tmux-ide 2.9.0-beta.9 → 2.9.3

package/packages/daemon/dist/lib/daemon-embed.js

@@ -6,6 +6,26 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
+import { requireSupportedTmuxVersion } from "./tmux-version.js";
+import { join } from "node:path";
+import { createClaudeTeamMembershipReader } from "../terminal/attachments/claude-team-names.js";
+import { PaneSourceDiscovery } from "./pane-source-discovery.js";
+import { createBackgroundNativeCapture } from "./background-native-capture.js";
+import { createOwnedViewerAdapterFactory } from "./owned-viewer-factory.js";
+import { publishOwnerInteractionReceipt } from "./interaction-receipt-publication.js";
+import { createAuthoredNativeCommandRunner } from "./authored-native-command-runner.js";
+import { AuthoredNativeReceiptEnricher } from "./authored-native-receipt-staging.js";
+import { OwnerInteractionObservation, nativeInteractionObservationRequested, } from "./owner-interaction-observation.js";
+import { createNativeTmuxSessionCreator } from "./tmux-server-session-create.js";
+import { createTmuxSessionMutationFence } from "./tmux-session-mutation-fence.js";
+import { createNativeTmuxSessionOpener } from "./tmux-server-session-open.js";
+import { createServerGenerationFencedTmuxRunner, createServerGenerationFencedTmuxAsyncRunner, } from "./tmux-server-generation-runner.js";
+import { createNativeTmuxServerCatalog } from "./tmux-server-owner.js";
+import { createEmbeddedTmuxServerOwners } from "./embedded-tmux-server-owners.js";
+import { captureTmuxServerProofAsync, captureTmuxServerProof, captureUnboundTmuxSelectorProof, } from "./tmux-server-proof.js";
+import { assertCanonicalDaemonServerIntent } from "./canonical-daemon-bootstrap.js";
+import { runtimeTmuxArgs, resolveTmuxServerIntent, resolveRuntimeNamespace, } from "./runtime-namespace.js";
+import { createFleetPreviewCapture } from "../command-center/resources/fleet-preview-route.js";
 import { mountTerminalNativeBackingRoute } from "../command-center/resources/terminal-native-backing-route.js";
 import { startOwnedEmbeddedDaemon } from "./embedded-daemon-lifecycle.js";
 /**
@@ -26,12 +46,12 @@ import { createTmuxAuthorityReplacementProbe } from "./tmux-authority-replacemen
 import { createNamedSocketFence } from "./tmux-named-socket-fence.js";
 import { fleetSessionIdForName } from "../command-center/resources/fleet-catalog.js";
 import { DAEMON_WIRE_PROTOCOL_VERSION, DaemonInstanceIdentitySchemaZ, PANE_STREAM_REDEEM_PATH, PaneStreamLoopbackWebSocketUrlSchemaZ, TERMINAL_ATTACHMENT_REDEEM_PATH, TerminalAttachmentLoopbackWebSocketUrlSchemaZ, } from "@tmux-ide/contracts";
-import { classifySessionInspectionError, DaemonSessionMonitor, execTmuxAsync, isConfirmedMissingTmuxTarget, parseDaemonMonitorPanes, readPortProcessFactsAsync, } from "./daemon-session-monitor.js";
+import { classifySessionInspectionError, DaemonSessionMonitor, isConfirmedMissingTmuxTarget, parseDaemonMonitorPanes, readPortProcessFactsAsync, } from "./daemon-session-monitor.js";
 import { DaemonShutdownError, DaemonStartupError } from "./errors.js";
 import { handlePtyWebSocket, shutdownPtyBridges } from "../server/ws-route.js";
 import { broadcastInteractionReceipt, broadcastResourceChanged, handleWsEventsConnection, setFleetFactsObserverDiagnostics, setFleetFactsTmuxRunner, shutdownWsEventObservation, } from "../command-center/ws-events.js";
-import { setRemoteAccessRestartBackend, } from "../command-center/actions/handlers/app-set-remote-access.js";
-import { setDaemonShutdownBackend } from "../command-center/actions/handlers/daemon-shutdown.js";
+import { setRemoteAccessRestartBackend } from "../command-center/actions/handlers/app-set-remote-access.js";
+import { setDaemonShutdownBackend, setDaemonRestartBackend, } from "../command-center/actions/handlers/daemon-shutdown.js";
 import { readAppSettings } from "./app-settings.js";
 import { getDefaultWorkspaceRegistry, readWorkspaceRegistrySessionInventory, WORKSPACE_REGISTRY_TMUX_TIMEOUT_MS, } from "./workspace-registry.js";
 import { createPinnedWorkspaceTmuxRunner, createPinnedWorkspaceTmuxAsyncRunner, resolveWorkspacePaneTmuxAuthority, WorkspacePaneCreationAuthority, } from "./workspace-pane-creation.js";
@@ -43,6 +63,10 @@ import { FleetLifecycleAuthority } from "./fleet-lifecycle-authority.js";
 import { AppWindowMutationAuthority } from "./app-window-mutation.js";
 import { WorkspaceMultiplexerAuthority } from "./workspace-multiplexer-verbs.js";
 import { TmuxExternalInteractionObserver } from "./tmux-external-interaction-observer.js";
+import { createTmuxInteractionObservationHandler, externalTmuxInteractionDraft, } from "./tmux-interaction-observation-handler.js";
+import { InteractionReceiptJournal } from "./interaction-receipt-journal.js";
+import { InteractionObservationStatusStore } from "./interaction-observation-status.js";
+import { InteractionEvidenceAuthority } from "./interaction-evidence-authority.js";
 import { createNativeTerminalAttachmentRuntime, WorkspaceTerminalInventoryRuntime, } from "../terminal/attachments/native-runtime.js";
 import { createTmuxAgentStatusProbe } from "../terminal/attachments/agent-status-probe.js";
 import { attachTerminalAttachmentWebSocket, } from "../server/terminal-attachment-upgrade.js";
@@ -54,7 +78,9 @@ import { createSessionRuntimeMultiplexerBackend } from "../terminal/session-runt
 import { PaneSourceCredentialAuthority, reconcilePaneSourceCredentialsAtStartup, } from "./pane-source-credentials.js";
 import { setActivationBackend } from "./active-projects.js";
 import { readOrMintEnvironmentId } from "./environment-identity.js";
-import { canonicalDaemonUrl, clearCanonicalDaemonInfoIfOwned, clearCanonicalDaemonInfoIfUnchanged, inspectCanonicalDaemonInfo, isCanonicalDaemonAlive, isCanonicalDaemonRecordOwnerProvenDead, probeCanonicalDaemonHealth, probeCanonicalDaemonIdentity, releaseCanonicalDaemonClaim, tryAcquireCanonicalDaemonClaim, writeCanonicalDaemonInfo, } from "./canonical-daemon.js";
