tmux-ide 2.7.0 → 2.9.0-beta.5

package/packages/daemon/src/lib/daemon-embed.ts

@@ -6,32 +6,144 @@
  */
 
 import { execFileSync } from "node:child_process";
-import { randomBytes } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
+import { createWriteStream } from "node:fs";
 import { createServer, type Server } from "node:http";
 import { createRequire } from "node:module";
 import type { Socket } from "node:net";
+import { performance } from "node:perf_hooks";
 import { WebSocket, WebSocketServer } from "ws";
-import { computeAgentStates, computePortPanes } from "./session-monitor.ts";
+import { ownerBearerMatches } from "../command-center/owner-authority.ts";
+import {
+  DAEMON_WIRE_PROTOCOL_VERSION,
+  DaemonInstanceIdentitySchemaZ,
+  PANE_STREAM_REDEEM_PATH,
+  PaneStreamLoopbackWebSocketUrlSchemaZ,
+  TERMINAL_ATTACHMENT_REDEEM_PATH,
+  TerminalAttachmentLoopbackWebSocketUrlSchemaZ,
+  type DaemonInstanceIdentity,
+  type SessionRuntimeSemanticIntent,
+} from "@tmux-ide/contracts";
+import {
+  classifySessionInspectionError,
+  DaemonSessionMonitor,
+  execTmuxAsync,
+  isConfirmedMissingTmuxTarget,
+  parseDaemonMonitorPanes,
+  readPortProcessFactsAsync,
+} from "./daemon-session-monitor.ts";
 import { DaemonShutdownError, DaemonStartupError } from "./errors.ts";
 import { handlePtyWebSocket, shutdownPtyBridges } from "../server/ws-route.ts";
-import { handleWsEventsConnection } from "../command-center/ws-events.ts";
+import {
+  broadcastInteractionReceipt,
+  broadcastResourceChanged,
+  handleWsEventsConnection,
+  setFleetFactsObserverDiagnostics,
+  setFleetFactsTmuxRunner,
+  shutdownWsEventObservation,
+} from "../command-center/ws-events.ts";
 import { setRemoteAccessRestartBackend } from "../command-center/actions/handlers/app-set-remote-access.ts";
 import { setDaemonShutdownBackend } from "../command-center/actions/handlers/daemon-shutdown.ts";
+import type { WorkspaceMultiplexerBackend } from "../command-center/actions/handlers/workspace-multiplexer.ts";
 import { readAppSettings } from "./app-settings.ts";
-import { getDefaultWorkspaceRegistry } from "./workspace-registry.ts";
+import {
+  getDefaultWorkspaceRegistry,
+  readWorkspaceRegistrySessionInventory,
+  WORKSPACE_REGISTRY_TMUX_TIMEOUT_MS,
+  type WorkspaceRegistry,
+} from "./workspace-registry.ts";
+import {
+  createPinnedWorkspaceTmuxRunner,
+  resolveWorkspacePaneTmuxAuthority,
+  WorkspacePaneCreationAuthority,
+} from "./workspace-pane-creation.ts";
+import { discoverLiveSessionSummaries, readAdoptedFleet } from "../command-center/discovery.ts";
+import { WorkspaceOpenAuthority } from "./workspace-open.ts";
+import { WorkspacePromotionAuthority } from "./workspace-promotion.ts";
+import { WorkspaceOpenHandoffCoordinator } from "./workspace-open-handoff.ts";
+import { FleetLifecycleAuthority } from "./fleet-lifecycle-authority.ts";
+import { AppWindowMutationAuthority } from "./app-window-mutation.ts";
+import { WorkspaceMultiplexerAuthority } from "./workspace-multiplexer-verbs.ts";
+import { TmuxExternalInteractionObserver } from "./tmux-external-interaction-observer.ts";
+import {
+  createNativeTerminalAttachmentRuntime,
+  type NativeTerminalAttachmentRuntime,
+  WorkspaceTerminalInventoryRuntime,
+} from "../terminal/attachments/native-runtime.ts";
+import { createTmuxAgentStatusProbe } from "../terminal/attachments/agent-status-probe.ts";
+import {
+  attachTerminalAttachmentWebSocket,
+  type TerminalAttachmentWebSocketBoundary,
+} from "../server/terminal-attachment-upgrade.ts";
+import {
+  attachPaneStreamWebSocket,
+  type PaneStreamWebSocketBoundary,
+} from "../server/pane-stream-upgrade.ts";
+import {
+  createPaneStreamRuntime,
+  type PaneStreamRuntime,
+} from "../terminal/pane-stream/runtime.ts";
+import { SessionRuntimeRegistry } from "../terminal/session-runtime/registry.ts";
+import { createSessionRuntimeObservability } from "../terminal/session-runtime/runtime-observability.ts";
+import { createSessionRuntimeMultiplexerBackend } from "../terminal/session-runtime/multiplexer-backend.ts";
+import {
+  PaneSourceCredentialAuthority,
+  reconcilePaneSourceCredentialsAtStartup,
+} from "./pane-source-credentials.ts";
 import { setActivationBackend, type ProjectActivationOptions } from "./active-projects.ts";
+import { readOrMintEnvironmentId } from "./environment-identity.ts";
 import {
-  clearCanonicalDaemonInfo,
+  canonicalDaemonUrl,
+  clearCanonicalDaemonInfoIfOwned,
+  clearCanonicalDaemonInfoIfUnchanged,
+  inspectCanonicalDaemonInfo,
   isCanonicalDaemonAlive,
-  readCanonicalDaemonInfo,
+  isCanonicalDaemonRecordOwnerProvenDead,
+  probeCanonicalDaemonHealth,
+  probeCanonicalDaemonIdentity,
+  releaseCanonicalDaemonClaim,
+  tryAcquireCanonicalDaemonClaim,
   writeCanonicalDaemonInfo,
+  type CanonicalDaemonClaim,
+  type CanonicalDaemonInfo,
 } from "./canonical-daemon.ts";
 
 const requireFromHere = createRequire(import.meta.url);
 const DEFAULT_HOSTNAME = "127.0.0.1";
 const DEFAULT_GRACEFUL_MS = 2000;
-const MONITOR_INTERVAL_MS = 1000;
 const EMBEDDED_SESSION_NAME = "__embedded__";
+const TAKEOVER_TIMEOUT_MS = 10_000;
+const TAKEOVER_POLL_MS = 50;
+const TAKEOVER_DEADLINE_TEST_OVERRIDE = Symbol.for(
+  "tmux-ide.daemon-embed.takeover-deadline-ms.test-only",
+);
+
+type PackageVersionLoader = () => unknown;
+
+function loadBundledPackage(): unknown {
+  return requireFromHere("../../package.json");
+}
+
+/**
+ * Resolve diagnostic version metadata without making daemon startup depend on
+ * package.json being present next to a bundled executable.
+ */
+export function resolveDaemonProductVersion(
+  explicit: string | undefined,
+  loadPackage: PackageVersionLoader = loadBundledPackage,
+): string {
+  if (typeof explicit === "string" && explicit.trim().length > 0) return explicit.trim();
+  try {
+    const pkg = loadPackage();
+    if (pkg && typeof pkg === "object" && "version" in pkg) {
+      const version = (pkg as { version?: unknown }).version;
+      if (typeof version === "string" && version.trim().length > 0) return version.trim();
+    }
+  } catch {
+    // Bundled/single-file hosts may have no package.json at this relative path.
+  }
+  return "0.0.0";
+}
 
 export interface EmbeddedDaemonOptions {
   sessionName?: string;
@@ -41,15 +153,21 @@ export interface EmbeddedDaemonOptions {
   localBypassToken?: string | null;
   takeoverIfRunning?: boolean;
   silent?: boolean;
+  /** Diagnostic product version advertised by daemon.json. */
+  productVersion?: string;
   /** @deprecated Use bindHostname. */
   hostname?: string;
 }
 
 export interface EmbeddedDaemonHandle {
+  readonly instanceId: string;
+  readonly pid: number;
   readonly port: number;
   readonly apiBaseUrl: string;
   readonly wsUrl: string;
   readonly localBypassToken: string | null;
+  /** Diagnostic only: normal pane-stream startup must keep this false. */
+  compatibilityTerminalAttachmentRuntimeConstructed(): boolean;
   activateProject(
     projectName: string,
     options?: ProjectActivationOptions,
@@ -57,16 +175,6 @@ export interface EmbeddedDaemonHandle {
   stop(opts?: { gracefulMs?: number }): Promise<void>;
 }
 
-interface MonitorPane {
-  id: string;
-  pid: string;
-  cmd?: string;
-  title?: string;
-  role?: string;
-  type?: string;
-  name?: string;
-}
-
 function tmux(...args: string[]): string {
   return execFileSync("tmux", args, {
     encoding: "utf-8",
@@ -76,6 +184,7 @@ function tmux(...args: string[]): string {
     // child spawn fails with EBADF. The visible symptom is sessionExists()
     // returning false → stopSelf → ghost daemon.
     stdio: ["ignore", "pipe", "pipe"],
+    timeout: 2_000,
   }).trim();
 }
 
@@ -87,9 +196,12 @@ function tmuxSilent(...args: string[]): string {
   }
 }
 
-function assertTmuxSession(sessionName: string): void {
+function assertTmuxSession(
+  sessionName: string,
+  runTmux: (args: readonly string[]) => string = (args) => tmux(...args),
+): void {
   try {
-    tmux("has-session", "-t", sessionName);
+    runTmux(["has-session", "-t", sessionName]);
   } catch (err) {
     throw new DaemonStartupError(
       `tmux session "${sessionName}" does not exist`,
@@ -105,6 +217,62 @@ function validatePort(port: number): void {
   }
 }
 
