projmux 0.15.0 → 0.15.1

package/docs/agent-message-replies.md

@@ -0,0 +1,49 @@
+# Explicit reply recovery
+
+An explicit Claude reply names the original request with `--reply-to`. The
+broker preserves that request's `conversationRef`, reverses its exact source
+and target routes, and retains peer, untrusted, coordination-only authority.
+Both activations and the original deadline must still be current. A reply
+cannot extend that deadline. Source metadata remains an unverified routing
+claim; an explicit reply also requires the registered provider's descendant
+caller and any existing qualification and execution guard.
+
+When a reply fails, `agent message send` exits nonzero and reports its ref,
+underlying reason, outcome uncertainty, and safe action. Inspect the durable
+attempt before deciding whether to retry:
+
+```sh
+projmux agent message status <failed-reply-ref>
+projmux agent message status <failed-reply-ref> -o json
+```
+
+Only a confirmed zero-write Claude failure permits a new manual attempt.
+Examples include rejected content or frame size, invalid auth configuration,
+pre-write refusal, and an actual zero-byte write. Correct the reported cause,
+then send a new reply ref on the same original correlation:
+
+```sh
+projmux agent message send uid:<original-source-agent> --reply-to <original-request-ref> --message-ref <fresh-reply-ref> -- '<corrected reply>'
+```
+
+Omitting `--message-ref` generates a fresh ref. In the qualified reply-only
+execution guard, use the existing bounded command without that flag:
+
+```sh
+projmux agent message send uid:<original-source-agent> --reply-to <original-request-ref> -- '<corrected reply>'
+```
+
+A same-ref call returns the original immutable receipt and never pushes again.
+Changing its payload is refused with the earlier ref and cause. A fresh ref
+allows one new attempt only when every previous attempt is known-zero. Failed
+records and the original request remain available; recovery never deletes or
+resets them. Store capacity can refuse a new attempt rather than discard its
+history.
+
+Delivered replies, partial writes, unknown outcomes, pending attempts, expired
+deadlines, and stale routes must not be resent. Inspect their status and the
+provider outcome. A false `outcomeUnknown` flag by itself is insufficient:
+the stored state and specific zero-write reason must agree. These rules also
+apply after store reload and to concurrent callers. Automatic resend is
+disabled, and replies whose delivery target is Codex do not gain a new retry
+policy here.

package/docs/agent-workflow.md

@@ -27,8 +27,18 @@
 
 ## Maintained Test List
 
+- Installed recovery receipt identity: `TestInstalledRecoveryReceiptMatchesPublicControlTurnIdentity` reproduces the public handler's quoted turn receipt versus the lifecycle snapshot's unquoted ID, then requires the fixture to decode the exact receipt and record only its validated `expectedTurn` before waiting. `TestInstalledRecoveryReceiptRejectsAmbiguousOrMalformedIdentity` requires one expected action label, one exact thread and one bounded opaque turn ID, decodes double-quoted fields with `strconv.Unquote`, and refuses missing/duplicate/unknown fields, wrong threads/actions, malformed/truncated/oversized identities and extra output. No stdout payload, completion inference or input retry is added.
+
+- Managed recovery first-input admission: `TestObserverReadyControlStartPreservesOwnedReadAdmissionAndFreshness` runs the real repo broker host, session, observer and control handler with a deterministic broker clock and owned reader. It reproduces current authority/status-ready followed by the one-second `lifecycle-retry` refusal with zero turn writes, pins the exact boundary, and requires the admitted read to observe new state before any start. Retired control still writes zero. The installed matrix waits for the same exact authority/control tuple to remain ready for that existing interval before the recovered survivor's first input, inside its unchanged 90-second authority deadline; the ledger records `waiting-read-admission`. This is fixture pacing, not a fresh-state receipt or a retry of an attempted input. `TestInstalledRecoveryAdmissionRequiresStableExactControlBeforeFirstInput` resets that wait on identity, broker/connection/binding/control, unknown/not-startable, or clock reversal changes. No product admission, freshness or timeout policy changes.
+
+- `make test`: `TestCodexNativeObserverForeignThreadSameTurnWritesNoRegistryProgressOrDiagnostics` waits for the observer's startup-ready callback after the initial progress/diagnostic flush, validates the complete baseline, then requires exact equality after a foreign-thread event. A following accepted lifecycle marker proves the foreign event was consumed; synchronization uses no sleep or expanded timeout.
+
+- `make test`: Stored Codex version-pair qualification diagnostics (C-3) read the qualification store independently of the generation journal. `TestDoctorStoredCodexQualificationWithoutJournal` requires the saved pair and verdict even without a journal or readable Registry. `TestDoctorStoredCodexQualificationTextJSONSupportParity` covers saved, absent, corrupt, filename/receipt pair mismatch, unreadable store, measured refusal, and unbacked acceptance fixtures across text, JSON, and support `doctor.json`; the existing gate supplies qualification readiness. `TestQualificationStoreListPreservesPairOrderAndLoadVerdicts`, `TestQualificationStoreListDistinguishesAbsentDamagedAndPairMismatch`, and `TestDoctorStoredCodexQualificationKeepsValidSiblingsVisible` pin deterministic enumeration, unchanged Load judgments, invalid filename visibility, non-regular file refusal, and valid sibling retention. `TestDoctorStoredCodexQualificationReadOnlyArgvAndState` requires zero execution argv and byte/mode/mtime-identical receipt/journal state across repeated diagnoses; `TestDoctorStoredCodexQualificationSupportRejectsNonDiagnosticStrings` keeps unvalidated strings redacted. Receipt schema v2 and its lack of expiry remain unchanged.
+
 - `make test`: Replacement guarantee Phase 1 makes `make install` finish the replacement it starts, for the one long-lived role that ships a drain. It adds a second entry condition to the drain the broker runtime already had -- the runtime's own image having been unlinked -- and a bounded termination condition for it. It adds no wire frame, no refusal token, and no way to end a process: the whole of the action is a socket handshake and the runtime decides. `TestBrokerRuntimeDrainsWhenItsOwnImageWasReplaced` holds the vintage trigger in both directions -- a runtime on the installed image is not drained, a superseded one is, live bindings keep delivering and keep control authority through the drain, a new bind is refused by name so the drain stays finite, the answer is read once rather than per session, and an idle superseded runtime closes as soon as it is asked. `TestReplacementRolePoliciesMatchTheContractDocument` holds the per-role disposition table and [replacement-contract.md](replacement-contract.md) equal in both directions and requires every census role to carry a stated decision. `TestReplacementSessionClientIsNeverADrainTarget` fixes the one entry that is a decision rather than an observation: the operator's attached session is report-only, and a fleet of nothing but attached sessions past the cutoff still produces no drain target. `TestReplacementDrainCutoffIsTheAdoptedValueAndBound` pins the adopted 24h cutoff -- truncation rate 9.5%, 13 of 137 residual processes by identity -- fixes the exclusive boundary, and rejects every spelling that would disable the bound. `TestInstallReplacementPassOutcomesAreFixedByFleetAndRequest` pins each fleet-and-request combination to its closed outcome token and its counters, including the refusal that says which door was closed. `TestInstallReplacementNeverFailsAnInstall` holds the property every post-publication step needs. `TestInstallReplacementOutcomeRecordCarriesNoProcessIdentity` and `TestInstallReplacementNoticeSpeaksOnlyWhenAnActionFollows` keep pid, path, and argv off the new record and the new terminal line. `TestDoctorReplacementProcessRowCarriesTheCutoffAndThePassAccount` holds the `L2` row: the bound it judged against, how many processes are past it, and what the last pass did, with an absent pass distinguished from a pass that found nothing. `TestReplacementPathEndsNoProcess` is the scope guard over the acting half -- no `os/exec`, no signal, no `Ensure` -- and `TestReplacementMeasurementPathEndsNoProcess` still holds the measuring half.
 
+- `make test`: Replacement guarantee Phase 2 makes report-only routes and delete refusals point at runnable commands. `TestReplacementRoutesNameARunnableAction` requires every per-role action step to be a `projmux` command the CLI catalog resolves to a non-refusal, non-`internal` verb, or an event from the closed lifecycle set, and proves the check rejects unknown, refusal-parent, literal-operand, and `internal` commands; `TestReplacementRolePoliciesMatchTheContractDocument` now also holds the `Operator action` column and the event table equal to code in both directions. `TestPaneDeleteLiveMirrorRefusalNamesTheExactUIDRegistryOnlyForm` pins full refusal strings: a name-selected MissingRuntime Pane, Offline Agent, or zero-Pane Offline Agent names the typed resource's exact `projmux delete pane|agent uid:<uid> --socket-path <server>` `--dry-run`/`--yes` form, while exact-uid-without-evidence, evidence-less Pane, Running Agent, and Failed Agent refusals carry no pointer. `TestDeleteByNameRefusalPointsAtARunnableUIDCommand` reaches both refusals through the real route and resolver and runs the named dry-run command with zero Registry writes.
+
 - `make test`: Replacement completion and restorability Phase 0 adds a read-only `projmux doctor` table only. [replacement-contract.md](replacement-contract.md) fixes the two axes, the closed per-layer reason-token vocabulary, and the closed signal-key inventory; nothing on this path changes install, update, or generation-pool behavior. `TestDoctorReplacementLayerVerdictsAreFixedByInputCombination` pins every reachable evidence combination of all three layers to its replacement verdict, restoration verdict, and governing token; `TestDoctorReplacementUnknownVerdictsNameTheEvidenceGap` requires each `unknown` to name which reading was silent and rejects an unreachable gap. `TestDoctorReplacementEveryReasonTokenCarriesARecoverableDiscriminant` is the negative gate: zero rows carrying a token with no discriminant. `TestDoctorReplacementSignalValuesCarryNoPathProcessOrFreeFormText` holds the serialization rule that lets the discriminant into `--json` -- every value is a counter or a closed token, and a path-shaped value becomes `unclassified`. `TestDoctorReplacementReasonTokensMatchTheContractDocument` and `TestDoctorReplacementSignalKeysMatchTheContractDocument` hold the document and the code constants equal in both directions and reject a published token no evidence reaches. `TestDoctorReplacementDarwinReportsUnsupportedPlatformForImageAndProcessLayers` fixes the `/proc`-less platform branch to `unsupported-platform` with `unknown` on both axes, with no device. `TestDoctorReplacementQualificationMissingMakesGenerationPoolNotRestorable` fixes `qualification-missing` to `not-restorable`. `TestDoctorReplacementCensusSeparatesRegistryRunningFromLiveProviderSession` reproduces the 2026-09-08 sample as a fixture: a Claude Pane's recorded process handle and a Codex Pane's composite authority are different discriminants, a Running Agent with neither is `unobservable` rather than live, and the row stays count-only. `TestDoctorRendersReplacementTableInDefaultRunAndSectionFilter` requires the table on an unfiltered run, under `--section replacement`, and in `--json`; `TestDoctorReplacementSectionCreatesNothing` runs the section against an empty home and requires it to stay empty.
 
 - `make test`: Replacement guarantee Phase 4 names the long-lived process roles that were behind the `other` bucket and makes residual survival countable per process. It adds classification and reading only: no process is ended, started, signalled, or restarted anywhere on this path. `TestProjmuxProcessRoleNamesEveryChildIncludingTheOnesItCannotName` is the route-to-role table, including the reachable roles added here (`session-client`, `agent-endpoint`, `usage-watcher`), the `--role shell` value that must *not* read as an attached session, and the unnamed remainder. `TestProjmuxProcessRoleOrderKeepsTheUnnamedRemainderLast` holds the census shape and requires every named role to be reachable from some argv. `TestReplacementProcessRolesMatchTheContractDocument` holds the role vocabulary and [replacement-contract.md](replacement-contract.md)'s `Process role vocabulary` table equal in both directions, the same guard the reason tokens and signal keys already carry. `TestDoctorReplacementProcessRowNamesTheResidualRoles` requires the `L2` row to carry `residual.role.*` in census order and to omit a role with no residue rather than print a zero. `TestProjmuxProcessVintageRecordsTheStartInstantIdentityIsKeyedOn` pins the identity key the ledger deduplicates on and requires the count-only projection `projmux doctor` renders to stay byte-identical. `TestInstallResidueSurvivalCountsProcessesNotObservations`, `TestInstallResidueSurvivalKeepsEachProcessAtItsOldestObservedAge`, `TestInstallResidueSurvivalRecordedStartInstantsCompareExactly`, `TestInstallResidueSurvivalReconstructedStartsAbsorbTheirOwnSecondOfSlack`, and `TestInstallResidueSurvivalDoesNotChainAcrossNearSimultaneousStarts` fix `projmux internal install-residue --survival`: both bases, the one-second ambiguity of a start reconstructed from an age, and the bound that keeps that ambiguity from chaining a burst of starts into one process. `TestInstallResidueSurvivalCarriesNoProcessIdentity` is the negative audit for the new report, and `TestInstallResidueSurvivalRouteAnswersOrSaysWhyItCannot` separates the census path, which must never fail an install, from the survival path, which owes a reader its reason. `TestReplacementMeasurementPathEndsNoProcess` is the scope guard: the four files of the measurement path may not acquire process termination, signalling, or restart, because this layer is one edit away from turning a census into an unplanned drain.
@@ -40,6 +50,11 @@
 - `make test` / `make test-integration` / `make test-e2e`: Columnar profiles Phase 1 changes only the CLI default projection. Registry plural reads use `KIND NAME STATUS ACTIONS`; runtime reads use identity/containment/classification, and the seven list routes accept explicit `-o wide`. [Column profiles](column-profiles.md) records the exact matrix and diagnostic recovery. `TestColumnCatalogCompletenessBijectionAndExactProfiles` compares typed field declarations to surface capabilities, rejects orphan/duplicate IDs and fixes all nine compact/wide orders and aliases; `TestColumnConsumersHaveNoIndependentHeaderLiteralAuthority` audits all four consumers. `TestColumnProfilesExactOutputAndSnapshotParity` pins whole default/wide output, structured/scalar byte digests and both explicit picker-wide entry frames in `column-profiles.golden`; its production observation fixture includes live, offline, missing-root and ControlSession-owned resources and proves one Registry read, exactly one four-query tmux observation, zero writes and zero sibling-server calls for every mode. ACTIONS is compared directly with the existing navigation projector and fixed eligibility examples. `TestColumnActionsReuseUnavailableSnapshotAndEmptyListsStayEmpty` pins unavailable-server actions and empty list bytes. `TestColumnProfilesDoNotSelectFromWidthAndWideIsUnbounded` checks 80/120 widths and long Hangul context/session values; `TestWideOutputIsScopedToColumnarListReads` rejects wide on every other canonical route. Existing age, session reference, context, termination, selector, JSON and picker layout tests retain their assertions through the explicit wide recovery surface where necessary. The integration and E2E exit-reconciliation probes explicitly use `get panes|agents -o wide` and retain their TERMINATION/evidence and Registry-write-free assertions. Phase 2 below owns the subsequent picker default/control and bound retirement; CLI, row identity/order/search and provider semantics retain these contracts. Isolated piped CLI smoke compares default/wide/JSON/scalar bytes and read/write counters at 80/120 columns before and after installation.
 
