projmux 0.12.2 → 0.13.0

package/docs/session-restore.md

@@ -1,164 +1,80 @@
 # Session Restore
 
-Session snapshots store tmux layout metadata and replay recipes for shell,
-startup, and supported agent panes. Manual CLI actions remain available through:
+Session snapshots are explicit desired-state inputs for one Project. They are
+not tmux replay scripts and they are not Registry backups. Snapshot save keeps
+the existing v1 schema and storage behavior.
 
 ```sh
-projmux get snapshots [--session <name>]
+projmux get snapshots [--session <snapshot-session>]
 projmux create snapshot
-projmux restore snapshot --dry-run [--session <name>]
-projmux restore snapshot [--session <name>]
-projmux delete snapshot --session <name>
+projmux restore snapshot --session <snapshot-session> [--project <ref> | -p <ref>] --dry-run
+projmux restore snapshot --session <snapshot-session> [--project <ref> | -p <ref>] --yes [--client /dev/pts/N]
+projmux delete snapshot --session <snapshot-session>
 ```
 
-Snapshots preserve source metadata, not a resolved display label. Window records
-keep `window_name`; pane records keep the user label, raw `pane_title`, recipe
-fields, AI topic and manual-ownership metadata (`@projmux_ai_topic` and
-`@projmux_ai_topic_manual`), and resume metadata when available. There is no
-`display_label` field in the snapshot schema. After restore, pane borders and
-app window tabs are display-time tmux policy: the app config derives both from
-the active pane's visible label expression, while raw shell or terminal titles
-remain metadata that may change independently. Branch names continue to appear
-in the statusbar git segment; branch-based shell title overwrites are not the
-canonical Projmux window naming source.
-
-The primary inspection surface is `Projects > Sessions > State`. It shows a
-read-only overview first: latest snapshot status, named snapshots, window ->
-pane structure, cwd, recipe, and agent resume health. Mutation belongs one
-level deeper in explicit actions; the overview does not immediately save,
-delete, preview, or restore.
-
-Project Session State actions are scoped to the project-derived session
-identity, not the currently attached tmux session. `Save latest snapshot`
-captures the live project session when that session exists. `Save named
-snapshot` captures the same live project session into a project-local named
-snapshot and stores cwd values with portable project-root placeholders. Closed
-project sessions disable save actions with the live-session reason. `Preview
-restore` prints the read-only dry-run restore plan for the project snapshot, and
-`Delete snapshot` requires a confirmation picker before removing the project
-snapshot. Destructive restore execution remains outside Settings in this slice.
-
-Agent panes in Settings and restore dry-run previews show resume metadata
-health next to the pane recipe. `available` means a resume id is present and
-recent enough for replay, `stale` means the stored id exists but the metadata is
-missing or older than the snapshot policy, and `unavailable` means projmux
-cannot safely resume that agent pane from the snapshot. Confidence is derived
-from the metadata source: direct session ids and hook ingest are high
-confidence, transcript/log fallbacks are medium confidence, and missing or
-unknown sources are low or none. The old statusbar Session State shortcut has
-been removed; use `Projects > Sessions > State` or the canonical snapshot CLI
-for inspection/actions.
-
-Session snapshots capture each pane's user-owned `label` separately from its
-raw `title` and agent recipe `topic`. Older snapshots decode with an empty
-label and no manual topic ownership; no title/topic equality heuristic is
-applied. Replay explicitly sets or clears the label, startup recipe fields, AI
-agent/topic/ownership/resume fields, and finally the raw title on the pane id
-returned by tmux creation. It does not derive a target or identity from pane
-order, a visible title, or equality between saved fields.
-
-Agent restore direct-starts supported resume commands when creating fresh tmux
-panes, matching the `projmux create agent` launch shape: the wrapper prepends the
-agent binary directory to `PATH`, changes to the saved cwd, then execs
-`codex resume <id>`, `claude --resume <id>`, or
-`agy --conversation <uuid>`. It does not copy the saved topic into OSC or raw
-tmux title state; replay restores the final raw title only from `Pane.Title`.
-Antigravity restore
-uses only the stable statusline `conversation_id` or hook `conversationId`
-metadata captured as the pane resume id; missing or non-UUID Antigravity ids
-render as `resume unavailable` rather than falling back silently to a shell
-recipe. This avoids typing agent resumes with
-`tmux send-keys`. The restore wrapper is still a non-interactive shell command
-tail, so it does not replay the original pane's interactive shell startup,
-environment, shell functions, aliases, or live process state. Startup recipes
