assert.equal(statCalls.includes(fallbackCwd), true);
+                const fakeBinDir = join(logPath, '..');
+                const geminiPath = join(fakeBinDir, 'gemini');
+                const powershellExePath = join(fakeBinDir, 'powershell.exe');
+                await writeFile(geminiPath, '#!/bin/sh\nexit 0\n');
+                await chmod(geminiPath, 0o755);
+                await writeFile(powershellExePath, '');
+                process.env.TMUX = 'leader-session,stub,0';
+                process.env.TMUX_PANE = '%1';
+                process.env.OMX_TEAM_WORKER_CLI = 'gemini';
+                delete process.env.MSYSTEM;
+                delete process.env.OSTYPE;
+                delete process.env.WSL_DISTRO_NAME;
+                delete process.env.WSL_INTEROP;
+                Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+                assert.throws(() => createTeamSession('Windows Team', 1, cwd), /worker pane 1 did not remain present/);
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, /display-message -p -t %11 #\{pane_current_path\}/);
-                assert.match(tmuxLog, new RegExp(`split-window -v -l ${HUD_TMUX_TEAM_HEIGHT_LINES} -t %11 -d -P -F #\\{pane_id\\} -c ${escapeRegExp(liveLeaderCwd)} `));
-                assert.doesNotMatch(tmuxLog, new RegExp(`split-window .* -c ${escapeRegExp(fallbackCwd)} `));
-                assert.match(tmuxLog, /select-pane -t %11/);
+                const listPaneCalls = tmuxLog.match(/list-panes -t leader:0 -F #\{pane_id\}\t#\{pane_current_command\}\t#\{pane_start_command\}/g) || [];
+                assert.ok(listPaneCalls.length >= 2, tmuxLog);
+                assert.match(tmuxLog, /kill-pane -t %2/);
             });
         }
         finally {
-            if (originalPlatform)
-                Object.defineProperty(process, 'platform', originalPlatform);
-            if (typeof previousPath === 'string')
-                process.env.PATH = previousPath;
+            if (origPlatform)
+                Object.defineProperty(process, 'platform', origPlatform);
+            if (typeof prevTmux === 'string')
+                process.env.TMUX = prevTmux;
             else
-                delete process.env.PATH;
-            if (typeof previousMsystem === 'string')
-                process.env.MSYSTEM = previousMsystem;
+                delete process.env.TMUX;
+            if (typeof prevTmuxPane === 'string')
+                process.env.TMUX_PANE = prevTmuxPane;
+            else
+                delete process.env.TMUX_PANE;
+            if (typeof prevWorkerCli === 'string')
+                process.env.OMX_TEAM_WORKER_CLI = prevWorkerCli;
+            else
+                delete process.env.OMX_TEAM_WORKER_CLI;
+            if (typeof prevMsystem === 'string')
+                process.env.MSYSTEM = prevMsystem;
             else
                 delete process.env.MSYSTEM;
-            if (typeof previousOstype === 'string')
-                process.env.OSTYPE = previousOstype;
+            if (typeof prevOstype === 'string')
+                process.env.OSTYPE = prevOstype;
             else
                 delete process.env.OSTYPE;
-            if (typeof previousWsl === 'string')
-                process.env.WSL_DISTRO_NAME = previousWsl;
+            if (typeof prevWsl === 'string')
+                process.env.WSL_DISTRO_NAME = prevWsl;
             else
                 delete process.env.WSL_DISTRO_NAME;
-            if (typeof previousWslInterop === 'string')
-                process.env.WSL_INTEROP = previousWslInterop;
+            if (typeof prevWslInterop === 'string')
+                process.env.WSL_INTEROP = prevWslInterop;
             else
                 delete process.env.WSL_INTEROP;
-            await rm(fakeCygpathDir, { recursive: true, force: true });
+            await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('falls back after an unusable MSYS drive-style live leader cwd split attempt fails', async () => {
-        const liveLeaderCwd = '/c/deleted-live';
-        const fallbackCwd = 'C:\\fallback';
-        const fakeCygpathDir = await mkdtemp(join(tmpdir(), 'omx-msys-deleted-live-cygpath-'));
-        const previousPath = process.env.PATH;
-        const previousMsystem = process.env.MSYSTEM;
-        const previousOstype = process.env.OSTYPE;
-        const previousWsl = process.env.WSL_DISTRO_NAME;
-        const previousWslInterop = process.env.WSL_INTEROP;
-        const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
-        const statCalls = [];
+    it('restores standalone HUD panes with direct resize on native Windows', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-win32-hud-'));
+        const prevLeaderNodePath = process.env.OMX_LEADER_NODE_PATH;
+        const prevMsystem = process.env.MSYSTEM;
+        const prevOstype = process.env.OSTYPE;
+        const prevWsl = process.env.WSL_DISTRO_NAME;
+        const prevWslInterop = process.env.WSL_INTEROP;
+        const origPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
         try {
-            const cygpathPath = join(fakeCygpathDir, 'cygpath');
-            await writeFile(cygpathPath, '#!/bin/sh\nprintf "%s\\n" "$2"\n');
-            await chmod(cygpathPath, 0o755);
-            process.env.PATH = `${fakeCygpathDir}:${previousPath ?? ''}`;
-            process.env.MSYSTEM = 'MINGW64';
-            process.env.OSTYPE = 'msys';
-            delete process.env.WSL_DISTRO_NAME;
-            delete process.env.WSL_INTEROP;
-            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
-            await withMockTmuxFixture('omx-tmux-msys-deleted-live-cwd-standalone-hud-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-win32-standalone-hud-', (logPath) => `#!/bin/sh
 set -eu
 printf '%s\\n' "$*" >> "${logPath}"
 case "\${1:-}" in
-  display-message)
-    case "$*" in
-      *"#{pane_current_path}"*)
-        echo "${liveLeaderCwd}"
-        ;;
-    esac
+  list-panes)
+    if [ "$2" = "-a" ]; then printf '%%11\\t0\\t2000000011\\n%%44\\t0\\t2000000044\\n'; fi
     exit 0
     ;;
   split-window)
-    case "$*" in
-      *"-c ${liveLeaderCwd} "*)
-        echo "deleted live cwd cannot be used" >&2
-        exit 1
-        ;;
-      *"-c ${fallbackCwd} "*)
-        echo "%44"
-        exit 0
-        ;;
-      *)
-        echo "unexpected cwd: $*" >&2
-        exit 1
-        ;;
-    esac
+    echo "%44"
+    exit 0
     ;;
-  run-shell|select-pane|resize-pane|set-hook)
+  resize-pane|select-pane)
+    exit 0
+    ;;
+  set-hook|run-shell)
     exit 0
     ;;
   *)
@@ -4928,110 +5941,310 @@ case "\${1:-}" in
     ;;
 esac
 `, async ({ logPath }) => {
-                const paneId = withMockedStatSync(((pathLike) => {
-                    const value = String(pathLike);
-                    statCalls.push(value);
-                    if (value === fallbackCwd)
-                        return { isDirectory: () => true };
-                    return { isDirectory: () => false };
-                }), () => restoreStandaloneHudPane('%11', fallbackCwd, { sessionId: 'current-session-for-hud' }));
+                delete process.env.MSYSTEM;
+                delete process.env.OSTYPE;
+                delete process.env.WSL_DISTRO_NAME;
+                delete process.env.WSL_INTEROP;
+                process.env.OMX_LEADER_NODE_PATH = 'C:\\Program Files\\nodejs\\node.exe';
+                Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+                const paneId = restoreStandaloneHudPane('%11', cwd);
                 assert.equal(paneId, '%44');
-                assert.equal(statCalls.includes(liveLeaderCwd), false);
-                assert.equal(statCalls.includes(fallbackCwd), true);
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                const liveAttemptIndex = tmuxLog.indexOf(`-c ${liveLeaderCwd} `);
-                const fallbackAttemptIndex = tmuxLog.indexOf(`-c ${fallbackCwd} `);
-                assert.ok(liveAttemptIndex >= 0, 'deleted MSYS live cwd should still be attempted');
-                assert.ok(fallbackAttemptIndex > liveAttemptIndex, 'fallback should be attempted after live split failure');
+                assert.match(tmuxLog, /'C:\\Program Files\\nodejs\\node\.exe'/);
+                assert.match(tmuxLog, new RegExp(`resize-pane -t %44 -y ${HUD_TMUX_TEAM_HEIGHT_LINES}`));
                 assert.match(tmuxLog, /select-pane -t %11/);
+                const commands = tmuxLog.trim().split('\n').filter(Boolean);
+                for (const [index, command] of commands.entries()) {
+                    if (/^(split-window .* -t %11|resize-pane -t %44|select-pane -t %11)( |$)/.test(command)) {
+                        assert.match(commands[index - 1] ?? '', /^list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}$/, `fresh global proof must immediately precede ${command}`);
+                    }
+                }
+                assert.doesNotMatch(tmuxLog, /run-shell -b sleep \d+; tmux resize-pane -t %44 -y \d+ >/);
+                assert.doesNotMatch(tmuxLog, /run-shell tmux resize-pane -t %44 -y \d+ >/);
+                assert.doesNotMatch(tmuxLog, /set-hook -t /);
             });
         }
         finally {
-            if (originalPlatform)
-                Object.defineProperty(process, 'platform', originalPlatform);
-            if (typeof previousPath === 'string')
-                process.env.PATH = previousPath;
+            if (origPlatform)
+                Object.defineProperty(process, 'platform', origPlatform);
+            if (typeof prevLeaderNodePath === 'string')
+                process.env.OMX_LEADER_NODE_PATH = prevLeaderNodePath;
             else
-                delete process.env.PATH;
-            if (typeof previousMsystem === 'string')
-                process.env.MSYSTEM = previousMsystem;
+                delete process.env.OMX_LEADER_NODE_PATH;
+            if (typeof prevMsystem === 'string')
+                process.env.MSYSTEM = prevMsystem;
             else
                 delete process.env.MSYSTEM;
-            if (typeof previousOstype === 'string')
-                process.env.OSTYPE = previousOstype;
+            if (typeof prevOstype === 'string')
+                process.env.OSTYPE = prevOstype;
             else
                 delete process.env.OSTYPE;
-            if (typeof previousWsl === 'string')
-                process.env.WSL_DISTRO_NAME = previousWsl;
+            if (typeof prevWsl === 'string')
+                process.env.WSL_DISTRO_NAME = prevWsl;
             else
                 delete process.env.WSL_DISTRO_NAME;
-            if (typeof previousWslInterop === 'string')
-                process.env.WSL_INTEROP = previousWslInterop;
+            if (typeof prevWslInterop === 'string')
+                process.env.WSL_INTEROP = prevWslInterop;
             else
                 delete process.env.WSL_INTEROP;
-            await rm(fakeCygpathDir, { recursive: true, force: true });