 - `make test` / installed opt-in smoke: Codex generation-pool Phase 2 keeps a state domain bounded to two dark private endpoint generations and keys each Broker by the canonical durable `stateDomainID + endpointGenerationID`. `TestGenerationEndpointKeyRoundTripTable`, `TestBrokerEndpointIdentityValidityMatchesDurableMetadataRef`, and `TestGenerationPoolStateTableKeepsPreparingDarkAndBounded` pin key/schema vocabulary parity, third-generation zero effect, and ready-Preparing create admission at zero. `TestGenerationPoolReconnectIsGenerationLocalAndCrossRouteWritesZero`, `TestGenerationPoolBrokerRestartRestoresExactBindingsAndFencesOldRuntime`, `TestGenerationPoolBrokerRestartPreservesSparseBindingEpochLedger`, `TestGenerationPoolFailedRestartRetryKeepsLedgerExactAndFencesOldRuntime`, `TestGenerationPoolRestartFenceRejectsBindingThatMissedTheSnapshot`, and `TestGenerationPoolRestartFenceRefusesControlAndWriteUntilExactSwap` use independent fake servers and semantic barriers to pin sibling reconnect isolation, same-thread cross-route typed refusal/provider write zero, exact/idempotent including sparse binding-ledger restore, fresh broker-runtime fencing, failed-restart retry, and the bind/control/write-vs-restart races. `TestPrivateGenerationHostLaunchProofTableAndLeaseRetention`, `TestPrivateGenerationHostLivePIDSocketExecutableDriftKeepsLifecycleAtZero`, `TestEveryQualifiedBundleArtifactIsMandatoryBeforePublish`, and `TestLaunchBoundaryBundleDriftRefusesPublicationAndCleansExactChild` pin the closed server/TUI/helper bundle, immutable leased argv, Phase-2-closed lease release, distinct endpoint-host versus broker runtime authority, pre-publication revalidation, and PID/process-group/socket-change-time/executable proof with lifecycle mutation zero for every drift, including immediate socket inode reuse. `TestPrivateGenerationHostCloseWaitsForOwnedSessionDescendants`, `TestPrivateGenerationHostCloseProcessSessionBarrierStateTable`, and `TestOwnedGenerationProcessCleanupSignalsExactSessionAndWaitsForDescendantExit` pin the exact `Setsid` group signal and the leader-exit plus inherited-session-EOF semantic barriers without a fixed sleep; the private-root tests retain outside-root, symlink, and mode mutation zero. `TestInstalledPrivateGenerationHostDualListenerSmoke` is opt-in and runs exact leased 0.152.0/0.152.1 private listeners with inherited `TMUX`/`TMUX_PANE` absent, two initialized runtimes, distinct private process groups, ambient/default socket/PID identity unchanged, and descendant-complete exact owned cleanup. Deletion ledger: zero canonical test symbols deleted or renamed; single-default broker, Phase 0 qualification/bundle, and Phase 1 composite-fence/projection tests retain their unique boundaries. Scope audit: current pointer/drain, Agent create/resume, foreign adoption, Settings/background UX, consumer projection, and unrelated cleanup remain unchanged.
+- `make test` / `make test-integration` / installed managed recovery: `TestRecoveredBrokerRetiredBarrierCannotRepublishAuthority`, `TestDefaultBrokerEndpointRequiresProbeWireAndRouteAgreement`, `TestRecoveredDefaultBrokerRebindsExactAuthorityAndControlConsumers`, and `TestRecoveredGenerationAuthorityRejectsStaleEndpointAndActivation` cover default socket probe/initialize/version agreement, current barrier publication, exact surviving Agent/Pane/activation/thread endpoint CAS, current control consumers, old-runtime epoch-1 refusal, old writes zero, and stale/unknown/Draining refusal. `TestRecoveredBrokerConcurrentOpenSharesOneCurrentView`, `TestRecoveredBrokerOpenWaiterHonorsCancellation`, `TestRecoveredBrokerCloseCancelsPendingRouteAndEnsure`, and `TestEnsureCancellationDuringStartupLockNeverLaunches` verify shared publication, cancellable queued Open, bounded Close during route/Ensure, and no launch after startup-lock cancellation. `TestRecoveredDefaultBrokerRefusesNewRollingJournalBeforeSameEndpointReopen` verifies typed read-only admission refusal before probing or reopening the same endpoint. Existing broker disconnect, runtime replacement, owned lifecycle cancellation, and Phase 0 usage timing tests remain required. `TestInstalledManagedCodexAuthorityRecoveryMatrix` takes only an explicit `PROJMUX_CODEX_RECOVERY_INPUT` JSON file: private root, exact installed binary/SHA/source head/tree, two read-only release mounts, protected private auth input, explicit model and ten fresh validation inputs, host namespace IDs, and evidence path. It uses real installed projmux, real tmux, official managed daemon/proxy, and the repo Go client for baseline 0.151.0, upgrade 0.154.0, and three same-version restarts; one survivor and a new control complete actual turns in every row. Its content-free ledger retains failures and submission counts; it never replays work. Before each create/turn input, the same verified selection guard used by the zero-input diagnostic records exact fixture shim/release evidence and refuses a fallback CLI before incrementing submissions. `TestInstalledRecoverySelectionRefusalKeepsSubmissionsAndProviderCallsZero` reproduces execution-denied shim PATH fallback and pins create/turn refusal with zero inputs; `TestInstalledRecoverySubmissionRecordsSelectionBeforeExactlyOneInput` pins evidence-before-input ordering and rechecks every later sample. Run `go run ./internal/testutil/codexinstalled/cmd/managed-preflight </absolute/input.json>` first to verify the same general fixture helper with official start/version/stop, PID birth/artifact/socket/executable checks, and no real inputs or auth. `TestManagedRecoveryColdStartRequiresExactAbsentState`, `TestManagedRecoveryVersionMissingClassificationIsExact`, and `TestManagedRecoveryCleanupNeverFallsBackAfterUnknownStart` cover exact initial ENOENT plus owned absent state, unknown-result refusal, and zero fallback stop/signal/removal after unresolved ownership. Both runners refuse shared namespaces, ambient managers, and missing init reapers. Each turn waits for exact control publication and a successful read-only status response as well as registry authority. The matrix's unique tmux server has a fixture-private default-name socket alias for outside-tmux public commands; cleanup verifies the exact socket and waits for normal owned process exit. Linux managed conformance is opt-in and separate from Darwin compile/CI and generation qualification.
+- Managed recovery failure evidence: `TestInstalledRecoveryReadinessReachesProductionControlThroughCanonicalAlias` reproduces the readiness fixture's unsupported capability spelling before any tmux/control call and requires readiness to resolve `agent turn start`, then issue status only through the production exact control consumer. It tests baseline and later current authority through the outside-tmux default alias, canonical logical socket and exact physical socket/PID proof; the public turn-start handler consumes the same route/epoch. Empty optional Codex `SessionID` remains empty while the nonempty ThreadID stays exact. `TestInstalledRecoveryReadinessAndTurnRefuseCanonicalAliasDriftBeforeControl` requires both readiness and turn start to make zero control calls on route drift. `TestRecoveryErrorDistinguishesNoBrokerRefusalAndRedactsUnknownContent` requires `RefusalNone`/generic errors to stay unclassified without a false broker label, while known typed codes remain useful and unknown content is redacted. `TestRecoveryFailureEvidenceRetainsPartialIdentityWithoutContent`, `TestRecoveryReadinessDistinguishesRefusalsAndOnlyRequestsStatus`, and `TestRecoveryObserverEvidenceFiltersIdentityVocabularyAndContent` preserve each attempt/created UID before completion, bounded partial Registry and exact tmux/control observations, and terminal process/observer evidence without provider content. Unknown error/message/approval fields are omitted or classified; diagnostics never submit a turn. `TestCleanupEvidenceRetainsErrorsWithoutRetryOrFalseSuccess`, `TestCleanupEvidenceReadsOnlyOneStatForValidatedProcIdentity`, `TestCleanupStatProjectionRejectsMalformedOrDifferentPIDWithoutContent`, and `TestOwnedProcessObservationErrorRetainsCauseWithoutContent` cover both harnesses' cleanup evidence: closed stage/operation, numeric errno, validated proc PID/leaf and at most one bounded later stat birth/state snapshot. Failure diagnostics retain the original error; their optional later snapshot grants no cleanup authority or false success and never rereads environment/argv or retains raw errors/process contents. `TestOwnedProcessesPermissionDeniedZombieRemainsNonemptyResidual` reproduces environment EACCES followed by an exact zombie stat. Only after a verified official lifecycle and rechecking the same private PID/mount/network namespaces with an init reaper may the general fixture retain two matching bounded zombie stat observations as an explicit `unreaped-residual`, distinct from an `owned-executable` and never signal authority. `TestOwnedProcessesPermissionFailuresRemainErrorsUnlessExactPrivateZombie`, `TestResidualAdmissionRequiresRecordedPrivateLifecycleProof`, `TestOwnedProcessesResidualRequiresNormalReapingBeforeCleanup`, and `TestOwnedProcessesFailedCensusCannotClearEarlierResidual` require live/unknown permission failures, malformed/disappeared/reused stat, and changed namespace proof to remain errors; known residuals block cleanup until a successful later census proves normal reaping. Existing drain deadlines remain unchanged. `TestCleanupResidualHistoryRetainsUnreapedEvidenceAfterNormalDrain` pins both installed ledgers retaining bounded PID/birth/state/parent residual history even after the inventory becomes empty; evidence overflow refuses rather than dropping observations.
+- Installed command failure evidence: `TestInstalledCommandFailureCapturesOnceWithoutOutputOrFalseOutcome` verifies one fixture command invocation, numeric exit capture, inherited tmux environment removal, unchanged successful output, and zero raw stderr/stdout/argv in failure ledgers. Both installed runners save bounded `commandFailure`; the matrix also attaches it to the current attempt without changing submissions or completion counts. `TestInstalledCommandFailureProjectionRequiresBoundedKnownCLIShape` accepts only closed turn-start response/message pairs or established CLI wrapper prefixes, validates and discards resource-selector recovery suffixes, and refuses multiline/control-byte/unknown/oversized content. Stderr capture drains at a fixed 4096-byte memory bound. `TestInstalledCommandFailureRetainsUnknownOutcomeAfterReadinessAndControl` exercises the public Cobra bridge and exact control handler: status readiness can precede a failed fresh state read, a failed wire call, or an error recording an accepted turn. These are boundary fixtures, not proof of any actual failed invocation's cause. Every failure retains `outcome=unknown`; there is no retry, partial-output success, or provider mutation inference.
+- Zero-input managed connection diagnostic: `TestInstalledManagedCodexConnectionDiagnostic` accepts only an absolute `PROJMUX_CODEX_CONNECTION_INPUT` JSON file with private root, exact binary/SHA/source head/tree, two read-only releases, host namespace IDs and external evidence path. It proves the same real tmux/Registry route, then official manager ownership and production default Current/shared/owned initialization and Close for 0.151.0 and 0.154.0. There are zero Agents, threads and provider inputs; no Bind, thread read/start/resume or turn call. `TestConnectionDiagnosticInitializesAndClosesWithoutProviderOperations` and `TestConnectionDiagnosticRefusesModelAuthAndProviderInputFields` enforce those limits. `TestManagedSelectionShimAndProbeFollowCurrentLinkWithoutVersionCache` isolates the fixture environment producer and production PATH manager-probe consumer across a current-link change using explicitly synthetic manager responses: CLI, managed and manager-evidence versions follow the link, attached versions remain empty, and a running-manager/absent-wire contradiction refuses attach and lifecycle mutation with unknown ownership. `TestConnectionSelectionEvidenceDistinguishesShimReleaseAndDrift`, `TestConnectionFailureProbeCannotReplaceCurrentRefusalWithLaterHealth`, and `TestConnectionHealthEvidenceRejectsUnboundedProviderStrings` retain exact fixture shim/selected-release paths and hashes, state domain, and closed health/CLI/managed/running/wire versions. A failed connection gets one bounded later read-only probe, explicitly separate from the failed Current observation; later readiness never replaces that failure or retries Current. Unexpected selection refuses before another CLI invocation. This diagnostic does not replace the actual survivor matrix. Run with a private TMPDIR outside CODEX_HOME (for example `/artifact/tmp`) to avoid official CLI PATH-helper warnings. `TestExplicitInputIsBoundedAndCannotTraverseOrFollowSymlinks` covers the shared regular JSON input reader: absolute clean path, parent directory capability, no final symlink, maximum 64 KiB.
+
 - `make test` / installed opt-in smoke: Codex generation-pool Phase 3 routes prompted and payload-free native create through one exact current `stateDomainID + endpointGenerationID`, then keeps resume, message/reply/approval, lifecycle observation, and TUI argv pinned to the durable Agent ref even after admission-current changes. `TestCodexNativeCurrentChangePinsExistingAgentAndAdmitsNewCreateOnlyToNew`, `TestCodexNativeResumeRouteUsesDurableEndpointAndRefusesLegacyOrDraining`, `TestOfflineCodexResumeRechecksDrainingInsideTransactionBeforeProviderWrite`, and the Agent-control action table pin old/new cross-wire zero, locked-transaction lifecycle revalidation, typed missing/Draining refusal, and provider/Registry first-write zero. `TestGenerationRoutedBrokerEpochPublishesItsExactRuntimeAuthority`, `TestCodexNativeEndpointRouteTransportShapeIsClosed`, `TestDefaultCodexStateDomainIdentityUsesExactCanonicalCodexHome`, and the broker transport tests require real generation-keyed broker runtime authority, default/private transport XOR, and canonical content-free state-domain identity; a changed `CODEX_HOME` never reattaches a stored Agent. `TestNativeResumePickerRowsPreserveExactGenerationThreadAndSource`, `TestNativeResumePickerDuplicateVisibilityUsesKnownOwnerOrRefusesAmbiguous`, and `TestCodexResumePickerPinnedValueShapeIsClosed` freeze source/domain/generation/state in each native row value, visibly mark handover/unavailable rows, refuse duplicate visibility without a durable owner, and keep rollout rows unable to carry partial native authority. `TestInstalledIsolatedGenerationPinnedEmptyPromptCreateSmoke` is opt-in through `PROJMUX_CODEX_PHASE3_SMOKE_ROOT=/tmp/<isolated-root>` and runs the installed binary against a fixture-owned unmanaged direct endpoint plus unique Registry/tmux roots; it first bootstraps the fresh generated app config through the installed public `config apply` path with no live isolated server, then accepts only the exact tuple's closed Phase-7 result: durable-ready keeps the historical payload-free Agent↔Pane↔thread↔endpoint, zero-turn, pinned-TUI, broker, obligation, ambient-mutation-zero, and cleanup assertions, while typed not-ready preserves one exact Failed Agent/thread/endpoint with Pane/TUI/plain fallback zero and an unresolved exact-UID retry with second Agent/thread/lane zero. Installed Codex does not subscribe the broker until the first real input materializes the rollout, so the successful pre-turn row keeps native authority unavailable instead of adding dummy content; the provider-recorder integration owns first-real-input same-thread/one-turn proof without requiring ambient auth. Each observation records its exact CLI/app-server/platform/route tuple and is not a version-family guarantee. Phase 5 old-endpoint stop, successor same-thread resume, endpoint-ref CAS, Pane relaunch, retirement, lease release, and foreign adoption remain out of scope.
 - `make test` / `make test-integration` / private installed observation: Codex generation-pool Phase 4 owns explicit crash-resumable `plan|apply|resume|abort`, at-most-once admission-current, and old-generation drain. `TestRollingUpgradeStateMachineKeepsPhase5EffectsAtZeroAndReceiptsAtMostOnce`, `TestRollingUpgradeStateSpaceProperty`, and `FuzzRollingUpgradeValidStatesNeverContainPhase5Effects` pin monotonic receipts and all seven Phase-5 effects at zero, including `leaseRelease`. `TestCoordinatorExactPhase0TuplePreflightRefusesBeforeEveryMutation` re-opens both complete leases read-only and pins exact bundle/version/RoleTUI plus same-domain, direct-socket, and non-overlapping private/state/lease-root topology before any physical start. `TestCoordinatorResumeAfterLaunchBeforeProofReusesOneCandidateAndLeavesNoDuplicate`, `TestCoordinatorAbortFencePreventsStalePlannedResumeFromLaunching`, `TestCoordinatorAbortAndAdmissionRaceNeverStopsCurrent`, `TestCoordinatorEveryFailpointCrashRestartConvergesAtMostOnce`, and `TestRollingJournalAtomicWriteCrashHooksRestartWithoutDuplicateEffects` cover coordinator death after supervisor launch, all ten declared coordinator failpoints, both journal atomic-write crash hooks, exactly-once candidate-start/admission/drain/handover convergence after restart, the durable abort fence, and deterministic Abort-vs-admission schedules without fixed sleeps. `TestCoordinatorCandidateReadyAbortCleansExactCandidateAndKeepsSevenPhase5EffectsZero`, `TestCoordinatorLaunchBeforeProofAbortCleansRecoveredCandidateWithoutPhase5Effects`, `TestRemoveCandidateSocketRefusesUnknownOrReboundIdentityWithoutUnlink`, `TestCleanupDurableCandidateAfterSupervisorExitRemovesOnlyOwnedSocketAndReceipts`, and `TestCleanupDurableCandidateRecoversOnlyExactUnlockedOrphanGuard` pin exact candidate cleanup, retained bundle lease, unlocked no-socket orphan-guard recovery, and locked/foreign/rebound mutation zero. `TestExactRoleTUIArtifactRefusesWrongAbsolutePathAndPostVerifyDrift`, `TestCoordinatorWrongAbsoluteTUIPathNeverCommitsAdmission`, and `TestCoordinatorTUIDriftAfterReadyProofFailsInsideAdmissionBarrier` require the exact single RoleTUI lease artifact at publication and commit. `TestCoordinatorTwoSlotThirdUpgradeRefusesWithEveryMutationSurfaceAtZero`, `TestCoordinatorRetainedRetiredRoutesDoNotConsumeThePreparingSlot`, and `TestCoordinatorAbortedOperationRefCannotBeReplayed` close capacity/replay consistency. `TestAgentResumeDrainingGenerationFailsClosedWhenHandoverRequesterIsUnconfigured` tables both Draining and HandoverPending with an unconfigured requester, while `TestAgentResumeDrainingGenerationReusesOneGenerationWideOperationRef`, `TestCoordinatorRepeatedDrainingResumeReusesOneGenerationHandoverOperation`, and `TestDrainingOldCodexAgentKeepsExactTurnControlTUIAndPaneBinding` cover exact operation-ref reuse and direct old-generation turn/control without endpoint/TUI/Pane mutation. `TestPrivateRollingAdmissionReceiptRendersAllSevenPhase5EffectsAtZero` and opt-in `TestInstalledPrivateRollingAdmissionReceipt` cover content-free receipts, private process groups, ambient/default read-only observation, exact old Draining thread read plus successful no-turn-compatible listing, payload-free new Current create/read, assertion-safe exact target teardown, and ambient-preserving cleanup. Deletion ledger: zero canonical tests deleted or renamed and zero Phase 0–3 boundary suites merged; the canonical graph baseline only adds the four explicit upgrade leaves. Phase 5 effects remain zero in the unchanged Phase-4 receipt and are implemented only by the distinct linked handover journal.
 - `make test` / `make test-integration` / opt-in installed private observation: Codex generation-pool Phase 5 owns `agent app-server handover plan|apply|resume|abort` and the generation-wide `stop → resume → snapshot-all → endpoint CAS → same-Pane relaunch → terminal retirement → lease release` journal. `TestGenerationHandoverOrdersStopResumeSnapshotCASRelaunchTerminalLease`, `TestGenerationHandoverCannotCASUntilEverySnapshot`, and `FuzzGenerationHandoverNeverAcceptsUnsafeReceiptOrder` pin monotonic per-effect intents, the global snapshot barrier, and terminal lease ordering. `TestCoordinatorGenerationWideOrderingAndEveryFailpointResumeConvergesWithoutDuplicateEffects`, `TestCoordinatorRecoversExactSameGenerationBeforeHandoverAndCrashRetryIsIdempotent`, and `TestCoordinatorUsesQualifiedFallbackWhenExactSameGenerationRestartIsUnavailable` cover every coordinator effect gap, journal-authoritative repeated Apply, same-generation-first cold recovery, and exact-qualified fallback without a fixed sleep. `TestExternalOwnersRemainAwaitingOwnerStopWithLifecycleArgvZero`, `TestIncompleteManagedOldRouteBlocksBeforeEveryEffect`, `TestSuccessorPreloadedTargetStopsBeforeOldStop`, `TestPlanIgnoresSameGenerationIDFromAnotherStateDomain`, `TestAppliedNoTurnChoiceIsForwardOnlyAndCannotClaimAuthorityRestored`, and the abort-fence tests pin the ownership matrix, exact state-domain tuple, reversible-only abort, explicit no-turn choice, pre-stop loaded-thread refusal, and foreign lifecycle argv zero. Production-effect tests revalidate the pinned Agent/Pane/runtime/generation/thread tuple before successor absence, old stop, resume, snapshot, and same-Pane relaunch; `TestHandoverResumeReceiptSurvivesSuccessorRestartWithoutSecondResumeWire` pins the content-free operation-qualified at-most-once resume receipt. `TestInstalledPrivateJournaledGenerationHandover` is opt-in through `PROJMUX_CODEX_PHASE5_SMOKE_ROOT=/tmp/<isolated-root>` and uses exact private 0.152.0→0.152.1 binaries plus isolated XDG/tmux roots for the public handover and no-turn negative. Enforcement ledger: prompt/turn/approval resend, provider-content replay/inspection, duplicate same-thread ownership, automatic no-turn migration, foreign kill/adopt, live-old same-thread resume, Phase-6 consumers/Doctor, and unrelated cleanup remain zero. Deletion ledger: zero canonical tests deleted or renamed; Phase 0 qualification, Phase 1 lifecycle fencing, Phase 2 host/pool, Phase 3 generation-pinned routing (including the empty-prompt migration receipt), and the Phase-4 seven-effect-zero suite retain their unique symbols and boundaries; the command graph adds only four handover leaves.
@@ -52,6 +67,9 @@
 - `make test` / `make test-integration` / `make test-e2e`: Window anchor and primary-shell separation Phase 2 closes the role/live consumer table. `TestAnchorAwareCreatePaneAndAgentUseExactLiveShellAnchorDetached`, `TestAnchorAwareCreatePaneAndAgentUseExactLiveAgentAnchorDetached`, `TestAnchorAwareCreatePaneAdoptsNewShellAsEmptyDefaultWithoutReplacingShellAnchor`, the paired resume tests, and the explicit-Pane/popup precedence tests pin detached exact-Window outcomes and create-time default-shell adoption. `TestAnchorAwareCreateRefusesDeadAndCrossWindowAnchorsWithZeroWrites` and `TestRegistryTopologyMaterializationRefusesDeadAnchorWithoutAlternateLivePaneInference` prohibit alternate-live-Pane inference. `TestRegistryTopologyMaterializationAgentAnchorLazyDefaultShellAndRepeatNoop` plus the installed isolated real-tmux Agent-only Window fixture pin the plan-visible lazy shell, preserved Agent anchor/Pane uid, exact default owner/ref graph, smoke-root socket containment, and repeat no-op. `TestFocusKindOnAnOfflineTargetExitsTwoAndMaterializesNothing`, `TestFocusKindMovesTheClientToAnAlreadyLiveTarget`, and `TestControlOwnedRegistryKeepsMaterializeGreen` cover strict read/navigation-only focus and the Project/ControlSession root boundary.
 - `make test` / `make test-integration` / `make test-e2e`: Window anchor and primary-shell separation Phase 3 keeps canonical Pane/Agent delete and clean exit independent from explicit Window deletion. Registry-order sibling choice, optional-empty default shell, Offline Agent retention, and same Window UID/name remain pinned for non-last Pane deletion. Project runtime stop Phase 1 supersedes the old last-Pane replacement boundary: an exact clean last-Pane receipt waits for its matching `window-unlinked`, then deletes only the Window subtree with zero replacement allocation. Explicit `delete window --yes` uses the same root-preserving shape: a non-last primary reanchors to its existing sibling and a last Window leaves the Project uid/root/reservation with empty `primaryWindowRef`; only explicit `delete project` unregisters the root. Unknown, killed, unpaired, foreign, stale, missing-server, and empty observations retain zero Window-delete authority.
 - `make test` / `make test-integration` / `make test-e2e`: Window anchor and primary-shell separation Phase 4 closes projection and startup over final-v2 desired state. `TestSnapshotProjectionFinalV2RefsAndOpenFreshGolden`, `FuzzSnapshotProjectionIsScopedValidAndIdempotent`, and `FuzzOpenFreshKeepsOnlyCanonicalProjectShell` pin metadata-bearing and legacy snapshot projection, Agent-anchor/default-shell policy, target-subtree replacement, source-snapshot preservation, and fixed points. `TestProjectFreshStartPruneScope` preserves an existing canonical Project/Window/shell UID chain and exact transaction-level Registry bytes across repeated Open fresh, while `TestProjectFreshStartAgentAnchorCreatesExactMinimumShellAndRepeatsNoop` covers its one permitted shell allocation; `TestRestoredOfflineAgentAnchorContinueConvergesLazyShellAgentAndRepeatNoop` covers offline restore through lazy default-shell/Agent materialization. `TestAuthorshipPromotionPreservesSiblingProjectSocketAndOtherHostDesiredState` pins exact-socket positive convergence while sibling-socket and other-host-only desired refs/status plus Registry order remain byte-identical. The isolated smoke covers snapshot/Open fresh closed repeats with the exact UID chain, lifecycle Window survival, create/resume/materialize/focus, failure/repeat paths, and exact-socket sibling isolation.