-continue to use their saved `send-keys` command replay, and shell recipes only
-restore cwd/layout.
-
-This live capture lane remains distinct from resume-picker disk discovery and
-has high confidence (`hook`/`session-id`). When an Antigravity picker row starts
-a pane, its source is captured too: a UUID verified by an exact regular
-`conversations/<uuid>.db` through `last_conversations` or workspace-bearing
-summarized metadata has medium confidence, while a legacy `history.jsonl` row
-has low confidence. Preview and doctor report that source/confidence as stored;
-they do not claim that the upstream cache exposes complete history. Disk
-discovery does not replace an existing live hook source, and it never opens a
-conversation database or reads prompt/transcript content.
-Bounded Session State agent-pane previews place resume health before the full
-resume id, topic, and title so status, confidence, and source remain visible;
-the underlying snapshot and unbounded preview model retain those identity and
-context fields unchanged. Non-agent pane preview ordering is unchanged.
-
-Settings > Session State is global settings only: global auto-save, auto-save
-interval, and storage/retention policy. It does not show the current
-snapshot tree. Delete for current-session snapshots and destructive restore
-execution stay deferred until those actions have a dedicated safe policy for
-existing or non-empty live sessions.
-
-Named snapshots may currently be backed by legacy project files in
-`<project>/.projmux/layouts/*.toml`. They reuse the same window, pane, cwd, and
-startup recipe concepts as session snapshots, but the user-facing restore model
-is still `Latest snapshot`, `Named snapshot`, or `Project topology`. The legacy
-files are imported read-only by Project open
-when building `Named snapshot` candidates; new primary surfaces should describe
-the restore unit as a snapshot, not as a separate layout or preset feature.
-
-Project open from the Alt-1 sidebar defaults to opening a closed project as its
-`Project topology`: the same explicit Registry materialization engine the public
-`reconcile resources --materialize-project` route uses rebuilds every Registry
-Window and Window-owned shell Pane under their existing uids, and the client
-moves only after that converges. A refusal or failure reports the exact stage and
-leaves the client where it was. A directory with no Registry Project, and a
-Project with no Registry Window, still start as a single default session.
-`Settings > Session State > Sidebar startup picker` is an opt-in toggle;
-when it is on, closed project open advances inside the sidebar to the native
-`Start project` step. Rows are ordered `Latest snapshot`, named snapshot rows,
-`Project topology`, then `Back`; a snapshot row stays entirely on the snapshot
-engine, so the two sources are never mixed in one open. `Latest snapshot` is the auto-saved snapshot that
-keeps changing as auto-save runs. `Named snapshot` is a fixed, user-named
-snapshot and is not updated by auto-save. Rows include saved-at date/time
-metadata when available. `Back` returns to the project list without creating,
-replaying, or opening a session. After the startup mode is selected, project
-automation trust is evaluated if needed. For a named snapshot with a startup
-`command`, projmux rejects symlink artifacts, reads the selected layout once,
-and authorizes the SHA-256 of the exact bytes used to parse the in-memory
-restore plan. The trust prompt names the layout file and shows terminal-safe
-command previews. Config absence and `PROJMUX_PROJECT_HOOKS=off` do not bypass
-this layout gate; commandless layouts keep their existing prompt-free restore
-behavior. Approval continues the selected path, while deny/cancel/error aborts
-before session or pane creation, snapshot replay, or `send-keys`. Project-owned
-layout names, descriptions, window names, agent topics, and command previews
-escape terminal control characters before rendering. The Alt-1 sidebar does
-not render trust approve/deny rows inline:
-before trust is requested, projmux snapshots the sidebar query/selection
-context and hands the selected open continuation to a detached tmux job. That
-job closes the sidebar popup state for the client and opens the shared `Trust
-project automation` popup as a client-scoped decision surface, so no code relies on
-the self-closing sidebar popup process continuing after `display-popup -C`.
-Deny/cancel or trust-popup errors return to the sidebar near the same
-query/selection with a visible status message; only a missing/invalid context
-may fall back to a closed popup plus tmux message. Existing sessions switch
-directly without a startup picker or trust gate.
-
-Default `projmux shell` no longer opens a compatibility startup picker and no
-longer accepts startup selector flags for snapshot restore. It always
-follows the normal empty attach path after resolving the target app session name
-and startup directory. Use `Settings > Session State > Sidebar startup picker` for