+import { captureDaemonProvenance } from "./daemon-provenance.js";
+import { registerLogSecret, setLogIdentity } from "./log.js";
+import { canonicalDaemonUrl, clearCanonicalDaemonInfoIfOwned, clearCanonicalDaemonInfoIfUnchanged, inspectCanonicalDaemonInfo, isCanonicalDaemonAlive, isCanonicalDaemonRecordOwnerProvenDead, probeCanonicalDaemonHealth, probeCanonicalDaemonIdentity, releaseCanonicalDaemonClaim, tryAcquireCanonicalDaemonClaim, writeCanonicalDaemonInfo, matchesCanonicalDaemonPredecessor, } from "./canonical-daemon.js";
 const requireFromHere = createRequire(import.meta.url);
 const DEFAULT_HOSTNAME = "127.0.0.1";
 const DEFAULT_GRACEFUL_MS = 2000;
@@ -86,7 +112,7 @@ export function resolveDaemonProductVersion(explicit, loadPackage = loadBundledP
     return "0.0.0";
 }
 function tmux(...args) {
-    return execFileSync("tmux", args, {
+    return execFileSync("tmux", runtimeTmuxArgs(args), {
         encoding: "utf-8",
         // Pipe stdio explicitly. Inheriting (the default) inherits the parent's
         // file descriptors; when the daemon is launched detached (nohup, disown,
@@ -97,14 +123,6 @@ function tmux(...args) {
         timeout: 2_000,
     }).trim();
 }
-function tmuxSilent(...args) {
-    try {
-        return tmux(...args);
-    }
-    catch {
-        return "";
-    }
-}
 function assertTmuxSession(sessionName, runTmux = (args) => tmux(...args)) {
     try {
         runTmux(["has-session", "-t", sessionName]);
@@ -349,7 +367,9 @@ function sameCanonicalInstance(left, right) {
         left.startedAt === right.startedAt &&
         left.bindHostname === right.bindHostname);
 }
-async function requestValidatedDaemonShutdown(info, deadline) {
+async function requestValidatedDaemonShutdown(info, deadline, intent) {
+    if (info.supervisionId)
+        throw new DaemonStartupError("A supervised daemon cannot be taken over", "canonical_takeover_refused");
     const identity = await probeCanonicalDaemonIdentity(info, deadline.signal);
     assertTakeoverDeadline(deadline, "Canonical daemon did not answer the takeover request before the takeover deadline");
     if (!identity ||
@@ -360,6 +380,8 @@ async function requestValidatedDaemonShutdown(info, deadline) {
         identity.startedAt !== info.startedAt) {
         throw new DaemonStartupError("Canonical daemon identity changed before takeover", "canonical_takeover_identity_mismatch");
     }
+    await assertCanonicalDaemonServerIntent(info, intent);
+    assertTakeoverDeadline(deadline, "Tmux server intent proof exceeded the takeover deadline");
     const health = await probeCanonicalDaemonHealth(info, deadline.signal);
     assertTakeoverDeadline(deadline, "Canonical daemon did not answer the takeover request before the takeover deadline");
     if (!health ||
@@ -368,7 +390,9 @@ async function requestValidatedDaemonShutdown(info, deadline) {
         throw new DaemonStartupError("Canonical daemon protocol or health is incompatible with takeover", "canonical_takeover_refused");
     }
     const current = inspectCanonicalDaemonInfo();
-    if (current.status !== "valid" || !sameCanonicalInstance(current.info, info)) {
+    if (current.status !== "valid" ||
+        current.info.supervisionId ||
+        !sameCanonicalInstance(current.info, info)) {
         throw new DaemonStartupError("Canonical daemon generation changed before takeover", "canonical_takeover_identity_mismatch");
     }
     const headers = { "Content-Type": "application/json" };
@@ -440,8 +464,8 @@ async function acquireCanonicalDaemonClaimAfterTakeover(info, deadline) {
     }
     throwTakeoverTimeout("Canonical daemon did not release its startup claim after accepting takeover");
 }
-function acquireCanonicalDaemonClaim() {
-    const attempt = tryAcquireCanonicalDaemonClaim();
+function acquireCanonicalDaemonClaim(intent = { kind: "ordinary" }) {
+    const attempt = tryAcquireCanonicalDaemonClaim(intent);
     if (attempt.status === "busy") {
         throw new DaemonStartupError(`Canonical daemon startup is owned by PID ${attempt.owner.pid}`, "canonical_claim_busy");
     }
@@ -463,7 +487,7 @@ function closeWsGoingAway(ws) {
     }
     ws.close(1001, reason);
 }
-async function startHttpServer({ sessionName, requestedPort, bindHostname, dir, authToken, localBypassToken, silent, readProjectAuth, daemonIdentity, workspacePaneCreationBackend, workspaceOpenBackend, workspaceOpenHandoffBackend, fleetLifecycleBackend, workspacePromotionBackend, appWindowMutationBackend, workspaceMultiplexerBackend, workspaceRegistry, terminalInventoryRuntime, getTerminalAttachmentRuntime, peekTerminalAttachmentRuntime, paneStreamRuntime, catalogLiveSessions, catalogFleet, sessionRuntimeRegistry, }) {
+async function startHttpServer({ sessionName, requestedPort, bindHostname, dir, authToken, localBypassToken, silent, readProjectAuth, tmuxServerProof, daemonIdentity, workspacePaneCreationBackend, workspaceOpenBackend, workspaceOpenHandoffBackend, fleetLifecycleBackend, workspacePromotionBackend, appWindowMutationBackend, workspaceMultiplexerBackend, workspaceRegistry, terminalInventoryRuntime, getTerminalAttachmentRuntime, peekTerminalAttachmentRuntime, paneStreamRuntime, catalogLiveSessions, catalogFleet, fleetPreviewCapture, sessionRuntimeRegistry, serverOwners, }) {
     const { createApp } = await import("../command-center/server.js");
     const { getRequestListener } = await import(__rewriteRelativeImportExtension(requireFromHere.resolve("@hono/node-server"), true));
     const { AuthService } = await import("./auth/auth-service.js");
@@ -482,6 +506,7 @@ async function startHttpServer({ sessionName, requestedPort, bindHostname, dir,
     }
     const authService = new AuthService(authConfig.secret);
     const app = createApp({
+        tmuxServerOwners: serverOwners.owners,
         authService,