+            await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('restores standalone HUD panes with an absolute OMX entry path after cwd drift', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-relative-hud-'));
-        const startupCwd = await mkdtemp(join(tmpdir(), 'omx-standalone-relative-start-'));
-        const previousEntryPath = process.env[OMX_ENTRY_PATH_ENV];
-        const previousStartupCwd = process.env[OMX_STARTUP_CWD_ENV];
-        const previousArgv = process.argv;
+    it('rejects restored HUD debt roots outside the canonical direct Team root before splitting', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-restored-hud-debt-root-'));
+        const canonicalTeamsRoot = join(cwd, '.omx', 'state', 'team');
+        const externalRoot = await mkdtemp(join(tmpdir(), 'omx-restored-hud-debt-external-'));
+        const symlinkRoot = join(canonicalTeamsRoot, 'linked-team');
         try {
-            const launcherDir = join(startupCwd, 'dist', 'cli');
-            const launcherPath = join(launcherDir, 'omx.js');
-            await mkdir(launcherDir, { recursive: true });
-            await writeFile(launcherPath, '#!/usr/bin/env node\n');
-            await withMockTmuxFixture('omx-tmux-relative-standalone-hud-', (logPath) => `#!/bin/sh
+            await mkdir(canonicalTeamsRoot, { recursive: true });
+            await symlink(externalRoot, symlinkRoot);
+            const invalidRoots = [
+                join(cwd, '.omx', 'state', 'foreign'),
+                join(canonicalTeamsRoot, 'alpha', '..', '..', 'foreign'),
+                join(canonicalTeamsRoot, 'alpha', 'nested'),
+                symlinkRoot,
+            ];
+            for (const stateRoot of invalidRoots) {
+                assert.throws(() => restoreStandaloneHudPane('%11', cwd, { stateRoot }), /restored_hud_cleanup_debt_state_root_invalid/);
+            }
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+            await rm(externalRoot, { recursive: true, force: true });
+        }
+    });
+    it('does not suppress a non-Windows parent-directory fsync failure for restored HUD debt', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-restored-hud-debt-fsync-'));
+        const originalFsyncSync = fs.fsyncSync;
+        try {
+            await withMockTmuxFixture('omx-restored-hud-debt-fsync-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      printf '%%11\\t0\\t2000000011\\n%%44\\t0\\t2000000044\\n'
+    else
+      printf '%%11\\tzsh\\tzsh\\n'
+    fi
+    ;;
+  split-window) printf '%%44\\n' ;;
+  *) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+                let fsyncCalls = 0;
+                assert.throws(() => withMockedFsyncSync((descriptor) => {
+                    fsyncCalls += 1;
+                    if (fsyncCalls === 2) {
+                        const error = new Error('parent fsync unavailable');
+                        error.code = 'EINVAL';
+                        throw error;
+                    }
+                    originalFsyncSync(descriptor);
+                }, () => restoreStandaloneHudPane('%11', cwd)), /parent fsync unavailable/);
+                assert.equal(fsyncCalls, 2);
+                const commands = await readFile(logPath, 'utf-8');
+                assert.match(commands, /split-window/);
+                assert.doesNotMatch(commands, /resize-pane|select-pane/);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('reuses an existing standalone HUD pane across repeated restore calls', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-reuse-hud-'));
+        try {
+            await withMockTmuxFixture('omx-tmux-reuse-standalone-hud-', (logPath) => {
+                const statePath = `${logPath}.state`;
+                return `#!/bin/sh
 set -eu
 printf '%s\\n' "$*" >> "${logPath}"
 case "\${1:-}" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      printf '%%11\t0\t2000000011\n'
+      if [ -f "${statePath}" ]; then printf '%%44\t0\t2000000044\n'; fi
+    else
+      printf '%%11\tzsh\tzsh\n'
+      if [ -f "${statePath}" ]; then
+        printf "%%44\tnode\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%%11' /node /omx.js hud --watch\n"
+      fi
+    fi
+    exit 0
+    ;;
   split-window)
+    : > "${statePath}"
     echo "%44"
     exit 0
     ;;
-  run-shell|select-pane|resize-pane|set-hook)
+  run-shell|select-pane|resize-pane|set-hook|kill-pane)
     exit 0
     ;;
+  show-option)
+    if [ "$5" = "%11" ] && [ "$6" = "@omx_team_pane_owner_id" ]; then
+      printf 'team:restore-replay\n'
+    else
+      exit 1
+    fi
+    ;;
   *)
     exit 0
     ;;
 esac
-`, async ({ logPath }) => {
-                delete process.env[OMX_ENTRY_PATH_ENV];
-                process.env[OMX_STARTUP_CWD_ENV] = startupCwd;
-                process.argv = [previousArgv[0] || 'node', 'dist/cli/omx.js'];
-                const paneId = restoreStandaloneHudPane('%11', cwd);
-                assert.equal(paneId, '%44');
+`;
+            }, async ({ logPath }) => {
+                const firstPaneId = restoreStandaloneHudPane('%11', cwd, {
+                    expectedLeaderPanePid: 2000000011,
+                    expectedLeaderPaneOwnerId: 'team:restore-replay',
+                });
+                assert.equal(firstPaneId, '%44');
+                const debtPath = join(cwd, '.omx', 'state', '.restored-hud-cleanup-debt.json');
+                const crashWindowDebt = JSON.parse(await readFile(debtPath, 'utf-8'));
+                assert.deepEqual(crashWindowDebt, {
+                    schema_version: 1,
+                    operation: 'restored_hud_cleanup',
+                    pane_id: '%44',
+                    pane_pid: 2000000044,
+                    leader_pane_id: '%11',
+                    leader_pane_pid: 2000000011,
+                    leader_pane_owner_id: 'team:restore-replay',
+                    hud_owner_leader_pane_id: '%11',
+                });
+                // The split may have survived a crash immediately before the config
+                // transaction; finalization is deliberately explicit and post-commit.
+                finalizeRestoredHudCleanupDebtSync(cwd, '%44', 2000000044);
+                await assert.rejects(() => readFile(debtPath, 'utf-8'));
+                const secondPaneId = restoreStandaloneHudPane('%11', cwd);
+                assert.equal(firstPaneId, '%44');
+                assert.equal(secondPaneId, '%44');
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, new RegExp(escapeRegExp(launcherPath)));
-                assert.doesNotMatch(tmuxLog, /'dist\/cli\/omx\.js' hud --watch/);
-                assert.match(tmuxLog, /exec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%11' .*hud --watch/);
+                const splitCount = (tmuxLog.match(/(^|\n)split-window /g) ?? []).length;
+                assert.equal(splitCount, 1);
+                assert.doesNotMatch(tmuxLog, /kill-pane -t %44/);
+                assert.match(tmuxLog, /list-panes -t %11 -F #\{pane_id\}\t#\{pane_current_command\}\t#\{pane_start_command\}/);
             });
         }
         finally {
-            process.argv = previousArgv;
-            if (typeof previousEntryPath === 'string')
-                process.env[OMX_ENTRY_PATH_ENV] = previousEntryPath;
-            else
-                delete process.env[OMX_ENTRY_PATH_ENV];
-            if (typeof previousStartupCwd === 'string')
-                process.env[OMX_STARTUP_CWD_ENV] = previousStartupCwd;
-            else
-                delete process.env[OMX_STARTUP_CWD_ENV];
             await rm(cwd, { recursive: true, force: true });
-            await rm(startupCwd, { recursive: true, force: true });
         }
     });
-    it('restores standalone HUD panes with the packaged CLI entry when argv1 is not the OMX CLI', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-noncli-hud-'));
-        const previousArgv = process.argv;
+    it('retains restored-HUD debt for a same-ID/PID non-HUD replacement after leader authorization', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-restored-hud-final-command-change-'));
         try {
-            await withMockTmuxFixture('omx-tmux-noncli-standalone-hud-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-restored-hud-final-command-change-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "\${1:-}" in
+  list-panes)
+    if [ "$2" = '-a' ]; then
+      printf '%%11\\t0\\t2000000011\\n%%44\\t0\\t2000000044\\n'
+    elif [ -f "${logPath}.leader-authorized" ]; then
+      printf "%%11\\tzsh\\tzsh\\n%%44\\tnode\\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%%other' /node /omx.js hud --watch\\n"
+    else
+      printf "%%11\\tzsh\\tzsh\\n%%44\\tnode\\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%%11' /node /omx.js hud --watch\\n"
+    fi
+    ;;
+  show-option)
+    : > "${logPath}.leader-authorized"
+    echo 'team:restore-final-command-change'
+    ;;
+esac
+`, async ({ logPath }) => {
+                const debtPath = join(cwd, '.omx', 'state', '.restored-hud-cleanup-debt.json');
+                await mkdir(dirname(debtPath), { recursive: true });
+                await writeFile(debtPath, `${JSON.stringify({
+                    schema_version: 1,
+                    operation: 'restored_hud_cleanup',
+                    pane_id: '%44',
+                    pane_pid: 2000000044,
+                    leader_pane_id: '%11',
+                    leader_pane_pid: 2000000011,
+                    leader_pane_owner_id: 'team:restore-final-command-change',
+                    hud_owner_leader_pane_id: '%11',
+                })}\n`);
+                assert.throws(() => finalizeRestoredHudCleanupDebtSync(cwd, '%44', 2000000044), /restored_hud_cleanup_debt_unresolved:%44/);
+                await readFile(debtPath, 'utf-8');
+                const commands = (await readFile(logPath, 'utf-8')).trim().split('\n').filter(Boolean);
+                const topologyIndex = commands.findIndex((command) => command.startsWith('list-panes -t %11 -F '));
+                const ownerIndex = commands.findIndex((command) => command === 'show-option -qv -p -t %11 @omx_team_pane_owner_id');
+                assert.ok(ownerIndex >= 0 && topologyIndex > ownerIndex);
+                assert.equal(commands.slice(topologyIndex + 1).filter((command) => command.startsWith('list-panes -a ')).length, 0);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('replays only a pinned restored HUD with continuous leader owner and HUD identity', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-restored-hud-replay-'));
+        try {
+            await withMockTmuxFixture('omx-restored-hud-replay-', (logPath) => {
+                const statePath = `${logPath}.killed`;
+                return `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "\${1:-}" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      printf '%%11\\t0\\t2000000011\\n'
+      if [ ! -f "${statePath}" ]; then printf '%%44\\t0\\t2000000044\\n'; fi
+    else
+      printf '%%11\\tzsh\\tzsh\\n'