+- `make test`: Install handover Phase 1 keeps every Window anchor writer inside the validator's anchor predicate. `TestWindowAnchorEligibilityPredicateBranches` pins the membership, role, and managed-Agent-Pane clauses of `windowAnchorEligibility`; `TestDeletePaneReanchorSkipsReleasedAgentPaneForEligibleShell`, `TestTransitionAgentReleasingAnchorPaneMovesAnchorToEligiblePane`, `TestAnchorWritersCloseOnNewDefaultShellWhenNoPaneIsEligible`, and `TestAttachAgentPaneMovesAnchorFromPreviousBindingToNewManagedPane` cover delete reselection, termination release with an empty `paneRef`, the default-shell close with preserved ineligible rows, and rebind including the snapshot-projection Offline binding; `TestAnchorWritersPreserveValidationOverRandomWindowConfigurations` (seed 20260913, 512 iterations) requires `Validate` after every writer; `TestTopologyAgentContinueAdmitsTerminatedAnchorAgentWithEmptyPaneRef` keeps the terminated anchor Agent out of the `still records a current paneRef` refusal.
+- `make test`: `TestStampProjectSnapshotSkipsUnboundPanesInRuntimeIDDuplicateCheck` pins that snapshot save's Pane runtime id duplicate check skips only a `MissingRuntime`=True/`RuntimeUnbound` Pane: its retained tmux id reused by a live Pane stamps the live Pane's UID, leaves the unbound Pane's `Status.Activation.RuntimeID` intact and absent from the snapshot, while two live Panes, a False condition, or another reason sharing the id still refuse with `share runtime id`.
+- `make test`: `TestStampProjectSnapshotSkipsUnboundWindowsInRuntimeIDDuplicateCheck` pins that snapshot save's Window runtime id duplicate check skips only a `MissingRuntime`=True/`RuntimeUnbound` Window: its retained tmux id reused by a live Window stamps the live Window's UID, leaves the unbound Window's `Status.RuntimeID` intact and absent from the snapshot, while two live Windows, a False condition, or another reason sharing the id still refuse with `Registry Windows ... share runtime id`.
 - `make test` / `make test-integration` / `make test-e2e`: Codex native control plane Phase 3 projects a closed, content-free app-server lifecycle into Agent interaction, badges, attention, and notifications. Unit and fuzz event sequences pin exact thread/turn/item/request approval identity, waiting-plus-unresolved gating, resolution and leave-waiting clears, successful completion once, failed/interrupted non-completion, and old-epoch/foreign-identity writes at zero. Fake proxy tests pin observation-only server requests with no approval response, snapshot convergence, invalidation-before-fallback ordering, reconnect replacement, and all Codex hooks writing zero through pending/healthy/invalidating authority. Settings and delivery tests pin the independent `approval_required`/`response_complete` Notify/State only/Quiet matrix across app-server and hook-fallback epochs, explicit raw fallback-only precedence, exact non-Notify queue clearing, raw hook-byte preservation and no inference, mixed multi-Pane source/reason/epoch diagnostics, Quiet aggregate-badge suppression, and content-free `describe agent` rows. Isolated tmux integration and e2e cover exact Registry/Pane/generation/thread binding, native/fallback/reconnect behavior, queue/desktop outcomes, sibling containment, and a privacy/scope inventory that excludes prompt/control, progress/diff, catalog/session-state, provider configuration, schema, and release changes.
 - `make test` / `make test-integration` / `make test-e2e`: Codex native control plane Phase 7 admits only bounded scalar progress from the exact current app-server turn. The adapter drops plan explanation/step text, diff bytes and paths after a 256 KiB header-only scan, and every item body while mapping only the installed-schema discriminator into the ten-value activity set. Unit and fake-clock properties pin 99 plan steps, 999 changed-file headers, 32 opaque dedupe ids, deterministic dropped/unknown/overflow counters, identical/out-of-order write zero, and at most four non-terminal Registry writes per Agent per second. Adapter-to-reducer-to-Registry/read/UI tests pin exact activation turn attribution, KO/EN 80/100/120-cell rendering, read-time-only Window counts, and immediate zero-history clear on completed/interrupted/failed turn, generation replacement, disconnect/invalidation, Offline, and Failed; unavailable native progress leaves the existing interaction UI unchanged. Privacy inventories reject prompt, reasoning, step, command/tool/file/path/name/output, diff body/hash, model, and effort fields across the reducer input, durable Agent status, describe/Inspector projection, tmux options, and diagnostics.
 - `make test`: Codex native control plane Phase 0 keeps the app-server wire in `internal/integrations/agents/codexappserver` and pins the headerless JSON-RPC JSONL frame bound, monotonic request IDs, out-of-order response routing, initialize/initialized lifecycle, typed notification delivery, context-bounded request and initialized-notification writes, local cancellation with ignored late responses, and connection replacement with no goroutine leak. A fake stdio proxy matrix closes healthy, missing/disconnected, unsupported `-32601`, malformed, and timeout outcomes into exactly one of available/unsupported/unavailable/timeout/protocol-error, while Doctor, support-report redaction, and the Settings no-op state row expose only source/reason/version/endpoint-kind/connection-state. Negative source and argv audits keep daemon mutation, login, config writes, remote transport, all existing Agent/hook/resume/usage consumers, giant provider interfaces, and Settings source controls at zero.
@@ -134,6 +152,7 @@
   This v4 row supersedes the automatic short-name, direct-owner reservation, and stored-presentation assertions in the earlier historical Registry observation and selector entries; those entries continue to document the defects and seams that produced the current tests, not the current wire contract.
 - `make test-e2e`: Project-wide naming closure Phase 2 automatic-name witnesses against real tmux. L06 `create-materialize` registers alpha with an explicit `--name alpha` and beta with no `--name` at all, then proves the automatic Project name is the exact created uid: beta's uid is read back through the read-only `get projects -o json` projection selected by beta's exact root -- never by listing order, and never by re-issuing the create, whose reuse projection a later Phase owns -- the root-selected uid is confirmed to be the Project bound to that exact root, `describe project uid:<uid> -o name` equals the uid byte-for-byte, and the create result line is `project/<uid> created` rather than any semantic stem; every later beta reference in that scenario is therefore a `uid:` reference, because the automatic name is no longer the word `beta`. L12 `first-open` proves the same for an implicitly registered Project, then separates the two mirrored fields whose v4 values coincide: `@projmux_project_name`, `@projmux_project_uid`, and `@projmux_project_path` are each asserted on the freshly opened `work-gamma` session, and because an automatic name *is* the uid there, two explicit `rename project uid:<uid>` round-trip steps on the inherited absolute socket make the fields diverge -- the name mirror follows every address change while the uid mirror, the path mirror, and the session name stay exactly where they were, with the failure message naming which of the three drifted. L07 `binding-convergence` adds the cross-kind half: an alpha Window and an alpha Pane both named `shared` coexist in the one root and `describe window shared -o uid` / `describe pane shared -o uid` each return their own exact uid. L06 also proves the automatic Agent name is the exact Agent uid -- the payload-free `create codex` shortcut allocates exactly one new `agent-<uid>` identity rather than reusing the provider-named first Agent, a `--` payload reaches the provider and never the name, no numeric suffix exists to append, and an explicit `--name` colliding with the one human-chosen Agent name in the owning root is still exit 2 with zero writes and no new pane. L14 `registry-navigation` keeps its imported shell Pane automatically named and renders it offline, which is covered by the compact-default picker contract below.
 - `make test` / `make test-e2e`: Columnar picker Phase 2 supersedes the naming Phase 2 NAME/RESOURCE workaround. `TestPickerCompactFullUIDAndHangulFits80Columns` fixes the compact `KIND NAME STATUS ACTIONS` first frame inside 75 cells with full UID names, Hangul context and real action lists; only repeated provider/phase and role display adornments move to wide. `TestPickerCompactNativeFramePreserves76CellRegression` keeps the prior 66-cell fixture and the observed 76-cell clipping regression, proves the latter clips under the real renderer pipeline, then checks every full compact field after picker-local one-cell spacing (63/73 cells). `TestPickerWideNativeFrameViewportMatrix` runs the same native frame/scrollbar/pointer pipeline at 80/120/180/184 columns: the historical 142-cell row clips through 180 and is complete at 184; wide retains its two-cell gap. `TestPickerWideRetainsUnboundedValuesAndDetailRecovery` checks full NAME/RESOURCE/REASON/raw-target values, per-field row detail recovery and Runtime CLI semantic parity. `TestPickerProfilesUseExactCatalogFieldOrder` pins both catalog projections. `TestColumnPickerProfileSettingsAndNativeStateParity` covers the two canonical catalog actions, default Alt-W and a plain single-key Settings override, effective footer keys, query/selected-value restoration, compact-wide-compact transitions, reopen reset and zero keymap writes. `TestColumnPickerToggleDoesNotObserveOrWriteAgain` exercises both command loops, including empty filtered results, and proves unchanged row cardinality/order/search plus no extra tmux observation or runtime writes. L13 and L14 drive both toggles through attached real tmux clients and retain exact popup-process completion and zero-Registry-write checks. Installed isolated 80x24/120x30/180x40 plus 184-column smoke observes compact visibility, expected narrow wide clipping and detail/JSON recovery. The historical 142-cell Registry and 120-cell Runtime rows are representative measurements, not arbitrary-data upper bounds; current actions and free text may widen them. The former picker truncation helpers and all NAME/RESOURCE/RUNTIME/REASON bounds are removed; the source PROGRESS policy, footer rendering, provider vocabulary, CLI/JSON/scalar projections and identity authority are unchanged. [Column profiles](column-profiles.md) describes the open-lifetime control and recovery contract.
+- `make test` / `make test-integration` / `make test-e2e`: Default resource AGE Phase 0 extends only the four Registry CLI compact lists to `NAME STATUS ACTIONS AGE`. `TestGetListDefaultAgeMatchesWideAtFixedClock` compares default/wide cells on the same row and injected clock for every kind, covering second/minute/hour/day boundaries, long ages, future creation stamps, missing `createdAt`, and repeated reads. `TestResourceTableDefaultAgeUnavailableIsEmpty` keeps absent resources and absent clocks as empty AGE cells in both profiles. `TestGetListDefaultProjectionIsColumnar`, `TestResourceTableColumnsAreTheCanonicalContract`, and `TestGetReadFamilyResolvesEveryKindWithListCardinality` pin the default table/header contract. `TestColumnProfilesDoNotSelectFromWidthAndWideIsUnbounded` retains AGE at COLUMNS 40/80/112/120 with byte-identical default output; resource CLI tables retain content width and can wrap on narrow terminals. `TestColumnProfilesExactOutputAndSnapshotParity` changes only four compact golden sections and freezes wide, JSON, metadata, scalar and runtime output; `TestColumnCatalogCompletenessBijectionAndExactProfiles` preserves the other three surfaces. Existing empty-list and scoped-row guards remain active. Integration and E2E compact recovery assertions accept the fourth AGE column. AGE still uses the existing `resourceAgeCell` and `i18n.FormatDuration` calculation.
 - `make test` / `make test-integration` / `make test-e2e`: Route-implied kind omission changes only the four Registry CLI compact lists to exact `NAME STATUS ACTIONS`. `TestColumnCatalogCompletenessBijectionAndExactProfiles` and `TestGetListDefaultProjectionIsColumnar` reject compact KIND reinsertion and wide/mixed KIND removal. `TestCompactResourceKindOmissionPreservesScopedRowsAndRecovery` covers all four routes with unscoped, all-projects, Project, Window and exact-Pane selectors where supported, including empty results, ordered UID sets, full NAME/STATUS/ACTIONS parity and wide/JSON kind recovery. Each fresh read runs `assertColumnReadCounters` (one Registry load, four existing tmux queries, zero Registry transactions/writes and zero sibling calls). `TestColumnProfilesExactOutputAndSnapshotParity` keeps the wide/JSON/metadata/scalar/runtime byte goldens and ACTIONS snapshot fixed; only four compact golden sections change. `TestMixedPickerProfilesRetainKindCells` verifies every mixed Registry/Runtime row retains KIND in both profiles; the existing toggle, query/selection, 80-column and detail-recovery guards remain active. Integration checks the restored Window's compact/wide/JSON cells; L06 repeats four-kind nonempty/empty default/wide/JSON recovery on real tmux and compares Registry bytes. This stdout change moves NAME, STATUS and ACTIONS one position left and can break positional parsers; wide and JSON retain kind.
 - `make test`: Resource timestamps surfacing Phase 0 timestamps in read surfaces: the registry has always stored `metadata.createdAt` on every resource, `Condition.firstObservedAt`/`lastTransitionAt` on every observed condition, and `Agent.status.lastTransitionAt` on every Agent, and `-o json` has always emitted them -- but no human-facing surface printed a single one of them, so `describe pane` carried zero time rows and the columnar `get` carried no `AGE`. Both now render, and nothing new is collected: no tmux query, no schema field, and no second relative-time implementation. The plural reads gain an `AGE` column, last on all four kinds because that is the one column whose width moves with the clock and last is the only position where growing it cannot walk an owner-chain column sideways; it is rendered through `i18n.FormatDuration`'s compact form, the same single implementation `notify list` already renders its own AGE through. `internal/app` pins the arithmetic as a boundary table asserted from both sides of every unit rollover (`59s`/`1m`, `59m`/`1h`, `23h`/`1d`, up to `900d`), plus the three cases that render an empty cell rather than a number -- a uid that has left the registry, a resource stored before `createdAt` was stamped whose zero Time would otherwise date it to year 1, and a caller that passed no clock -- and a whole-table golden spanning `9s`/`47m`/`6h`/`11d` in one read, which is also the alignment case because the widest cell sets the column. Determinism is stated as a two-sided claim rather than a single assertion, since only the pair is falsifiable: the same injected clock twice must be byte-identical (which a renderer ignoring the clock would also satisfy) **and** a clock advanced three days must produce a different table (which a renderer reading `time.Now` would fail), so only a renderer reading the passed-in clock and nothing else survives both. The clock reaches exactly one projection: `writeResourceProjection` takes it as an explicit parameter and the singular call sites (`get pane`, `describe`, `rename`, and the create fan-out, whose default projection is the `<kind>/<name> created` line and never the table) pass the zero Time, which `resourceAgeCell` renders as no age at all rather than as "created exactly now". `describe` gains absolute UTC instants instead: a `CreatedAt` row beside the identity rows on all four kinds, `PhaseSince` under an Agent's phase, and the second half of a condition's stored pair (`lastTransitionAt` beside the `firstObservedAt` that was already there), each omitted when the registry file predates the field so a pre-`createdAt` registry keeps its exact current block. The timestamp machine-consumer contract is frozen the whole way: `-o uid|name|ref|none|metadata` remain byte-identical, and the durable portion of plural `-o json` remains exact around the later Columnar Phase 0 context sibling -- both current whole documents are pinned rather than substring-matched, so a timestamp key anywhere still reddens. The Columnar track's `describe pane` byte-golden moves by exactly one row and keeps its own purpose intact: what it guards is that the columnar table is reachable only with `list` true, and a header line or a padded column in a singular route still reddens it.
 - `make test`: Settings IA re-cut Phase 0 full navigation cutover: the visible Settings tree is declared once in `internal/app/settings_nav.go` and frozen by `internal/app/testdata/settings-nav-tree.golden`, so an IA change is a golden diff rather than a shape spread across the section loops. Structural tests prove the catalog is a tree (unique ids, resolvable parents, a scope root at the top of every path), that every control hangs off exactly one owning `[View]` and that only a View owns children (row-affordance exclusivity), and that each rendered picker value maps onto exactly one navigation node whose owning loop the closed reachability table actually handles (control-owner cardinality); the drift guard runs in both directions, so a section loop cannot grow a row the golden does not show. The removed-path negative guard proves `Labs`, the separate `Theme` root, `Project recipe` and `Effective merge view` are neither rendered, nor catalogued, nor routable through `runSection` — the retired handlers, action metadata, and i18n entries are absent rather than hidden redirects — and the legacy-copy guard rejects the retired vocabulary (`AI Settings`, `Project Picker`, `Project Root`, `Workdirs`, `Enabled agents`, `Default split mode`, `Resume picker`, `Session State`, `Kill Session`, `New window`, `Hook quiet policy`, `Delivery sources`, `Labs`, `Usage HUD`, `Path icon`, `Notify icon`, …) across navigation labels, rendered rows and keymap display labels, in both locales. Display renaming is proven display-only: the keymap action IDs (`new-window`, `Sidebar:KillSession`, `ai-split-right`, …), the `sessionstate:`/`project-hooks:`/`live-resources:`/`statusbar-decoration:`/`workdir:`/`projdir:`/`switch:`/`keymap:`/`theme:` action spellings and their owner contracts are all unchanged behind the renamed rows. Keybinding navigation is category-based: an exhaustiveness test requires every catalog action to carry exactly one explicit category (never an ID-prefix inference), every surface action to sit in the sidebar/picker category with a display label for its surface, one display label per action, and each action to render exactly once across the rendered categories, while the category rows carry their members' action IDs, labels, chords and state so search still crosses the category boundary. The action detail projects the product semantics the target IA asks for — target kind, result kind, placement and anchor — and pins that every interactive right/down split declares the explicit current-Pane anchor and a right/down placement, that `Create <Provider> Agent` is always-new, and that resume names the existing `Offline`/`Failed` Agent it rebinds. Navigation is proven side-effect free (opening the root, every section and every container writes no config and runs no tmux command), every `[State]` row carries the catalogued passive value so Enter can never fall through, and the promoted rows keep their old state at the new route (Resources reads the same `live-resources` file it read from Labs, the project automation policy the same `project-hooks` file, Theme the same global `[theme]` block through `Appearance > Theme`). The pinned Project item view keeps Project identity separable (display name, unique name, uid, bound root, condition, missing-since, runtime) and offers same-uid remediation through the canonical `rebind project` route instead of re-pinning, with the unregistered-path case rendering a disabled rebind row carrying its reason. The Agent Usage HUD ownership guard keeps `agent usage` canonical: no Settings row spells a `Usage` resource or a `get usage` read, and `docs/settings-ia.md` names the owner.
@@ -252,6 +271,8 @@
 - Picker focused unit coverage includes native picker item/action mapping, direct native routing with no backend selector, stale selector env/file non-observation without lookup/delete/rewrite/propagation, native title-focused filtering, numeric selection, shared close actions including raw native custom actions, fuzzy-score reference fixtures, AI picker title chrome and stable search-key ordering, Settings title chrome and root section order, Settings Labs without picker source or hidden keybindings rows, compact multi-line metadata gutters with one-column-indented metadata, proportional native scrollbar thumb rendering, native row width clamps that preserve ANSI resets and Korean/wide-cell frame geometry with matched scrollbar/no-scrollbar row budgets including Settings > Appearance AI badge preview rows and parent long emoji preview rows, native app-background and semantic selected/muted/accent/warning/critical role coverage for fallback/effective themes across content padding, empty no-footer rows, footer rows, scrollbars, split-preview gaps, reset-to-padding continuation, and Korean Settings > Appearance AI badge style chips/prompt/emoji rows, multiline partial next/previous item row rendering with rendered-row scrollbar units, fixed split-preview and sidebar list viewports with scrollbar tracks, native Up/Down and Ctrl-N/Ctrl-P navigation wrap with empty-list safety and PageUp/PageDown/Home/End clamp regression coverage, native mouse down/follow-drag/release behavior, deferred native row updates that preserve filter/selection state and can repeat from event triggers, preview tab/control normalization before width clipping, optional native frame titlebars without same-line rule fill and with title/chip gap inheritance guards, titled Alt-1 sidebar chrome, statusbar-preserving sidebar popup height, compact project sidebar popup sizing, cheap Alt-1 first-paint rows with deferred git/window/attention/preview enrichment, fixed three-line Alt-1 sidebar row geometry across cheap/enriched paints, bulk switch existing-session classification with per-candidate fallback, and notify sidebar title/popup sizing.
 - Picker/setup lifecycle coverage includes deferred native key-reader stop and repeated reopen cleanup, plus per-probe controlling-TTY cleanup and timeout-then-next-key reads without stale goroutines stealing input.
 - Doctor focused unit coverage includes tmux required/stale behavior on every host, Windows `stty` skip behavior, and tmux bell fallback diagnostics.
+- `make test`: Codex endpoint diagnostics C-1 is enforced by `TestDoctorCodexEndpointMismatchExactActivationSet` (mismatch/match/mixed/empty and installed-CLI skew), `TestDoctorCodexEndpointMismatchIncludesBoundNonRunningActivation` (current activation scope), `TestDoctorCodexEndpointMismatchSignalsEnumerationGaps` (missing/orphaned/conflicting activation, foreign/opaque endpoint and unavailable observations), and `TestDoctorCodexEndpointMismatchDoesNotGuessPrivateGenerationRouting` (version-shaped private IDs and unknown pool routing). `TestDoctorCodexEndpointMismatchTextJSONSupportParity` and `TestDoctorCodexEndpointMismatchPartialEnumerationParity` require exact Doctor UID sets, support-hashed identity parity, visible partial enumeration, 2026-09-09 n=1 observed risk with undetermined causality, and no mismatch block for a complete matching census. `TestDoctorCodexEndpointMismatchSupportAllowlistIsScoped` preserves support redaction. `TestDoctorCodexEndpointMismatchReadOnlyArgvAudit` exercises the production Doctor/support probe against an isolated failing proxy, requires visible incomplete enumeration and only `app-server proxy`/`app-server daemon version` argv, and preserves the Codex state tree; it never reaches live app-server, broker, or supervisor processes.
+- `make test`: Codex endpoint diagnostics C-2 is enforced by `TestOperatorRecoveryGuidanceOwnershipMatrix`: unmanaged current, skewed, and unknown-version endpoints name `codex app-server daemon bootstrap` and the observed `pid` backend's need to bootstrap again after reboot; managed and unknown ownership omit that prescription, with readiness/refusal/recovery codes unchanged. `TestDoctorCodexRecoveryGuidanceTextJSONSettingsSupportParity` requires Doctor's bounded sentence and the existing Settings/Doctor JSON/support recovery code to agree without a schema change. `TestOperatorRecoveryGuidanceReadOnlyArgvAndState` exercises repeated Doctor/Settings/support triggers against an isolated ready unmanaged proxy, allows only `app-server proxy` and `app-server daemon version` argv, and preserves Codex state byte-for-byte; recovery execution argv is zero. `TestProductSourceHasNoSharedDaemonStopRestartOrKillArgv` also forbids bootstrap argv in the product source. The reboot observation makes no claim about other backends' boot persistence.
 - Shell focused unit coverage includes canonical typed Project/ControlSession bootstrap followed by the non-creating foreground route `tmux -L projmux -f <generated config> attach-session -t =<session> [-c <cwd>]`; disappearance after preflight fails closed instead of letting `new-session -A` provision outside the plan. Generated tmux config callbacks, native key-broker platform policy, runtime overrides, and nested-socket guards remain covered.
 - `make test` also covers npm retire/staging path canonicalization for the resolved projmux executable so generated tmux config and hooks never embed a `node_modules/.projmux-<hash>` directory, plus error-suppressed attention and rebalance-panes hooks.
 - `make test` also covers the public config spelling: `projmux config edit [--get|--set <mode>]`, `config render standalone|app`, and `config apply` forward raw argv to their manual leaf handlers; flags, unknown tokens, streams, handler errors, and side effects stay on those handlers. `make install` and every update path emit `projmux config apply`, while generated plumbing uses only the hidden `internal` namespace.
@@ -270,7 +291,8 @@
 