+/**
+ * Renderer descriptors are always local capabilities, even when the HTTP
+ * server listens on a wildcard. Explicit remote-only binds are deliberately
+ * unsupported rather than leaking an unreachable or remotely addressable URL.
+ */
+export function terminalAttachmentWebSocketUrl(bindHostname: string, port: number): string {
+  const descriptorHostname =
+    bindHostname === "0.0.0.0" ? "127.0.0.1" : bindHostname === "::" ? "::1" : bindHostname;
+  if (!["127.0.0.1", "localhost", "::1"].includes(descriptorHostname)) {
+    throw new TypeError("Terminal attachment listener must include a canonical loopback address.");
+  }
+  return TerminalAttachmentLoopbackWebSocketUrlSchemaZ.parse(
+    canonicalDaemonUrl("ws", descriptorHostname, port, TERMINAL_ATTACHMENT_REDEEM_PATH),
+  );
+}
+
+/** Pane-stream descriptors share the loopback-only discipline above. */
+export function paneStreamWebSocketUrl(bindHostname: string, port: number): string {
+  const descriptorHostname =
+    bindHostname === "0.0.0.0" ? "127.0.0.1" : bindHostname === "::" ? "::1" : bindHostname;
+  if (!["127.0.0.1", "localhost", "::1"].includes(descriptorHostname)) {
+    throw new TypeError("Pane-stream listener must include a canonical loopback address.");
+  }
+  return PaneStreamLoopbackWebSocketUrlSchemaZ.parse(
+    canonicalDaemonUrl("ws", descriptorHostname, port, PANE_STREAM_REDEEM_PATH),
+  );
+}
+
+/**
+ * Start both direct-terminal retirement barriers before awaiting either one.
+ * The runtime call closes admission and PTYs; the boundary call detaches the
+ * upgrade listener. Returning failures lets the outer daemon shutdown keep
+ * retiring legacy transports, HTTP, and canonical publication.
+ */
+export async function retireTerminalAttachmentTransport(
+  runtime: Pick<NativeTerminalAttachmentRuntime, "dispose"> | null,
+  boundary: Pick<TerminalAttachmentWebSocketBoundary, "close">,
+): Promise<readonly unknown[]> {
+  let runtimeDisposal: Promise<void>;
+  try {
+    runtimeDisposal = runtime?.dispose() ?? Promise.resolve();
+  } catch (error) {
+    runtimeDisposal = Promise.reject(error);
+  }
+
+  let boundaryClose: Promise<void>;
+  try {
+    boundaryClose = boundary.close();
+  } catch (error) {
+    boundaryClose = Promise.reject(error);
+  }
+
+  const results = await Promise.allSettled([runtimeDisposal, boundaryClose]);
+  return results.flatMap((result) => (result.status === "rejected" ? [result.reason] : []));
+}
+
 async function pickFreePort(hostname: string): Promise<number> {
   const probe = createServer();
   return await new Promise<number>((resolve, reject) => {
@@ -120,59 +288,6 @@ async function pickFreePort(hostname: string): Promise<number> {
   });
 }
 
-function sessionExists(sessionName: string): "yes" | "no" | "unknown" {
-  try {
-    tmux("has-session", "-t", sessionName);
-    return "yes";
-  } catch (err) {
-    const msg = (err as NodeJS.ErrnoException).message ?? "";
-    const code = (err as NodeJS.ErrnoException).code;
-    // Spawn-level failures (EBADF, EAGAIN, etc.) are transient OS issues,
-    // not "session is gone" signals. Same for non-zero exits without stderr
-    // — `has-session` returns 1 only when the session is genuinely missing,
-    // and tmux always writes to stderr in that case.
-    if (
-      code === "EBADF" ||
-      code === "EAGAIN" ||
-      code === "EMFILE" ||
-      code === "ENFILE" ||
-      msg.includes("EBADF") ||
-      msg.includes("EAGAIN")
-    ) {
-      console.error("[daemon] sessionExists transient spawn error:", msg);
-      return "unknown";
-    }
-    return "no";
-  }
-}
-
-function hasClients(): boolean {
-  return tmuxSilent("list-clients").length > 0;
-}
-
-function listPanes(sessionName: string): MonitorPane[] {
-  const raw = tmuxSilent(
-    "list-panes",
-    "-t",
-    sessionName,
-    "-F",
-    "#{pane_id}\t#{pane_pid}\t#{pane_current_command}\t#{pane_title}\t#{@ide_role}\t#{@ide_type}\t#{@ide_name}",
-  );
-  if (!raw) return [];
-  return raw.split("\n").map((line) => {
-    const [id, pid, cmd, title, role, type, name] = line.split("\t");
-    return {
-      id: id!,
-      pid: pid!,
-      cmd,
-      title,
-      role: role || undefined,
-      type: type || undefined,
-      name: name || undefined,
-    };
-  });
-}
-
 function bearerToken(authHeader: string | string[] | undefined): string | null {
   const value = Array.isArray(authHeader) ? authHeader[0] : authHeader;
   if (!value?.startsWith("Bearer ")) return null;
@@ -240,7 +355,9 @@ function attachWebSockets(
     authToken?: string | null;
     localBypassToken?: string | null;
     bindHostname?: string | null;
-  } = {},
+    daemonIdentity: DaemonInstanceIdentity;
+    ownerToken?: string | null;
+  },
 ): {
   closeClients: () => void;
   closeServers: () => Promise<void>;
@@ -272,7 +389,11 @@ function attachWebSockets(
     if (pathname === "/ws/events") {
       eventsWss.handleUpgrade(req, socket, head, (ws) => {
         track(ws);
-        handleWsEventsConnection(ws);
+        const requestUrl = new URL(req.url ?? "/ws/events", "http://daemon.local");
+        handleWsEventsConnection(ws, opts.daemonIdentity, {
+          mode: requestUrl.searchParams.get("mode") === "semantic" ? "semantic" : "legacy",
+          ownerAuthorized: ownerBearerMatches(req.headers.authorization, opts.ownerToken ?? null),
+        });
       });
       return;
     }
@@ -329,68 +450,244 @@ function generateLocalBypassToken(): string {
   return randomBytes(32).toString("base64url");
 }
 
-function probeHostname(bindHostname: string): string {
-  return bindHostname === "0.0.0.0" ? "127.0.0.1" : bindHostname;
+interface TakeoverDeadline {
+  readonly signal: AbortSignal;
+  readonly expiresAt: number;
+  remainingMs(): number;
+  dispose(): void;
 }
 
-function timeoutSignal(ms: number): AbortSignal {
+function createTakeoverDeadline(timeoutMs: number): TakeoverDeadline {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new TypeError("Takeover deadline must be a positive finite duration.");
+  }
   const controller = new AbortController();
-  setTimeout(() => controller.abort(), ms).unref?.();
-  return controller.signal;
+  const expiresAt = performance.now() + timeoutMs;
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  timer.unref?.();
+  return {
+    signal: controller.signal,
+    expiresAt,
+    remainingMs: () => Math.max(0, expiresAt - performance.now()),
+    dispose: () => clearTimeout(timer),
+  };
+}
+
+function takeoverTimeoutMs(): number {
+  const override = (globalThis as Record<PropertyKey, unknown>)[TAKEOVER_DEADLINE_TEST_OVERRIDE];
+  return typeof override === "number" ? override : TAKEOVER_TIMEOUT_MS;
+}
+
+function throwTakeoverTimeout(message: string): never {
+  throw new DaemonStartupError(message, "canonical_takeover_timeout");
+}
+
+function assertTakeoverDeadline(deadline: TakeoverDeadline, message: string): void {
+  if (deadline.signal.aborted || deadline.remainingMs() <= 0) throwTakeoverTimeout(message);
 }
 