         authConfig,
         remoteAccess: {
@@ -491,6 +516,7 @@ async function startHttpServer({ sessionName, requestedPort, bindHostname, dir,
             ownerToken: localBypassToken ?? null,
         },
         daemonIdentity,
+        tmuxServerProof,
         workspacePaneCreationBackend,
         workspaceOpenBackend,
         workspaceOpenHandoffBackend,
@@ -511,12 +537,13 @@ async function startHttpServer({ sessionName, requestedPort, bindHostname, dir,
         startupReadinessAttachmentBackend: terminalInventoryRuntime,
         catalogLiveSessions,
         catalogFleet,
+        fleetPreviewCapture,
     });
     mountTerminalNativeBackingRoute(app, {
         ownerToken: localBypassToken ?? null,
         generation: daemonIdentity.instanceId,
         resolveSession: (workspace) => workspaceRegistry.get(workspace)?.sessionName ?? null,
-        capture: (session, pane) => sessionRuntimeRegistry.captureNativeBacking(session, pane),
+        capture: (session, pane, expected) => sessionRuntimeRegistry.captureNativeBacking(session, pane, expected),
     });
     app.get("/api/daemon/health", (c) => {
         return c.json({
@@ -549,7 +576,8 @@ async function startHttpServer({ sessionName, requestedPort, bindHostname, dir,
     });
     const terminalAttachmentBoundary = attachTerminalAttachmentWebSocket(server, (create) => (create ? getTerminalAttachmentRuntime() : peekTerminalAttachmentRuntime())?.admission ??
         null);
-    const paneStreamBoundary = attachPaneStreamWebSocket(server, paneStreamRuntime.coordinator);
+    const paneStreamBoundary = attachPaneStreamWebSocket(server, paneStreamRuntime.coordinator, PANE_STREAM_REDEEM_PATH, () => serverOwners.isDefaultCurrent());
+    serverOwners.attach(server);
     try {
         await new Promise((resolve, reject) => {
             const onError = (err) => {
@@ -596,11 +624,14 @@ async function startHttpServer({ sessionName, requestedPort, bindHostname, dir,
     };
 }
 export async function startEmbeddedDaemon(opts) {
+    if (opts.supervisionId && !opts.requestRestart)
+        throw new DaemonStartupError("Supervised startup requires the foreground lifecycle owner", "canonical_record_invalid");
     return opts.requestRestart
         ? startEmbeddedDaemonGeneration(opts)
         : startOwnedEmbeddedDaemon(opts, startEmbeddedDaemonGeneration);
 }
 async function startEmbeddedDaemonGeneration(opts) {
+    const tmuxServerIntent = resolveTmuxServerIntent();
     const sessionName = opts.sessionName ?? EMBEDDED_SESSION_NAME;
     const sessionless = opts.sessionName == null;
     const appSettings = readAppSettings();
@@ -615,13 +646,26 @@ async function startEmbeddedDaemonGeneration(opts) {
         ? (opts.authToken ?? null)
         : (persistedRemoteAccess?.token ?? null);
     const localBypassToken = opts.localBypassToken ?? generateLocalBypassToken();
+    const claimIntent = opts.supervisionId
+        ? { kind: "supervised", supervisionId: opts.supervisionId, predecessor: opts.predecessor }
+        : { kind: "ordinary" };
+    if (opts.supervisionId) {
+        const reserved = inspectCanonicalDaemonInfo();
+        const binding = reserved.status === "reserved"
+            ? reserved.reservation.supervisionId
+            : reserved.status === "valid"
+                ? reserved.info.supervisionId
+                : undefined;
+        if (binding !== opts.supervisionId)
+            throw new DaemonStartupError("Matching supervisor reservation is required", "canonical_record_invalid");
+    }
     let claim;
     if (opts.takeoverIfRunning) {
         const state = inspectCanonicalDaemonInfo();
         if (state.status === "valid" && (await isCanonicalDaemonAlive(state.info))) {
             const takeoverDeadline = createTakeoverDeadline(takeoverTimeoutMs());
             try {
-                await requestValidatedDaemonShutdown(state.info, takeoverDeadline);
+                await requestValidatedDaemonShutdown(state.info, takeoverDeadline, tmuxServerIntent);
                 claim = await acquireCanonicalDaemonClaimAfterTakeover(state.info, takeoverDeadline);
             }
             finally {
@@ -629,11 +673,11 @@ async function startEmbeddedDaemonGeneration(opts) {
             }
         }
         else {
-            claim = acquireCanonicalDaemonClaim();
+            claim = acquireCanonicalDaemonClaim(claimIntent);
         }
     }
     else {
-        claim = acquireCanonicalDaemonClaim();
+        claim = acquireCanonicalDaemonClaim(claimIntent);
     }
     try {
         const existingCanonical = inspectCanonicalDaemonInfo();
@@ -649,11 +693,14 @@ async function startEmbeddedDaemonGeneration(opts) {
             }
         }
         else if (existingCanonical.status === "valid") {
-            if (await isCanonicalDaemonAlive(existingCanonical.info)) {
+            if ((await isCanonicalDaemonAlive(existingCanonical.info)) &&
+                !(opts.supervisionId &&
+                    matchesCanonicalDaemonPredecessor(existingCanonical, opts.predecessor, opts.supervisionId))) {
                 throw new DaemonStartupError(`Canonical daemon is already running on port ${existingCanonical.info.port}`, "canonical_already_running");
             }
             else {
-                if (!clearCanonicalDaemonInfoIfUnchanged(existingCanonical, claim)) {
+                if (!existingCanonical.info.supervisionId &&
+                    !clearCanonicalDaemonInfoIfUnchanged(existingCanonical, claim)) {
                     throw new DaemonStartupError("Canonical daemon metadata changed while stale state was being removed", "canonical_already_running");
                 }
             }
@@ -663,8 +710,25 @@ async function startEmbeddedDaemonGeneration(opts) {
         // observe one daemon-generation authority rather than whichever server a
         // caller's ambient TMUX/PATH happens to select.