 - `make test` / `make test-integration` / `make test-e2e`: Registry-first control plane Phase 8 termination evidence transport binds a managed process's real exit to the Pane it ran in. `internal/core/metadata` adds the per-materialization `status.activation` generation and the optional `status.lastTermination` receipt on Pane and Agent, and its tests pin the closed classification vocabulary (exit 0 is `normal` and never `intentional`; non-zero and signal are `abnormal`), the generation guard across replaced generations, deleted Panes, a shell Pane claimed by an Agent and an Agent that no longer binds the Pane, the byte-identical duplicate no-op, intent recordable only by `source: control-action` and sticky against the signal a deliberate delete causes, the operation-id-scoped withdrawal that refuses to clear another operation's receipt, the generation-guarded runtime handle, and a registry stripped of both additive blocks that decodes, validates, re-encodes byte-identically, and rejects a receipt for a Pane that never carried a generation. `internal/app` adds the hidden `internal supervise` route: the argv builder terminates its own flags with `--` so an operator payload spelling `--pane-uid` cannot be re-read as one, a shell Pane with no command of its own is supervised over tmux's documented `default-command`/login-`default-shell` rule read from the same exact server, and every failure to construct a supervisor -- an unresolvable binary, an unreadable tmux default, a Pane with no generation -- returns the caller's original command so the pane still starts with no receipt rather than not starting. The route's tests pin the recorded wait status for clean exit, non-zero exit, and signal with the matching `128+signum` exit status, a registry that cannot be written costing the evidence and never the pane's own status, a stale receipt reported and dropped, a usage refusal that starts no child, and a launch failure reported as a launch failure rather than a termination. `runSupervisedChild` is exercised against real `sh` children for all three wait statuses and for argv/cwd/environment parity. Create, create-window, create-agent, `agent resume`, and the topology materializer each issue their own generation before the launch argv is built, and a route-level table proves every launched pane quotes the generation the Registry stored for it, that a fan-out never repeats one, and that a receipt from the process a resume replaced changes nothing. `delete window|pane|agent` gains `--socket`/`--socket-path` and now resolves exactly one server from those flags or the inherited absolute `$TMUX`, refusing outside tmux instead of falling back to `-L projmux` -- which supersedes the `-L projmux` inventory the Window and Pane/Agent deletion entries above describe -- and it commits its intentional receipt in its own transaction before the first live mutation, withdrawing it again on every refusal that leaves the processes running. The integration smoke records real shell exit 0, exit 7, and a signal death on an isolated exact socket and reads the receipts back out of an isolated Registry; the e2e smoke drives the same lifecycle against a real tmux server and proves an isolated `delete agent`/`delete pane` dry-run and apply touch only the socket they were given, leaving a sibling socket and the default socket unchanged.
 - `make test` / `make test-integration` / `make test-e2e`: Agent clean-exit and Continue replay policy Phase 0 records Project-stop provenance without changing replay. `TestProjectStopInterruptionPrewriteSelectsOnlyExactRunningAgentsAtomically` requires every and only then-Running Agent-owned Pane in the exact Project to receive matching generation/operation `interrupted/control-action` evidence in one Registry commit. `TestProjectStopFailureCompensatesOnlyWhenExactSessionIsProvedLive` pins same-operation compensation after a proved-live failure and retention after an apply error whose exact Session is proved absent; the existing external-HUP supervision rows remain `killed/supervisor`, and `TestInterruptedControlActionIsCurrentGenerationStickyAgainstLateSupervisorHUP` prevents a delayed HUP receipt from overwriting Project-stop authority. `TestCanonicalV2MigratesToV3WithoutInformationLoss` and `TestCanonicalV2ToV3PublishesOneLosslessBackupReportAndRepeatsNoop` pin the schema 2→3 lossless transform, exact versioned backup/report, one-time write, and newer-schema downgrade refusal. Describe renders classification/source/generation as separate fields and `get` includes all three in its termination cell. Continue planning, explicit resume, Open fresh, snapshot projection, provider argv, and public hooks remain unchanged in this producer-only Phase.
-- `make test` / `make test-integration` / `make test-e2e`: Agent clean-exit and Continue replay policy Phase 1 makes current-generation exact `control-action/interrupted` evidence the sole automatic Agent authority of retained-Project Continue. `TestTopologyAgentContinueEligibilityMatrix` closes source × classification × pre-projection-Running/projected-Offline phase × sessionRef, including nil evidence, stale generation, illegal pairings, and the supervisor normal/abnormal/killed, delete intentional, and reconcile unknown refusals. `TestRegistryTopologyContinueLaunchesInterruptedBOnceAndRetainsCleanA` and `TestClosedProjectStartupContinuesOnlyInterruptedAgents` require clean A launch 0 with UID/sessionRef/evidence retained, interrupted B exact-conversation launch 1, and repeated Continue duplicate 0 with no Registry write or split. A recorded conversation never degrades to fresh when its exact resume argv cannot be built. `TestExplicitSnapshotRestoreRetainsAgentReplayAuthority`, the session-state request assertion, and the isolated L10 topology/L11 startup smokes keep explicit snapshot restore and explicit `agent resume` authoritative. L10 requires raw Window/server HUP launch 0 while exact shell/Window UIDs converge, then uses only its test fixture utility to supply current-generation interrupted authority for the Agent-only anchor replay; L11 proves external HUP launch 0, Open fresh one canonical shell/zero Agent, exact `TMUX`/`TMUX_PANE` removal, unique contained sockets, and exact queried cleanup. Phase 0 producer/schema/vocabulary/migration, clean-Agent deletion, provider input/transcript/conversation stores, public hooks, ControlSession/quit/delete semantics, and Fresh identity remain unchanged.
+- `make test` / `make test-integration` / `make test-e2e`: Continue recovery diagnostics Phase 1 is enforced by `TestTopologyRecoveryTypedReasonDecisionSites`, `TestTopologyRecoveryMixedReasonsReachJournal`, `TestTopologyRecoveryStartupCommittedSummaryAndJournal`, `TestTopologyRecoveryPublicPreviewRepeatAndLockReplan`, `TestTopologyRecoveryFailureNeverRecordsPlannedSuccess`, `TestTopologyRecoveryWriterDisplayFailureAndNoClient`, `TestTopologyRecoverySnapshotRetainsSeparateAuthority`, and `TestTopologyRecoveryReportArchiveIncludesSuccess`. The diagnostics package tests `TestTopologyRecorderCommittedCountsAndOnce`, `TestTopologyRecorderFailureAndInvalidCounts`, and `TestTopologyEventClosedShapes` hold the exact ten reason codes, same-run reason totals, count/event isolation, privacy, and writer failure ownership. Startup tests cover 0/1/9 committed resumed/skipped counts, nine long Korean names, en-US/ko-KR summaries within 220 valid UTF-8 bytes including ellipsis, retained stderr details, public log/report, and no foreign-server display without a client. `TestTopologyRecoveryCanonicalContinueReportsAfterCommit` exercises the canonical zero-Window/no-topology fallback through the real session transaction, requiring no precommit success and exactly one 0/0 success or commit-failure outcome; `TestTopologyRecoverySwitchDoesNotDuplicateMaterializerOrSnapshot` protects existing reporting ownership. L10/L11 retain verified same-run safe events and their exact bounded summary as unique recovery JSON artifacts. L10 reads public materialize results through diagnostics log after each evidence-matrix execution and repeat; L11 reads the actual startup invocation after external HUP, mixed normal/interrupted recovery, and nine missing refs, preserving explicit-resume/snapshot authority and live-open bypass with no duplicate event.
+- `make test` / `make test-integration` / `make test-e2e`: Retained-Project Continue resumes exact stored conversations after unplanned stops. `TestTopologyAgentContinueEligibilityMatrix` covers interrupted/killed/abnormal/unknown/no-receipt × Running/Offline/Failed/Pending with actual exact-resume or zero-launch assertions; intentional and normal remain excluded. `TestTopologyAgentContinueRejectsInvalidActivationEvidence` and `TestTopologyAgentContinueTerminationPairingAndShape` require legal receipt provenance and wait status, matching Agent/Pane evidence, current managed generation/owner, Running's exact paneRef, and Offline/Failed's unique retained activation when evidence is absent. `TestTopologyAgentContinueResumePreparationMatrix` fixes missing/blank/malformed/mismatched refs, normalized IDs, unsupported/disabled providers, missing cwd, and prepare errors at fresh 0 with a reason. `TestRegistryTopologyMaterializationReplaysStoredAgents`, `TestRegistryTopologyContinueLaunchesInterruptedBOnceAndRetainsCleanA`, and `TestClosedProjectStartupContinuesUnplannedStops` require independent shell/Window recovery, abnormal Failed recovery, retained excluded UID/ref/evidence, and repeat duplicate/Registry-write 0. `TestRegistryTopologyContinueRechecksEvidenceUnderLock`, existing owner-guard/binder rollback tests, `TestRegistryTopologyContinueKeepsUnresumableAgentAnchorRefusal`, and `TestRegistryTopologyMaterializationAgentAnchorLazyDefaultShellAndRepeatNoop` retain current ownership and rollback boundaries. `TestTopologyAgentSnapshotKeepsFreshFallback`, `TestExplicitSnapshotRestoreRetainsAgentReplayAuthority`, and `TestExplicitSnapshotRestoredOfflineAgentAnchorConvergesLazyShellAgentAndRepeatNoop` preserve explicit snapshot fresh fallback and exact resume. L10 requires raw Window/server HUP exact resume 1 and deterministic abnormal/Failed, unknown, absent-receipt, intentional/normal, and managed-stop ref-less cases; L11 requires startup HUP resume 1, clean launch 0, managed-stop exact resume 1, repeat 0, and independent explicit resume/snapshot/Fresh parity. Both smokes use isolated HOME/XDG/TMUX_TMPDIR, remove inherited tmux routing, and clean only queried contained sockets. Receipt producers/schema/sticky intent, quit/delete/stop, provider stores/transcripts, prompt/turn/approval replay, and public hooks are unchanged.
 