-async function healthGone(port: number, bindHostname: string): Promise<boolean> {
+async function waitForTakeoverPoll(deadline: TakeoverDeadline): Promise<void> {
+  assertTakeoverDeadline(deadline, "Canonical daemon did not quiesce before the takeover deadline");
+  const waitMs = Math.min(TAKEOVER_POLL_MS, deadline.remainingMs());
+  await new Promise<void>((resolve) => {
+    const timer = setTimeout(finish, waitMs);
+    const onAbort = () => finish();
+    function finish(): void {
+      clearTimeout(timer);
+      deadline.signal.removeEventListener("abort", onAbort);
+      resolve();
+    }
+    deadline.signal.addEventListener("abort", onAbort, { once: true });
+  });
+  assertTakeoverDeadline(deadline, "Canonical daemon did not quiesce before the takeover deadline");
+}
+
+function sameCanonicalInstance(left: CanonicalDaemonInfo, right: CanonicalDaemonInfo): boolean {
+  return (
+    left.pid === right.pid &&
+    left.port === right.port &&
+    left.protocolVersion === right.protocolVersion &&
+    left.instanceId === right.instanceId &&
+    left.startedAt === right.startedAt &&
+    left.bindHostname === right.bindHostname
+  );
+}
+
+async function requestValidatedDaemonShutdown(
+  info: CanonicalDaemonInfo,
+  deadline: TakeoverDeadline,
+): Promise<void> {
+  const identity = await probeCanonicalDaemonIdentity(info, deadline.signal);
+  assertTakeoverDeadline(
+    deadline,
+    "Canonical daemon did not answer the takeover request before the takeover deadline",
+  );
+  if (
+    !identity ||
+    identity.pid !== info.pid ||
+    identity.protocolVersion !== info.protocolVersion ||
+    identity.protocolVersion !== DAEMON_WIRE_PROTOCOL_VERSION ||
+    identity.instanceId !== info.instanceId ||
+    identity.startedAt !== info.startedAt
+  ) {
+    throw new DaemonStartupError(
+      "Canonical daemon identity changed before takeover",
+      "canonical_takeover_identity_mismatch",
+    );
+  }
+  const health = await probeCanonicalDaemonHealth(info, deadline.signal);
+  assertTakeoverDeadline(
+    deadline,
+    "Canonical daemon did not answer the takeover request before the takeover deadline",
+  );
+  if (
+    !health ||
+    health.protocolVersion !== info.protocolVersion ||
+    health.protocolVersion !== DAEMON_WIRE_PROTOCOL_VERSION
+  ) {
+    throw new DaemonStartupError(
+      "Canonical daemon protocol or health is incompatible with takeover",
+      "canonical_takeover_refused",
+    );
+  }
+  const current = inspectCanonicalDaemonInfo();
+  if (current.status !== "valid" || !sameCanonicalInstance(current.info, info)) {
+    throw new DaemonStartupError(
+      "Canonical daemon generation changed before takeover",
+      "canonical_takeover_identity_mismatch",
+    );
+  }
+
+  const headers: Record<string, string> = { "Content-Type": "application/json" };
+  if (info.authToken) headers.Authorization = `Bearer ${info.authToken}`;
+
+  let response: Response;
   try {
-    const res = await fetch(`http://${probeHostname(bindHostname)}:${port}/health`, {
-      signal: timeoutSignal(500),
-    });
-    return !res.ok;
-  } catch {
-    return true;
+    response = await fetch(
+      canonicalDaemonUrl("http", info.bindHostname, info.port, "/api/v2/action/daemon.shutdown"),
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ reason: "takeover", expectedInstanceId: info.instanceId }),
+        signal: deadline.signal,
+      },
+    );
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new DaemonStartupError(
+        "Canonical daemon did not answer the takeover request in time",
+        "canonical_takeover_timeout",
+        { cause: error },
+      );
+    }
+    throw new DaemonStartupError(
+      "Canonical daemon did not accept the takeover request",
+      "canonical_takeover_refused",
+      { cause: error as Error },
+    );
+  }
+
+  const envelope = (await response.json().catch(() => null)) as {
+    ok?: unknown;
+    result?: { stopping?: unknown };
+    error?: { code?: unknown };
+  } | null;
+  assertTakeoverDeadline(
+    deadline,
+    "Canonical daemon did not answer the takeover request before the takeover deadline",
+  );
+  if (envelope?.error?.code === "daemon_instance_mismatch") {
+    throw new DaemonStartupError(
+      "Canonical daemon generation changed before shutdown",
+      "canonical_takeover_identity_mismatch",
+    );
+  }
+  if (!response.ok || envelope?.ok !== true || envelope.result?.stopping !== true) {
+    throw new DaemonStartupError(
+      `Canonical daemon refused takeover (HTTP ${response.status})`,
+      "canonical_takeover_refused",
+    );
   }
 }
 
-async function requestDaemonShutdown(port: number, bindHostname: string): Promise<void> {
-  try {
-    await fetch(`http://${probeHostname(bindHostname)}:${port}/api/v2/action/daemon.shutdown`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ reason: "takeover" }),
-      signal: timeoutSignal(1_000),
-    });
-  } catch {
-    // The existing daemon may predate the action or be mid-shutdown. Polling
-    // and the final PID kill below handle both cases.
+async function waitForTakeoverQuiescence(
+  info: CanonicalDaemonInfo,
+  deadline: TakeoverDeadline,
+): Promise<void> {
+  while (!deadline.signal.aborted) {
+    const current = inspectCanonicalDaemonInfo();
+    if (current.status === "valid" && !sameCanonicalInstance(current.info, info)) {
+      throw new DaemonStartupError(
+        "Another daemon generation won the takeover race",
+        "canonical_already_running",
+      );
+    }
+    const recordOwnerGone =
+      current.status === "missing" || (await isCanonicalDaemonRecordOwnerProvenDead(current));
+    const [identity, health] = await Promise.all([
+      probeCanonicalDaemonIdentity(info, deadline.signal),
+      probeCanonicalDaemonHealth(info, deadline.signal),
+    ]);
+    assertTakeoverDeadline(
+      deadline,
+      "Canonical daemon retained its generation after accepting takeover",
+    );
+    if (recordOwnerGone && identity === null && health === null) return;
+    await waitForTakeoverPoll(deadline);
   }
+  throwTakeoverTimeout("Canonical daemon retained its generation after accepting takeover");
 }
 
-async function takeoverCanonicalDaemon(info: {
-  pid: number;
-  port: number;
-  bindHostname: string;
-}): Promise<void> {
-  await requestDaemonShutdown(info.port, info.bindHostname);
-  const deadline = Date.now() + 10_000;
-  while (Date.now() < deadline) {
-    const current = readCanonicalDaemonInfo();
-    const fileGone = !current || current.pid !== info.pid || current.port !== info.port;
-    const serverGone = await healthGone(info.port, info.bindHostname);
-    if (fileGone && serverGone) return;
-    await delay(150);
+async function acquireCanonicalDaemonClaimAfterTakeover(
+  info: CanonicalDaemonInfo,
+  deadline: TakeoverDeadline,
+): Promise<CanonicalDaemonClaim> {
+  while (!deadline.signal.aborted) {
+    const current = inspectCanonicalDaemonInfo();
+    if (current.status === "valid" && !sameCanonicalInstance(current.info, info)) {
+      throw new DaemonStartupError(
+        "Another daemon generation won the takeover race",
+        "canonical_already_running",
+      );
+    }
+    const attempt = tryAcquireCanonicalDaemonClaim();
+    if (attempt.status === "acquired") {
+      try {
+        await waitForTakeoverQuiescence(info, deadline);
+        return attempt.claim;
+      } catch (error) {
+        releaseCanonicalDaemonClaim(attempt.claim);
+        throw error;
+      }
+    }
+    if (attempt.status === "invalid") {
+      throw new DaemonStartupError(
+        `Canonical daemon claim is invalid: ${attempt.detail}`,
+        "canonical_record_invalid",
+      );
+    }
+    await waitForTakeoverPoll(deadline);
   }
+  throwTakeoverTimeout(
+    "Canonical daemon did not release its startup claim after accepting takeover",
+  );
+}
 
-  try {
-    process.kill(info.pid, "SIGTERM");
-  } catch {
-    // Already gone or not ours.
+function acquireCanonicalDaemonClaim(): CanonicalDaemonClaim {
+  const attempt = tryAcquireCanonicalDaemonClaim();
+  if (attempt.status === "busy") {
+    throw new DaemonStartupError(
+      `Canonical daemon startup is owned by PID ${attempt.owner.pid}`,
+      "canonical_claim_busy",
+    );
   }
-  await delay(500);
-  try {
-    process.kill(info.pid, "SIGKILL");
-  } catch {
-    // Already gone or not ours.
+  if (attempt.status === "invalid") {
+    throw new DaemonStartupError(
+      `Canonical daemon claim is invalid: ${attempt.detail}`,
+      "canonical_record_invalid",
+    );
   }
-  clearCanonicalDaemonInfo();
+  return attempt.claim;
 }
 
 function closeWsGoingAway(ws: WebSocket): void {
@@ -415,6 +712,22 @@ async function startHttpServer({
   authToken,
   localBypassToken,
   silent,
+  readProjectAuth,
+  daemonIdentity,
+  workspacePaneCreationBackend,
+  workspaceOpenBackend,
+  workspaceOpenHandoffBackend,
+  fleetLifecycleBackend,
+  workspacePromotionBackend,
+  appWindowMutationBackend,
+  workspaceMultiplexerBackend,
+  workspaceRegistry,
+  terminalInventoryRuntime,
+  getTerminalAttachmentRuntime,
+  peekTerminalAttachmentRuntime,
+  paneStreamRuntime,
+  catalogLiveSessions,
+  catalogFleet,
 }: {
   sessionName: string;
   requestedPort: number;
@@ -423,11 +736,38 @@ async function startHttpServer({
   authToken?: string | null;
   localBypassToken?: string | null;
   silent?: boolean;
+  readProjectAuth?: boolean;
+  daemonIdentity: {
+    productVersion: string;
+    instanceId: string;
+    startedAt: string;
+    environmentId?: string;
+  };
+  workspacePaneCreationBackend: WorkspacePaneCreationAuthority;
+  workspaceOpenBackend: WorkspaceOpenAuthority;
+  workspaceOpenHandoffBackend: WorkspaceOpenHandoffCoordinator;
+  fleetLifecycleBackend: FleetLifecycleAuthority;
+  workspacePromotionBackend: WorkspacePromotionAuthority;
+  appWindowMutationBackend: AppWindowMutationAuthority;
+  workspaceMultiplexerBackend: WorkspaceMultiplexerBackend;
+  workspaceRegistry: WorkspaceRegistry;
+  terminalInventoryRuntime: WorkspaceTerminalInventoryRuntime;
+  getTerminalAttachmentRuntime: () => NativeTerminalAttachmentRuntime;
+  peekTerminalAttachmentRuntime: () => NativeTerminalAttachmentRuntime | null;
+  paneStreamRuntime: PaneStreamRuntime;
+  catalogLiveSessions: () => readonly {
+    readonly liveSessionId: `live-session.${string}`;
+    readonly sessionName: string;
+    readonly paneCount: number;
+  }[];
+  catalogFleet: () => ReturnType<typeof readAdoptedFleet>;
 }): Promise<{
   server: Server;
   sockets: Set<Socket>;
   closeClients: () => void;
   closeWsServers: () => Promise<void>;
+  terminalAttachmentBoundary: TerminalAttachmentWebSocketBoundary;
+  paneStreamBoundary: PaneStreamWebSocketBoundary;
 }> {
   const { createApp } = await import("../command-center/server.ts");
   const { getRequestListener } = await import(requireFromHere.resolve("@hono/node-server"));
@@ -435,12 +775,14 @@ async function startHttpServer({
   const { AuthConfigSchema } = await import("./auth/types.ts");
 