         const tmuxAuthority = resolveWorkspacePaneTmuxAuthority();
+        requireSupportedTmuxVersion(execFileSync(tmuxAuthority.executablePath, ["-V"], { encoding: "utf8", timeout: 3000 }));
+        const readTeamMemberships = createClaudeTeamMembershipReader(join(resolveRuntimeNamespace().claudeDir, "teams"));
         const catalogTmuxRunner = createPinnedWorkspaceTmuxRunner(tmuxAuthority);
-        const fleetFactsTmuxRunner = createPinnedWorkspaceTmuxAsyncRunner(tmuxAuthority);
+        const initialTmuxProof = captureTmuxServerProof(catalogTmuxRunner);
+        if (initialTmuxProof)
+            requireSupportedTmuxVersion(catalogTmuxRunner(["display-message", "-p", "#{version}"]));
+        const initialNativeIdentityParts = initialTmuxProof
+            ? catalogTmuxRunner(["display-message", "-p", "#{pid}\t#{start_time}"]).split("\t")
+            : null;
+        const initialNativeServerIdentity = initialNativeIdentityParts
+            ? { pid: initialNativeIdentityParts[0], startTime: initialNativeIdentityParts[1] }
+            : undefined;
+        const sessionMutationFence = createTmuxSessionMutationFence();
+        const nativeGenerationTmuxRunner = sessionMutationFence.wrap(initialNativeServerIdentity
+            ? createServerGenerationFencedTmuxRunner(tmuxAuthority, initialNativeServerIdentity)
+            : catalogTmuxRunner);
+        const fleetFactsTmuxRunner = initialNativeServerIdentity
+            ? createServerGenerationFencedTmuxAsyncRunner(tmuxAuthority, initialNativeServerIdentity)
+            : createPinnedWorkspaceTmuxAsyncRunner(tmuxAuthority);
         const tmuxAuthorityReplaced = createTmuxAuthorityReplacementProbe(tmuxAuthority, catalogTmuxRunner);
         const registryTmuxRunner = createPinnedWorkspaceTmuxRunner(tmuxAuthority, {
             timeoutMs: WORKSPACE_REGISTRY_TMUX_TIMEOUT_MS,
@@ -687,11 +751,14 @@ async function startEmbeddedDaemonGeneration(opts) {
         const workspaceRegistry = getDefaultWorkspaceRegistry();
         await workspaceRegistry.load(() => readWorkspaceRegistrySessionInventory(registryTmuxRunner));
         const paneSourceCredentials = new PaneSourceCredentialAuthority({
-            run: (args) => tmuxSilent(...args),
-            runAsync: (args, signal) => execTmuxAsync(args, signal),
+            run: (args) => nativeGenerationTmuxRunner(args),
+            runAsync: (args, signal) => fleetFactsTmuxRunner(args, signal),
         });
+        const sourceDiscovery = new PaneSourceDiscovery(paneSourceCredentials, () => workspaceRegistry.list());
         const legacySession = process.env.TMUX_IDE_SESSION;
-        if (legacySession && !workspaceRegistry.has(legacySession)) {
+        if (legacySession &&
+            !workspaceRegistry.has(legacySession) &&
+            !workspaceRegistry.list().some((workspace) => workspace.sessionName === legacySession)) {
             try {
                 workspaceRegistry.add({
                     name: legacySession,
@@ -710,7 +777,8 @@ async function startEmbeddedDaemonGeneration(opts) {
         // dashboard's "terminal not connecting" symptom before this fix.