 - `make test` / `make test-integration`: the delete result names the socket the invocation resolved. Phase 8 made `delete window|pane|agent` resolve one exact server from `--socket`/`--socket-path` or the inherited `$TMUX`, but left the result line printing a constant `socket=-L/projmux`, so every delete against any other server reported the wrong target -- and that line is exactly what an operator audits after a destructive command. `explicitTmuxTarget.label()` renders the flag and value the route actually used, a table pins all three resolutions (explicit name, explicit absolute path, inherited client) and fails if the default app socket appears in a result that did not name it, and the isolated integration smoke asserts the reported socket is the run-unique one -- which is the whole assertion, because a fallback would print `-L/projmux` instead, and a separate "must not contain" check would collide with the isolated socket's own `projmux` prefix.
 
@@ -316,6 +338,28 @@
 - `make test`: Codex native control plane Phase 8 capability and review coverage pins distinct localized default/advanced provider rows; default Codex launch with zero capability-session/readiness calls and zero `--model`/`model_reasoning_effort` overrides; advanced-only hidden/duplicate model removal, supported-effort and closed-modality normalization, boolean-only personality projection, catalog-localized semantic picker labels with provider model/effort/modality data unchanged, paginated `model/list`, connection/version epoch cache invalidation, stale picker refusal, live-session cleanup on pre-plan create refusal, the live picker-to-pre-create session refresh rejecting a removed option, and dynamic `model/list` -> exact launch argv. Advanced discovery failure returns its exact unavailable reason with zero create intents while a separate default launch remains usable. Review tests require one exact Running Agent -> owned Pane -> activation generation -> stored/live thread binding before `review/start`, use one bounded action context, reject incomplete or unknown initial turns, map only a valid initial response to provider-control-plane interaction state, and commit zero lifecycle writes for unavailable, timed-out, mismatched, or replaced bindings. The installed smoke is opt-in through `PROJMUX_CODEX_CAPABILITY_INSTALLED_SMOKE=1`; it closes the discovery context before refreshing the retained live connection. CI does not require a local authenticated Codex daemon or create a disposable provider thread.
 
 - `make test`: Codex native control plane Phase 5 makes `account/rateLimits/read` the authoritative Codex Usage source and consumes `account/rateLimits/updated` through one single-lease, demand-bounded read-only watcher. Bucket/malformed/sparse-event goldens pin percent, reset, label, nullable identity, unknown cadence, and row-level isolation. Manager tests require an accepted native event batch to atomically replace only Codex rows, preserve other-provider/backoff state, advance the Codex throttle timestamp, and trigger zero second collector calls in the same HUD invocation. Watcher tests pin single ownership, demand-expiry heartbeat cleanup, failure backoff, sparse-update recovery after malformed events, and a private atomic native-only sidecar that never replaces last-known-good bytes with rollout/fallback provenance. The watcher launch boundary rejects `.test` and `.test.exe` executables before starting a child; the status regression runs repeated calls from the actual Go test binary with zero child starts and all usage state confined to its isolated root. Adapter/CLI/HUD/diagnostics tests keep unavailable and unsupported accounts on the existing rollout lane, all-malformed native batches on last-known-good with a closed stale reason, source/value parity across table/JSON/HUD, and an exact request inventory containing only `account/rateLimits/read` with zero login/logout/config/token mutation.
+- `TestWatchNativeRateLimitsPeriodicReadKeepsQuietConnection`,
+  `TestWatchNativeRateLimitsNoEOFFailureIsBounded`, and
+  `TestWatchNativeRateLimitsPeriodicReadRefreshesSparseBase` use Go's virtual
+  clock to pin the initial read, fixed 30-second same-client reads, two-second
+  timeout, busy-notification independence, single pending read, native-only
+  publication, validated sparse base and malformed-result last-good retention.
+  `TestWatchNativeRateLimitsParentCancelRejectsLateProbeAndEvents` prevents a
+  canceled connection's late results or queued events from publishing.
+  `TestOwnedProxyCloseIsBoundedWhenPeerDoesNotRead` and
+  `TestOwnedProxyCloseUnblocksConcurrentWriterAndReapsChild` fill real owned
+  child pipes and require local close within one second, child reap, joined
+  reader/writers and concurrent/idempotent Close. Close never waits for a
+  WebSocket close frame or its write lock. Only the exact owned proxy is killed;
+  its upstream daemon lifecycle is unchanged.
+  `TestNativeWatcherProbeFailureUsesExistingBackoff` and
+  `TestNativeWatcherDemandExpiryCancelsPendingProbe` distinguish a failed
+  two-second probe from parent cancellation. They pin failure timestamps,
+  heartbeat removal, lease release, the existing inclusive 30-second backoff,
+  next-demand relaunch, and the 15-second demand TTL plus one-second monitor.
+  Existing cache freshness, newer-than-store, independent collector/fallback,
+  request cancellation/late-response and notification channel lifetime tests
+  remain the parity gates; heartbeat alone supplies no connection health proof.
 
 - `make test`: Codex native control plane Phase 9 makes the compact Usage identity native-first: label goldens map healthy authoritative app-server rows to exact `Codex`, fresh rollout rows and unknown non-stale provenance to `Codex [fallback]`, and retained last-known-good rows to `Codex [stale]`; en-US/ko-KR narrow statusbar fixtures pin spacing and width. Same-snapshot HUD/table/JSON tests and operations-journal tests preserve exact percent/reset values plus typed source/fallback/stale reasons, while Claude/Antigravity labels, projection order, and Usage semantics remain unchanged.
 
@@ -472,6 +516,8 @@
 - `make test`: Codex endpoint broker diagnostics dial the endpoint the runtime published. `observeCodexBrokerRuntime` used to name `DefaultEndpointKey` up front, while a managed runtime publishes under the generation-scoped key its route derives, so `projmux doctor` reported a broker that was listening as `absent / host-unavailable` -- and an operator acted on that answer by terminating a foreign app-server process. The reader now lists the discovery records the state domain actually holds, keeps only those whose announced endpoint derives back to the record that announced it, and dials that set in one stable endpoint order under a single deadline; `Dial` stays the call, because `Ensure` may create the directory, reclaim an artifact, and start a runtime, which would make a diagnostics read a side effect. `TestBrokerDiagnosticsDialTheEndpointTheRuntimePublished` is the machine's exact shape -- a live generation-scoped runtime beside a default-key lock with no socket and no record -- and requires `running`, the generation-scoped key as the observed endpoint, the answering host's runtime identity, a byte-identical state-domain file set across the read, a runtime still serving afterwards, and a second read reaching the same runtime; it fails against the default-key dial. Its mutation audit covers the connection axis and not only the file set, because a dial is itself a connection: two reads must leave zero upstream opens, an unmoved connection epoch, zero bindings and zero upstream connections reported, and host stats -- live sessions, bindings, refusals, draining, endpoint -- back at their pre-read values. `TestBrokerDiagnosticsStayAbsentWhenOnlyAnUnpublishedArtifactRemains` keeps the resting answer and its closed token: a startup lock is not a runtime and neither is a record whose announced endpoint does not derive back to its own filename, so the verdict stays `absent / host-unavailable` with zero published endpoints and no endpoint claimed. `TestBrokerDiagnosticsSelectEveryPublishedEndpointDeterministically` publishes two generations at once and pins the selection rule the reader is allowed to have: a stable ascending endpoint order, the first runtime that answers, both hosts alive after the read, and the same endpoint on a repeat read -- which generation ought to be current stays the generation pool's judgment. `doctor` now prints `Published endpoints: N` and, when one was judged, `observed endpoint: <key>` on every state rather than only on `running`, so `absent` beside a non-zero count is visibly a runtime this reader could not reach rather than a runtime that is gone.
 - `make test`: One oversized answer no longer cycles the Codex app-server control plane. The broker multiplexes one upstream connection across every bound thread, and `codexappserver.Client.readLoop` used to treat an inbound message past the 1 MiB frame bound as a fatal connection error. `thread/read` with `includeTurns=true` returns a thread's whole transcript, so a long-lived Agent's own lifecycle snapshot crosses that bound on its own: the connection died, `Broker.revoke` suspended **every** binding at once, each observer's next epoch re-issued the same read, and the cycle sustained itself -- measured on this machine at 0.86-1.35 connection epochs per second for hours, with `bind` never dipping. The framing layer now reads an over-long message to its exact byte count and drops it, so the stream stays framed; the client answers only the requests that were waiting with `ErrPayloadTooLarge` and keeps the connection; and the broker classifies that as `indeterminate` under its own `payload-too-large` reason rather than collapsing it onto `disconnect-boundary`, because the connection survived and an operator reading the two alike looks for a broker fault that is not there. `TestClientDropsAnOversizedAnswerAndKeepsTheConnection` requires the dropped answer to reach its caller as `ErrPayloadTooLarge`, a following notification to still arrive on the same connection, and the drop to be counted. `TestClientKeepsServingRequestsAfterAnOversizedAnswer` proves the drop is request-scoped by serving the next request on that connection. `TestWebsocketStreamDropsAnOversizedMessageAndStaysFramed` reads the whole message behind a dropped one, which is what a discard that consumed the wrong byte count would break. `TestOversizedAnswerEndsOneMutationAndNotTheConnectionEpoch` holds the blast radius: five oversized answers leave the connection epoch, the disconnect count, the binding count, and a neighbour binding's live fence and stream all untouched. `TestOversizedAnswerIsToldApartFromADisconnectBoundary` keeps the two indeterminate reasons distinct. Beyond the frame bound the message is still refused, because reading it out is itself the denial of service the bound exists to stop.
 