   let authConfig = AuthConfigSchema.parse({});
-  try {
-    const { readConfig } = await import("./yaml-io.ts");
-    const { config } = readConfig(dir);
-    if (config.auth) authConfig = AuthConfigSchema.parse(config.auth);
-  } catch {
-    // Config not readable — use defaults.
+  if (readProjectAuth !== false) {
+    try {
+      const { resolveConfig } = await import("./resolved-config.ts");
+      const { launchConfig } = await resolveConfig(dir);
+      if (launchConfig?.auth) authConfig = AuthConfigSchema.parse(launchConfig.auth);
+    } catch {
+      // Config not readable — use defaults.
+    }
   }
 
   const authService = new AuthService(authConfig.secret);
@@ -452,10 +794,36 @@ async function startHttpServer({
       bindHostname,
       token: authToken ?? null,
       localBypassToken: localBypassToken ?? null,
+      ownerToken: localBypassToken ?? null,
     },
+    daemonIdentity,
+    workspacePaneCreationBackend,
+    workspaceOpenBackend,
+    workspaceOpenHandoffBackend,
+    fleetLifecycleBackend,
+    workspacePromotionBackend,
+    appWindowMutationBackend,
+    // Named in this function's parameter type since the verb routes shipped and
+    // never forwarded, so every multiplexer verb answered "not available from
+    // this daemon" in every real process. Only the in-test dispatcher, which is
+    // handed the authority directly, ever reached it.
+    workspaceMultiplexerBackend,
+    workspaceRegistry,
+    terminalAttachmentIssueBackend: {
+      issue: (request, context) => getTerminalAttachmentRuntime().admission.issue(request, context),
+    },
+    paneStreamIssueBackend: paneStreamRuntime.coordinator,
+    applicationShellInventoryBackend: terminalInventoryRuntime,
+    startupReadinessAttachmentBackend: terminalInventoryRuntime,
+    catalogLiveSessions,
+    catalogFleet,
   });
   app.get("/api/daemon/health", (c: { json: (body: unknown, status?: number) => Response }) => {
-    return c.json({ ok: true, session: sessionName });
+    return c.json({
+      ok: true,
+      session: sessionName,
+      compatibilityTerminalAttachmentRuntimeConstructed: peekTerminalAttachmentRuntime() !== null,
+    });
   });
 
   const server = createServer(getRequestListener(app.fetch));
@@ -463,50 +831,84 @@ async function startHttpServer({
   server.on("connection", (socket) => {
     sockets.add(socket);
     socket.on("close", () => sockets.delete(socket));
+    // `upgrade` hands the raw TCP socket to our route boundaries. A route can
+    // deliberately decline an unrelated path, leaving no protocol-specific
+    // owner to observe a later peer reset. Keep error ownership at this common
+    // accepted-socket boundary so ECONNRESET is connection-local and can never
+    // terminate the canonical daemon during client/session teardown.
+    socket.on("error", () => sockets.delete(socket));
   });
 
   const { closeClients, closeServers: closeWsServers } = attachWebSockets(server, {
     authToken,
     localBypassToken,
     bindHostname,
+    daemonIdentity: DaemonInstanceIdentitySchemaZ.parse({
+      protocolVersion: DAEMON_WIRE_PROTOCOL_VERSION,
+      ...daemonIdentity,
+    }),
+    ownerToken: localBypassToken,
   });
+  const terminalAttachmentBoundary = attachTerminalAttachmentWebSocket(
+    server,
+    (create) =>
+      (create ? getTerminalAttachmentRuntime() : peekTerminalAttachmentRuntime())?.admission ??
+      null,
+  );
+  const paneStreamBoundary = attachPaneStreamWebSocket(server, paneStreamRuntime.coordinator);
 
-  await new Promise<void>((resolve, reject) => {
-    const onError = (err: NodeJS.ErrnoException) => {
-      server.off("listening", onListening);
-      if (err.code === "EADDRINUSE") {
-        reject(
-          new DaemonStartupError(`Port ${requestedPort} is already in use`, "port_in_use", {
-            cause: err,
-          }),
-        );
-      } else {
-        reject(
-          new DaemonStartupError(`Failed to bind daemon on port ${requestedPort}`, "bind_failed", {
-            cause: err,
-          }),
-        );
-      }
-    };
-    const onListening = () => {
-      server.off("error", onError);
-      if (!silent) {
-        console.log(
-          `[daemon] Command Center on http://${bindHostname}:${requestedPort} (session: ${sessionName})`,
-        );
-      }
-      resolve();
-    };
-    server.once("error", onError);
-    server.once("listening", onListening);
-    server.listen(requestedPort, bindHostname);
-  });
+  try {
+    await new Promise<void>((resolve, reject) => {
+      const onError = (err: NodeJS.ErrnoException) => {
+        server.off("listening", onListening);
+        if (err.code === "EADDRINUSE") {
+          reject(
+            new DaemonStartupError(`Port ${requestedPort} is already in use`, "port_in_use", {
+              cause: err,
+            }),
+          );
+        } else {
+          reject(
+            new DaemonStartupError(
+              `Failed to bind daemon on port ${requestedPort}`,
+              "bind_failed",
+              { cause: err },
+            ),
+          );
+        }
+      };
+      const onListening = () => {
+        server.off("error", onError);
+        if (!silent) {
+          console.log(
+            `[daemon] Command Center on http://${bindHostname}:${requestedPort} (session: ${sessionName})`,
+          );
+        }
+        resolve();
+      };
+      server.once("error", onError);
+      server.once("listening", onListening);
+      server.listen(requestedPort, bindHostname);
+    });
+  } catch (error) {
+    await Promise.allSettled([
+      Promise.resolve().then(() => terminalAttachmentBoundary.close()),
+      Promise.resolve().then(() => paneStreamBoundary.close()),
+      Promise.resolve().then(() => closeClients()),
+      ...[...sockets].map((socket) => Promise.resolve().then(() => socket.destroy())),
+      ...(server.listening ? [waitForServerClose(server)] : []),
+      Promise.resolve().then(() => closeWsServers()),
+    ]);
+    throw error;
+  }
 
   return {
     server,
     sockets,
     closeClients,
     closeWsServers,
+    terminalAttachmentBoundary,
+    paneStreamBoundary,
   };
 }
 