+      if [ ! -f "${statePath}" ]; then printf "%%44\\tnode\\texec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%%11' /node /omx.js hud --watch\\n"; fi
+    fi
+    ;;
+  show-option)
+    if [ "$5" = "%11" ] && [ "$6" = "@omx_team_pane_owner_id" ]; then
+      printf 'team:restore-replay\n'
+    else
+      exit 1
+    fi
+    ;;
+  kill-pane) : > "${statePath}" ;;
+esac
+`;
+            }, async ({ logPath }) => {
+                const debtPath = join(cwd, '.omx', 'state', '.restored-hud-cleanup-debt.json');
+                await mkdir(dirname(debtPath), { recursive: true });
+                await writeFile(debtPath, `${JSON.stringify({
+                    schema_version: 1,
+                    operation: 'restored_hud_cleanup',
+                    pane_id: '%44',
+                    pane_pid: 2000000044,
+                    leader_pane_id: '%11',
+                    leader_pane_pid: 2000000011,
+                    leader_pane_owner_id: 'team:restore-replay',
+                    hud_owner_leader_pane_id: '%11',
+                })}\n`);
+                reconcileRestoredHudCleanupDebtSync(cwd);
+                await assert.rejects(() => readFile(debtPath, 'utf-8'));
+                const tmuxLog = await readFile(logPath, 'utf-8');
+                assert.match(tmuxLog, /kill-pane -t %44/);
+                assert.match(tmuxLog, /list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}\nlist-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}\nshow-option -qv -p -t %11 @omx_team_pane_owner_id\nlist-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}\nlist-panes -t %11 -F #\{pane_id\}\t#\{pane_current_command\}\t#\{pane_start_command\}/);
+                assert.match(tmuxLog, /list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}\nlist-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}\nshow-option -qv -p -t %11 @omx_team_pane_owner_id\nlist-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}\nlist-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}\nkill-pane -t %44\nlist-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}/);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('restores standalone HUD panes from the live leader pane cwd with explicit session ownership', async () => {
+        const teamLaunchCwd = await mkdtemp(join(tmpdir(), 'omx-standalone-team-launch-cwd-'));
+        const leaderPaneCwd = await mkdtemp(join(tmpdir(), 'omx-standalone-leader-pane-cwd-'));
+        try {
+            await withMockTmuxFixture('omx-tmux-leader-cwd-standalone-hud-', (logPath) => `#!/bin/sh
 set -eu
 printf '%s\\n' "$*" >> "${logPath}"
 case "\${1:-}" in
+  display-message)
+    case "$*" in
+      *"#{pane_current_path}"*)
+        echo "${leaderPaneCwd}"
+        ;;
+    esac
+    exit 0
+    ;;
   split-window)
     echo "%44"
     exit 0
@@ -5044,159 +6257,991 @@ case "\${1:-}" in
     ;;
 esac
 `, async ({ logPath }) => {
-                process.argv = [previousArgv[0] || 'node', '/tmp/codex-host-binary'];
-                const paneId = restoreStandaloneHudPane('%11', cwd);
+                const paneId = restoreStandaloneHudPane('%11', teamLaunchCwd, {
+                    sessionId: 'current-session-for-hud',
+                });
                 assert.equal(paneId, '%44');
                 const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, /dist\/cli\/omx\.js' hud --watch/);
-                assert.doesNotMatch(tmuxLog, /\/tmp\/codex-host-binary' hud --watch/);
-                assert.match(tmuxLog, /exec env OMX_TMUX_HUD_OWNER=1 .*hud --watch/);
+                assert.match(tmuxLog, /display-message -p -t %11 #\{pane_current_path\}/);
+                assert.match(tmuxLog, new RegExp(`split-window -v -l ${HUD_TMUX_TEAM_HEIGHT_LINES} -t %11 -d -P -F #\\{pane_id\\} -c ${escapeRegExp(leaderPaneCwd)} `));
+                assert.doesNotMatch(tmuxLog, new RegExp(`split-window .* -c ${escapeRegExp(teamLaunchCwd)} `));
+                assert.match(tmuxLog, /exec env OMX_SESSION_ID='current-session-for-hud' OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%11' .*hud --watch/);
             });
         }
         finally {
-            process.argv = previousArgv;
-            await rm(cwd, { recursive: true, force: true });
+            await rm(teamLaunchCwd, { recursive: true, force: true });
+            await rm(leaderPaneCwd, { recursive: true, force: true });
         }
     });
-    it('restores standalone HUD panes with OMX_ROOT forwarded and shell-escaped', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-root-hud-'));
-        const previousOmxRoot = process.env.OMX_ROOT;
+    it('falls back to the team launch cwd when the live leader pane cwd is unusable', async () => {
+        const teamLaunchCwd = await mkdtemp(join(tmpdir(), 'omx-standalone-team-launch-cwd-fallback-'));
+        const deletedLeaderPaneCwd = await mkdtemp(join(tmpdir(), 'omx-standalone-deleted-leader-pane-cwd-'));
+        await rm(deletedLeaderPaneCwd, { recursive: true, force: true });
         try {
-            await withMockTmuxFixture('omx-tmux-root-standalone-hud-', (logPath) => `#!/bin/sh
+            await withMockTmuxFixture('omx-tmux-deleted-leader-cwd-standalone-hud-', (logPath) => `#!/bin/sh
 set -eu
 printf '%s\\n' "$*" >> "${logPath}"
 case "\${1:-}" in
+  display-message)
+    case "$*" in
+      *"#{pane_current_path}"*)
+        echo "${deletedLeaderPaneCwd}"
+        ;;
+    esac
+    exit 0
+    ;;
   split-window)
-    echo "%44"
+    case "$*" in
+      *"-c ${teamLaunchCwd} "*)
+        echo "%44"
+        exit 0
+        ;;
+      *"-c ${deletedLeaderPaneCwd} "*)
+        echo "deleted cwd should not be used" >&2
+        exit 1
+        ;;
+      *)
+        echo "unexpected cwd: $*" >&2
+        exit 1
+        ;;
+    esac
+    ;;
+  run-shell|select-pane|resize-pane|set-hook)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, async ({ logPath }) => {
+                const paneId = restoreStandaloneHudPane('%11', teamLaunchCwd, {
+                    sessionId: 'current-session-for-hud',
+                });
+                assert.equal(paneId, '%44');
+                const tmuxLog = await readFile(logPath, 'utf-8');
+                assert.match(tmuxLog, /display-message -p -t %11 #\{pane_current_path\}/);
+                assert.match(tmuxLog, new RegExp(`split-window -v -l ${HUD_TMUX_TEAM_HEIGHT_LINES} -t %11 -d -P -F #\\{pane_id\\} -c ${escapeRegExp(teamLaunchCwd)} `));
+                assert.doesNotMatch(tmuxLog, new RegExp(`split-window .* -c ${escapeRegExp(deletedLeaderPaneCwd)} `));
+                assert.match(tmuxLog, /select-pane -t %11/);
+            });
+        }
+        finally {
+            await rm(teamLaunchCwd, { recursive: true, force: true });
+        }
+    });
+    it('keeps MSYS drive-style live leader cwd candidates without raw stat prefiltering', async () => {
+        const liveLeaderCwd = '/c/live';
+        const fallbackCwd = 'C:\\fallback';
+        const fakeCygpathDir = await mkdtemp(join(tmpdir(), 'omx-msys-live-cygpath-'));
+        const previousPath = process.env.PATH;
+        const previousMsystem = process.env.MSYSTEM;
+        const previousOstype = process.env.OSTYPE;
+        const previousWsl = process.env.WSL_DISTRO_NAME;
+        const previousWslInterop = process.env.WSL_INTEROP;
+        const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+        const statCalls = [];
+        try {
+            const cygpathPath = join(fakeCygpathDir, 'cygpath');
+            await writeFile(cygpathPath, '#!/bin/sh\nprintf "%s\\n" "$2"\n');
+            await chmod(cygpathPath, 0o755);
+            process.env.PATH = `${fakeCygpathDir}:${previousPath ?? ''}`;
+            process.env.MSYSTEM = 'MINGW64';
+            process.env.OSTYPE = 'msys';
+            delete process.env.WSL_DISTRO_NAME;
+            delete process.env.WSL_INTEROP;
+            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+            await withMockTmuxFixture('omx-tmux-msys-live-cwd-standalone-hud-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "\${1:-}" in
+  display-message)
+    case "$*" in
+      *"#{pane_current_path}"*)
+        echo "${liveLeaderCwd}"
+        ;;
+    esac
+    exit 0
+    ;;
+  split-window)
+    case "$*" in
+      *"-c ${liveLeaderCwd} "*)
+        echo "%44"
+        exit 0
+        ;;
+      *"-c ${fallbackCwd} "*)
+        echo "fallback cwd should not be used when MSYS live cwd succeeds" >&2
+        exit 1
+        ;;
+      *)
+        echo "unexpected cwd: $*" >&2
+        exit 1
+        ;;
+    esac
+    ;;
+  run-shell|select-pane|resize-pane|set-hook)
+    exit 0
+    ;;
+  *)
     exit 0
     ;;
-  run-shell|select-pane|resize-pane|set-hook)
-    exit 0
+esac
+`, async ({ logPath }) => {
+                const paneId = withMockedStatSync(((pathLike) => {
+                    const value = String(pathLike);
+                    statCalls.push(value);
+                    if (value === fallbackCwd)
+                        return { isDirectory: () => true };
+                    return { isDirectory: () => false };
+                }), () => restoreStandaloneHudPane('%11', fallbackCwd, { sessionId: 'current-session-for-hud' }));
+                assert.equal(paneId, '%44');
+                assert.equal(statCalls.includes(liveLeaderCwd), false);
+                assert.equal(statCalls.includes(fallbackCwd), true);
+                const tmuxLog = await readFile(logPath, 'utf-8');
+                assert.match(tmuxLog, /display-message -p -t %11 #\{pane_current_path\}/);
+                assert.match(tmuxLog, new RegExp(`split-window -v -l ${HUD_TMUX_TEAM_HEIGHT_LINES} -t %11 -d -P -F #\\{pane_id\\} -c ${escapeRegExp(liveLeaderCwd)} `));
+                assert.doesNotMatch(tmuxLog, new RegExp(`split-window .* -c ${escapeRegExp(fallbackCwd)} `));
+                assert.match(tmuxLog, /select-pane -t %11/);
+            });
+        }
+        finally {
+            if (originalPlatform)
+                Object.defineProperty(process, 'platform', originalPlatform);
+            if (typeof previousPath === 'string')
+                process.env.PATH = previousPath;
+            else
+                delete process.env.PATH;
+            if (typeof previousMsystem === 'string')
+                process.env.MSYSTEM = previousMsystem;
+            else
+                delete process.env.MSYSTEM;
+            if (typeof previousOstype === 'string')
+                process.env.OSTYPE = previousOstype;
+            else
+                delete process.env.OSTYPE;
+            if (typeof previousWsl === 'string')
+                process.env.WSL_DISTRO_NAME = previousWsl;
+            else
+                delete process.env.WSL_DISTRO_NAME;
+            if (typeof previousWslInterop === 'string')
+                process.env.WSL_INTEROP = previousWslInterop;
+            else
+                delete process.env.WSL_INTEROP;
+            await rm(fakeCygpathDir, { recursive: true, force: true });
+        }
+    });
+    it('falls back after an unusable MSYS drive-style live leader cwd split attempt fails', async () => {