         if (!sessionless &&
             sessionName !== EMBEDDED_SESSION_NAME &&
-            !workspaceRegistry.has(sessionName)) {
+            !workspaceRegistry.has(sessionName) &&
+            !workspaceRegistry.list().some((workspace) => workspace.sessionName === sessionName)) {
             try {
                 workspaceRegistry.add({
                     name: sessionName,
@@ -727,16 +795,19 @@ async function startEmbeddedDaemonGeneration(opts) {
             daemonInstanceId: instanceId,
             registry: workspaceRegistry,
             tmuxAuthority,
+            io: { runTmux: nativeGenerationTmuxRunner },
         });
         const workspaceOpen = new WorkspaceOpenAuthority({
             daemonInstanceId: instanceId,
             registry: workspaceRegistry,
             tmuxAuthority,
+            io: { runTmux: nativeGenerationTmuxRunner },
         });
         const workspacePromotion = new WorkspacePromotionAuthority({
             daemonInstanceId: instanceId,
             registry: workspaceRegistry,
             tmuxAuthority,
+            io: { runTmux: fleetFactsTmuxRunner },
         });
         if (opts.restoreTmuxWorkspaces) {
             for (const workspace of workspaceRegistry.list()) {
@@ -752,62 +823,148 @@ async function startEmbeddedDaemonGeneration(opts) {
             productVersion,
             startedAt,
             registry: workspaceRegistry,
-            runTmux: catalogTmuxRunner,
+            runTmux: nativeGenerationTmuxRunner,
             readFleet: () => readAdoptedFleet(workspaceRegistry, catalogTmuxRunner),
         });
         const appWindowMutation = new AppWindowMutationAuthority({
             daemonInstanceId: instanceId,
             registry: workspaceRegistry,
         });
+        let authoredNativeRunner = null;
         const workspaceMultiplexer = new WorkspaceMultiplexerAuthority({
             daemonInstanceId: instanceId,
             registry: workspaceRegistry,
             tmuxAuthority,
+            ...(initialTmuxProof
+                ? {
+                    io: {
+                        runTmux: nativeGenerationTmuxRunner,
+                        runAuthoredNative: (request, options) => authoredNativeRunner?.(request, options) ?? null,
+                    },
+                }
+                : {}),
+        });
+        const interactionReceipts = new InteractionReceiptJournal();
+        let interactionEvidence = null;
+        let interactionObservation = null;
+        const nativeObservationRequested = nativeInteractionObservationRequested();
+        let observationSelector = null;
+        let backgroundCapture = null;
+        let ownedViewerFactory = null;
+        const authoredReceiptEnricher = new AuthoredNativeReceiptEnricher({
+            journal: interactionReceipts,
+            publishRaw: (evidence) => interactionReceipts.appendEvidence(evidence),
+            noteGap: () => observationSelector?.noteOwnedOperationUncertainty(),
+            onFailure: () => observationSelector?.failOwnedOperationObservation(),
         });
         let sessionRuntimeRegistry = null;
         let workspaceOpenHandoff = null;
         let terminalInventoryRuntime = null;
+        let sessionMonitor = null;
         const externalInteractionObserver = new TmuxExternalInteractionObserver({
             daemonInstanceId: instanceId,
+            onAvailability: (available) => {
+                if (observationSelector)
+                    observationSelector.stockAvailable(available);
+                else
+                    interactionObservation?.setStockAvailable(available);
+            },
+            onGap: (gap) => {
+                terminalInventoryRuntime?.invalidate();
+                if (observationSelector)
+                    observationSelector.stockGap(gap.reason === "overflow"
+                        ? "retention-overflow"
+                        : gap.reason === "hooks-replaced"
+                            ? "hooks-replaced"
+                            : "uncertain-consume");
+                else
+                    interactionObservation?.noteGap(gap.reason === "overflow"
+                        ? "retention-overflow"
+                        : gap.reason === "hooks-replaced"
+                            ? "hooks-replaced"
+                            : "uncertain-consume");
+            },
             internalReadOwnerToken: localBypassToken,
+            resolveCapturedTarget: (target) => {
+                const endpoint = interactionEvidence?.captureObservedEndpoint(target);
+                return endpoint?.kind === "pane" ? endpoint : null;
+            },
+            onUnresolvedObservation: () => {
+                if (observationSelector)
+                    observationSelector.stockGap("unresolved-target", 1);
+                else
+                    interactionObservation?.noteGap("unresolved-target", 1);
+                terminalInventoryRuntime?.invalidate();
+            },
+            io: { runTmux: fleetFactsTmuxRunner },
             registry: workspaceRegistry,
             tmuxAuthority,
-            onObserved: ({ workspaceName, semanticPaneId, operationKind, operationId }) => {
-                if (operationKind !== "workspace.pane.read")
-                    terminalInventoryRuntime?.invalidate();
-                if (operationId) {
-                    const consumed = sessionRuntimeRegistry?.observeTmuxInteraction({
-                        operationId,
-                        workspaceName,
-                        semanticPaneId,
-                        operationKind,
-                    }) ?? false;
-                    if (consumed)
-                        return true;
-                }
-                try {
-                    broadcastInteractionReceipt({
-                        operationId: randomUUID(),
-                        origin: "external",
-                        workspaceName,
-                        target: { kind: "pane", semanticPaneId },
-                        operationKind,
-                        phase: "observed",
-                        summary: operationKind === "workspace.pane.read"
-                            ? { operationKind, observedOnly: true }
-                            : { operationKind, observedOnly: true },
-                        proof: { operationKind, observed: true, semanticPaneId },
-                    }, instanceId);
-                }
-                catch (error) {
+            // A gap cannot reconstruct historical interactions. Refresh inventory
+            // facts while authored operations retain their observation deadlines.