@@ -522,261 +924,819 @@ export async function startEmbeddedDaemon(
       : null;
   const bindHostname =
     opts.bindHostname ?? opts.hostname ?? (persistedRemoteAccess ? "0.0.0.0" : DEFAULT_HOSTNAME);
-  const authToken = opts.authToken ?? persistedRemoteAccess?.token ?? null;
+  // Explicit null means "no auth". This is important for the native app's
+  // loopback-only `tmux-ide --headless` child: persisted remote-access settings
+  // must not silently change the process contract it requested.
+  const authToken = Object.prototype.hasOwnProperty.call(opts, "authToken")
+    ? (opts.authToken ?? null)
+    : (persistedRemoteAccess?.token ?? null);
   const localBypassToken = opts.localBypassToken ?? generateLocalBypassToken();
-  const existingCanonical = readCanonicalDaemonInfo();
-  if (existingCanonical) {
-    if (await isCanonicalDaemonAlive(existingCanonical)) {
-      if (opts.takeoverIfRunning) {
-        await takeoverCanonicalDaemon(existingCanonical);
+  let claim: CanonicalDaemonClaim;
+  if (opts.takeoverIfRunning) {
+    const state = inspectCanonicalDaemonInfo();
+    if (state.status === "valid" && (await isCanonicalDaemonAlive(state.info))) {
+      const takeoverDeadline = createTakeoverDeadline(takeoverTimeoutMs());
+      try {
+        await requestValidatedDaemonShutdown(state.info, takeoverDeadline);
+        claim = await acquireCanonicalDaemonClaimAfterTakeover(state.info, takeoverDeadline);
+      } finally {
+        takeoverDeadline.dispose();
+      }
+    } else {
+      claim = acquireCanonicalDaemonClaim();
+    }
+  } else {
+    claim = acquireCanonicalDaemonClaim();
+  }
+  try {
+    const existingCanonical = inspectCanonicalDaemonInfo();
+    if (existingCanonical.status === "invalid") {
+      if (await isCanonicalDaemonRecordOwnerProvenDead(existingCanonical)) {
+        if (!clearCanonicalDaemonInfoIfUnchanged(existingCanonical, claim)) {
+          throw new DaemonStartupError(
+            "Canonical daemon metadata changed while stale state was being removed",
+            "canonical_record_invalid",
+          );
+        }
       } else {
         throw new DaemonStartupError(
-          `Canonical daemon is already running on port ${existingCanonical.port}`,
+          `Canonical daemon metadata is ${existingCanonical.reason}: ${existingCanonical.detail}. ` +
+            "Refusing to start another owner.",
+          "canonical_record_invalid",
+        );
+      }
+    } else if (existingCanonical.status === "valid") {
+      if (await isCanonicalDaemonAlive(existingCanonical.info)) {
+        throw new DaemonStartupError(
+          `Canonical daemon is already running on port ${existingCanonical.info.port}`,
           "canonical_already_running",
         );
+      } else {
+        if (!clearCanonicalDaemonInfoIfUnchanged(existingCanonical, claim)) {
+          throw new DaemonStartupError(
+            "Canonical daemon metadata changed while stale state was being removed",
+            "canonical_already_running",
+          );
+        }
       }
-    } else {
-      clearCanonicalDaemonInfo();
     }
-  }
-  if (!sessionless) assertTmuxSession(sessionName);
-  const port = opts.port ?? (await pickFreePort(bindHostname));
-  validatePort(port);
-  const dir = process.cwd();
-
-  // Workspace registry: load + reconcile against live tmux sessions on
-  // startup. Backwards-compat: if TMUX_IDE_SESSION is set, auto-add it as
-  // a workspace so legacy single-session callers (pre-T068) keep working.
-  // The registry is the source of truth for /api/project/:name lookups.
-  const workspaceRegistry = getDefaultWorkspaceRegistry();
-  await workspaceRegistry.load();
-  const legacySession = process.env.TMUX_IDE_SESSION;
-  if (legacySession && !workspaceRegistry.has(legacySession)) {
-    try {
-      workspaceRegistry.add({
-        name: legacySession,
-        sessionName: legacySession,
-        projectDir: dir,
-      });
-    } catch {
-      // Already added or persistence failed; non-fatal.
+    // Resolve both tmux selectors before any state read. Registry discovery,
+    // explicit-session validation, catalog reads and later mutations must all
+    // observe one daemon-generation authority rather than whichever server a
+    // caller's ambient TMUX/PATH happens to select.
+    const tmuxAuthority = resolveWorkspacePaneTmuxAuthority();
+    const catalogTmuxRunner = createPinnedWorkspaceTmuxRunner(tmuxAuthority);
+    const registryTmuxRunner = createPinnedWorkspaceTmuxRunner(tmuxAuthority, {
+      timeoutMs: WORKSPACE_REGISTRY_TMUX_TIMEOUT_MS,
+    });
+    if (!sessionless) assertTmuxSession(sessionName, catalogTmuxRunner);
+    const port = opts.port ?? (await pickFreePort(bindHostname));
+    validatePort(port);
+    const dir = process.cwd();
+    const productVersion = resolveDaemonProductVersion(opts.productVersion);
+    const instanceId = randomUUID();
+    const startedAt = new Date().toISOString();
+    // Stable across restarts, unlike the per-process nonce above; minted once
+    // per daemon state home and re-minted only if its record disappears.
+    const environmentId = readOrMintEnvironmentId();
+
+    // Workspace registry: load + reconcile against live tmux sessions on
+    // startup. Backwards-compat: if TMUX_IDE_SESSION is set, auto-add it as
+    // a workspace so legacy single-session callers (pre-T068) keep working.
+    // The registry is the source of truth for /api/project/:name lookups.
+    const workspaceRegistry = getDefaultWorkspaceRegistry();
+    await workspaceRegistry.load(() => readWorkspaceRegistrySessionInventory(registryTmuxRunner));
+    const paneSourceCredentials = new PaneSourceCredentialAuthority({
+      run: (args) => tmuxSilent(...args),
+      runAsync: (args, signal) => execTmuxAsync(args, signal),
+    });
+    const legacySession = process.env.TMUX_IDE_SESSION;
+    if (legacySession && !workspaceRegistry.has(legacySession)) {
+      try {
+        workspaceRegistry.add({
+          name: legacySession,
+          sessionName: legacySession,
+          projectDir: dir,
+        });
+      } catch {
+        // Already added or persistence failed; non-fatal.
+      }
     }
-  }
-  // Also register the explicit sessionName when the daemon is launched
-  // against a specific tmux session (e.g. `node daemon.ts new-name 6060`).
-  // Without this the operator has to POST /api/workspaces by hand before
-  // /api/sessions / /api/project/:name return anything — which was the
-  // dashboard's "terminal not connecting" symptom before this fix.
-  if (
-    !sessionless &&
-    sessionName !== EMBEDDED_SESSION_NAME &&
-    !workspaceRegistry.has(sessionName)
-  ) {
+    // Also register the explicit sessionName when the daemon is launched
+    // against a specific tmux session (e.g. `node daemon.ts new-name 6060`).
+    // Without this the operator has to POST /api/workspaces by hand before
+    // /api/sessions / /api/project/:name return anything — which was the
+    // dashboard's "terminal not connecting" symptom before this fix.
+    if (
+      !sessionless &&
+      sessionName !== EMBEDDED_SESSION_NAME &&
+      !workspaceRegistry.has(sessionName)
+    ) {
+      try {
+        workspaceRegistry.add({
+          name: sessionName,
+          sessionName,
+          projectDir: dir,
+        });
+      } catch {
+        // Already added or persistence failed; non-fatal.
+      }
+    }
+    await reconcilePaneSourceCredentialsAtStartup(
+      paneSourceCredentials,
+      workspaceRegistry.list().map((workspace) => workspace.sessionName),
+    );
+    const workspacePaneCreation = new WorkspacePaneCreationAuthority({
+      daemonInstanceId: instanceId,
+      registry: workspaceRegistry,
+      tmuxAuthority,
+    });
+    const workspaceOpen = new WorkspaceOpenAuthority({
+      daemonInstanceId: instanceId,
+      registry: workspaceRegistry,
+      tmuxAuthority,
+    });
+    const workspacePromotion = new WorkspacePromotionAuthority({
+      daemonInstanceId: instanceId,
+      registry: workspaceRegistry,
+      tmuxAuthority,
+    });
+    const fleetLifecycle = new FleetLifecycleAuthority({
+      daemonInstanceId: instanceId,
+      productVersion,
+      startedAt,
+      registry: workspaceRegistry,
+      runTmux: catalogTmuxRunner,
+      readFleet: () => readAdoptedFleet(workspaceRegistry, catalogTmuxRunner),
+    });
+    const appWindowMutation = new AppWindowMutationAuthority({
+      daemonInstanceId: instanceId,
+      registry: workspaceRegistry,
+    });
+    const workspaceMultiplexer = new WorkspaceMultiplexerAuthority({
+      daemonInstanceId: instanceId,
+      registry: workspaceRegistry,
+      tmuxAuthority,
+    });
+    let sessionRuntimeRegistry: SessionRuntimeRegistry | null = null;
+    let workspaceOpenHandoff: WorkspaceOpenHandoffCoordinator | null = null;
+    let terminalInventoryRuntime: WorkspaceTerminalInventoryRuntime | null = null;
+    const externalInteractionObserver = new TmuxExternalInteractionObserver({
+      daemonInstanceId: instanceId,
+      internalReadOwnerToken: localBypassToken,
+      registry: workspaceRegistry,
+      tmuxAuthority,
+      onObserved: ({ workspaceName, semanticPaneId, operationKind, operationId }) => {
+        if (operationKind !== "workspace.pane.read") terminalInventoryRuntime?.invalidate();
+        if (operationId) {
+          const consumed =
+            sessionRuntimeRegistry?.observeTmuxInteraction({
+              operationId,
+              workspaceName,
+              semanticPaneId,
+              operationKind,
+            }) ?? false;
+          if (consumed) return true;
+        }
+        try {
+          broadcastInteractionReceipt(
+            {
+              operationId: randomUUID(),
+              origin: "external",
+              workspaceName,
+              target: { kind: "pane", semanticPaneId },
+              operationKind,
+              phase: "observed",
+              summary:
+                operationKind === "workspace.pane.read"
+                  ? { operationKind, observedOnly: true }
+                  : { operationKind, observedOnly: true },
+              proof: { operationKind, observed: true, semanticPaneId },
+            },
+            instanceId,
+          );
+        } catch (error) {
+          if (!opts.silent) console.error("[daemon] External interaction receipt failed:", error);
+        }
+        return false;
+      },
+    });
+    let terminalAttachmentRuntime: NativeTerminalAttachmentRuntime | null = null;
+    let paneStreamRuntime: PaneStreamRuntime | null = null;
+    let runtimeTraceStream: ReturnType<typeof createWriteStream> | null = null;
+    const closeRuntimeTraceStream = async (): Promise<void> => {
+      externalInteractionObserver.setDiagnostics(null);
+      setFleetFactsObserverDiagnostics(null);
+      const stream = runtimeTraceStream;
+      runtimeTraceStream = null;
+      if (!stream || stream.closed || stream.destroyed) return;
+      await new Promise<void>((resolve) => stream.end(resolve));
+    };
+    let startedServer: Awaited<ReturnType<typeof startHttpServer>>;
     try {
-      workspaceRegistry.add({
-        name: sessionName,
+      const selector = tmuxAuthority.socketSelector;
+      const executeRuntimeIntent = (
+        operationId: string,
+        intent: SessionRuntimeSemanticIntent,
+        timing?: Parameters<typeof workspaceMultiplexer.mutate>[1],
+      ) => {
+        if (intent.verb === "workspace.pane.read") {
+          workspaceMultiplexer.readPane(operationId, intent);
+          return;
+        }
+        return workspaceMultiplexer.mutate(
+          { operationId, expectedDaemonInstanceId: instanceId, intent },
+          timing,
+        );
+      };
+      const runtimeTracePath = process.env.TMUX_IDE_SESSION_RUNTIME_TRACE_LOG;
+      runtimeTraceStream = runtimeTracePath
+        ? createWriteStream(runtimeTracePath, { flags: "a", highWaterMark: 64 * 1_024 })
+        : null;
+      let runtimeTraceSaturated = false;
+      runtimeTraceStream?.on("error", () => {
+        runtimeTraceSaturated = true;
+      });
+      runtimeTraceStream?.on("drain", () => {
+        runtimeTraceSaturated = false;
+      });
+      const runtimeObservability = runtimeTracePath
+        ? createSessionRuntimeObservability({
+            // The JSONL stream is the qualifying record. Keep only a small
+            // in-memory diagnostic tail so a sustained terminal flood cannot
+            // retain tens of thousands of frozen span objects or induce GC
+            // pauses on the daemon's input/output event loop.
+            capacity: 1_024,
+            onSpan: (span) => {
+              if (!runtimeTraceStream || runtimeTraceSaturated) return;
+              runtimeTraceSaturated = !runtimeTraceStream.write(
+                `${JSON.stringify({ version: 1, type: "performance.stage", ...span })}\n`,
+              );
+            },
+          })
+        : undefined;
+      if (runtimeTracePath) {
+        const publishObserverDiagnostic = (event: object): void => {
+          try {
+            if (!runtimeTraceStream || runtimeTraceSaturated) return;
+            runtimeTraceSaturated = !runtimeTraceStream.write(
+              `${JSON.stringify({
+                version: 1,
+                type: "performance.daemon-observer",
+                ...event,