+        const liveLeaderCwd = '/c/deleted-live';
+        const fallbackCwd = 'C:\\fallback';
+        const fakeCygpathDir = await mkdtemp(join(tmpdir(), 'omx-msys-deleted-live-cygpath-'));
+        const previousPath = process.env.PATH;
+        const previousMsystem = process.env.MSYSTEM;
+        const previousOstype = process.env.OSTYPE;
+        const previousWsl = process.env.WSL_DISTRO_NAME;
+        const previousWslInterop = process.env.WSL_INTEROP;
+        const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+        const statCalls = [];
+        try {
+            const cygpathPath = join(fakeCygpathDir, 'cygpath');
+            await writeFile(cygpathPath, '#!/bin/sh\nprintf "%s\\n" "$2"\n');
+            await chmod(cygpathPath, 0o755);
+            process.env.PATH = `${fakeCygpathDir}:${previousPath ?? ''}`;
+            process.env.MSYSTEM = 'MINGW64';
+            process.env.OSTYPE = 'msys';
+            delete process.env.WSL_DISTRO_NAME;
+            delete process.env.WSL_INTEROP;
+            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+            await withMockTmuxFixture('omx-tmux-msys-deleted-live-cwd-standalone-hud-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "\${1:-}" in
+  display-message)
+    case "$*" in
+      *"#{pane_current_path}"*)
+        echo "${liveLeaderCwd}"
+        ;;
+    esac
+    exit 0
+    ;;
+  split-window)
+    case "$*" in
+      *"-c ${liveLeaderCwd} "*)
+        echo "deleted live cwd cannot be used" >&2
+        exit 1
+        ;;
+      *"-c ${fallbackCwd} "*)
+        echo "%44"
+        exit 0
+        ;;
+      *)
+        echo "unexpected cwd: $*" >&2
+        exit 1
+        ;;
+    esac
+    ;;
+  run-shell|select-pane|resize-pane|set-hook)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, async ({ logPath }) => {
+                const paneId = withMockedStatSync(((pathLike) => {
+                    const value = String(pathLike);
+                    statCalls.push(value);
+                    if (value === fallbackCwd)
+                        return { isDirectory: () => true };
+                    return { isDirectory: () => false };
+                }), () => restoreStandaloneHudPane('%11', fallbackCwd, { sessionId: 'current-session-for-hud' }));
+                assert.equal(paneId, '%44');
+                assert.equal(statCalls.includes(liveLeaderCwd), false);
+                assert.equal(statCalls.includes(fallbackCwd), true);
+                const tmuxLog = await readFile(logPath, 'utf-8');
+                const liveAttemptIndex = tmuxLog.indexOf(`-c ${liveLeaderCwd} `);
+                const fallbackAttemptIndex = tmuxLog.indexOf(`-c ${fallbackCwd} `);
+                assert.ok(liveAttemptIndex >= 0, 'deleted MSYS live cwd should still be attempted');
+                assert.ok(fallbackAttemptIndex > liveAttemptIndex, 'fallback should be attempted after live split failure');
+                assert.match(tmuxLog, /select-pane -t %11/);
+            });
+        }
+        finally {
+            if (originalPlatform)
+                Object.defineProperty(process, 'platform', originalPlatform);
+            if (typeof previousPath === 'string')
+                process.env.PATH = previousPath;
+            else
+                delete process.env.PATH;
+            if (typeof previousMsystem === 'string')
+                process.env.MSYSTEM = previousMsystem;
+            else
+                delete process.env.MSYSTEM;
+            if (typeof previousOstype === 'string')
+                process.env.OSTYPE = previousOstype;
+            else
+                delete process.env.OSTYPE;
+            if (typeof previousWsl === 'string')
+                process.env.WSL_DISTRO_NAME = previousWsl;
+            else
+                delete process.env.WSL_DISTRO_NAME;
+            if (typeof previousWslInterop === 'string')
+                process.env.WSL_INTEROP = previousWslInterop;
+            else
+                delete process.env.WSL_INTEROP;
+            await rm(fakeCygpathDir, { recursive: true, force: true });
+        }
+    });
+    it('restores standalone HUD panes with an absolute OMX entry path after cwd drift', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-relative-hud-'));
+        const startupCwd = await mkdtemp(join(tmpdir(), 'omx-standalone-relative-start-'));
+        const previousEntryPath = process.env[OMX_ENTRY_PATH_ENV];
+        const previousStartupCwd = process.env[OMX_STARTUP_CWD_ENV];
+        const previousArgv = process.argv;
+        try {
+            const launcherDir = join(startupCwd, 'dist', 'cli');
+            const launcherPath = join(launcherDir, 'omx.js');
+            await mkdir(launcherDir, { recursive: true });
+            await writeFile(launcherPath, '#!/usr/bin/env node\n');
+            await withMockTmuxFixture('omx-tmux-relative-standalone-hud-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "\${1:-}" in
+  split-window)
+    echo "%44"
+    exit 0
+    ;;
+  run-shell|select-pane|resize-pane|set-hook)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, async ({ logPath }) => {
+                delete process.env[OMX_ENTRY_PATH_ENV];
+                process.env[OMX_STARTUP_CWD_ENV] = startupCwd;
+                process.argv = [previousArgv[0] || 'node', 'dist/cli/omx.js'];
+                const paneId = restoreStandaloneHudPane('%11', cwd);
+                assert.equal(paneId, '%44');
+                const tmuxLog = await readFile(logPath, 'utf-8');
+                assert.match(tmuxLog, new RegExp(escapeRegExp(launcherPath)));
+                assert.doesNotMatch(tmuxLog, /'dist\/cli\/omx\.js' hud --watch/);
+                assert.match(tmuxLog, /exec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%11' .*hud --watch/);
+            });
+        }
+        finally {
+            process.argv = previousArgv;
+            if (typeof previousEntryPath === 'string')
+                process.env[OMX_ENTRY_PATH_ENV] = previousEntryPath;
+            else
+                delete process.env[OMX_ENTRY_PATH_ENV];
+            if (typeof previousStartupCwd === 'string')
+                process.env[OMX_STARTUP_CWD_ENV] = previousStartupCwd;
+            else
+                delete process.env[OMX_STARTUP_CWD_ENV];
+            await rm(cwd, { recursive: true, force: true });
+            await rm(startupCwd, { recursive: true, force: true });
+        }
+    });
+    it('restores standalone HUD panes with the packaged CLI entry when argv1 is not the OMX CLI', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-noncli-hud-'));
+        const previousArgv = process.argv;
+        try {
+            await withMockTmuxFixture('omx-tmux-noncli-standalone-hud-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "\${1:-}" in
+  split-window)
+    echo "%44"
+    exit 0
+    ;;
+  run-shell|select-pane|resize-pane|set-hook)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, async ({ logPath }) => {
+                process.argv = [previousArgv[0] || 'node', '/tmp/codex-host-binary'];
+                const paneId = restoreStandaloneHudPane('%11', cwd);
+                assert.equal(paneId, '%44');
+                const tmuxLog = await readFile(logPath, 'utf-8');
+                assert.match(tmuxLog, /dist\/cli\/omx\.js' hud --watch/);
+                assert.doesNotMatch(tmuxLog, /\/tmp\/codex-host-binary' hud --watch/);
+                assert.match(tmuxLog, /exec env OMX_TMUX_HUD_OWNER=1 .*hud --watch/);
+            });
+        }
+        finally {
+            process.argv = previousArgv;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('restores standalone HUD panes with OMX_ROOT forwarded and shell-escaped', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-standalone-root-hud-'));
+        const previousOmxRoot = process.env.OMX_ROOT;
+        try {
+            await withMockTmuxFixture('omx-tmux-root-standalone-hud-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "\${1:-}" in
+  split-window)
+    echo "%44"
+    exit 0
+    ;;
+  run-shell|select-pane|resize-pane|set-hook)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, async ({ logPath }) => {
+                process.env.OMX_ROOT = "/tmp/boxed root/it's/$(literal)";
+                const paneId = restoreStandaloneHudPane('%11', cwd);
+                assert.equal(paneId, '%44');
+                const tmuxLog = await readFile(logPath, 'utf-8');
+                assert.match(tmuxLog, /exec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%11' OMX_ROOT='\/tmp\/boxed root\/it'\\''s\/\$\(literal\)' .*hud --watch/);
+            });
+        }
+        finally {
+            if (typeof previousOmxRoot === 'string')
+                process.env.OMX_ROOT = previousOmxRoot;
+            else
+                delete process.env.OMX_ROOT;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+});
+describe('dismissTrustPromptIfPresent capture shape', () => {
+    it('uses visible capture-pane argv without tail flags', async () => {
+        const previousAutoTrust = process.env.OMX_TEAM_AUTO_TRUST;
+        delete process.env.OMX_TEAM_AUTO_TRUST;
+        try {
+            await withMockTmuxFixture('omx-tmux-dismiss-trust-visible-capture-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  capture-pane)
+    cat <<'EOF'
+Do you trust the contents of this directory?
+Press enter to continue
+EOF
+    exit 0
+    ;;
+  send-keys)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, async ({ logPath }) => {
+                assert.equal(dismissTrustPromptIfPresent('omx-team-x', 1), true);
+                const log = await readFile(logPath, 'utf-8');
+                assert.match(log, /capture-pane -t omx-team-x:1 -p/);
+                assert.doesNotMatch(log, /capture-pane -t omx-team-x:1 -p -S/);
+            });
+        }
+        finally {
+            if (typeof previousAutoTrust === 'string')
+                process.env.OMX_TEAM_AUTO_TRUST = previousAutoTrust;
+            else
+                delete process.env.OMX_TEAM_AUTO_TRUST;
+        }
+    });
+    it('does not send trust controls to a pane ID reused after capture', async () => {
+        const previousAutoTrust = process.env.OMX_TEAM_AUTO_TRUST;
+        delete process.env.OMX_TEAM_AUTO_TRUST;
+        try {
+            await withMockTmuxFixture('omx-tmux-dismiss-trust-pid-reuse-', (logPath) => `#!/bin/sh
+set -eu
+state_dir="$(dirname "${logPath}")"
+proof_count_file="$state_dir/proof-count"
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    count=0
+    if [ -f "$proof_count_file" ]; then count=$(cat "$proof_count_file"); fi
+    count=$((count + 1))
+    printf '%s' "$count" > "$proof_count_file"
+    if [ "$count" -eq 1 ]; then
+      printf '%%9\t0\t2000000001\n'
+    elif [ "$count" -le 2 ]; then
+      printf '%%9\t0\t2000000001\n'
+    else
+      printf '%%9\t0\t2000000002\n'
+    fi
+    ;;
+  show-option)
+    printf 'team:test\n'
+    ;;
+  capture-pane)
+    cat <<'EOF'
+Do you trust the contents of this directory?