-interactive Latest snapshot / Named snapshot / Project topology selection.
-
-## Operational diagnostics
-
-Selected Session State mutations leave one local, best-effort terminal outcome
-in the bounded operational journal. Manual and popup save, Project Settings
-latest/named save, manual/Settings/prune delete, and actual project-startup
-latest/named replay are covered. Restore preview and `--dry-run` remain
-read-only. Successful autosave, disabled/not-due/fresh autosave no-ops, and
-nested snapshot store/replay calls do not write an outcome; an actual autosave
-failure writes one safe error even under `--quiet`.
-
-The outcome contains only a closed operation/source and aggregate window,
-pane, recipe, or deleted-item counts. It never contains a snapshot or project
-path, snapshot content/name, pane cwd/command, agent resume/conversation/session
-ID, or arbitrary metadata. Diagnostics append failure never changes save,
-restore, delete, or quiet-autosave behavior. See
-[operational-diagnostics.md](operational-diagnostics.md) for the complete event
-schema and retention/privacy contract.
+Restore requires an exact snapshot and an exact, closed target Project. The
+dry-run validates both inputs and prints replacement, deletion, preserved-UID,
+and lost-conversation-pointer counts with zero Registry, tmux, and snapshot writes.
+Snapshot Project/Window/Pane metadata is checked against the exact target owner
+chain. A UID held by another root, a cross-kind UID reuse, a Project mismatch,
+or conflicting owner metadata refuses before commit. The ordinary Project-open
+trust authorization must also approve the exact target root before the Registry
+transaction begins.
+
+After `--yes`, one atomic Registry transaction replaces only the target
+Project's descendant Window/Pane/Agent graph and its descendant name
+reservations. The Project UID, root, trust metadata, unrelated Projects,
+ControlSessions, and source snapshot bytes are preserved. Metadata-bearing
+snapshots reuse their exact target-subtree UIDs and preserve a surviving
+final-v2 Agent or shell anchor plus a surviving direct default shell.
+Metadata-free legacy snapshots reuse target descendants positionally, select
+the first valid Window-local Pane as the role-agnostic anchor, select the first
+direct shell as the optional default, and mint identities only for missing
+items. An Agent-only Window is valid with an empty default. Repeating the same
+projection is a Registry zero-diff.
+
+The committed Registry is then converged by the ordinary Project materializer.
+For a restored offline Agent-anchor Window, `Continue project` visibly plans a
+lazy default shell, creates the Window from that shell, and stages the Agent on
+its retained anchor Pane UID. A successful repeat writes neither Registry nor
+topology. Agent recipes use the canonical provider launch/resume path. Stored startup
+commands are not directly executed by snapshot restore. A runtime item refusal
+does not roll the Registry back: desired state and the source snapshot remain
+available for another `Continue project`, and the refusal is reported as an
+item notice. If an explicit client is supplied, the final observable step is
+`switch-client -c` to the Project's declared session even when the background
+continuation has no inherited `TMUX` variable.
+
+## Project startup
+
+A closed Project has exactly two actions:
+
+- `Continue project` opens the current Registry desired state with the ordinary
+  materializer. A retained graph keeps its Project, Window, Pane, and Agent
+  UIDs. A zero-Window Project keeps its Project UID and atomically receives one
+  new canonical Window and shell UID before materialization.
+- `Open fresh` atomically replaces the same-root graph with a new Project UID
+  and one new canonical Window/shell UID chain. It does not archive or retain
+  the old generation.
+
+Esc/cancel returns to Projects; it is not an action row. Picker failure falls
+back to the non-destructive `Continue project` action.
+
+`Open fresh` never deletes or overwrites autosave or named snapshot files. It
+preserves the root, Git/worktrees, trust decision, and all unrelated Registry
+graphs while changing the Project identity. A rejected commit retains the
+exact old Registry preimage. Repeating `Open fresh` replaces identity again;
+each successful result has exactly one Project claiming the root.
+
+## Snapshot contents and diagnostics
+
+Snapshots keep window names, pane cwd/label/title, shell/startup/agent recipes,
+AI topic ownership, and provider resume metadata when available. Resume health
+in preview is `available`, `stale`, or `unavailable`; confidence derives from
+the stored source. Snapshot inspection never reads provider transcript or
+conversation database content.
+
+An approved projection restore records one safe Session State outcome with
+aggregate Window/Pane/recipe counts and source `manual`. Paths, commands,
+snapshot content, and provider conversation identifiers are never included.
+Dry-run remains read-only and records no mutation outcome.