+                generation: instanceId,
+              })}\n`,
+            );
+          } catch {
+            // Qualification diagnostics never alter daemon observation.
+          }
+        };
+        const diagnostics = {
+          nowMicros: () => Math.floor(performance.now() * 1_000),
+          createTraceId: randomUUID,
+          publish: publishObserverDiagnostic,
+        };
+        externalInteractionObserver.setDiagnostics(diagnostics);
+        setFleetFactsObserverDiagnostics(diagnostics);
+      }
+      sessionRuntimeRegistry = new SessionRuntimeRegistry({
+        generation: instanceId,
+        ...(runtimeObservability ? { observability: runtimeObservability } : {}),
+        semanticMutations: {
+          resolveSession: (workspaceName) =>
+            workspaceRegistry.get(workspaceName)?.sessionName ?? null,
+          execute: executeRuntimeIntent,
+          traceAuthority: { generation: instanceId, incarnation: null },
+          publishReceipt: (receipt) => broadcastInteractionReceipt(receipt, instanceId),
+          publishResourceChange: (change) => broadcastResourceChanged(change, instanceId),
+        },
+        mirror: {
+          executable: tmuxAuthority.executablePath,
+          internalReadHookEmission: (runtimePaneId, marker) =>
+            externalInteractionObserver.internalReadHookEmission(runtimePaneId, marker),
+          ...(selector.kind === "path" ? { socketPath: selector.path } : {}),
+          ...(selector.kind === "name" && selector.name !== "default"
+            ? { socketName: selector.name }
+            : {}),
+        },
+      });
+      workspaceOpenHandoff = new WorkspaceOpenHandoffCoordinator({
+        daemonInstanceId: instanceId,
+        openProject: (request) => workspaceOpen.open(request),
+        adoptLiveSession: (request) => workspacePromotion.promote(request),
+        prewarmPrevious: async (workspaceName) => {
+          const record = workspaceRegistry.get(workspaceName);
+          if (record) await sessionRuntimeRegistry!.prewarmSession(record.sessionName);
+        },
+        prepareRuntime: async (workspaceName, preferredPaneId) => {
+          const record = workspaceRegistry.get(workspaceName);
+          if (!record)
+            throw new Error(
+              `Prepared workspace ${workspaceName} is absent from the durable catalog.`,
+            );
+          await sessionRuntimeRegistry!.prewarmSession(record.sessionName);
+          const consumer = sessionRuntimeRegistry!.connect(
+            record.sessionName,
+            "workspace-open-prepare",
+            `workspace-open-${randomUUID()}`,
+          );
+          try {
+            const layout = await consumer.describe();
+            if (layout.degraded || layout.panes.length === 0) {
+              throw new Error(
+                `Prepared workspace ${workspaceName} has no coherent semantic layout.`,
+              );
+            }
+            const semanticPaneId =
+              layout.panes.find((pane) => pane.semanticPaneId === preferredPaneId)
+                ?.semanticPaneId ??
+              layout.panes.find((pane) => pane.active)?.semanticPaneId ??
+              layout.panes[0]!.semanticPaneId;
+            const seed = await new Promise<{
+              revision: number;
+              stateHash: string;
+            }>((resolve, reject) => {
+              const timeout = setTimeout(
+                () => reject(new Error("Timed out awaiting first coherent terminal seed.")),
+                5_000,
+              );
+              void consumer
+                .subscribeReplica(semanticPaneId, (update) => {
+                  if (update.type !== "terminal.seed") return;
+                  clearTimeout(timeout);
+                  resolve({ revision: update.revision, stateHash: update.stateHash });
+                })
+                .catch((error: unknown) => {
+                  clearTimeout(timeout);
+                  reject(error);
+                });
+            });
+            return {
+              semanticPaneId,
+              paneCount: layout.panes.length,
+              terminalRevision: seed.revision,
+              terminalStateHash: seed.stateHash,
+            };
+          } finally {
+            await consumer.close();
+          }
+        },
+      });
+      const terminalRuntimeOptions = {
+        registry: workspaceRegistry,
+        sessionRuntimeRegistry,
+        tmuxAuthority: {
+          executablePath: tmuxAuthority.executablePath,
+          socketSelector: tmuxAuthority.socketSelector,
+          trustedCwd: dir,
+        },
+        agentStatusProbeFactory: ({ run }) => createTmuxAgentStatusProbe({ run }),
+        onInventory: (snapshot) => workspaceMultiplexer.adoptPaneInventory(snapshot.panes),
+        onSessionInventory: (sessionName, snapshot) =>
+          workspaceMultiplexer.adoptSessionPaneInventory(sessionName, snapshot?.panes ?? []),
+        ...(runtimeObservability ? { observability: runtimeObservability } : {}),
+      } satisfies ConstructorParameters<typeof WorkspaceTerminalInventoryRuntime>[0];
+      terminalInventoryRuntime = new WorkspaceTerminalInventoryRuntime(terminalRuntimeOptions);
+      // Reconcile only cryptographically marked legacy view sessions before
+      // publishing this daemon generation. This neutral cleanup does not
+      // construct PTYs, attachment leases, or admission.
+      await terminalInventoryRuntime.whenReady();
+      const getTerminalAttachmentRuntime = (): NativeTerminalAttachmentRuntime => {
+        if (terminalAttachmentRuntime) return terminalAttachmentRuntime;
+        terminalAttachmentRuntime = createNativeTerminalAttachmentRuntime({
+          daemonInstanceId: instanceId,
+          webSocketUrl: terminalAttachmentWebSocketUrl(bindHostname, port),
+          ...terminalRuntimeOptions,
+          inventoryRuntime: terminalInventoryRuntime!,
+        });
+        void terminalAttachmentRuntime.whenReady().catch(() => undefined);
+        return terminalAttachmentRuntime;
+      };
+      const peekTerminalAttachmentRuntime = (): NativeTerminalAttachmentRuntime | null =>
+        terminalAttachmentRuntime;
+      paneStreamRuntime = createPaneStreamRuntime({
+        daemonInstanceId: instanceId,
+        webSocketUrl: paneStreamWebSocketUrl(bindHostname, port),
+        sessionRuntimeRegistry,
+        semanticPaneCatalog: terminalInventoryRuntime.semanticPaneCatalog,
+        ...(runtimeObservability ? { observability: runtimeObservability } : {}),
+      });
+      const orderedMultiplexerBackend = createSessionRuntimeMultiplexerBackend({
+        registry: sessionRuntimeRegistry,
+        resolveSession: (workspaceName) =>
+          workspaceRegistry.get(workspaceName)?.sessionName ?? null,
+        resolvePaneSourceCredential: (credential, resolvedSession, claimedSource) =>
+          paneSourceCredentials.resolve(credential, resolvedSession, claimedSource),
+      });
+      await externalInteractionObserver.start();
+      setFleetFactsTmuxRunner(catalogTmuxRunner);
+      startedServer = await startHttpServer({
         sessionName,
-        projectDir: dir,
+        requestedPort: port,
+        bindHostname,
+        dir,
+        authToken,
+        localBypassToken,
+        silent: opts.silent,
+        readProjectAuth: !sessionless,
+        daemonIdentity: { productVersion, instanceId, startedAt, environmentId },
+        workspacePaneCreationBackend: workspacePaneCreation,
+        workspaceOpenBackend: workspaceOpen,
+        workspaceOpenHandoffBackend: workspaceOpenHandoff,
+        fleetLifecycleBackend: fleetLifecycle,
+        workspacePromotionBackend: workspacePromotion,
+        appWindowMutationBackend: appWindowMutation,
+        workspaceMultiplexerBackend: orderedMultiplexerBackend,
+        workspaceRegistry,
+        terminalInventoryRuntime,
+        getTerminalAttachmentRuntime,
+        peekTerminalAttachmentRuntime,
+        paneStreamRuntime,
+        catalogLiveSessions: () => discoverLiveSessionSummaries(catalogTmuxRunner),
+        catalogFleet: () => readAdoptedFleet(workspaceRegistry, catalogTmuxRunner),
       });
-    } catch {
-      // Already added or persistence failed; non-fatal.
+    } catch (error) {
+      setFleetFactsTmuxRunner(null);
+      await Promise.allSettled([
+        Promise.resolve().then(() => terminalAttachmentRuntime?.dispose()),
+        Promise.resolve().then(() => terminalInventoryRuntime?.dispose()),
+        paneStreamRuntime?.dispose() ?? Promise.resolve(),
+        workspacePaneCreation.dispose(),
+        workspaceOpen.dispose(),
+        Promise.resolve().then(() => workspaceOpenHandoff?.dispose()),
+        workspacePromotion.dispose(),
+        appWindowMutation.dispose(),
+        workspaceMultiplexer.dispose(),
+        externalInteractionObserver.dispose(),
+        closeRuntimeTraceStream(),
+      ]);
+      // The pane-stream coordinator may still hold runtime consumers while it
+      // drains. Preserve the normal shutdown order on startup rollback too:
+      // transports first, then the one session/control authority.
+      await Promise.allSettled([sessionRuntimeRegistry?.dispose() ?? Promise.resolve()]);
+      throw error;
+    }
+    const {
+      server,
+      sockets,
+      closeClients,
+      closeWsServers,
+      terminalAttachmentBoundary,
+      paneStreamBoundary,
+    } = startedServer;
+    const retirePaneStreamTransport = async (): Promise<readonly unknown[]> => {
+      const transportResults = await Promise.allSettled([
+        Promise.resolve().then(() => paneStreamRuntime!.dispose()),
+        Promise.resolve().then(() => paneStreamBoundary.close()),
+      ]);
+      const runtimeResults = await Promise.allSettled([
+        Promise.resolve().then(() => sessionRuntimeRegistry!.dispose()),
+      ]);
+      return [...transportResults, ...runtimeResults].flatMap((result) =>
+        result.status === "rejected" ? [result.reason] : [],
+      );
+    };
+    const abortStartedServer = async (): Promise<void> => {
+      setFleetFactsTmuxRunner(null);
+      const terminalFailures = [
+        ...(await retireTerminalAttachmentTransport(
+          terminalAttachmentRuntime,
+          terminalAttachmentBoundary,
+        )),
+        ...(await retirePaneStreamTransport()),
+      ];
+      terminalInventoryRuntime.dispose();
+      const paneDisposal = Promise.resolve().then(() => workspacePaneCreation.dispose());
+      const workspaceOpenDisposal = Promise.resolve().then(() => workspaceOpen.dispose());
+      const workspaceOpenHandoffDisposal = Promise.resolve().then(() =>
+        workspaceOpenHandoff?.dispose(),
+      );
+      const workspacePromotionDisposal = Promise.resolve().then(() => workspacePromotion.dispose());
+      const appWindowMutationDisposal = Promise.resolve().then(() => appWindowMutation.dispose());
+      const workspaceMultiplexerDisposal = Promise.resolve().then(() =>
+        workspaceMultiplexer.dispose(),
+      );
+      const externalInteractionDisposal = Promise.resolve().then(() =>
+        externalInteractionObserver.dispose(),
+      );
+      const closePromise = Promise.resolve()
+        .then(() => waitForServerClose(server))
+        .catch(() => undefined);
+      await Promise.allSettled([
+        paneDisposal,
+        workspaceOpenDisposal,
+        workspaceOpenHandoffDisposal,
+        workspacePromotionDisposal,
+        appWindowMutationDisposal,
+        workspaceMultiplexerDisposal,
+        externalInteractionDisposal,
+        closeRuntimeTraceStream(),
+        Promise.resolve().then(() => closeClients()),
+        ...[...sockets].map((socket) => Promise.resolve().then(() => socket.destroy())),
+        Promise.race([closePromise, delay(100)]),
+        Promise.resolve().then(() => closeWsServers()),
+      ]);
+      if (terminalFailures.length > 0 && !opts.silent) {
+        console.error("[daemon] Direct terminal startup rollback reported cleanup failures.");
+      }
+    };
+    try {
+      writeCanonicalDaemonInfo(
+        {
+          pid: process.pid,
+          port,
+          protocolVersion: DAEMON_WIRE_PROTOCOL_VERSION,
+          productVersion,
+          instanceId,
+          startedAt,
+          environmentId,
+          bindHostname,
+          authToken: localBypassToken,
+        },
+        claim,
+      );
+      const published = inspectCanonicalDaemonInfo();
+      if (
+        published.status !== "valid" ||
+        published.info.instanceId !== instanceId ||
+        published.info.pid !== process.pid ||
+        published.info.port !== port
+      ) {
+        throw new DaemonStartupError(
+          "Canonical daemon publication does not belong to the started server",
+          "canonical_publication_lost",
+        );
+      }
+    } catch (error) {
+      await abortStartedServer();
+      throw error;
     }
-  }
-  const { server, sockets, closeClients, closeWsServers } = await startHttpServer({
-    sessionName,
-    requestedPort: port,
-    bindHostname,
-    dir,
-    authToken,
-    localBypassToken,
-    silent: opts.silent,
-  });
-  const pkg = requireFromHere("../../package.json") as { version?: string };
-  writeCanonicalDaemonInfo({
-    pid: process.pid,
-    port,
-    version: pkg.version ?? "0.0.0",
-    startedAt: new Date().toISOString(),
-    bindHostname,
-    authToken,
-  });
 