+            onObserved: createTmuxInteractionObservationHandler({
+                invalidateInventory: () => terminalInventoryRuntime?.invalidate(),
+                consumeAuthored: (observation) => sessionRuntimeRegistry?.observeTmuxInteraction({
+                    ...observation,
+                    operationId: observation.operationId,
+                }) ?? false,
+                publishExternal: (observation) => {
+                    if (observationSelector
+                        ? !observationSelector.allowStockPublication()
+                        : nativeObservationRequested)
+                        return;
+                    if (!interactionEvidence)
+                        throw new Error("Scoped interaction evidence is unavailable");
+                    const draft = externalTmuxInteractionDraft(observation, observation.capturedTarget
+                        ? interactionEvidence.captureObservedEndpoint(observation.capturedTarget)
+                        : interactionEvidence.captureUnavailableEndpoint());
+                    interactionReceipts.publish(draft);
+                    broadcastInteractionReceipt(draft, instanceId);
+                },
+                reportPublicationFailure: (error) => {
                     if (!opts.silent)
                         console.error("[daemon] External interaction receipt failed:", error);
-                }
-                return false;
-            },
+                },
+            }),
         });
+        const disposeInteractionObservation = async () => {
+            authoredReceiptEnricher.dispose();
+            const failures = [];
+            try {
+                await observationSelector?.dispose();
+            }
+            catch (error) {
+                failures.push(error);
+            }
+            try {
+                await externalInteractionObserver.dispose();
+            }
+            catch (error) {
+                failures.push(error);
+            }
+            if (failures.length)
+                throw new AggregateError(failures, "Interaction observer retirement failed");
+        };
         let terminalAttachmentRuntime = null;
         let paneStreamRuntime = null;
+        let serverOwners = null;
+        const defaultSessionCreator = createNativeTmuxSessionCreator({
+            generation: instanceId,
+            registry: workspaceRegistry,
+            run: nativeGenerationTmuxRunner,
+            assertOpen: () => {
+                if (serverOwners?.defaultRetired)
+                    throw new Error("Default tmux owner is retired");
+            },
+        });
+        const defaultSessionOpener = createNativeTmuxSessionOpener({
+            generation: instanceId,
+            registry: workspaceRegistry,
+            run: fleetFactsTmuxRunner,
+            assertOpen: () => {
+                if (serverOwners?.defaultRetired)
+                    throw new Error("Default tmux owner is retired");
+            },
+        });
         let runtimeTraceStream = null;
         const closeRuntimeTraceStream = async () => {
             externalInteractionObserver.setDiagnostics(null);
@@ -821,12 +978,27 @@ async function startEmbeddedDaemonGeneration(opts) {
         let startedServer;
         try {
             const selector = tmuxAuthority.socketSelector;
-            const executeRuntimeIntent = (operationId, intent, timing) => {
+            const executeRuntimeIntent = (operationId, intent, timing, execution) => {
                 if (intent.verb === "workspace.pane.read") {
-                    workspaceMultiplexer.readPane(operationId, intent);
-                    return;
+                    return workspaceMultiplexer.readPane(operationId, intent, execution);
+                }
+                if (intent.verb === "workspace.window.link.select" ||
+                    intent.verb === "workspace.window.link.unlink" ||
+                    intent.verb === "workspace.pane.select") {
+                    return workspaceMultiplexer.mutateWindowLink({ operationId, expectedDaemonInstanceId: instanceId, intent }, (session, action) => {
+                        if (!sessionRuntimeRegistry)
+                            throw new Error("Session runtime unavailable");
+                        return sessionRuntimeRegistry.executeWindowLinkAction(session, action);
+                    }, timing);
+                }
+                if (intent.verb === "workspace.pane.resize") {
+                    return workspaceMultiplexer.mutateResize({ operationId, expectedDaemonInstanceId: instanceId, intent }, (session) => {
+                        if (!sessionRuntimeRegistry)
+                            throw new Error("Session runtime unavailable");
+                        return sessionRuntimeRegistry.paneResizeTransport(session);
+                    });
                 }
-                return workspaceMultiplexer.mutate({ operationId, expectedDaemonInstanceId: instanceId, intent }, timing);
+                return workspaceMultiplexer.mutate({ operationId, expectedDaemonInstanceId: instanceId, intent }, timing, execution);
             };
             const runtimeTracePath = process.env.TMUX_IDE_SESSION_RUNTIME_TRACE_LOG;
             runtimeTraceStream = runtimeTracePath
@@ -881,15 +1053,32 @@ async function startEmbeddedDaemonGeneration(opts) {
                 generation: instanceId,
                 ...(runtimeObservability ? { observability: runtimeObservability } : {}),
                 semanticMutations: {
+                    captureInteractionContext: (intent) => {
+                        if (!interactionEvidence)
+                            throw new Error("Scoped interaction evidence is unavailable");
+                        return {
+                            destination: ("semanticPaneId" in intent &&
+                                interactionEvidence.captureAuthoredEndpoint(intent.workspaceName, intent.semanticPaneId)) ||
+                                interactionEvidence.captureUnavailableEndpoint(),
+                            source: null,
+                        };
+                    },
+                    validateInteractionContext: (context) => {
+                        if (context.destination.kind !== "pane" ||
+                            !interactionEvidence?.isCurrent(context.destination))
+                            throw new Error("Interaction target lifetime is no longer current");
+                    },
                     resolveSession: (workspaceName) => workspaceRegistry.get(workspaceName)?.sessionName ?? null,
                     execute: executeRuntimeIntent,
                     traceAuthority: { generation: instanceId, incarnation: null },
-                    publishReceipt: (receipt) => broadcastInteractionReceipt(receipt, instanceId),
+                    publishReceipt: (receipt) => publishOwnerInteractionReceipt(interactionReceipts, receipt, (draft) => broadcastInteractionReceipt(draft, instanceId)),
                     publishResourceChange: (change) => broadcastResourceChanged(change, instanceId),
                 },
                 mirror: {
+                    createOwnedViewerAdapter: () => ownedViewerFactory?.(),
+                    nativeServerIdentity: initialNativeServerIdentity,
                     executable: tmuxAuthority.executablePath,
-                    resolveSocketPath: () => catalogTmuxRunner(["display-message", "-p", "#{socket_path}"]),