package/docs/settings-ia.md

@@ -33,28 +33,49 @@ step, never a silent no-op.
 
 ## Global
 
-- **Projects** — Project discovery, pins, and sidebar policy. Settings manages
-  discovery and pinning; the runtime picker UI keeps the name `Project Picker`.
+- **Projects** — Project discovery, pins, and sidebar policy, as three separate
+  collections with three separate authorities: discovery roots are scan sources,
+  Pinned Projects are Registry Project uids, and Candidate Pins are paths no
+  Project claims. Settings manages discovery and pinning; the runtime picker UI
+  keeps the name `Project Picker`.
   - `Primary discovery root [View]` — effective/saved/source state, then
     `Use current directory`, `Enter path`, `Clear saved root`.
   - `Additional discovery roots [View]` — the collection owns the two add rows;
-    each saved root is an item View that owns `Remove discovery root`.
-  - `Pinned Projects [View]` — each pin is an item View showing the Project's
-    display name, unique name, uid, bound root, condition, missing-since and
-    runtime separately. A `MissingRoot` Project is never hidden, deleted, or
-    re-pinned under a new identity: the item offers `Rebind Project root`, which
-    calls the canonical `rebind project` route and keeps the same uid. Settings
-    performs no heuristic uid merge and no automatic prune.
-  - `Project Sidebar [View]` — `Closed Project startup` chooses between using
-    the stored Project topology and asking for a Snapshot. `Use Project
-    topology` materializes every Registry Window and Window-owned shell Pane of
-    that Project under their existing uids and only then moves the client; it is
-    not an empty session, and the startup picker names that row `Project
-    topology` for the same reason. `Ask for Snapshot or Project topology` adds
-    the `Latest snapshot` and `Named snapshot` rows, which stay on the Session
-    State snapshot engine — the two sources are never mixed in one open. Neither
-    choice resumes an Agent or executes a stored `Pane.spec.command`. The saved
-    file keeps its `sidebar-startup-picker` spelling.
+    each saved root is an item View that owns `Remove discovery root`. These are
+    scan roots: adding one never registers a Project, and scanning one never
+    does either.
+  - `Pinned Projects [View]` — managed pins only. Each pin references a Registry
+    Project uid and is an item View showing the Project's display name, unique
+    name, uid, bound root, condition, missing-since and runtime separately, all
+    projected from the Registry on every render. Because the pin is a uid rather
+    than a path, a rebind, a rename, and a vanished directory all keep the same
+    pin: a `MissingRoot` Project is never hidden, deleted, or re-pinned under a
+    new identity, and the item offers `Rebind Project root`, which calls the
+    canonical `rebind project` route and keeps the same uid. Settings performs no
+    heuristic uid merge and no automatic prune.
+  - `Candidate Pins [View]` — pinned paths that no Registry Project claims. A
+    candidate has exactly the two affordances a candidate has: `Register as
+    Project`, which forwards to the canonical `create project --root` route for
+    that one exact path, and `Unpin candidate`, which removes the preference and
+    leaves the directory alone. Nothing here adopts a path automatically.
+  - `Project Sidebar [View]` — holds the two Projects sidebar policies:
+    `Runtime diagnostics [Choice]` chooses `When needed` (the read-time default