-  let lastState = "";
-  let stopped = false;
-  let stopping: Promise<void> | null = null;
-  let stopSelf: (() => void) | null = null;
-  const activeProjectStops = new Map<string, { stop: () => void }>();
+    let stopped = false;
+    let stopping: Promise<void> | null = null;
+    let stopSelf: (() => void) | null = null;
+    const activeProjectStops = new Map<string, { stop: () => void }>();
 
-  // Track active projects so the session-control surface can open/close
-  // them. Orchestration moved out of tmux-ide (agent coordination lives in
-  // sfora.ai), so activation is now bookkeeping only.
-  const activateProjectOnDaemon = async (
-    projectName: string,
-    _options: ProjectActivationOptions = {},
-  ): Promise<{ stop: () => Promise<void> }> => {
-    if (!activeProjectStops.has(projectName)) {
-      activeProjectStops.set(projectName, { stop: () => undefined });
-    }
-    return {
-      stop: async () => {
-        const current = activeProjectStops.get(projectName);
-        if (!current) return;
-        activeProjectStops.delete(projectName);
-        current.stop();
-      },
+    // Track active projects so the session-control surface can open/close
+    // them. Orchestration moved out of tmux-ide (agent coordination lives in
+    // sfora.ai), so activation is now bookkeeping only.
+    const activateProjectOnDaemon = async (
+      projectName: string,
+      _options: ProjectActivationOptions = {},
+    ): Promise<{ stop: () => Promise<void> }> => {
+      if (!activeProjectStops.has(projectName)) {
+        activeProjectStops.set(projectName, { stop: () => undefined });
+      }
+      return {
+        stop: async () => {
+          const current = activeProjectStops.get(projectName);
+          if (!current) return;
+          activeProjectStops.delete(projectName);
+          current.stop();
+        },
+      };
     };
-  };
 
-  setActivationBackend({
-    activateProject: async (name, options) => {
-      await activateProjectOnDaemon(name, options);
-    },
-    deactivateProject: async (name) => {
-      const stop = activeProjectStops.get(name);
-      if (!stop) return;
-      activeProjectStops.delete(name);
-      stop.stop();
-    },
-  });
+    setActivationBackend({
+      activateProject: async (name, options) => {
+        await activateProjectOnDaemon(name, options);
+      },
+      deactivateProject: async (name) => {
+        const stop = activeProjectStops.get(name);
+        if (!stop) return;
+        activeProjectStops.delete(name);
+        stop.stop();
+      },
+    });
 
-  const tick = (): void => {
-    if (sessionless) return;
-    const session = sessionExists(sessionName);
-    if (session === "no") {
-      stopSelf?.();
-      return;
-    }
-    if (session === "unknown") {
-      // Transient spawn failure — skip this tick rather than self-destruct.
-      return;
-    }
-    if (!hasClients()) return;
-
-    const panes = listPanes(sessionName);
-    if (panes.length === 0) return;
-
-    const portPanes = computePortPanes(panes);
-    const agentStates = computeAgentStates(panes);
-    const stateKey = panes
-      .map((pane) => {
-        const portState = portPanes.has(pane.id) ? "1" : "0";
-        const agent = agentStates.get(pane.id) ?? "-";
-        const titleDrift = pane.name && pane.title !== pane.name ? "d" : "ok";
-        return `${pane.id}:${portState}:${agent}:${titleDrift}`;
-      })
-      .join("|");
-
-    if (stateKey === lastState) return;
-
-    for (const pane of panes) {
-      const hasPort = portPanes.has(pane.id) ? "1" : "0";
-      const agent = agentStates.get(pane.id);
-      tmuxSilent("set-option", "-pqt", pane.id, "@has_port", hasPort);
-      tmuxSilent("set-option", "-pqt", pane.id, "@agent_busy", agent === "busy" ? "1" : "0");
-      tmuxSilent("set-option", "-pqt", pane.id, "@agent_idle", agent === "idle" ? "1" : "0");
-      if (pane.name && pane.title !== pane.name) {
-        tmuxSilent("select-pane", "-t", pane.id, "-T", pane.name);
-      }
-    }
+    const sessionMonitor = sessionless
+      ? null
+      : new DaemonSessionMonitor({
+          sessionName,
+          backend: {
+            inspectSession: async (candidate, signal) => {
+              try {
+                await execTmuxAsync(["has-session", "-t", candidate], signal);
+                return "yes";
+              } catch (error) {
+                if (signal.aborted) return "unknown";
+                return classifySessionInspectionError(error);
+              }
+            },
+            listCredentialSessions: () =>
+              workspaceRegistry.list().map((workspace) => workspace.sessionName),
+            reconcileCredentials: async (workspaceSession, signal) => {
+              try {
+                await paneSourceCredentials.reconcileSessionAsync(workspaceSession, signal);
+              } catch (error) {
+                // Registry/session races are idempotent; transport/resource
+                // failures must escape so this state is retried next cycle.
+                if (!isConfirmedMissingTmuxTarget(error)) throw error;
+              }
+            },
+            hasClients: async (signal) => {
+              try {
+                return (await execTmuxAsync(["list-clients"], signal)).length > 0;
+              } catch {
+                return null;
+              }
+            },
+            listPanes: async (candidate, signal) => {
+              try {
+                const raw = await execTmuxAsync(
+                  [
+                    "list-panes",
+                    "-t",
+                    candidate,
+                    "-F",
+                    "#{pane_id}\t#{pane_pid}\t#{pane_current_command}\t#{pane_title}\t#{@ide_role}\t#{@ide_type}\t#{@ide_name}",
+                  ],
+                  signal,
+                );
+                return parseDaemonMonitorPanes(raw);
+              } catch {
+                return null;
+              }
+            },
+            readPortProcessFacts: async (signal) => {
+              try {
+                return await readPortProcessFactsAsync(signal);
+              } catch {
+                return null;
+              }
+            },
+            setPaneOption: async (paneId, option, value, signal) => {
+              try {
+                await execTmuxAsync(["set-option", "-pt", paneId, option, value], signal);
+              } catch (error) {
+                if (!isConfirmedMissingTmuxTarget(error)) throw error;
+              }
+            },
+            setPaneTitle: async (paneId, title, signal) => {
+              try {
+                await execTmuxAsync(["select-pane", "-t", paneId, "-T", title], signal);
+              } catch (error) {
+                if (!isConfirmedMissingTmuxTarget(error)) throw error;
+              }
+            },
+            refreshClients: async (signal) => {
+              try {
+                await execTmuxAsync(["refresh-client", "-S"], signal);
+              } catch (error) {
+                if (!isConfirmedMissingTmuxTarget(error)) throw error;
+              }
+            },
+            onSessionGone: () => stopSelf?.(),
+          },
+        });
+    sessionMonitor?.start();
 