+Press enter to continue
+EOF
+    ;;
+  -V) exit 0 ;;
+  send-keys) exit 1 ;;
+  *) exit 1 ;;
+esac
+`, async ({ logPath }) => {
+                assert.throws(() => dismissTrustPromptIfPresent('ignored-session', 1, '%9', 2000000001, 'team:test', '%10'), /tmux pane identity changed: %9/);
+                const log = await readFile(logPath, 'utf-8');
+                assert.match(log, /capture-pane -t %9 -p/);
+                assert.doesNotMatch(log, /send-keys -t %9/);
+            });
+        }
+        finally {
+            if (typeof previousAutoTrust === 'string')
+                process.env.OMX_TEAM_AUTO_TRUST = previousAutoTrust;
+            else
+                delete process.env.OMX_TEAM_AUTO_TRUST;
+        }
+    });
+    it('fails closed without emitting trust controls when an explicit pane lacks a PID', async () => {
+        await withMockTmuxFixture('omx-tmux-dismiss-trust-missing-pid-', (logPath) => `#!/bin/sh
+printf '%s\\n' "$*" >> "${logPath}"
+[ "$1" = "-V" ] && exit 0
+exit 1
+`, async ({ logPath }) => {
+            assert.equal(dismissTrustPromptIfPresent('ignored-session', 1, '%9'), false);
+            const log = await readFile(logPath, 'utf-8');
+            assert.doesNotMatch(log, /capture-pane|send-keys|list-panes/);
+        });
+    });
+});
+describe('dismissTrustPromptIfPresent', () => {
+    it('returns false when tmux is unavailable', () => {
+        withEmptyPath(() => {
+            assert.equal(dismissTrustPromptIfPresent('omx-team-x', 1), false);
+        });
+    });
+    it('returns false when OMX_TEAM_AUTO_TRUST is disabled', () => {
+        const prev = process.env.OMX_TEAM_AUTO_TRUST;
+        process.env.OMX_TEAM_AUTO_TRUST = '0';
+        try {
+            assert.equal(dismissTrustPromptIfPresent('omx-team-x', 1), false);
+        }
+        finally {
+            if (typeof prev === 'string')
+                process.env.OMX_TEAM_AUTO_TRUST = prev;
+            else
+                delete process.env.OMX_TEAM_AUTO_TRUST;
+        }
+    });
+    it('returns false when OMX_TEAM_AUTO_TRUST is unset (auto-trust enabled) but tmux unavailable', () => {
+        const prev = process.env.OMX_TEAM_AUTO_TRUST;
+        delete process.env.OMX_TEAM_AUTO_TRUST;
+        try {
+            withEmptyPath(() => {
+                assert.equal(dismissTrustPromptIfPresent('omx-team-x', 1), false);
+            });
+        }
+        finally {
+            if (typeof prev === 'string')
+                process.env.OMX_TEAM_AUTO_TRUST = prev;
+        }
+    });
+});
+describe('isWorkerAlive', () => {
+    it('does not require pane_current_command to match "codex"', () => {
+        // This was a real failure mode: tmux reports pane_current_command=node for the Codex TUI,
+        // which caused workers to be treated as dead and the leader to clean up state too early.
+        withEmptyPath(() => {
+            assert.equal(isWorkerAlive('omx-team-x', 1), false);
+        });
+    });
+    it('treats blank persisted pane IDs as absent and uses the compatibility target', async () => {
+        await withMockTmuxFixture('omx-blank-pane-fallback-', () => `#!/bin/sh
+if [ "$1" = "list-panes" ] && [ "$2" = "-t" ]; then printf '0 %s\n' "$PPID"; exit 0; fi
+exit 1
+`, async () => {
+            assert.equal(isWorkerAlive('compat-session', 1, ''), true);
+            assert.equal(isWorkerAlive('compat-session', 1, '   '), true);
+        });
+    });
+    it('treats EPERM liveness probes as unknown and emits no async kill controls', async () => {
+        await withMockTmuxFixture('omx-worker-liveness-eperm-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then printf '%%77\t0\t%s\n' "$PPID"; exit 0; fi
+    if [ "$2" = "-t" ]; then printf '0 %s\n' "$PPID"; exit 0; fi
+    exit 1
+    ;;
+  show-option) printf 'team:liveness\n'; exit 0 ;;
+  *) exit 1 ;;
+esac
+`, async ({ logPath }) => {
+            const originalProcessKill = process.kill;
+            process.kill = ((pid, signal) => {
+                if (pid === process.pid && signal === 0) {
+                    const error = new Error('permission denied');
+                    error.code = 'EPERM';
+                    throw error;
+                }
+                return originalProcessKill(pid, signal);
+            });
+            try {
+                assert.equal(isWorkerAlive('compat-session', 1), true);
+                assert.equal(isWorkerAlive('ignored-session', 1, '%77', process.pid, 'team:liveness'), true);
+                await killWorker('ignored-session', 1, '%77', undefined, process.pid, 'team:liveness');
+            }
+            finally {
+                process.kill = originalProcessKill;
+            }
+            const log = await readFile(logPath, 'utf-8');
+            assert.doesNotMatch(log, /send-keys -t %77|kill-pane -t %77/);
+        });
+    });
+    it('treats only ESRCH as a gone process', async () => {
+        await withMockTmuxFixture('omx-worker-liveness-esrch-', () => `#!/bin/sh
+case "$1" in
+  list-panes)
+    if [ "$2" = "-a" ]; then printf '%%77\t0\t%s\n' "$PPID"; exit 0; fi
+    if [ "$2" = "-t" ]; then printf '0 %s\n' "$PPID"; exit 0; fi
+    exit 1
+    ;;
+  show-option) printf 'team:liveness\n'; exit 0 ;;
+  *) exit 1 ;;
+esac
+`, async () => {
+            const originalProcessKill = process.kill;
+            process.kill = ((pid, signal) => {
+                if (pid === process.pid && signal === 0) {
+                    const error = new Error('no such process');
+                    error.code = 'ESRCH';
+                    throw error;
+                }
+                return originalProcessKill(pid, signal);
+            });
+            try {
+                assert.equal(isWorkerAlive('compat-session', 1), false);
+                assert.equal(isWorkerAlive('ignored-session', 1, '%77', process.pid, 'team:liveness'), false);
+            }
+            finally {
+                process.kill = originalProcessKill;
+            }
+        });
+    });
+    it('uses the exact global row for explicit pane liveness and fails closed for dead rows', async () => {
+        await withMockTmuxFixture('omx-pane-id-liveness-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "${logPath}"
+case "\${1:-}" in
+  list-panes)
+    if [ "$2" = "-a" ]; then
+      printf '%%77\t0\t%s\n%%88\t1\t1\n' "$PPID"
+      exit 0
+    fi
+    exit 1
+    ;;
+  show-option)
+    printf 'team:liveness\n'
+    ;;
+  *)
+    exit 1
+    ;;
+esac
+`, async () => {
+            assert.equal(isWorkerAlive('ignored-session', 1, '%77', process.pid, 'team:liveness'), true);
+            assert.equal(isWorkerPaneOpen('ignored-session', 1, '%77', process.pid, 'team:liveness'), true);
+            assert.equal(isWorkerAlive('ignored-session', 2, '%88', 1, 'team:liveness'), false);
+            assert.equal(isWorkerPaneOpen('ignored-session', 2, '%88', 1, 'team:liveness'), false);
+        });
+    });
+});
+describe('exact global pane proof contract', () => {
+    it('matches only exact pane IDs and distinguishes live, dead, and absent rows', async () => {
+        const pane13Pid = 13013;
+        const pane130Pid = 130130;
+        await withMockTmuxFixture('omx-exact-pane-rows-', () => `#!/bin/sh
+set -eu
+case "$1" in
+  list-panes)
+    printf '%%13\t0\t%s\n%%130\t0\t%s\n%%9\t1\t1\n' "${pane13Pid}" "${pane130Pid}"
+    ;;
+  show-option)
+    printf 'team:rows\n'
+    ;;
+  *)
+    exit 1
+    ;;
+esac
+`, async () => {
+            assert.deepEqual(readExactPaneProofSync('%1'), { status: 'gone', paneId: '%1', reason: 'absent' });
+            assert.deepEqual(readExactPaneProofSync('%9'), { status: 'gone', paneId: '%9', reason: 'dead' });
+            assert.deepEqual(readExactPaneProofSync('%404'), { status: 'gone', paneId: '%404', reason: 'absent' });
+            assert.deepEqual(await readExactPaneProof('%13'), {
+                status: 'live',
+                paneId: '%13',
+                pid: pane13Pid,
+            });
+            assert.deepEqual(await readExactPaneProof('%130'), {
+                status: 'live',
+                paneId: '%130',
+                pid: pane130Pid,
+            });
+            assert.equal(getWorkerPanePid('ignored-session', 1, '%13', pane13Pid, 'team:rows'), pane13Pid);
+            assert.equal(getWorkerPanePid('ignored-session', 1, '%130', pane130Pid, 'team:rows'), pane130Pid);
+        });
+    });
+    it('fails closed for command failures, malformed snapshots, and invalid IDs', async () => {
+        await withMockTmuxFixture('omx-exact-pane-malformed-', () => `#!/bin/sh
+set -eu
+if [ "$1" = "list-panes" ]; then
+  printf '%%1 0 1\n'
+fi
+`, async () => {
+            const malformed = readExactPaneProofSync('%1');
+            assert.equal(malformed.status, 'unavailable');
+            if (malformed.status === 'unavailable') {
+                assert.equal(malformed.reason, 'malformed_snapshot');
+            }
+            const invalid = await readExactPaneProof('not-a-pane');
+            assert.equal(invalid.status, 'unavailable');
+            if (invalid.status === 'unavailable') {
+                assert.equal(invalid.reason, 'invalid_pane_id');
+            }
+        });
+        await withMockTmuxFixture('omx-exact-pane-query-failure-', () => `#!/bin/sh
+set -eu
+if [ "$1" = "list-panes" ]; then
+  echo "tmux query failed" >&2
+  exit 1
+fi
+exit 1
+`, async () => {
+            const proof = await readExactPaneProof('%1');
+            assert.equal(proof.status, 'unavailable');
+            if (proof.status === 'unavailable') {
+                assert.equal(proof.reason, 'query_failed');
+            }
+        });
+    });
+    it('treats malformed PIDs in dead and unrelated global rows as malformed snapshots', async () => {