+    with nothing saved) or `Always` for the sidebar's Runtime row. `When needed`
+    keeps the row for a refused runtime class or for an observation that could
+    not be taken, and withholds it otherwise; `Always` is the shipped
+    every-render behavior. The choice moves one row on one surface: the Registry
+    view still carries the complete Runtime row and class tally, the Sessions and
+    Recent Windows links are unchanged, and `projmux runtime diagnostics` and
+    `get runtime` never read it. An unrecognized saved value applies the default
+    without writing and shows an invalid source.
+    `Closed Project startup` optionally shows exactly two actions.
+    `Continue project` materializes the Project's current Registry desired state
+    and then moves the client. `Open fresh` confirms exact counts,
+    atomically replaces the old Project graph with a new Project UID and a new
+    canonical Window/shell UID pair, and leaves exactly one same-root claimant
+    before ordinary materialization. Esc returns to Projects. Neither action
+    deletes or rewrites snapshots, root, Git, or worktree data. The saved file
+    keeps its `sidebar-startup-picker` spelling.
 - **AI** — `AI` is a product category, never an addressable resource.
   - `Default launch target [Choice]` — an Agent Provider, a Shell Pane, or
     choose-at-launch. It is a keybinding/picker preference and does not weaken
@@ -118,9 +139,11 @@ step, never a silent no-op.
     `Weekly` only. Parent off states gate effective visibility without rewriting
     saved child values. Provider/window rows show saved, effective, and source.
     `Project`, `Clock` and `Settings launcher` are direct visibility Toggles. These global
-    presentation values default on and report saved/default source; hiding the
-    Settings launcher removes only its mouse chip, not the CLI or keybinding
-    entry. `Resources` remains one enablement Toggle backed only by
+    presentation values default on except Codex `5h`, which defaults off to
+    keep the ambient HUD compact; every row reports saved/default source and an
+    explicit saved `on` restores Codex `5h`. Hiding the Settings launcher
+    removes only its mouse chip, not the CLI or keybinding entry. `Resources`
+    remains one enablement Toggle backed only by
     `live-resources` (default off): off removes its segment and sampler/cache
     mutation. Notifications and every Agent Usage visibility depth remain
     presentation-only and do not disable their underlying producers, cache,
@@ -210,8 +233,9 @@ an explicit `TMUX_SPLIT_TARGET_PANE` or from `#{pane_id}` — and not as a
 `metadata.uid`, because no keybinding handler reads a uid mirror and a raw pane
 id is never a canonical uid. The two properties the row does assert are the ones
 that hold: the target is explicit and pinned at press time, and it is never the
-Window's persisted `spec.primaryPaneRef`. Automation that omits an anchor uses
-`spec.primaryPaneRef` and never silently recovers a stale reference from the
+Window's persisted compatibility shell ref. Automation that omits an anchor
+uses `spec.defaultShellPaneRef` when present and otherwise
+`spec.anchorPaneRef`; it never silently recovers a stale reference from the
 focused Pane. `Create <Provider> Agent` always creates a new
 Agent and `Open Agent Resume Picker` only resumes an existing Offline or Failed
 Agent; the two are separate actions with separate result kinds and are never