+- `make test` / `make test-integration`: Window teardown decision journal Phase 0 records each consumed lifecycle teardown decision at the app layer (never inside the pure core planner) as one closed `topology.teardown.decision` event. `TestTeardownReasonJournalMappingCoversEveryCoreReason` and `TestTeardownVocabularyMatchesCoreDecisionTable` read `internal/core/metadata` source for every `TeardownReason`, `TeardownAction`, and `TerminationClassification` constant and fail on any unmapped or unallowlisted value; the first also round-trips every code through the real store and every conflict reason through its unchanged error bytes. `TestTeardownDecisionEventClosedShapes` and `TestTeardownRecorderAppendsWithoutOutcomeOwnership` pin the closed shape, strict `win-`/`pane-` UIDs, rejection of the new fields on every other family, and best-effort appends that never own the top-level outcome. `TestTeardownJournalCleanLastPanePairRecordsOneDeleteWindow`, `TestTeardownJournalKilledLastPaneRecordsRetainAndKeepsRegistry`, `TestTeardownJournalCleanupRetryRecordsRetainOnce`, and `TestTeardownJournalAuthorityConflictRecordsOneRefusal` run each fixture beside an unjournaled twin and require identical results, errors, and Registry bytes with exactly one decision per evaluation; `TestTeardownJournalWindowUnlinkRecordsFirstWaitAndExhaustion` requires one `retain`/`awaiting-pane-exit` on the hook's first wait, zero during carried causal retries, and one at exhaustion; `TestTeardownJournalKillWindowShapeFirstWaitCarriesWindowPaneAndKilled` drives the real controller body for a `kill-window`-shaped Registry and requires that first record to carry the exact Window UID, Pane UID, and `killed` with unchanged Registry bytes, while `TestTeardownJournalAmbiguousUnlinkSubjectOmitsUIDs` and `TestLifecycleWindowUnlinkAwaitingSubjectOmitsAmbiguousPane` omit any ambiguous UID. The integration termination smoke asserts one `delete-window`/`window-teardown` record for the exact closed Window UID, the first-wait plus exactly one exhaustion record for a replayed unpaired `window-unlinked`, and one `awaiting-pane-exit` record with the exact Window UID for a real `tmux kill-window` whose Window row is retained. Its read-only status/viewer and automatic-path journal line-count windows, which follow hook-driven session stop/unregister/prune closes, exclude only the asynchronously appended `topology.teardown.decision` lines, so any record the measured command itself appends still fails.
+
 ## When To Update This List
 
 - A feature moves between unit, integration, and e2e coverage levels.
@@ -672,6 +718,13 @@
   now fails closed over separate core, Codex broker, and Codex app-server
   children; the core child preserves metadata, notify, and recent-window
   coverage, and `CIWorkflowContractTest` pins both Codex failure paths red.
+  `CIWorkflowContractTest.test_required_unit_job_runs_pinned_deadcode_without_bypass`
+  requires the existing `Unit Tests` job to run `make deadcode` with the module's
+  pinned Go tool before `make test`, preserving every required job name.
+  `test_deadcode_failure_fails_unit_and_test_aggregate` executes the workflow
+  commands with a failing scanner gate and rejects failed, skipped, or cancelled
+  Unit results in `Test`. `DeadcodeBaselineContractTest.test_stale_current_and_new_finding_are_rejected`
+  preserves rejection of new findings; neither deadcode baseline is expanded.
   Required real-tmux L06 owns only the deterministic holder/released-before-
   deadline/waiter convergence guarantee. Eight-way throughput and fairness stay
   outside required acceptance in the explicit stress command documented above.
@@ -1031,6 +1084,11 @@
   That token is deliberately not `binding-revoked`: the four close-cause tokens
   answer "who closed the stream" and come from the broker epoch, and here the
   stream was never closed at all.
+- `test/e2e/codex-lifecycle.sh` (C01) exercises its actual projection barrier on
+  an inert fixture pane with an already-ready or later-ready level and repeated
+  option hooks before waiting. An atomic claim shared by the level check and
+  hook emits exactly one signal; duplicate `wait-for -S` calls would otherwise
+  lose the pending wakeup. The existing barrier deadline is unchanged.
 - `test/e2e/codex-lifecycle.sh` (C01) pins the exact disconnect token at its
   disconnect projection barrier and at the reconnect-gap hook comparison. It
   waited on the literal `disconnected` before, which was the bucket published
@@ -1123,6 +1181,17 @@
   `TestAgentMessageReplyReturnsOnlyToOriginalSourceConversation` pin exact
   current-Pane source authority, exact target eligibility before effects,
   same-envelope retry without resend, and broker-owned reply correlation.
+- `TestCoordinationContentLabelsSourceClaimsForBothProviders` pins claimed,
+  unverified source Agent/provider notices, including wrong UID/provider
+  fixtures, while preserving exact routing metadata, untrusted payload, and
+  peer permission and reply boundaries in both provider contents.
+- `TestAgentMessageSendSourceAnchorAndOmittedFallbackPreserveRouteAndPeerAuthority`
+  pins explicit source anchors, omitted-source active Pane fallback, refusal
+  without an anchor, and unchanged exact routes and peer authority.
+- `TestAgentMessageSourceAnchorCatalogHelpAndGeneratedDocsParity` pins
+  `--source` usage and its anchor (not caller authentication) meaning across
+  agent/message/send catalog, help, and generated CLI reference sections;
+  `TestGeneratedReferenceMatchesTheCommandManifest` rejects stale docs.
 - `TestClaudePrivateProjectionPreservesPublicBoundaryAndAmbiguity`,
   `TestLiveClaudeAdapterMapsTerminalResponseKindsWithoutDelivery`,
   `TestLiveClaudeAdapterRefusesPublicValidEnvelopeThatExceedsPrivateFrame`, and
@@ -1136,6 +1205,33 @@
   terminal-safe output, activation fencing, and deterministic Registry-only
   idle, timeout, and stale waits. Codex `delivered` ends at target self-claim;
   it does not assert model processing or reply.
+- `TestCodexCoordinationPushClassifiesNativeOutcomesForSenders` and
+  `TestCodexCoordinationPushExpiresBeforeAnyProviderCall` own the native Codex
+  push outcome table: start success and the `turn-in-progress` steer fallback
+  deliver as `provider-turn-push`, every known zero-write refusal code fails as
+  `codex-turn-push-refused`, every ambiguous or unrecognised code fails closed
+  as `codex-turn-push-outcome-unknown`, an unconfigured seam, a failed content
+  render and an unavailable binding fail with their own causes, and a
+  pre-dispatch deadline expires as `deadline-expired` with zero binding
+  resolutions and zero control calls. The refusal code is the discriminator and
+  `stale-turn` keeps its per-operation split.
+- `TestCodexCoordinationPushFailuresExitNonzeroWithCauseAndStatusParity` pins
+  the sender contract: `agent message send` to a Codex target prints
+  `ref/state/reason/action` and then exits nonzero without a usage dump when the
+  native push did not deliver, and `agent message status` reports the same state
+  and reason. A failed terminal store write keeps the original cause token on
+  the receipt, and a delivered turn whose write failed projects
+  `broker-delivery-persist-failed` with an unknown outcome; those two cases
+  cannot reach status parity, because the store write is what failed.
+- `TestCodexCoordinationPushKeepsTerminalReceiptAndSkipsExtraSteer` pins no
+  steer after a successful start, no new event or delivery change from a second
+  push over a terminal record, and a delivered reason that names only the
+  provider turn push, never model consumption, acknowledgement, or completion.
+- The offline Claude dialogue fixtures reply to a Codex source, so they now
+  accept a terminal Codex push failure receipt from the qualification reply --
+  the four-field `ref/state/reason/action` line for a fresh reply ref, read
+  instead of the exit code -- because no Codex app-server exists in those
+  fixtures.
 
 ### Heterogeneous Agent dialogue Phase 4 tests
 
@@ -1155,11 +1251,41 @@
   recursive, late, or unrelated Stop publishes zero replies.
 - `TestClaudeQualificationRequiresBrokerChallengeAndExplicitReply` requires a
   stored original challenge, exact current source and target, a full frozen
-  frame, and a broker-committed explicit reply before opening general ingress.
-  A text echo or Stop alone cannot qualify the endpoint.
+  frame, and a broker-committed explicit reply before opening the general reply
+  execution gate. Current qualification responses stay pending across ordinary
+  delivery and Stop text, become qualified after the exact reply, and report
+  helper restart after close while the execution gate refuses further actions.
 - `TestClaudeExplicitReplyRejectsForeignStaleAndAlteredCorrelationBeforeCommit`
   covers foreign refs, altered conversations, stale generations/incarnations,
   reversed-route mismatch, and a wrong qualification response with commit zero.
+- `TestClaudeExplicitReplyKnownZeroManualRetryPublicReceiptsAndReload` and
+  `TestStoreExplicitReplyKnownZeroManualRetrySurvivesReload` pin the documented
+  [manual reply recovery](agent-message-replies.md): a known-zero failure keeps
+  its immutable receipt, same-ref calls write zero, and a fresh corrected ref
+  delivers once with the original conversation, reversed routes, deadline and
+  peer authority. Public stderr and text/JSON status preserve cause and ref.
+- `TestClaudeExplicitReplyPartialUnknownExpiredAndStaleNeverDuplicate`,
+  `TestStoreExplicitReplyNonzeroUnknownAndExpiredNeverRetry`, and
+  `TestStoreExplicitReplyRetryKeepsDeadlineAndExactRoute` reject delivered,
+  partial/unknown, pending, expired and stale retries, including store reload,
+  false-unknown-flag and unrecognized-reason cases; Codex retry policy stays
+  unchanged. `TestStoreExplicitReplyConcurrentAttemptsAndCapacityPreserveReceipts`
+  permits only one concurrent new attempt and prevents capacity pruning from
+  reopening a live reply relationship.
+- `TestClaudeExplicitReplyGuardRetryRetainsQualificationAndRouteFences` keeps
+  known-zero recovery behind the existing exact qualification, provider caller,
+  route and bounded-command gates. `TestClaudeEndpointProcessIntegration/explicit-reply-known-zero-manual-retry`
+  runs the public CLI as the synthetic provider's real descendant: invalid
+  content fails with stderr/ref/action, a corrected manual reply reaches the
+  provider once, same/different-ref duplicates write zero, and independent
+  public status processes preserve both attempts. The provider checks for
+  unexpected queued connections before exit.
+- `TestClaudeExplicitReplyAcknowledgementRequiresFreshDispatchProof` refuses
+  legacy or malformed acknowledgements without granting a push; replay replies
+  use a distinct response kind that older callers also cannot dispatch.
+  `TestClaudeExplicitReplyStoreRefusalsKeepCauseAndUnknownReservation` preserves
+  bounded busy/capacity/missing/malformed store causes, frees only proven
+  pre-write refusals, and keeps an ambiguous persistence attempt reserved.
 - `TestClaudeExplicitMultipleRequestsAndHumanOverlapSelectOnlyNamedOriginal`
   permits an explicit reply to B then A across human activity, rejects a second
   reply to either request, and never chooses correlation by arrival order.
@@ -1216,8 +1342,10 @@
   composite authority before send; semantic barriers replace sleeps. The
   scenario requires exact UID/Pane/generation/message/conversation/reply
   receipts, Agent count two, Codex provider writes zero, and pre-removal
-  Registry/tmux/helper/socket/process residual checks. It does not require a
-  provider binary, model, network, or version matrix.
+  Registry/tmux/helper/socket/process residual checks. Its strict Claude content
+  fixture preserves `sourceNotice` and verifies claimed/unverified source,
+  caller-authentication limits, and untrusted payload semantics. It does not
+  require a provider binary, model, network, or version matrix.
 - The real-provider path is opt-in through `scripts/agent-dialogue-canary-setup.py`
   and `docs/heterogeneous-dialogue-canary.md`. It uses public reply-only activation,
   product observer/helper-memory evidence and separate qualification/idle claims.
@@ -1811,6 +1939,22 @@ separate decision this measurement exists to inform.
 - `TestClaudePushSourceReplacementAfterDurableHandoffWritesZero` and
   `TestClaudeProviderPushFinalRouteCheckPrecedesSoleWrite` cover source/target
   authority loss across durable work and the final provider pre-write fence.
+- `TestClaudeProviderFrameSerializedByteBoundaryAndSafeRejection` fixes the
+  complete auth/user frame boundary at 8191/8192/8193 serialized bytes.
+  `TestClaudeProviderPostPreservesConstructionReasonBeforeAnyRouteOrWrite`
+  separates invalid auth/content from size rejection before route or write.
+  `TestClaudeProviderWriteReasonsRequireOneActualWrite` distinguishes actual
+  zero/partial writes and invalid-count/full-with-error unknown outcomes.
+  `TestClaudeProviderRejectionReasonsSurviveHubReceiptStatusAndStoreReload`
+  preserves reasons through helper and public receipts, terminal store reload,
+  sender recovery text, secret exclusion, and duplicate sends with zero retries.
+  `TestClaudeProviderRejectionResponseValidationIsClosedAndLegacyCompatible`
+  admits canonical numeric size details and legacy reasons while rejecting
+  inconsistent ambiguity and secret-bearing suffixes.
+  `TestClaudeEndpointProcessIntegration/provider-frame-rejection-receipt`
+  exercises the built binary's public send/status against the isolated provider:
+  size/action survive, credentials stay absent, and the rejected frame adds no
+  provider connection before the next expected message.
 - `TestClaudeExplicitMultipleRequestsAndHumanOverlapSelectOnlyNamedOriginal`
   requires an explicit choice of the original request; Stop text has no reply
   authority regardless of human activity or pending request count.
@@ -1847,9 +1991,10 @@ separate decision this measurement exists to inform.
   outside the disposable root, reject unsafe candidate permissions before
   credential copying, and retain roots after uncertain cleanup without retry. Product `TestClaudeDialogueStream*` tests own public output parsing;
   the obsolete separate canary collector is removed.
-- `TestClaudeDialogueCanaryAcceptsProductionStoreAndPublicClaimReceipts` validates
-  production Store.PutReply/Claim and public CLI JSON with the Python companion,
-  including the actual `target-self-claim` reason and version-2 envelope.
+- `TestClaudeDialogueCanaryAcceptsProductionStoreClaimAndPublicReceipt` validates
+  production Store.PutReply/Claim records and current public send/status receipt
+  JSON with the Python companion, including the actual `target-self-claim`
+  reason and version-2 envelope, without a public claim command or serializer.
 
 - L20 owns a real authenticated Codex broker host and keeps its observed snapshot
   binding alive for the round trip; Registry-only synthetic authority is refused.
@@ -1964,3 +2109,6 @@ separate decision this measurement exists to inform.
 
 - `test/agent_dialogue_rpc_envelope_test.py`: pinned public JSON-RPC forms classify server requests, errors and notifications without admitting them. Exact success shape and expected ID remain mandatory; wrong/foreign IDs, unknown fields, mixed forms and malformed method/error/trace types refuse. All 64 known-field combinations and nested type branches verify the independent fixed `envelopeFacts` projection, simultaneous defect visibility and dynamic-name/value exclusion. Policy/native initialization tests propagate only those facts; audit tests reject malformed projections before writing. Real parent setup/finally tests preserve external facts before once cleanup, retain uncertain roots or failed audit writes, and produce no source effect or success receipt.
 - `test/agent_dialogue_websocket_test.py`: memory-only RFC6455 upgrade/masked writes/message framing, Unicode fragmentation with interleaved control frames, cumulative bounds/EOF/deadline and malformed transport privacy; pinned full initialization with exact owned codexHome precedes framed config/read and thread/read. Canary audit tests connect upgrade refusal/socket close to once parent cleanup and external code retention. Closed substage/rejection-kind regressions distinguish connect/peer, upgrade, initialize/initialized, config/read, EOF/deadline/frame and error/ID/notification envelope rejection; unknown labels remain unknown, raw exception/RPC content is excluded, and audit failure still retains the root.
+
+- `make test`: Codex recovery diagnostics retain the original request through RPC classification, catalog wrappers, bounded broker lifecycle IPC and observer fallback. `TestRequestFailureDiagnosticPreservesOriginalThroughCatalogWrapping`, `TestFailureDiagnosticIPCProjectionIsClosedAndBounded`, `TestLifecycleRPCDiagnosticPreservesCodeAndRejectsUnrepresentableCode`, `TestObserverFallbackJournalPreservesSafeFailureAndClosedStartup`, `TestObserverDiagnosticRejectedAuthorityWritesZero`, `TestObserverSessionFailurePreservesTerminalReasonAfterAuthorityRejection`, `TestAIIngestTextPreservesBoundedRecoveryDiagnosticsAndLegacyRecords`, and `TestRecoveryDiagnosticGoldenInventoryAndBounds` cover unsupported/catalog/protocol/transport causes, missing/null codes, secret/invalid UTF-8/oversized inputs, existing reason tokens, terminal session-construction fallback after a rejected authority write, bounded public text projection with legacy-row compatibility, and commit-before-journal refusal. `TestManagerEvidenceContradictionAndOwnershipMatrix` and `TestManagerEvidenceCommandFailureAndTimeout` (with `TestManagerDiagnosticDeadlineProcess`) separate independent attach and official read-only manager observations, with unknown/contradictory refusal and zero lifecycle argv. The existing startup parser, parent fallback, exact authority, Phase 0 timing/close and Phase 1 recovery tests remain required.
+- Opt-in installed zero-turn fixture: `CODEX_DIAGNOSTIC_INPUT=/absolute/input.json go test ./internal/app -run '^TestInstalledCodexRecoveryDiagnosticFixture$' -count=1 -v`, with inherited `TMUX` and `TMUX_PANE` unset. Input fields are `root` (new short `/tmp` directory), `binary`, `binarySHA256`, `sourceHead`, `sourceTree`, and `evidence` (outside root). The binary must come from that clean committed source. Synthetic manager/provider responses are explicitly labeled; the actual executable runs its observer and doctor against a private Registry, exact private tmux socket and real bounded broker IPC. `TestCodexDiagnosticProxyProcess` is the read-only synthetic subprocess helper. The fixture never uses authentication, starts a turn, resumes a live session, or mutates a manager. It checks journal/doctor agreement, the actual public `diagnostics agent-hook` JSON and text consumers (including a labeled synthetic legacy row), old startup parsing, version/ownership refusals, output bounds and exact socket cleanup, then removes its private root. Evidence retains the public JSON records and text lines alongside observer rows and doctor reports. Run the identical fixture against the candidate and the isolated merged-main install; preserve the input, binary/source/tree hashes and evidence JSON.

package/docs/architecture.md

@@ -242,6 +242,16 @@ Resources and ownership:
   session observation, and no replacement allocation. The requested Window and
   all descendants are removed exactly; only explicit Project deletion removes
   the owning root itself.
+  Every in-place anchor writer uses the one eligibility predicate `Validate`
+  enforces: same-Window ancestry, `shell` or `agent` role, and an Agent Pane
+  only while it is its owner's `status.paneRef`. Delete reselection picks the
+  first eligible Pane in Registry order; a termination that releases the
+  anchoring Agent's binding moves the anchor in the same mutation; a rebind
+  moves an anchor on the previous binding Pane onto the new managed Pane.
+  Ineligible retained Agent Pane rows are skipped, never selected or deleted,
+  and when no eligible Pane remains the anchor lands on a shell allocated
+  through the default-shell path. A non-Running Agent still carries an empty
+  `paneRef`: the anchor moves, the binding is never kept for it.
 