+        const proofStatePath = join(tmpdir(), `omx-exact-pane-invalid-pid-${process.pid}-${Date.now()}`);
+        await withMockTmuxFixture('omx-exact-pane-invalid-pid-', () => `#!/bin/sh
+set -eu
+if [ "$1" = "list-panes" ]; then
+  if [ -f "${proofStatePath}" ]; then
+    printf '%%1\t0\t2000000001\n%%99\t0\tnot-a-pid\n'
+  else
+    : > "${proofStatePath}"
+    printf '%%1\t0\t2000000001\n%%99\t1\tnot-a-pid\n'
+  fi
+fi
+`, async () => {
+            const deadRow = readExactPaneProofSync('%1');
+            assert.equal(deadRow.status, 'unavailable');
+            if (deadRow.status === 'unavailable')
+                assert.equal(deadRow.reason, 'malformed_snapshot');
+            const unrelatedRow = await readExactPaneProof('%1');
+            assert.equal(unrelatedRow.status, 'unavailable');
+            if (unrelatedRow.status === 'unavailable')
+                assert.equal(unrelatedRow.reason, 'malformed_snapshot');
+        });
+        await rm(proofStatePath, { force: true });
+    });
+    it('does not fall back to a session target or issue effects for an unproven explicit ID', async () => {
+        await withMockTmuxFixture('omx-exact-pane-no-fallback-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    printf '%%13\t0\t%s\n' "$PPID"
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, async ({ logPath }) => {
+            assert.equal(getWorkerPanePid('ignored-session', 1, '%1'), null);
+            assert.equal(isWorkerAlive('ignored-session', 1, '%1'), false);
+            assert.equal(isWorkerPaneOpen('ignored-session', 1, '%1'), false);
+            await assert.rejects(() => sendToWorker('ignored-session', 1, 'check inbox', '%1'), /not proven live/);
+            await killWorker('ignored-session', 1, '%1');
+            killWorkerByPaneId('%1', 1);
+            await killWorkerByPaneIdAsync('%1', 1);
+            const log = fs.existsSync(logPath) ? await readFile(logPath, 'utf-8') : '';
+            assert.doesNotMatch(log, /list-panes -t ignored-session:1/);
+            assert.doesNotMatch(log, /send-keys/);
+            assert.doesNotMatch(log, /kill-pane/);
+        });
+    });
+    it('revalidates an explicit pane before every send effect', async () => {
+        await withMockTmuxFixture('omx-exact-pane-send-revalidation-', (logPath) => `#!/bin/sh
+set -eu
+state_dir="$(dirname "${logPath}")"
+count_file="$state_dir/list-count"
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    count=0
+    if [ -f "$count_file" ]; then count=$(cat "$count_file"); fi
+    count=$((count + 1))
+    printf '%s' "$count" > "$count_file"
+    if [ "$count" -le 4 ]; then
+      printf '%%9\t0\t%s\n' "$PPID"
+    fi
+    ;;
+  show-option)
+    printf 'team:test\n'
+    ;;
+  capture-pane)
+    cat <<'EOF'
+${READY_HELPER_CAPTURE}
+EOF
+    ;;
+  send-keys)
+    ;;
+  *)
+    exit 1
+    ;;
+esac
+`, async ({ logPath }) => {
+            await assert.rejects(() => sendToWorker('ignored-session', 1, 'check inbox', '%9', undefined, process.pid, 'team:test', '%10'), /not proven live/);
+            const commands = (await readFile(logPath, 'utf-8')).trim().split('\n').filter(Boolean);
+            const exactGlobalPaneProof = /^list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}$/;
+            const effects = commands
+                .map((command, index) => ({ command, index }))
+                .filter(({ command }) => /^(send-keys|kill-pane) -t %9\b/.test(command));
+            assert.ok(effects.length > 0, `expected an explicit pane effect in log:\n${commands.join('\n')}`);
+            for (const { command, index } of effects) {
+                assert.match(commands[index - 1] ?? '', exactGlobalPaneProof, `fresh proof must immediately precede ${command}`);
+            }
+            assert.match(commands.join('\n'), /send-keys -t %9 -l -- check inbox/);
+            assert.doesNotMatch(commands.join('\n'), /send-keys -t %9 C-m/);
+        });
+    });
+    it('pins an explicit pane PID through an adaptive retry and rejects later pane-ID reuse', async () => {
+        await withMockTmuxFixture('omx-exact-pane-send-retry-pid-pin-', (logPath) => `#!/bin/sh
+set -eu
+state_dir="$(dirname "${logPath}")"
+retry_file="$state_dir/retry"
+sent_file="$state_dir/sent"
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ -f "$retry_file" ]; then
+      printf '%%9\t0\t2000000002\n'
+
+    else
+      printf '%%9\t0\t2000000001\n'
+
+    fi
+    ;;
+  capture-pane)
+    if [ -f "$sent_file" ]; then
+      cat <<'EOF'
+${READY_HELPER_CAPTURE}
+
+› check inbox
+EOF
+    else
+      cat <<'EOF'
+${READY_HELPER_CAPTURE}
+
+• Running tests (esc to interrupt)
+EOF
+    fi
+    ;;
+  send-keys)
+    case "$*" in
+      *" -l -- check inbox") : > "$sent_file" ;;
+      *" C-u") : > "$retry_file" ;;
+    esac
     ;;
-  *)
-    exit 0
+  show-option)
+    printf 'team:test\n'
     ;;
+  *) exit 1 ;;
 esac
 `, async ({ logPath }) => {
-                process.env.OMX_ROOT = "/tmp/boxed root/it's/$(literal)";
-                const paneId = restoreStandaloneHudPane('%11', cwd);
-                assert.equal(paneId, '%44');
-                const tmuxLog = await readFile(logPath, 'utf-8');
-                assert.match(tmuxLog, /exec env OMX_TMUX_HUD_OWNER=1 OMX_TMUX_HUD_LEADER_PANE='%11' OMX_ROOT='\/tmp\/boxed root\/it'\\''s\/\$\(literal\)' .*hud --watch/);
-            });
-        }
-        finally {
-            if (typeof previousOmxRoot === 'string')
-                process.env.OMX_ROOT = previousOmxRoot;
-            else
-                delete process.env.OMX_ROOT;
-            await rm(cwd, { recursive: true, force: true });
-        }
+            await assert.rejects(() => sendToWorker('ignored-session', 1, 'check inbox', '%9', undefined, 2000000001, 'team:test', '%10'), /tmux pane identity changed: %9/);
+            const commands = await readFile(logPath, 'utf-8');
+            assert.match(commands, /send-keys -t %9 C-u/);
+            assert.equal((commands.match(/send-keys -t %9 -l -- check inbox/g) || []).length, 1, `the retry must not type into a reused pane:\n${commands}`);
+        });
     });
-});
-describe('dismissTrustPromptIfPresent capture shape', () => {
-    it('uses visible capture-pane argv without tail flags', async () => {
-        const previousAutoTrust = process.env.OMX_TEAM_AUTO_TRUST;
-        delete process.env.OMX_TEAM_AUTO_TRUST;
-        try {
-            await withMockTmuxFixture('omx-tmux-dismiss-trust-visible-capture-', (logPath) => `#!/bin/sh
+    it('rejects same-ID/PID owner takeover before worker input', async () => {
+        await withMockTmuxFixture('omx-exact-pane-send-owner-takeover-', (logPath) => `#!/bin/sh
 set -eu
+state_dir="$(dirname "${logPath}")"
+owner_count="$state_dir/owner-count"
 printf '%s\n' "$*" >> "${logPath}"
 case "$1" in
+  list-panes)
+    printf '%%9\t0\t%s\n' "$PPID"
+    ;;
+  show-option)
+    count=0
+    if [ -f "$owner_count" ]; then count=$(cat "$owner_count"); fi
+    count=$((count + 1))
+    printf '%s' "$count" > "$owner_count"
+    if [ "$count" -eq 1 ]; then printf 'team:expected\n'; else printf 'team:foreign\n'; fi
+    ;;
   capture-pane)
     cat <<'EOF'
-Do you trust the contents of this directory?
-Press enter to continue
+${READY_HELPER_CAPTURE}
 EOF
-    exit 0
     ;;
   send-keys)
-    exit 0
-    ;;
-  *)
-    exit 0
     ;;
+  *) exit 1 ;;
 esac
 `, async ({ logPath }) => {
-                assert.equal(dismissTrustPromptIfPresent('omx-team-x', 1), true);
-                const log = await readFile(logPath, 'utf-8');
-                assert.match(log, /capture-pane -t omx-team-x:1 -p/);
-                assert.doesNotMatch(log, /capture-pane -t omx-team-x:1 -p -S/);
-            });
-        }
-        finally {
-            if (typeof previousAutoTrust === 'string')
-                process.env.OMX_TEAM_AUTO_TRUST = previousAutoTrust;
-            else
-                delete process.env.OMX_TEAM_AUTO_TRUST;
-        }
-    });
-});
-describe('dismissTrustPromptIfPresent', () => {
-    it('returns false when tmux is unavailable', () => {
-        withEmptyPath(() => {
-            assert.equal(dismissTrustPromptIfPresent('omx-team-x', 1), false);
+            await assert.rejects(() => sendToWorker('ignored-session', 1, 'check inbox', '%9', undefined, process.pid, 'team:expected', '%10'), /team owner changed: %9/);
+            const commands = await readFile(logPath, 'utf-8');
+            assert.doesNotMatch(commands, /send-keys -t %9/);
         });
     });
-    it('returns false when OMX_TEAM_AUTO_TRUST is disabled', () => {
-        const prev = process.env.OMX_TEAM_AUTO_TRUST;
-        process.env.OMX_TEAM_AUTO_TRUST = '0';
-        try {
-            assert.equal(dismissTrustPromptIfPresent('omx-team-x', 1), false);
-        }
-        finally {
-            if (typeof prev === 'string')
-                process.env.OMX_TEAM_AUTO_TRUST = prev;
-            else
-                delete process.env.OMX_TEAM_AUTO_TRUST;
-        }
-    });
-    it('returns false when OMX_TEAM_AUTO_TRUST is unset (auto-trust enabled) but tmux unavailable', () => {
-        const prev = process.env.OMX_TEAM_AUTO_TRUST;
-        delete process.env.OMX_TEAM_AUTO_TRUST;
-        try {
-            withEmptyPath(() => {
-                assert.equal(dismissTrustPromptIfPresent('omx-team-x', 1), false);
-            });
-        }
-        finally {
-            if (typeof prev === 'string')
-                process.env.OMX_TEAM_AUTO_TRUST = prev;
-        }
-    });
-});
-describe('isWorkerAlive', () => {
-    it('does not require pane_current_command to match "codex"', () => {
-        // This was a real failure mode: tmux reports pane_current_command=node for the Codex TUI,
-        // which caused workers to be treated as dead and the leader to clean up state too early.