package/docs/statusbar.md

@@ -31,8 +31,9 @@ row 1  [#S]  #{pane_current_path}  <git>  CPU 12%  MEM 41%   %H:%M
   Usage HUD` independently. Agent Usage HUD is a View whose `Visible` parent
   contains Claude/Codex/Antigravity provider Views; each provider has its own
   `Visible` plus explicit supported windows (Claude/Codex: `5h`, `Weekly`;
-  Antigravity: `Weekly`). Every leaf defaults on. Parent off preserves saved
-  children, and returning it on restores them. When only one HUD is visible, its
+  Antigravity: `Weekly`). Every leaf defaults on except Codex `5h`, which
+  defaults off; saving it as on explicitly restores that window. Parent off
+  preserves saved children, and returning it on restores them. When only one HUD is visible, its
   sole range receives the full `#{client_width}` budget and the absent range and
   alignment are not emitted. When both are hidden, tmux collapses to one line
   with `status on`,
@@ -252,6 +253,13 @@ bind-key -n MouseDown1Status if-shell -F "#{==:#{mouse_status_range},window}" \
 
 ## Usage element drop order
 
+The compact Codex provider identity is native-first. An authoritative healthy
+app-server snapshot renders as `Codex`; only degraded lanes are qualified as
+`Codex [fallback]` or `Codex [stale]`. Unknown non-stale provenance uses the
+conservative fallback label. These labels are locale-invariant, including on
+en-US and ko-KR narrow rows. The full Usage table, JSON, and diagnostics retain
+the raw source and closed reason; the statusbar label is presentation only.
+
 The usage segment does not pick a whole-segment tier. It starts from its
 richest render and sheds **one optional element at a time** until the result
 fits its budget. The order below is the drop order; index 1 goes first.

package/docs/testing.md

@@ -17,10 +17,30 @@ and humans run the same entrypoints.
   `test/install/smoke.sh`. It validates `make install`, atomic binary
   replacement into an isolated install dir, `tmux apply`, and post-install
   `notify reconcile` initialization with a fresh HOME/XDG state tree.
-- `make test-e2e` builds the same Docker image and runs
-  `test/e2e/linux-smoke.sh`. It validates a minimal real-tmux workflow:
-  sessions, panes, config sourcing, reply-state notify reconciliation, focus
-  notify fallback, and status notify rendering.
+- `make test-e2e` prepares one attempt-local immutable product binary, then
+  runs four isolated Linux real-tmux fixtures plus the Codex lifecycle and npm
+  staging fixtures. The required inventory is `L01`-`L19`, `C01`, and `N01`;
+  every fixture has its own HOME/XDG/tmux/socket/evidence roots and every
+  consumer records the same binary SHA. `E2E_SCENARIO=<ID>` selects one exact
+  stable scenario for replay.
+- `make test-e2e-contract`, `make test-e2e-reliability`, and
+  `make test-e2e-shards` validate typed attempt evidence, bounded semantic
+  waits/owned cleanup, and exhaustive four-shard isolation without rerunning
+  the full product matrix.
+- `make test-e2e-coverage` validates
+  `test/e2e/ags-oedr-manifest.json`: executable scenario markers and shard
+  assignments must match all 21 rows with orphan count zero. A matrix may move
+  out of real-tmux E2E only when its checked-in entry names executable lower
+  positive, negative, and fixed-point evidence and retains a real-boundary
+  sentinel. The manifest/orphan half is a prerequisite of `make test-e2e`,
+  while the referenced lower test runs in both this coverage target and the
+  required unit-test job.
+- `make security` runs the exact three Security groups in parallel locally:
+  Go vulnerability/security, Go static quality, and repository policy.
+  `make security-serial` is the parity control and `make security-contract`
+  checks scanner/rule/baseline identity, PR-range/full-history secret scans,
+  cache miss-to-hit convergence, privacy-safe artifacts, and the fail-closed
+  aggregate. CI exposes their stable aggregate as `Test`.
 - `make deadcode` runs `go tool deadcode` (pinned via the go.mod tool
   directive) over the module and reports unreachable functions, filtering out
   the intentional/MUST-KEEP baseline in `.deadcode-allowlist.txt`; it fails
@@ -43,6 +63,62 @@ The test container disables networking during `docker run`. The image build may
 use the network to fetch the pinned base image and apt packages, but suite
 execution should not need network access after the image is built.
 