+                    resolveSocketPath: () => nativeGenerationTmuxRunner(["display-message", "-p", "#{socket_path}"]),
                     internalReadHookEmission: (runtimePaneId, marker) => externalInteractionObserver.internalReadHookEmission(runtimePaneId, marker),
                     ...(selector.kind === "path" ? { socketPath: selector.path } : {}),
                     ...(selector.kind === "name" && selector.name !== "default"
@@ -952,6 +1141,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                 sessionRuntimeRegistry,
                 tmuxAuthority: {
                     executablePath: tmuxAuthority.executablePath,
+                    nativeServerIdentity: initialNativeServerIdentity,
                     socketSelector: tmuxAuthority.socketSelector,
                     trustedCwd: dir,
                     ...(tmuxAuthority.socketSelector.kind === "name"
@@ -960,9 +1150,38 @@ async function startEmbeddedDaemonGeneration(opts) {
                         }
                         : {}),
                 },
-                agentStatusProbeFactory: ({ run }) => createTmuxAgentStatusProbe({ run }),
-                onInventory: (snapshot) => workspaceMultiplexer.adoptPaneInventory(snapshot.panes),
-                onSessionInventory: (sessionName, snapshot) => workspaceMultiplexer.adoptSessionPaneInventory(sessionName, snapshot?.panes ?? []),
+                agentStatusProbeFactory: ({ run }) => createTmuxAgentStatusProbe({
+                    run,
+                    readTeamMemberships,
+                    captureNative: (pane, signal) => backgroundCapture?.({
+                        paneId: pane.runtimePaneId,
+                        nativeIdentity: pane.nativeIdentity ?? null,
+                        mode: "agent-status",
+                    }, signal) ?? Promise.resolve(null),
+                }),
+                nativeServerEpoch: () => observationSelector?.nativeServerEpoch ?? null,
+                resolveInteractionEndpoint: (workspaceName, semanticPaneId) => interactionEvidence?.captureAuthoredEndpoint(workspaceName, semanticPaneId) ?? null,
+                onInventory: async (snapshot, signal) => {
+                    workspaceMultiplexer.adoptPaneInventory(snapshot.panes);
+                    interactionEvidence?.adoptInventory(snapshot.panes);
+                    await sourceDiscovery.prepare(snapshot.panes.map((pane) => ({
+                        ...pane,
+                        paneLifetimeId: pane.semanticPaneId
+                            ? (interactionEvidence?.captureInventoryEndpoint(pane.sessionName, pane.runtimePaneId, pane.semanticPaneId)?.paneLifetimeId ?? null)
+                            : null,
+                    })), signal);
+                },
+                onSessionInventory: async (sessionName, snapshot, signal) => {
+                    workspaceMultiplexer.adoptSessionPaneInventory(sessionName, snapshot?.panes ?? []);
+                    interactionEvidence?.adoptSessionInventory(sessionName, snapshot?.panes ?? []);
+                    if (snapshot)
+                        await sourceDiscovery.prepare(snapshot.panes.map((pane) => ({
+                            ...pane,
+                            paneLifetimeId: pane.semanticPaneId
+                                ? (interactionEvidence?.captureInventoryEndpoint(pane.sessionName, pane.runtimePaneId, pane.semanticPaneId)?.paneLifetimeId ?? null)
+                                : null,
+                        })), signal);
+                },
                 ...(runtimeObservability ? { observability: runtimeObservability } : {}),
             };
             terminalInventoryRuntime = new WorkspaceTerminalInventoryRuntime(terminalRuntimeOptions);
@@ -993,11 +1212,158 @@ async function startEmbeddedDaemonGeneration(opts) {
             const orderedMultiplexerBackend = createSessionRuntimeMultiplexerBackend({
                 registry: sessionRuntimeRegistry,
                 resolveSession: (workspaceName) => workspaceRegistry.get(workspaceName)?.sessionName ?? null,
+                resolvePaneSourceBinding: (credential, resolvedSession, claimedSource) => {
+                    const grant = paneSourceCredentials.resolveBinding(credential, resolvedSession, claimedSource);
+                    return grant && interactionEvidence
+                        ? interactionEvidence.captureSourceBinding(grant)
+                        : null;
+                },
                 resolvePaneSourceCredential: (credential, resolvedSession, claimedSource) => paneSourceCredentials.resolve(credential, resolvedSession, claimedSource),
             });
             await externalInteractionObserver.start();
+            serverOwners = await createEmbeddedTmuxServerOwners({
+                environmentId,
+                onDefaultScope: async (scope) => {
+                    interactionEvidence = new InteractionEvidenceAuthority(environmentId, scope);
+                    interactionObservation = new InteractionObservationStatusStore(environmentId, scope);
+                    observationSelector = new OwnerInteractionObservation({
+                        environmentId,
+                        serverScope: scope,
+                        tmuxAuthority,
+                        nativeServerIdentity: initialNativeServerIdentity,
+                        enabled: nativeObservationRequested,
+                        status: interactionObservation,
+                        onOwnedPlanComplete: (proof) => {
+                            sessionRuntimeRegistry?.observeOwnedNativePlan(proof);
+                        },
+                        publishOwnedEvidence: (decision) => authoredReceiptEnricher.consume(decision),
+                        publishEvidence: (evidence) => {
+                            interactionReceipts.appendEvidence(evidence);
+                        },
+                    });
+                    ownedViewerFactory = createOwnedViewerAdapterFactory({
+                        environmentId,
+                        serverScope: scope,
+                        observation: observationSelector,
+                        status: interactionObservation,
+                    });
+                    backgroundCapture = createBackgroundNativeCapture({
+                        environmentId,
+                        serverScope: scope,
+                        observation: () => observationSelector,
+                        runPinnedTmux: fleetFactsTmuxRunner,
+                    });
+                    authoredNativeRunner = createAuthoredNativeCommandRunner({
+                        environmentId,
+                        serverScope: scope,
+                        sessionGuard: () => sessionMutationFence.snapshot(),
+                        observation: () => observationSelector,
+                        runPinnedTmux: createPinnedWorkspaceTmuxRunner(tmuxAuthority, { timeoutMs: 5_000 }),
+                    });
+                    observationSelector.stockAvailable(externalInteractionObserver.available);
+                    if (nativeObservationRequested)
+                        interactionObservation.noteGap("uncertain-consume");
+                    await observationSelector.start();
+                    await terminalInventoryRuntime.discoverTerminalInventory();
+                },
+                defaultAuthority: tmuxAuthority,