-        withEmptyPath(() => {
-            assert.equal(isWorkerAlive('omx-team-x', 1), false);
-        });
+    it('rejects an explicit worker target equal to the canonical HUD pane', async () => {
+        await assert.rejects(() => sendToWorker('ignored-session', 1, 'check inbox', '%9', undefined, process.pid, 'team:expected', '%9'), /HUD target: %9/);
     });
-    it('treats an existing non-dead pane id as live even when pane_pid is unavailable', async () => {
-        await withMockTmuxFixture('omx-pane-id-liveness-', (logPath) => `#!/bin/sh
+    it('revalidates an explicit pane before later kill effects', async () => {
+        await withMockTmuxFixture('omx-exact-pane-kill-revalidation-', (logPath) => `#!/bin/sh
 set -eu
+state_dir="$(dirname "${logPath}")"
+count_file="$state_dir/list-count"
 printf '%s\n' "$*" >> "${logPath}"
-case "\${1:-}" in
-  -V)
-    echo "tmux 3.4"
-    exit 0
-    ;;
+case "$1" in
   list-panes)
-    if [ "$2" = "-a" ]; then
-      printf "%%77 0 \\n%%88 1 \\n"
-      exit 0
+    count=0
+    if [ -f "$count_file" ]; then count=$(cat "$count_file"); fi
+    count=$((count + 1))
+    printf '%s' "$count" > "$count_file"
+    if [ "$count" -le 9 ]; then
+      printf '%%9\t0\t%s\n' "$PPID"
     fi
-    exit 1
+    ;;
+  show-option) printf 'team:kill-test\n' ;;
+  send-keys|kill-pane)
     ;;
   *)
     exit 1
     ;;
 esac
-`, async () => {
-            assert.equal(isWorkerAlive('ignored-session', 1, '%77'), true);
-            assert.equal(isWorkerPaneOpen('ignored-session', 1, '%77'), true);
-            assert.equal(isWorkerAlive('ignored-session', 2, '%88'), false);
+`, async ({ logPath }) => {
+            await killWorker('ignored-session', 1, '%9', undefined, process.pid, 'team:kill-test');
+            const commands = (await readFile(logPath, 'utf-8')).trim().split('\n').filter(Boolean);
+            const exactGlobalPaneProof = /^list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}$/;
+            const effects = commands
+                .map((command, index) => ({ command, index }))
+                .filter(({ command }) => /^(send-keys|kill-pane) -t %9\b/.test(command));
+            assert.ok(effects.length > 0, `expected an explicit pane effect in log:\n${commands.join('\n')}`);
+            for (const { command, index } of effects) {
+                assert.match(commands[index - 1] ?? '', exactGlobalPaneProof, `fresh proof must immediately precede ${command}`);
+            }
+            assert.match(commands.join('\n'), /send-keys -t %9 C-c/);
+            assert.match(commands.join('\n'), /send-keys -t %9 C-d/);
+            assert.doesNotMatch(commands.join('\n'), /kill-pane -t %9/);
+        });
+    });
+    it('pins an explicit pane PID through later control and kill effects', async () => {
+        await withMockTmuxFixture('omx-exact-pane-kill-pid-pin-', (logPath) => `#!/bin/sh
+set -eu
+state_dir="$(dirname "${logPath}")"
+exit_file="$state_dir/exit"
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ -f "$exit_file" ]; then
+      printf '%%9\t0\t%s\n' "$((PPID + 1))"
+    else
+      printf '%%9\t0\t%s\n' "$PPID"
+    fi
+    ;;
+  show-option) printf 'team:kill-test\n' ;;
+  send-keys)
+    case "$*" in
+      *" C-d") : > "$exit_file" ;;
+    esac
+    ;;
+  kill-pane) exit 0 ;;
+  *) exit 1 ;;
+esac
+`, async ({ logPath }) => {
+            await assert.rejects(() => killWorker('ignored-session', 1, '%9', undefined, process.pid, 'team:kill-test'), /tmux pane identity changed: %9/);
+            const commands = await readFile(logPath, 'utf-8');
+            assert.match(commands, /send-keys -t %9 C-c/);
+            assert.match(commands, /send-keys -t %9 C-d/);
+            assert.doesNotMatch(commands, /kill-pane -t %9/);
+        });
+    });
+    it('uses the pinned liveness proof PID without an unconstrained second proof', async () => {
+        await withMockTmuxFixture('omx-exact-pane-kill-liveness-pid-pin-', (logPath) => `#!/bin/sh
+set -eu
+state_dir="$(dirname "${logPath}")"
+count_file="$state_dir/list-count"
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    count=0
+    if [ -f "$count_file" ]; then count=$(cat "$count_file"); fi
+    count=$((count + 1))
+    printf '%s' "$count" > "$count_file"
+    if [ -f "$state_dir/killed" ]; then
+      :
+    elif [ "$count" -le 12 ]; then
+      printf '%%9\t0\t%s\n' "$PPID"
+    else
+      printf '%%9\t0\t999999999\n'
+    fi
+    ;;
+  show-option) printf 'team:kill-test\n' ;;
+  send-keys) ;;
+  kill-pane) : > "$state_dir/killed" ;;
+  *) exit 1 ;;
+esac
+`, async ({ logPath }) => {
+            await killWorker('ignored-session', 1, '%9', undefined, process.pid, 'team:kill-test');
+            const commands = await readFile(logPath, 'utf-8');
+            assert.match(commands, /send-keys -t %9 C-c/);
+            assert.match(commands, /send-keys -t %9 C-d/);
+            assert.equal((commands.match(/list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}/g) || []).length, 13, `liveness and effects must each use the pinned proof around owner authorization:\n${commands}`);
         });
     });
 });
@@ -5390,30 +7435,66 @@ describe('enableMouseScrolling', () => {
         }
     });
 });
-describe('killWorkerByPaneId leader pane guard', () => {
-    it('skips kill when workerPaneId matches leaderPaneId (guard fires before tmux is called)', () => {
-        // With empty PATH tmux is unavailable, so any actual kill-pane call would fail.
-        // When the guard fires (paneId === leaderPaneId) the function returns early
-        // without invoking tmux, so no error is thrown regardless of PATH.
+describe('killWorkerByPaneId exact PID guard', () => {
+    it('skips kill when workerPaneId matches leaderPaneId before tmux is called', () => {
         withEmptyPath(() => {
-            assert.doesNotThrow(() => killWorkerByPaneId('%5', '%5'));
+            assert.doesNotThrow(() => killWorkerByPaneId('%5', 5, '%5'));
         });
     });
-    it('does not skip kill when pane ids differ (falls through to tmux attempt)', () => {
-        // Different IDs: guard does not fire. tmux is unavailable but kill errors are swallowed internally.
+    it('requires a positive expected PID for an explicit direct pane kill', () => {
         withEmptyPath(() => {
-            assert.doesNotThrow(() => killWorkerByPaneId('%5', '%6'));
+            assert.doesNotThrow(() => killWorkerByPaneId('%5'));
+            assert.doesNotThrow(() => killWorkerByPaneId('%5', 0));
+            assert.doesNotThrow(() => killWorkerByPaneId('%5', -1));
         });
     });
-    it('skips kill for non-percent pane id without reaching tmux', () => {
+    it('keeps blank pane IDs as no-effect compatibility values', () => {
         withEmptyPath(() => {
-            assert.doesNotThrow(() => killWorkerByPaneId('invalid', '%5'));
+            assert.doesNotThrow(() => killWorkerByPaneId('', 5));
+            assert.doesNotThrow(() => killWorkerByPaneId('   ', 5));
         });
     });
-    it('skips kill when no leaderPaneId provided and pane id is valid percent id', () => {
-        // Without leaderPaneId the guard is not active; tmux call fails gracefully.
-        withEmptyPath(() => {
-            assert.doesNotThrow(() => killWorkerByPaneId('%5'));
+    it('does not kill a recycled pane ID when its current PID differs from the frozen PID', async () => {
+        await withMockTmuxFixture('omx-direct-kill-recycled-sync-', (logPath) => `#!/bin/sh
+printf '%s\\n' "$*" >> "${logPath}"
+if [ "$1" = "list-panes" ]; then
+  printf '%%5\t0\t222\n'
+elif [ "$1" = "show-option" ]; then
+  printf 'team:expected\n'
+fi
+`, async ({ logPath }) => {
+            killWorkerByPaneId('%5', 111, undefined, 'team:expected', '%6');
+            const log = await readFile(logPath, 'utf-8');
+            assert.match(log, /list-panes -a/);
+            assert.doesNotMatch(log, /kill-pane -t %5/);
+        });
+    });
+    it('does not kill a recycled pane ID asynchronously when its current PID differs from the frozen PID', async () => {
+        await withMockTmuxFixture('omx-direct-kill-recycled-async-', (logPath) => `#!/bin/sh
+printf '%s\\n' "$*" >> "${logPath}"
+if [ "$1" = "list-panes" ]; then
+  printf '%%5\t0\t222\n'
+elif [ "$1" = "show-option" ]; then
+  printf 'team:expected\n'
+fi
+`, async ({ logPath }) => {
+            await killWorkerByPaneIdAsync('%5', 111, undefined, 'team:expected', '%6');
+            const log = await readFile(logPath, 'utf-8');
+            assert.match(log, /list-panes -a/);
+            assert.doesNotMatch(log, /kill-pane -t %5/);
+        });
+    });
+    it('rejects unbound, HUD, and owner-taken-over direct kill targets without effects', async () => {
+        await withMockTmuxFixture('omx-direct-kill-owner-hud-', (logPath) => `#!/bin/sh
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes) printf '%%5\\t0\\t111\\n' ;;
+  show-option) printf 'team:foreign\\n' ;;
+esac`, async ({ logPath }) => {
+            killWorkerByPaneId('%5', 111);
+            killWorkerByPaneId('%5', 111, undefined, 'team:expected', '%5');
+            killWorkerByPaneId('%5', 111, undefined, 'team:expected', '%6');
+            assert.doesNotMatch(await readFile(logPath, 'utf8'), /kill-pane/);
         });
     });
 });
@@ -5496,6 +7577,21 @@ esac
             assert.doesNotMatch(tmuxLog, /terminal-overrides/);
         });
     });
+    it('requires a fresh caller authorization before every post-sleep session mouse and copy-mode operation', async () => {
+        await withMockTmuxFixture('omx-tmux-enable-mouse-reproof-', (tmuxLogPath) => `#!/bin/sh
+printf '%s\n' "$*" >> "${tmuxLogPath}"
+case "$1" in
+  show-options) printf '%s\n' 'bg=yellow,fg=black,underscore' ;;
+  set-option) exit 0 ;;
+esac
+`, async ({ logPath }) => {
+            let authorizations = 0;
+            assert.equal(enableMouseScrolling('omx-team-x', () => { authorizations += 1; }), true);
+            const effects = (await readFile(logPath, 'utf-8')).trim().split('\n').filter(Boolean);
+            assert.equal(authorizations, effects.length);
+            assert.ok(authorizations > 2, 'copy-mode reads and mutations must not share a mouse proof');
+        });
+    });
 });
 describe('mitigateCopyModeUnderlineArtifacts', () => {
     it('best-effort sanitizes copy-mode style options without requiring global tmux changes', async () => {
@@ -5539,13 +7635,13 @@ describe('killWorker leader pane guard', () => {
             assert.doesNotThrow(() => killWorker('omx-team-x:0', 1, '%5', '%5'));
         });
     });
-    it('proceeds (gracefully) when pane ids differ', () => {
-        // Guard does not fire; tmux calls fail gracefully with empty PATH.