+## Layered E2E Evidence
+
+The AGS-OEDR manifest is the source of truth for which layer owns each
+guarantee. Its `A/G/S` fields describe the scenario contract and `O/E/D/R`
+identify the owner, enforcement, detection, and recovery boundary. The
+coverage audit reads the actual `smoke_contract_begin` markers and
+`linux-shards.tsv`; documentation-only rows cannot satisfy it.
+
+L19's plural-read context/selector table is the first evidence-backed move.
+`TestPluralReadContextSelectorMatrix` executes all 60 cells twice at the app
+layer, covering exact positive sets, foreign-scope refusal, and read-only
+fixed-point behavior with zero Registry transaction/write/model change. L19
+still drives five representative sentinels through the built binary on the
+queried exact real-tmux socket below its owned smoke root. Lower-layer parity
+therefore owns the combinatorial table; E2E still owns transport, origin, and
+socket/root containment.
+
+Merged main evidence is closed by the same manifest without adding stable IDs.
+L17 links the simultaneous/coalesced exact-generation exit unit tests and the
+integration marker to its real-hook replay: both dead/mirrored Panes disappear,
+Agents become resumable Offline with cleared pane refs, siblings survive, and
+the repeat is Registry-byte-identical. L18 links the closed foreground
+`run-shell` producer ledger and integration transport marker to its attached
+client replay: success is silent or one bounded exact-client message, no
+view-mode overlay appears, and origin PID, focus, and Registry identity remain.
+The two lifecycle boundaries merged at `3322b5f7` stay on existing IDs rather
+than expanding the inventory. L17 links exact clean last-Pane plus
+Window-unlinked causality, zero-Window Project retention, stale-resume refusal,
+sibling reanchor/containment, and byte-identical replay to the Project-stop
+marker. L19 separately links ControlSession last-Window descendant cleanup,
+root retention, zero replacement allocation, sibling containment, and
+fixed-point replay to its own marker. The shared integration marker closes the
+real last-Pane transport boundary. The audit fails when any linked guarantee,
+exact lower test inventory/symbol/selector, or executable integration/E2E
+marker is missing, misspelled, or duplicated.
+
+Lifecycle commit `dcffa5da` remains inside L11. Its closed evidence row links
+the retained/zero-Window lifecycle table, managed runtime stop, Continue, and
+always-new Fresh lower tests to the existing lifecycle integration completion
+and the L11 attached-client marker before pass. Authority commit `de52d15d`
+remains inside L17. Its row links creator-Registry admission, journal-path and
+CLOEXEC handshake tests to the immediate-exit integration/E2E markers, and
+also closes the focused fresh-root repeat harness plus the read-only
+owner/queue observation and product-terminal controller marker. These rows add
+no scenario ID: the audit still requires exactly 21 stable scenarios and fails
+closed if either source commit, guarantee set, lower selector, supporting
+marker, or marker-before-pass edge drifts.
+
+The required result hash accepts exactly one `begin` followed by one typed
+`pass` for every expected stable ID. A terminal `fail`, `cancel`, or
+`unattributed` class, a terminal without its begin row, and an interrupted
+unterminated attempt all keep the aggregate red. `cancel` remains a schema
+value for an explicitly observed cancellation; the shell harness does not
+invent cancellation evidence from a signal whose semantic cause it cannot
+attribute.
+
 ## Host-Only Checks
 
 The Docker suites do not replace checks that depend on a real host terminal,