-    tmuxSilent("refresh-client", "-S");
-    lastState = stateKey;
-  };
+    const apiBaseUrl = canonicalDaemonUrl("http", bindHostname, port);
+    const wsUrl = canonicalDaemonUrl("ws", bindHostname, port, "/ws/events");
 
-  const monitorInterval = setInterval(tick, MONITOR_INTERVAL_MS);
+    const handle: EmbeddedDaemonHandle = {
+      instanceId,
+      pid: process.pid,
+      port,
+      apiBaseUrl,
+      wsUrl,
+      localBypassToken,
+      compatibilityTerminalAttachmentRuntimeConstructed: () => terminalAttachmentRuntime !== null,
+      stop: async ({ gracefulMs = DEFAULT_GRACEFUL_MS } = {}) => {
+        if (stopping) return stopping;
+        if (stopped) return;
+        stopping = (async () => {
+          const failures: unknown[] = [];
+          const capture = async (operation: () => void | Promise<void>): Promise<void> => {
+            try {
+              await operation();
+            } catch (error) {
+              failures.push(error);
+            }
+          };
+          try {
+            stopped = true;
+            await capture(() => setActivationBackend(null));
+            await capture(() => sessionMonitor?.stop());
+            paneSourceCredentials.dispose();
 
-  const apiBaseUrl = `http://${bindHostname}:${port}`;
-  const wsUrl = `ws://${bindHostname}:${port}/ws/events`;
+            // Retire direct-ticket admission, live PTYs, and the direct upgrade
+            // listener before touching the legacy WS or HTTP surfaces.
+            failures.push(
+              ...(await retireTerminalAttachmentTransport(
+                terminalAttachmentRuntime,
+                terminalAttachmentBoundary,
+              )),
+            );
+            failures.push(...(await retirePaneStreamTransport()));
+            await capture(() => terminalInventoryRuntime.dispose());
+            await capture(() => workspacePaneCreation.dispose());
+            await capture(() => workspaceOpen.dispose());
+            await capture(() => workspaceOpenHandoff?.dispose());
+            await capture(() => workspacePromotion.dispose());
+            await capture(() => appWindowMutation.dispose());
+            await capture(() => workspaceMultiplexer.dispose());
+            await capture(() => externalInteractionObserver.dispose());
 
-  const handle: EmbeddedDaemonHandle = {
-    port,
-    apiBaseUrl,
-    wsUrl,
-    localBypassToken,
-    stop: async ({ gracefulMs = DEFAULT_GRACEFUL_MS } = {}) => {
-      if (stopped) return;
-      if (stopping) return stopping;
-      stopping = (async () => {
-        try {
-          stopped = true;
-          setActivationBackend(null);
-          clearInterval(monitorInterval);
-
-          const closePromise = waitForServerClose(server);
-          closeClients();
-          for (const stop of activeProjectStops.values()) {
-            stop.stop();
-          }
-          activeProjectStops.clear();
-          shutdownPtyBridges();
-          await Promise.race([closePromise, delay(gracefulMs)]);
-          for (const socket of sockets) socket.destroy();
-          await Promise.race([closePromise.catch(() => undefined), delay(100)]);
-          await closeWsServers();
-          setRemoteAccessRestartBackend(null);
-          setDaemonShutdownBackend(null);
-        } catch (err) {
-          throw new DaemonShutdownError("Daemon shutdown failed", { cause: err as Error });
-        } finally {
-          clearCanonicalDaemonInfo();
-        }
-      })();
-      return stopping;
-    },
-    activateProject: activateProjectOnDaemon,
-  };
-  setDaemonShutdownBackend(async () => {
-    await handle.stop({ gracefulMs: 500 });
-  });
-  setRemoteAccessRestartBackend((request) => {
-    setTimeout(() => {
-      void (async () => {
-        const restartPort = request.port ?? port;
-        try {
-          await handle.stop({ gracefulMs: 500 });
-        } catch (err) {
-          console.error("[daemon] Remote access stop before restart failed:", err);
-        } finally {
-          clearCanonicalDaemonInfo();
-        }
+            let closePromise: Promise<void>;
+            try {
+              closePromise = waitForServerClose(server);
+            } catch (error) {
+              failures.push(error);
+              closePromise = Promise.resolve();
+            }
+            await capture(() => closeClients());
+            for (const stop of activeProjectStops.values()) {
+              await capture(() => stop.stop());
+            }
+            activeProjectStops.clear();
+            await capture(() => shutdownPtyBridges());
+            await capture(() => Promise.race([closePromise, delay(gracefulMs)]));
+            for (const socket of sockets) {
+              await capture(() => {
+                socket.destroy();
+              });
+            }
+            await capture(() => Promise.race([closePromise, delay(100)]));
+            await capture(() => closeWsServers());
+            await capture(() => shutdownWsEventObservation());
+            await capture(() => setFleetFactsTmuxRunner(null));
+            await capture(() => closeRuntimeTraceStream());
+            await capture(() => setRemoteAccessRestartBackend(null));
+            await capture(() => setDaemonShutdownBackend(null));
 
-        for (let attempt = 0; attempt < 2; attempt++) {
+            if (failures.length > 0) {
+              const cause =
+                failures.length === 1
+                  ? failures[0]
+                  : new AggregateError(failures, "Daemon resources reported shutdown failures");
+              throw new DaemonShutdownError("Daemon shutdown failed", { cause: cause as Error });
+            }
+          } finally {
+            try {
+              clearCanonicalDaemonInfoIfOwned(instanceId, claim);
+            } finally {
+              releaseCanonicalDaemonClaim(claim);
+            }
+          }
+        })();
+        return stopping;
+      },
+      activateProject: activateProjectOnDaemon,
+    };
+    setDaemonShutdownBackend(async () => {
+      await handle.stop({ gracefulMs: 500 });
+    }, instanceId);
+    setRemoteAccessRestartBackend((request) => {
+      setTimeout(() => {
+        void (async () => {
+          const restartPort = request.port ?? port;
           try {
-            const nextHandle = await startEmbeddedDaemon({
-              sessionName: sessionless ? undefined : sessionName,
-              port: restartPort,
-              bindHostname: request.bindHostname,
-              authToken: request.token,
-              localBypassToken,
-            });
-            const mutableHandle = handle as {
-              stop: EmbeddedDaemonHandle["stop"];
-              activateProject: EmbeddedDaemonHandle["activateProject"];
-            };
-            mutableHandle.stop = nextHandle.stop;
-            mutableHandle.activateProject = nextHandle.activateProject;
-            return;
+            await handle.stop({ gracefulMs: 500 });
           } catch (err) {
-            if (
-              err instanceof DaemonStartupError &&
-              err.reason === "port_in_use" &&
-              attempt === 0
-            ) {
-              await delay(150);
-              continue;
+            console.error("[daemon] Remote access stop before restart failed:", err);
+          }
+
+          for (let attempt = 0; attempt < 2; attempt++) {
+            try {
+              const nextHandle = await startEmbeddedDaemon({
+                sessionName: sessionless ? undefined : sessionName,
+                port: restartPort,
+                bindHostname: request.bindHostname,
+                authToken: request.token,
+                localBypassToken,
+              });
+              const mutableHandle = handle as {
+                stop: EmbeddedDaemonHandle["stop"];
+                activateProject: EmbeddedDaemonHandle["activateProject"];
+              };
+              mutableHandle.stop = nextHandle.stop;
+              mutableHandle.activateProject = nextHandle.activateProject;
+              return;
+            } catch (err) {
+              if (
+                err instanceof DaemonStartupError &&
+                err.reason === "port_in_use" &&
+                attempt === 0
+              ) {
+                await delay(150);
+                continue;
+              }
+              throw err;
             }
-            throw err;
           }
-        }
-      })().catch((err) => {
-        console.error("[daemon] Remote access restart failed:", err);
-        clearCanonicalDaemonInfo();
-      });
-    }, 50).unref?.();
-    return { port };
-  });
-  stopSelf = () => void handle.stop();
-  tick();
+        })().catch((err) => {
+          console.error("[daemon] Remote access restart failed:", err);
+        });
+      }, 50).unref?.();
+      return { port };
+    });
+    stopSelf = () => void handle.stop();
+    void sessionMonitor?.runOnce();
 
-  return handle;
+    return handle;
+  } catch (error) {
+    releaseCanonicalDaemonClaim(claim);
+    throw error;
+  }
 }