+    it('does not send control keys when a differing explicit pane ID cannot be proven live', () => {
+        // The leader guard does not fire, but global proof failure remains fail-closed.
         withEmptyPath(() => {
             assert.doesNotThrow(() => killWorker('omx-team-x:0', 1, '%5', '%6'));
         });
     });
-    it('proceeds when leaderPaneId is not provided', () => {
+    it('does not send control keys without a leader guard when proof is unavailable', () => {
         withEmptyPath(() => {
             assert.doesNotThrow(() => killWorker('omx-team-x:0', 1, '%5'));
         });
@@ -5555,13 +7651,25 @@ describe('teardownWorkerPanes shared primitive', () => {
     it('excludes leader and hud panes in shared pane-kill primitive', async () => {
         await withMockTmuxFixture('omx-tmux-teardown-', (logPath) => `#!/bin/sh
 set -eu
-printf '%s\\n' "$*" >> "${logPath}"
-exit 0
-`, async ({ logPath }) => {
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ ! -f "${logPath}.dead" ]; then
+      printf '%%3\t0\t%s\n' "$PPID"
+    fi
+    ;;
+  kill-pane)
+    : > "${logPath}.dead"
+    ;;
+  *)
+    exit 0
+    ;;
+esac`, async ({ logPath }) => {
             const summary = await teardownWorkerPanes(['%1', '%2', '%3'], {
                 leaderPaneId: '%1',
                 hudPaneId: '%2',
                 graceMs: 1,
+                expectedPanePids: { '%3': process.pid },
             });
             assert.equal(summary.excluded.leader, 1);
             assert.equal(summary.excluded.hud, 1);
@@ -5573,28 +7681,89 @@ exit 0
             assert.doesNotMatch(log, /kill-pane -t %2/);
         });
     });
-    it('uses pane-id-direct kill semantics without liveness-gated helper calls', async () => {
-        const source = await readFile(new URL('../tmux-session.js', import.meta.url), 'utf-8');
-        const primitiveBlock = source.split('export async function teardownWorkerPanes')[1] ?? '';
-        assert.equal(primitiveBlock.includes('isWorkerAlive'), false);
-        assert.equal(primitiveBlock.includes('killWorker('), false);
+    it('treats an exit-zero kill as unresolved when the pane ID is freshly reused', async () => {
+        await withMockTmuxFixture('omx-tmux-teardown-reused-pane-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ -f "${logPath}.killed" ]; then
+      printf '%%77\t0\t7702\n'
+    else
+      printf '%%77\t0\t7701\n'
+    fi
+    ;;
+  kill-pane)
+    : > "${logPath}.killed"
+    ;;
+esac`, async ({ logPath }) => {
+            const summary = await teardownWorkerPanes(['%77'], { graceMs: 1, expectedPanePids: { '%77': 7701 } });
+            assert.equal(summary.kill.attempted, 1);
+            assert.equal(summary.kill.succeeded, 0);
+            assert.equal(summary.kill.failed, 1);
+            assert.deepEqual(summary.kill.failedPaneIds, ['%77']);
+            assert.deepEqual(summary.killedPaneIds, []);
+            const commands = (await readFile(logPath, 'utf-8')).trim().split('\n');
+            assert.deepEqual(commands, [
+                'list-panes -a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}',
+                'list-panes -a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}',
+                'kill-pane -t %77',
+                'list-panes -a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}',
+            ]);
+        });
     });
-    it('continues best-effort when a pane target is missing', async () => {
-        await withMockTmuxFixture('omx-tmux-teardown-missing-', (logPath) => `#!/bin/sh
+    it('stops at the first unavailable proof without killing a later live candidate', async () => {
+        await withMockTmuxFixture('omx-tmux-teardown-proof-unavailable-', (logPath) => {
+            const proofStatePath = `${logPath}.proof-state`;
+            return `#!/bin/sh
 set -eu
-printf '%s\\n' "$*" >> "${logPath}"
-if [ "$1" = "kill-pane" ] && [ "\${3:-}" = "%404" ]; then
-  echo "missing pane" >&2
-  exit 1
+printf '%s\n' "$*" >> "${logPath}"
+if [ "$1" = "list-panes" ]; then
+  if [ -f "${proofStatePath}" ]; then
+    printf '%%405\t0\t%s\n' "$$"
+  else
+    : > "${proofStatePath}"
+    echo "tmux unavailable" >&2
+    exit 1
+  fi
 fi
 exit 0
-`, async ({ logPath }) => {
+`;
+        }, async ({ logPath }) => {
             const summary = await teardownWorkerPanes(['%404', '%405'], { graceMs: 1 });
-            assert.equal(summary.kill.attempted, 2);
-            assert.equal(summary.kill.succeeded, 1);
+            assert.equal(summary.kill.attempted, 0);
+            assert.deepEqual(summary.provenGonePaneIds, []);
+            assert.deepEqual(summary.proofUnavailable.map((proof) => proof.paneId), ['%404']);
+            const commands = (await readFile(logPath, 'utf-8')).trim().split('\n').filter(Boolean);
+            assert.deepEqual(commands, ['list-panes -a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}']);
+        });
+    });
+    it('distinguishes proven-gone panes from target command failures', async () => {
+        await withMockTmuxFixture('omx-tmux-teardown-proof-outcomes-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    printf '%%405\t0\t%s\n' "$PPID"
+    ;;
+  kill-pane)
+    echo "target command failed" >&2
+    exit 1
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, async ({ logPath }) => {
+            const summary = await teardownWorkerPanes(['%404', '%405'], { graceMs: 1, expectedPanePids: { '%405': process.pid } });
+            assert.equal(summary.kill.attempted, 1);
+            assert.equal(summary.kill.succeeded, 0);
             assert.equal(summary.kill.failed, 1);
+            assert.deepEqual(summary.provenGonePaneIds, ['%404']);
+            assert.deepEqual(summary.proofUnavailable, []);
+            assert.deepEqual(summary.kill.failedPaneIds, ['%405']);
             const log = await readFile(logPath, 'utf-8');
-            assert.match(log, /kill-pane -t %404/);
+            assert.doesNotMatch(log, /kill-pane -t %404/);
             assert.match(log, /kill-pane -t %405/);
         });
     });
@@ -5604,4 +7773,100 @@ describe('leader mailbox-only boundary', () => {
         assert.equal('sendToLeaderPane' in tmuxSessionModule, false);
     });
 });
+describe('exact pane PID authority regressions', () => {
+    it('ignores an unrelated PID-less pane while requiring the matched target PID', async () => {
+        await withMockTmuxFixture('omx-exact-pane-empty-unrelated-', () => `#!/bin/sh
+set -eu
+if [ "$1" = "list-panes" ]; then
+  printf '%%42\t0\t4242\n%%99\t0\t\n'
+fi
+`, async () => {
+            const proof = await readExactPaneProof('%42');
+            assert.deepEqual(proof, { status: 'live', paneId: '%42', pid: 4242 });
+            const emptyTarget = await readExactPaneProof('%99');
+            assert.equal(emptyTarget.status, 'unavailable');
+            if (emptyTarget.status === 'unavailable')
+                assert.equal(emptyTarget.reason, 'malformed_snapshot');
+        });
+    });
+    it('retains a live pane as unresolved teardown debt when no positive PID was persisted', async () => {
+        await withMockTmuxFixture('omx-teardown-pid-missing-', (logPath) => `#!/bin/sh
+printf '%s\\n' "$*" >> "${logPath}"
+if [ "$1" = "list-panes" ]; then printf '%%42\\t0\\t4242\\n'; fi`, async ({ logPath }) => {
+            const summary = await teardownWorkerPanes(['%42'], { graceMs: 1 });
+            assert.equal(summary.kill.attempted, 0);
+            assert.deepEqual(summary.proofUnavailable.map((proof) => proof.paneId), ['%42']);
+            assert.doesNotMatch(await readFile(logPath, 'utf8'), /kill-pane/);
+        });
+    });
+    it('does not kill a stale pane ID whose live PID differs from persisted identity', async () => {
+        await withMockTmuxFixture('omx-teardown-pid-changed-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "${logPath}"
+if [ "$1" = "list-panes" ]; then printf '%%42\t0\t4343\n'; fi
+`, async ({ logPath }) => {
+            const summary = await teardownWorkerPanes(['%42'], {
+                graceMs: 1,
+                expectedPanePids: { '%42': 4242 },
+            });
+            assert.deepEqual(summary.proofUnavailable.map((proof) => proof.reason), ['pane_pid_changed']);
+            assert.doesNotMatch(await readFile(logPath, 'utf8'), /kill-pane/);
+        });
+    });
+    it('does not kill a replacement pane when owner authorization recycles its ID', async () => {
+        await withMockTmuxFixture('omx-teardown-owner-read-pid-reuse-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+case "$1" in
+  list-panes)
+    if [ -f "${logPath}.owner-read" ]; then
+      printf '%%42\\t0\\t4343\\n'
+    else
+      printf '%%42\\t0\\t4242\\n'
+    fi
+    ;;
+  show-options)
+    : > "${logPath}.owner-read"
+    echo 'team:owned'
+    ;;
+esac
+`, async ({ logPath }) => {
+            const summary = await teardownWorkerPanes(['%42'], {
+                graceMs: 1,
+                expectedPanePids: { '%42': 4242 },
+                authorizePaneKill: () => {
+                    spawnSync('tmux', ['show-options', '-p', '-t', '%42', '@omx_team_pane_owner_id']);
+                    return true;
+                },
+            });
+            assert.deepEqual(summary.proofUnavailable.map((proof) => proof.reason), ['pane_pid_changed']);
+            assert.doesNotMatch(await readFile(logPath, 'utf8'), /kill-pane/);
+        });
+    });
+    it('preserves an empty pane_start_command field but rejects a missing trailing field before startup mutation', async () => {
+        await withMockTmuxFixture('omx-startup-topology-trailing-field-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+if [ "$1" = "list-panes" ]; then
+  case "$*" in
+    *"pane_current_command"*) printf '%%11\\tzsh\\t\\n' ;;
+    *) printf '%%11\\n' ;;
+  esac
+fi
+`, async ({ logPath }) => {
+            assert.deepEqual(listPaneIds('leader:0'), ['%11']);
+            const log = await readFile(logPath, 'utf8');
+            assert.doesNotMatch(log, /set-option|split-window|resize-pane|select-layout|set-window-option|select-pane|send-keys/);
+        });
+        await withMockTmuxFixture('omx-startup-topology-missing-field-', (logPath) => `#!/bin/sh
+set -eu
+printf '%s\\n' "$*" >> "${logPath}"
+if [ "$1" = "list-panes" ]; then printf '%%11\\tzsh\\n'; fi
+`, async ({ logPath }) => {
+            assert.deepEqual(listPaneIds('leader:0'), []);
+            const log = await readFile(logPath, 'utf8');
+            assert.doesNotMatch(log, /set-option|split-window|resize-pane|select-layout|set-window-option|select-pane|send-keys/);
+        });
+    });
+});
 //# sourceMappingURL=tmux-session.test.js.map