 Home and root kinds:
 

package/docs/cli-guide.md

@@ -549,6 +549,14 @@ content, prompt, history, and transcript are never parsed. `abnormal`,
 `killed`, `unknown`, stale/resumed bindings, empty or unavailable inventory,
 permission failure, and foreign-host/window observations keep their diagnostic
 rows and produce no automatic delete plan.
+Every teardown decision on this hook path appends one
+`topology.teardown.decision` journal record (`projmux diagnostics log
+--component topology`) with its `delete-window`/`delete-pane-agent`/`retain`/
+`refuse` decision, `topology.teardown.<reason>` code, Window/Pane UID, and
+termination classification. An unpaired `window-unlinked` records `retain`
+with `topology.teardown.awaiting-pane-exit` when it first waits and again when
+its bounded pair wait is exhausted; `kill-window` closes surface this way,
+because tmux fires no `pane-exited` for them.
 
 For `pane-exited`, tmux supplies `%N` as `#{hook_pane}`. Its current-context
 session/window formats may already name a surviving client Window, so the owner
@@ -760,6 +768,14 @@ Registry-only result reports that no tmux Pane was killed, preserves the owning
 Window/root/socket and all siblings, and repeating the exact apply returns the
 ordinary no-match result.
 
+A name, scope, or active-target delete of a target that carries that evidence
+still refuses with the live-mirror refusal, but the refusal then names the
+typed resource's exact form to run instead —
+`projmux delete pane|agent uid:<uid> --socket-path <server> --dry-run`, then the
+same command with `--yes` — and says which evidence qualifies it. A target the
+`uid:` form would refuse too, such as a Pane without `MissingRuntime` or a
+`Running` or `Failed` Agent, gets no such pointer.
+
 `delete window|pane|agent` names the server its live half addresses the same
 way `reconcile resources` does: `--socket <name>`, `--socket-path <absolute>`,
 or the inherited absolute `$TMUX`. Outside tmux with neither flag it refuses
@@ -1144,7 +1160,9 @@ autosave-session-state`, `window record`, and
 successful `diagnostics log` views do not produce an event. Errors from those
 automatic hook/poll paths still produce one safe `error` outcome. Successful
 direct command help and explicit `--dry-run` preview modes also remain
-read-only and do not produce an event. Journal failures are a best-effort side
+read-only and do not produce an event. The automatic `internal tmux converge`
+route still appends one typed `topology.teardown.decision` record per Window or
+Pane teardown decision it consumes. Journal failures are a best-effort side
 channel and never change command output or exit status. See
 [operational-diagnostics.md](operational-diagnostics.md) for the file,
 retention, concurrency, and privacy contracts.

package/docs/cli.md

@@ -130,7 +130,7 @@ projmux agent app-server upgrade resume|abort --operation <ref>
 projmux agent app-server handover plan|apply --request <absolute-json>
 projmux agent app-server handover resume|abort --operation <ref>
 projmux agent capabilities [<agent-ref> | --provider <codex|claude|antigravity>] [-o json]
-projmux agent message send <agent-ref> [--message-ref <ref>] [--reply-to <ref>] [--ttl <duration>] -- <text>
+projmux agent message send <agent-ref> [--source <agent-ref>] [--message-ref <ref>] [--reply-to <ref>] [--ttl <duration>] -- <text>
 projmux agent message status <message-ref> [-o json]
 projmux agent message qualify <claude-agent-ref> --evidence <absolute-private-json> --confirm-isolated-provider-push -o json
 projmux agent wait <agent-ref> [--until idle] [--timeout <duration>] [-o json]
@@ -150,7 +150,7 @@ Subcommands:
 | [`projmux agent usage`](#projmux-agent-usage) | Read provider account usage quota snapshots |
 | [`projmux agent app-server`](#projmux-agent-app-server) | Manage explicitly requested private Codex app-server generation operations |
 | [`projmux agent capabilities`](#projmux-agent-capabilities) | Read static provider support or one exact Agent's Registry-backed runtime eligibility |
-| [`projmux agent message`](#projmux-agent-message) | Exchange bounded untrusted coordination messages through exact Agent activations |
+| [`projmux agent message`](#projmux-agent-message) | Exchange bounded untrusted coordination messages; --source selects a source Agent anchor, not caller authentication (default: active Pane) |
 | [`projmux agent wait`](#projmux-agent-wait) | Wait read-only for one exact Agent's Registry-backed idle observation |
 
 Canonical spelling: `projmux agent status`, `projmux agent topic`, `projmux agent resume`, `projmux agent turn start`, `projmux agent turn steer`, `projmux agent turn interrupt`, `projmux agent approval review`, `projmux agent review`, `projmux agent integrate`, `projmux agent usage`, `projmux agent app-server upgrade qualify`, `projmux agent app-server upgrade plan`, `projmux agent app-server upgrade apply`, `projmux agent app-server upgrade resume`, `projmux agent app-server upgrade abort`, `projmux agent app-server handover plan`, `projmux agent app-server handover apply`, `projmux agent app-server handover resume`, `projmux agent app-server handover abort`, `projmux agent capabilities`, `projmux agent message send`, `projmux agent message status`, `projmux agent message qualify`, `projmux agent wait`
@@ -736,7 +736,7 @@ Output modes (`-o`): `json`
 
 ### `projmux agent message`
 
-Exchange bounded untrusted coordination messages through exact Agent activations
+Exchange bounded untrusted coordination messages; --source selects a source Agent anchor, not caller authentication (default: active Pane)
 
 Selectorless authority: `refusal` — there is no safe selectorless action; refuse before output or mutation.
 
@@ -752,7 +752,7 @@ Allowed effects:
 - `domain-effect=agent-delivery`
 
 ```
-projmux agent message send <agent-ref> [--message-ref <ref>] [--reply-to <ref>] [--ttl <duration>] -- <text>
+projmux agent message send <agent-ref> [--source <agent-ref>] [--message-ref <ref>] [--reply-to <ref>] [--ttl <duration>] -- <text>
 projmux agent message status <message-ref> [-o json]
 projmux agent message qualify <claude-agent-ref> --evidence <absolute-private-json> --confirm-isolated-provider-push -o json
 ```
@@ -761,7 +761,7 @@ Subcommands:
 
 | Route | Summary |
 | --- | --- |
-| [`projmux agent message send`](#projmux-agent-message-send) | Submit a bounded coordination message from the current exact Agent |
+| [`projmux agent message send`](#projmux-agent-message-send) | Submit bounded peer coordination; --source selects a source Agent anchor, not caller authentication (default: active Pane) |
 | [`projmux agent message status`](#projmux-agent-message-status) | Read a payload-free broker delivery receipt |
 | [`projmux agent message qualify`](#projmux-agent-message-qualify) | Explicitly qualify one exact Claude target using owned current-version isolation evidence and one marker push |
 
@@ -769,7 +769,7 @@ Canonical spelling: `projmux agent message send`, `projmux agent message status`
 
 #### `projmux agent message send`
 
-Submit a bounded coordination message from the current exact Agent
+Submit bounded peer coordination; --source selects a source Agent anchor, not caller authentication (default: active Pane)
 
 Selectorless authority: `explicit-target` — the route or caller must name the exact target.
 
@@ -785,7 +785,7 @@ Allowed effects:
 - `domain-effect=agent-delivery`
 
 ```
-projmux agent message send <agent-ref> [--message-ref <ref>] [--reply-to <ref>] [--ttl <duration>] -- <text>
+projmux agent message send <agent-ref> [--source <agent-ref>] [--message-ref <ref>] [--reply-to <ref>] [--ttl <duration>] -- <text>
 ```
 
 #### `projmux agent message status`
@@ -2003,10 +2003,10 @@ Subcommands:
 
 | Route | Summary |
 | --- | --- |
-| [`projmux get projects`](#projmux-get-projects) | List Project resources as NAME STATUS ACTIONS; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context |
-| [`projmux get windows`](#projmux-get-windows) | List Window resources as NAME STATUS ACTIONS; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry |
-| [`projmux get panes`](#projmux-get-panes) | List Pane resources as NAME STATUS ACTIONS; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry |
-| [`projmux get agents`](#projmux-get-agents) | List Agent resources as NAME STATUS ACTIONS; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry |
+| [`projmux get projects`](#projmux-get-projects) | List Project resources as NAME STATUS ACTIONS AGE; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context |
+| [`projmux get windows`](#projmux-get-windows) | List Window resources as NAME STATUS ACTIONS AGE; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry |
+| [`projmux get panes`](#projmux-get-panes) | List Pane resources as NAME STATUS ACTIONS AGE; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry |
+| [`projmux get agents`](#projmux-get-agents) | List Agent resources as NAME STATUS ACTIONS AGE; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry |
 | [`projmux get runtime`](#projmux-get-runtime) | List every tmux Session, Window, and Pane on one exact server with its attribution |
 | [`projmux get notifications`](#projmux-get-notifications) | List pending notification rows |
 | [`projmux get snapshots`](#projmux-get-snapshots) | List saved session snapshots |
@@ -2016,7 +2016,7 @@ Canonical spelling: `projmux get projects`, `projmux get windows`, `projmux get
 
 ### `projmux get projects`
 
-List Project resources as NAME STATUS ACTIONS; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context
+List Project resources as NAME STATUS ACTIONS AGE; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context
 
 Selectorless authority: `explicit-fan-out` — the route spelling is an intentional global or whole-set opt-in.
 
@@ -2041,7 +2041,7 @@ Output modes (`-o`): `uid`, `name`, `ref`, `metadata`, `json`, `none`, `wide`
 
 ### `projmux get windows`
 
-List Window resources as NAME STATUS ACTIONS; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry
+List Window resources as NAME STATUS ACTIONS AGE; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry
 
 Selectorless authority: `natural-omitted` — omission resolves one predictable current resource or documented contextual read/scope; any selector replaces it.
 
@@ -2066,7 +2066,7 @@ Output modes (`-o`): `uid`, `name`, `ref`, `metadata`, `json`, `none`, `wide`
 
 ### `projmux get panes`
 
-List Pane resources as NAME STATUS ACTIONS; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry
+List Pane resources as NAME STATUS ACTIONS AGE; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry
 
 Selectorless authority: `natural-omitted` — omission resolves one predictable current resource or documented contextual read/scope; any selector replaces it.
 
@@ -2089,7 +2089,7 @@ Output modes (`-o`): `uid`, `name`, `ref`, `metadata`, `json`, `none`, `wide`
 
 ### `projmux get agents`
 
-List Agent resources as NAME STATUS ACTIONS; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry
+List Agent resources as NAME STATUS ACTIONS AGE; route-implied KIND is omitted, shifting stdout positions; -o wide retains KIND and diagnostics, and -o json retains kind and invocation context; inside tmux defaults to the active managed root, and --all-projects lists the whole Registry
 
 Selectorless authority: `natural-omitted` — omission resolves one predictable current resource or documented contextual read/scope; any selector replaces it.
 

package/docs/codex-generation-pool.md

@@ -217,6 +217,11 @@ handover resume refuses before it drives any effect. A receipt qualifies the one
 pair it names and no other, and the refusal for a pair with no stored receipt
 names the two commands that produce and install one.
 
+`projmux doctor --section integrations` reports the saved version pairs and
+their verdicts even without a generation journal. Text, JSON, and support
+`doctor.json` distinguish an empty store from damaged or misfiled receipts;
+see [Stored Codex version-pair qualification](codex-stored-qualification.md).
+
 The same `receipt.json` also goes verbatim into the `qualification` field of an
 `agent app-server upgrade plan|apply --request <absolute>.json` document. The
 upgrade request requires that receipt's version pair to match the exact current

package/docs/codex-stored-qualification.md

@@ -0,0 +1,45 @@
+# Stored Codex version-pair qualification
+
+`projmux agent app-server upgrade qualify --receipt <absolute-json>` installs
+one measured receipt for its exact old/new Codex version pair. Inspect the
+saved receipts with:
+
+```sh
+projmux doctor --section integrations
+projmux doctor --section integrations --json
+```
+
+The default Doctor report includes the same inventory. Its
+`codex_stored_qualification` JSON field also appears in support `doctor.json`,
+with version pairs, statuses, verdicts, reasons, and readiness preserved.
+The read does not depend on a generation-pool journal or a readable Registry.
+
+```text
+Codex stored version-pair qualification
+  Store: stored
+  0.153.2 -> 0.153.4: stored; verdict: yes; reason: qualified; qualification ready: true
+```
+
+| Store status | Meaning |
+| --- | --- |
+| `stored` | All enumerated receipts decoded and matched their filenames. |
+| `absent` | No saved receipt exists; the directory may be absent or empty. |
+| `damaged` | At least one receipt could not be read as its filename's pair. Other receipts remain visible. |
+| `unavailable` | The store path could not be resolved or the directory could not be read. |
+
+Each `version_pairs` row reports `stored`, `damaged`, or
+`version-pair-mismatch`. A mismatch means a valid receipt names a different pair
+from its filename; its verdict is not reported for the filename's pair. A
+malformed `.json` filename produces a damaged row without exposing that name.
+Non-regular receipt files are damaged; temporary save files are ignored.
+
+For a stored row, `verdict` and `reason` come from the existing strict receipt
+decoder. `qualification_ready` comes from the existing qualification gate:
+a saved `no` or a self-consistent `yes` with unbacked evidence counters remains
+not ready. This field describes only the pair's qualification, and does not
+assert that the generation pool or an upgrade operation is ready.
+
+Schema v2 has no timestamps or expiry policy. A receipt stays reportable until
+it is replaced or removed. Doctor reads it without running qualification,
+writing receipts or journals, restoring upgrade state, or executing lifecycle
+commands.

package/docs/column-profiles.md

@@ -1,13 +1,18 @@
 # Column profiles
 
 Plural Registry reads (`get projects|windows|panes|agents`) now default to
-`NAME STATUS ACTIONS`. The route already selects the resource kind. Runtime
+`NAME STATUS ACTIONS AGE`. The route already selects the resource kind. Runtime
 reads default to their identity, containment, and classification columns. Use `-o wide` (or `--output wide`) to print the full
 column profile. Terminal width and data length never select a profile.
 
-Removing KIND changes these four default tables from four columns to three and
-moves NAME, STATUS and ACTIONS one position left. Existing positional parsers
-can break; request `-o wide` or recover each resource's `kind` from `-o json`.
+Adding AGE changes these four default tables from three columns to four, keeping
+NAME, STATUS and ACTIONS in their existing positions. AGE uses the same stored
+creation timestamp and formatter as wide; unavailable ages remain empty cells.
+The AGE header and a two-cell gap add five display cells when ages fit within
+three cells; longer ages widen the table further. Resource CLI output is not
+clipped at COLUMNS 40/80/112, so narrow terminals can wrap earlier.
+Positional parsers must account for the added field; each resource's `kind`
+remains available in `-o wide` and `-o json`.
 Mixed Registry/Runtime pickers keep KIND in both profiles.
 
 Scripts that need diagnostic columns must request `-o wide` or a structured projection explicitly. Registry JSON items
@@ -18,15 +23,15 @@ projections retain their contracts, as do singular reads and selector cardinalit
 
 | Surface / kind | Default | Wide |
 | --- | --- | --- |
-| Registry Project | NAME STATUS ACTIONS | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED AGE |
-| Registry Window | NAME STATUS ACTIONS | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED PROJECT AGE |
-| Registry Pane | NAME STATUS ACTIONS | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED PROJECT WINDOW AGENT TERMINATION AGE |
-| Registry Agent | NAME STATUS ACTIONS | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED INTERACTION PROJECT WINDOW SESSION TERMINATION AGE |
+| Registry Project | NAME STATUS ACTIONS AGE | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED AGE |
+| Registry Window | NAME STATUS ACTIONS AGE | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED PROJECT AGE |
+| Registry Pane | NAME STATUS ACTIONS AGE | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED PROJECT WINDOW AGENT TERMINATION AGE |
+| Registry Agent | NAME STATUS ACTIONS AGE | KIND NAME STATUS ACTIONS CONTEXT SOURCE OBSERVED INTERACTION PROJECT WINDOW SESSION TERMINATION AGE |
 | Runtime Session | SESSION NAME CLASS | SESSION NAME CLASS UID RESOURCE REASON |
 | Runtime Window | WINDOW SESSION NAME CLASS | WINDOW SESSION NAME CLASS UID RESOURCE REASON |
 | Runtime Pane | PANE WINDOW TITLE CLASS | PANE WINDOW TITLE CLASS UID RESOURCE REASON |
 
-Registry defaults omit KIND, CONTEXT, SOURCE, OBSERVED, AGE and each kind's owner-chain,
+Registry defaults omit KIND, CONTEXT, SOURCE, OBSERVED and each kind's owner-chain,
 INTERACTION, SESSION and TERMINATION diagnostics shown in the wide column above.
 Runtime defaults omit UID, RESOURCE and REASON. Wide retains their full values;
 stdout is unbounded and copyable, including long names, context, provider session

package/docs/operational-diagnostics.md

@@ -44,6 +44,20 @@ UIDs and stage labels are bounded control data; root paths, pane content,
 history, prompts, transcripts, and snapshot contents are never identity or
 intent authority.
 
+Automatic Window teardown decisions use `component=topology` and
+`event=topology.teardown.decision`: one `info`/`success` record per decision
+the `internal tmux converge` hook path consumes. An unpaired `window-unlinked`
+records `retain` when its own hook first waits and again when its bounded pair
+wait is exhausted, never for the carried retries between; its Window/Pane UID
+is resolved read-only from the exact `$N/@N` handles and omitted when
+ambiguous. The record adds only
+a closed `decision` (`retain`, `delete-pane-agent`, `delete-window`, `refuse`),
+a `code` from the closed `topology.teardown.<reason>` set that mirrors every
+core teardown reason, an optional closed termination `classification`, and
+optional opaque `window_uid` (`win-…`) and `pane_uid` (`pane-…`) Registry UIDs.
+tmux `%N`/`@N`/`$N` handles, socket paths, session names, cwd, argv, and free
+text are never recorded, and every other event family rejects these fields.
+
 Session State mutations use one outcome-only `session-state.outcome` record
 per selected attempt. The closed operations are `session-state.save`,
 `session-state.autosave`, `session-state.restore`, and `session-state.delete`;

package/docs/replacement-contract.md

@@ -105,7 +105,9 @@ holds the forgery refusal. For the `L2` guarantee above,
 `TestBrokerRuntimeDrainsWhenItsOwnImageWasReplaced` holds the vintage entry
 condition and that a runtime on the installed image is not drained by it,
 `TestReplacementRolePoliciesMatchTheContractDocument` and
-`TestReplacementSessionClientIsNeverADrainTarget` hold the policy table, and
+`TestReplacementSessionClientIsNeverADrainTarget` hold the policy table,
+`TestReplacementRoutesNameARunnableAction` holds that every role's action is a
+runnable `projmux` command or a closed lifecycle event, and
 `TestInstallReplacementPassOutcomesAreFixedByFleetAndRequest` fixes every
 outcome of the install pass.
 
@@ -321,18 +323,46 @@ measurement, and they are fixed here rather than at a call site.
 when it actually goes. `report-only` means no install touches it; the route that
 does replace it is named instead, so a reader of the row knows what would.
 
-`TestReplacementRolePoliciesMatchTheContractDocument` holds this table and the
-code's policy map equal, in both directions.
+`TestReplacementRolePoliciesMatchTheContractDocument` holds this table — its
+operator actions included — and the lifecycle event table below equal to the
+code's policy map and event set, in both directions.
 
-| Role | Disposition | Replacement route |
-| --- | --- | --- |
-| `broker-runtime` | `drain` | `broker-drain` |
-| `lifecycle-observer` | `report-only` | `pane-relaunch` |
-| `supervisor` | `report-only` | `pane-relaunch` |
-| `session-client` | `report-only` | `operator-reattach` |
-| `agent-endpoint` | `report-only` | `pane-relaunch` |
-| `usage-watcher` | `report-only` | `lease-expiry` |
-| `other` | `report-only` | `process-exit` |
+| Role | Disposition | Replacement route | Operator action |
+| --- | --- | --- | --- |
+| `broker-runtime` | `drain` | `broker-drain` | event `install-replacement-pass` |
+| `lifecycle-observer` | `report-only` | `pane-relaunch` | `projmux stop project <project-ref>`, then `projmux start project <project-ref>` |
+| `supervisor` | `report-only` | `pane-relaunch` | `projmux stop project <project-ref>`, then `projmux start project <project-ref>` |
+| `session-client` | `report-only` | `operator-reattach` | event `shell-wrapper-exit`, then `projmux shell` |
+| `agent-endpoint` | `report-only` | `pane-relaunch` | `projmux stop project <project-ref>`, then `projmux start project <project-ref>` |
+| `usage-watcher` | `report-only` | `lease-expiry` | event `usage-demand-lapse` |
+| `other` | `report-only` | `process-exit` | event `invocation-exit` |
+
+**The operator action is the route spelled as something that can happen.** A
+route name says which kind of replacement applies; the action says what carries
+it out, step by step. A step is either a `projmux` command the shipped CLI
+catalog resolves to a runnable verb, or one of the lifecycle events below, which
+replace a role with no command at all.
+`TestReplacementRoutesNameARunnableAction` fails when a command names a route
+the catalog does not have, stops at a verb that refuses without its child, or
+reaches into `internal`, and when an event is outside this list.
+
+| Event | What happens |
+| --- | --- |
+| `install-replacement-pass` | `make install` runs `projmux internal install-replace`, which dials the superseded broker runtime. The runtime drains, closes when its last binding goes, and the next binding starts one on the installed image |
+| `shell-wrapper-exit` | the terminal command that ran `projmux shell` returns. The wrapper waits on its `tmux attach-session` child, so it ends only when that client does |
+| `usage-demand-lapse` | no usage render has refreshed the watcher's demand marker within its 15-second TTL, so the watcher cancels itself and releases its lease; the next render starts one on the installed image. A status line still rendering the usage segment keeps that demand fresh |
+| `invocation-exit` | a short-lived invocation returns on its own, and the next one runs the installed image |
+
+**`pane-relaunch` is a Project runtime cycle.** Each role it covers lives as
+long as one managed Pane: the supervisor is that Pane's own process, the
+lifecycle observer ends once its Pane binding is gone, and the endpoint helper
+ends once its provider process does. `projmux stop project` ends the Project's
+exact tmux session and preserves its Registry graph; `projmux start project`
+materializes that graph again from the installed image, and its Continue
+launches or resumes the Project's declared Agents under the same eligibility
+every Continue uses. It ends every Pane of that Project, which is exactly why
+no install runs it on the operator's behalf. A Pane under the Home control
+session belongs to no Project, and no Project verb reaches it.
 
 **Exactly one role drains, and that is a fact about what exists rather than a
 first instalment.** A drain is a protocol: the runtime has to be able to hear
@@ -350,6 +380,17 @@ typed into. It is report-only and no cutoff reaches it.
 `TestReplacementSessionClientIsNeverADrainTarget` holds that as a property of
 the table rather than of any call site.
 
+**Detaching and reattaching does not by itself finish that replacement.** The
+census counts the `projmux shell` wrapper, not the tmux client. The wrapper
+starts `tmux attach-session` as a child process and waits on it, so the
+wrapper — the process still on the pre-install image — keeps running until that
+client exits and the terminal command that ran `projmux shell` returns. A
+reattach that leaves that command running, such as switching sessions or
+attaching a second client, leaves the wrapper exactly where it was. The required
+action is to end the wrapper by exiting the terminal session running
+`projmux shell`, then start `projmux shell` again, which runs the installed
+image.
+
 **No disposition severs work.** The one hard kill this repository has measured —
 2026-09-05, four panes — brought three of the four back automatically and left
 the fourth wedged on `backlog-overflow`. A recovery asymmetry that large is what

package/docs/session-restore.md

@@ -2,7 +2,11 @@
 
 Session snapshots are explicit desired-state inputs for one Project. They are
 not tmux replay scripts and they are not Registry backups. Snapshot save keeps
-the existing v1 schema and storage behavior.
+the existing v1 schema and storage behavior. In snapshot save's runtime id
+duplicate check, a Window or Pane recorded as `MissingRuntime`/`RuntimeUnbound`
+does not claim its retained runtime id, so a tmux id reused after a server
+restart does not refuse the save; two live Windows or two live Panes sharing an
+id are still refused.
 
 ```sh
 projmux get snapshots [--session <snapshot-session>]
@@ -42,10 +46,11 @@ same-kind collision is rejected as damaged before trust authorization,
 Registry/tmux/provider mutation, or any snapshot write.
 
 The committed Registry is then converged by the ordinary Project materializer.
-For a restored offline Agent-anchor Window, `Continue project` visibly plans a
+For a restored offline Agent-anchor Window, snapshot materialization visibly plans a
 lazy default shell, creates the Window from that shell, and stages the Agent on
 its retained anchor Pane UID. A successful repeat writes neither Registry nor
-topology. Agent recipes use the canonical provider launch/resume path. Stored startup
+topology. Snapshot Agent recipes use the canonical provider launch/resume path,
+including their existing fresh-conversation fallback. Stored startup
 commands are not directly executed by snapshot restore. A runtime item refusal
 does not roll the Registry back: desired state and the source snapshot remain
 available for another `Continue project`, and the refusal is reported as an
@@ -70,6 +75,41 @@ A closed Project has exactly two actions:
 Esc/cancel returns to Projects; it is not an action row. Picker failure falls
 back to the non-destructive `Continue project` action.
 
+Continue resumes an Agent's exact recorded conversation after interrupted,
+killed, abnormal, unknown, or unrecorded termination. Intentional and normal
+termination remain excluded. A recorded receipt must agree on the Agent and
+its retained Pane's current managed activation. Without a receipt, Running
+requires its exact paneRef; Offline or Failed requires one unambiguous retained
+Agent-owned Pane activation. Pending Agents are skipped. Live Agents are not
+launched again.
+
+A missing, blank, malformed, or mismatched conversation ref, a disabled provider,
+a missing workspace, or a resume preparation failure skips the Agent with a
+reason. Continue never substitutes a new conversation. Shells and other
+recoverable Agents still converge; an unrecoverable Agent that is itself a
+Window's required anchor keeps the existing Window refusal. Explicit snapshot
+restore and `agent resume` retain their separate authority.
+
+After Continue commits, its startup summary shows the resumed and skipped Agent
+totals and `projmux diagnostics log --component topology`. The same counts are
+available in the public materialize-project JSON result's `recovery` field.
+Already-live Agents count in neither total. Full per-Agent explanations remain
+on stderr; the transient summary stays within 220 UTF-8 bytes, including any
+ellipsis, independently of Agent names or how many were skipped.
+
+The private operations journal stores one `topology.outcome` and one
+`topology.agent.skipped` row per reason in the same invocation `run_id`. Reason
+counts sum to the committed skipped total. The ten codes use `topology.agent.`
+followed by `termination-excluded`, `phase-ineligible`, `activation-unproven`,
+`termination-invalid`, `session-ref-missing`, `session-ref-invalid`,
+`session-ref-mismatch`, `provider-unavailable`, `workspace-unavailable`, or
+`resume-prepare-failed`. `diagnostics report` includes recent closed recovery
+events in `topology-recovery.json`, including successful partial and 0/0 results.
+Journal rows contain no resource IDs/names, conversation IDs, payloads, or raw
+errors. Dry-run writes no execution event; failed or rolled-back execution
+records an error with zero committed counts. Journal and display failures are
+best effort and never change the topology result.
+
 `Recreate Project` never deletes or overwrites autosave or named snapshot files. It
 preserves the root, Git/worktrees, trust decision, and all unrelated Registry
 graphs while changing the Project identity. A rejected commit retains the

package/docs/troubleshooting.md

@@ -111,6 +111,32 @@ The `Codex app-server` result keeps four readiness axes separate:
 remain separate supporting fields. A ready endpoint therefore does not hide an
 unmanaged process or version skew.
 
+When a current Codex activation records a different endpoint generation from
+the running default endpoint, `Codex endpoint generation comparison` lists each
+affected Agent by exact `uid:` selector. The comparison uses the activation's
+`endpointGenerationID` and the observed running version, independently of the
+installed CLI version. It reports an observed interruption risk during endpoint
+replacement (2026-09-09, n=1), with causality undetermined; interruption is not
+certain. This is a snapshot valid before the next replacement, and performs no
+recovery or process mutation.
+
+The census includes bound Codex activations across every Project and Window in
+the managed Registry, even if their Agent phase is stale. Offline conversation
+history without a current activation is excluded. A complete comparison with no
+mismatches emits no comparison block. An unreadable Registry or missing,
+inconsistent, orphaned, or unobservable activation produces an `unavailable` or
+`incomplete` enumeration signal; confirmed mismatches remain visible alongside
+those gaps. A foreign Codex state domain, opaque generation, or a present or
+unreadable generation pool is unobservable from the default daemon probe.
+Private pool generations can also have version-shaped IDs, so Doctor does not
+infer their running endpoint from that spelling or from admission-current.
+
+The additive `codex_endpoint_mismatch` JSON field carries the same mismatch set,
+enumeration gaps, and evidence strength without changing the schema version.
+Support report `doctor.json` preserves those counts and closed evidence fields;
+Agent and generation IDs retain the support report's normal deterministic
+hashes. Exact Agent selectors are available in ordinary Doctor text and JSON.
+
 `external-cli-only` states only two observed facts: the ordinary Codex CLI
 exists, and the managed standalone payload was not observed. It does not mean
 the ordinary CLI is unsupported, identify how that CLI was installed, or prove
@@ -120,9 +146,12 @@ An explicit native action refuses a ready unmanaged or version-skewed endpoint.
 The refusal reports `shared-clients-disconnect`: replacing this shared process
 can interrupt every attached Codex client. For a managed skew, confirm the
 interruption and run `codex app-server daemon restart`. For an unmanaged
-endpoint, close every sharing client, stop the process through the operator
-that owns it, then run `codex app-server daemon start`. Projmux never performs
-those stop/restart steps or invents an ownership-specific kill command.
+endpoint, close every sharing Codex client, run
+`codex app-server daemon bootstrap`, then rerun diagnostics. The observed `pid`
+backend requires bootstrap again after reboot; this observation does not
+establish boot persistence for other backends. The unmanaged bootstrap
+prescription is absent for managed or unknown ownership. Projmux reports this
+operator-owned guidance without executing the recovery commands.
 
 A prompted managed Codex create also requires that endpoint. When it is not
 ready or not attachable, `projmux create codex -- "<prompt>"` refuses instead of
@@ -159,6 +188,38 @@ method, rerun Doctor. Do not copy binaries, create symlinks in the Codex home,
 or edit the control socket as a diagnostic workaround. Doctor, Settings, and
 support-report collection never start the daemon or modify the installation.
 
+The read-only manager observation is recorded separately as `manager_evidence`:
+`status`, `backend`, `result`, `agreement`, and the manager's reported `version`.
+`running_version` describes the independently initialized endpoint. A version or
+running/stopped contradiction yields `manager_ownership=unknown`,
+`native_action_refusal=evidence-contradictory`, and inspection guidance. A ready
+endpoint with insufficient manager evidence also refuses mutation. Running/PID
+or a managed-looking path alone does not prove ownership. The existing exact
+cold-start rule remains separate; a contradictory running-manager observation
+cannot authorize it.
+
+Observer `ai-ingest.log` fallback rows keep the existing `reason` and add a
+`failure` object: allowlisted request `method`, nullable original `rpc_code`, and
+closed `cause`. For example, an unsupported request and a catalog rejection can
+share `reason=unsupported` while retaining different original methods/codes.
+Transport and local protocol failures have `rpc_code=null`. Read-only preflight
+refusals also carry the same `recovery` evidence and operator decision Doctor
+reports. These fields are appended only after the exact authority write succeeds;
+the existing startup handshake and reason consumers are unchanged.
+`projmux diagnostics agent-hook` displays the same safe `failure=` and `recovery=`
+JSON objects in its default text output; `--json` retains the original JSONL
+records. Older rows keep their existing text format.
+
+Diagnostic bounds are 32 bytes per method/cause/evidence token or version,
+20 decimal bytes for an RPC integer, 64 bytes per recovery decision token,
+160 bytes for `failure` JSON, 256 for `manager_evidence`, and 768 for `recovery`.
+The Codex health JSON/text section and enriched observer row each fit within
+4096 bytes (the row reserves space for its timestamp). Public journal text adds
+at most 947 bytes for both diagnostic objects, labels and separators; an enriched
+observer line remains within the same 4096-byte row bound. The existing journal file
+retention bound remains 1 MiB. Provider messages, payloads, prompts, auth, paths,
+and raw PIDs are excluded; unknown strings are replaced by closed unknown values.
+
 ## Incomplete npm install
 
 If the npm shim exits before Projmux starts with:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "projmux",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "tmux project session manager",
   "license": "MIT",
   "homepage": "https://github.com/crevissepartners/projmux#readme",
@@ -28,9 +28,9 @@
     "package:npm:pack": "scripts/package-npm.sh --pack"
   },
   "optionalDependencies": {
-    "@projmux/linux-x64": "0.15.0",
-    "@projmux/linux-arm64": "0.15.0",
-    "@projmux/darwin-x64": "0.15.0",
-    "@projmux/darwin-arm64": "0.15.0"
+    "@projmux/linux-x64": "0.15.1",
+    "@projmux/linux-arm64": "0.15.1",
+    "@projmux/darwin-x64": "0.15.1",
+    "@projmux/darwin-arm64": "0.15.1"
   }
 }