+                defaultGeneration: instanceId,
+                expectedDefaultProofDigest: initialTmuxProof?.digest ?? null,
+                stateDirectory: resolveRuntimeNamespace().runtimeDir,
+                webSocketBaseUrl: canonicalDaemonUrl("ws", bindHostname, port),
+                defaultOwner: {
+                    get interactionObservation() {
+                        return interactionObservation;
+                    },
+                    get interactionEvidence() {
+                        return interactionEvidence;
+                    },
+                    submitAutomationIntent: (operationId, intent, authority) => sessionRuntimeRegistry.submitAutomationIntent(operationId, intent, authority),
+                    resolveInteractionSource: (credential, workspaceName, claimedSemanticPaneId) => {
+                        const session = workspaceRegistry.get(workspaceName)?.sessionName;
+                        if (!session || !interactionEvidence)
+                            return null;
+                        const grant = paneSourceCredentials.resolveBinding(credential, session, claimedSemanticPaneId);
+                        return grant ? interactionEvidence.captureSourceBinding(grant) : null;
+                    },
+                    interactionReceipts,
+                    catalog: createNativeTmuxServerCatalog(workspaceRegistry, fleetFactsTmuxRunner),
+                    openSession: async (liveSessionId) => {
+                        await createNativeTmuxServerCatalog(workspaceRegistry, fleetFactsTmuxRunner)();
+                        const result = await defaultSessionOpener.openSession(liveSessionId);
+                        terminalInventoryRuntime.invalidate();
+                        return result;
+                    },
+                    workspaceRegistry,
+                    multiplexerBackend: orderedMultiplexerBackend,
+                    createSession: defaultSessionCreator.createSession,
+                    createSessionPane: async (liveSessionId, request) => {
+                        const selectedSession = workspaceRegistry.get(request.intent.workspaceName)?.sessionName;
+                        if (!selectedSession)
+                            throw new Error("Selected workspace is unavailable");
+                        const result = await sessionMutationFence.execute({
+                            liveSessionId,
+                            sessionName: selectedSession,
+                            run: fleetFactsTmuxRunner,
+                            mutate: () => workspacePaneCreation.create(request),
+                        });
+                        terminalInventoryRuntime.invalidate();
+                        return result;
+                    },
+                    mutateSession: async (liveSessionId, request, authenticatedHostClientId) => {
+                        const selectedSession = workspaceRegistry.get(request.intent.workspaceName)?.sessionName;
+                        if (!selectedSession)
+                            throw new Error("Selected workspace is unavailable");
+                        return sessionMutationFence.execute({
+                            liveSessionId,
+                            sessionName: selectedSession,
+                            run: fleetFactsTmuxRunner,
+                            mutate: () => orderedMultiplexerBackend.mutate(request, authenticatedHostClientId, undefined, true),
+                        });
+                    },
+                    sessionRuntimeRegistry,
+                    terminalInventoryRuntime,
+                    paneStreamRuntime,
+                    dispose: async () => {
+                        sessionMonitor?.stop();
+                        paneSourceCredentials.dispose();
+                        const transportResults = await Promise.allSettled([
+                            Promise.resolve().then(() => terminalAttachmentRuntime?.dispose()),
+                            Promise.resolve().then(() => paneStreamRuntime.dispose()),
+                        ]);
+                        const authorityResults = await Promise.allSettled([
+                            Promise.resolve().then(() => terminalInventoryRuntime.dispose()),
+                            Promise.resolve().then(() => workspacePaneCreation.dispose()),
+                            Promise.resolve().then(() => workspaceOpen.dispose()),
+                            Promise.resolve().then(() => workspaceOpenHandoff?.dispose()),
+                            Promise.resolve().then(() => Promise.all([
+                                workspacePromotion.dispose(),
+                                defaultSessionOpener.dispose(),
+                                defaultSessionCreator.dispose(),
+                            ]).then(() => { })),
+                            Promise.resolve().then(() => appWindowMutation.dispose()),
+                            Promise.resolve().then(() => workspaceMultiplexer.dispose()),
+                            Promise.resolve().then(() => disposeInteractionObservation()),
+                        ]);
+                        try {
+                            await sessionRuntimeRegistry.dispose();
+                        }
+                        finally {
+                            interactionReceipts.dispose();
+                            interactionEvidence?.dispose();
+                            interactionEvidence = null;
+                            interactionObservation?.dispose();
+                            interactionObservation = null;
+                        }
+                        const failures = [...transportResults, ...authorityResults].flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+                        if (failures.length)
+                            throw new AggregateError(failures, "Default tmux owner retirement failed");
+                    },
+                },
+            });
             setFleetFactsTmuxRunner(fleetFactsTmuxRunner);
             startedServer = await startHttpServer({
+                serverOwners,
                 sessionName,
                 requestedPort: port,
                 bindHostname,
@@ -1007,6 +1373,13 @@ async function startEmbeddedDaemonGeneration(opts) {
                 silent: opts.silent,
                 readProjectAuth: !sessionless,
                 daemonIdentity: { productVersion, instanceId, startedAt, environmentId },
+                tmuxServerProof: async () => {
+                    // Two native reads share this bound. Concurrent cold CLI election
+                    // can delay the daemon on small hosts; this is not an input deadline.
+                    const deadline = AbortSignal.timeout(2_000);
+                    return ((await captureTmuxServerProofAsync((args) => fleetFactsTmuxRunner(args, deadline))) ??
+                        captureUnboundTmuxSelectorProof(tmuxAuthority));
+                },
                 workspacePaneCreationBackend: workspacePaneCreation,
                 workspaceOpenBackend: workspaceOpen,
                 workspaceOpenHandoffBackend: workspaceOpenHandoff,
@@ -1020,11 +1393,35 @@ async function startEmbeddedDaemonGeneration(opts) {
                 peekTerminalAttachmentRuntime,
                 paneStreamRuntime,
                 catalogLiveSessions: () => discoverLiveSessionSummaries(catalogTmuxRunner),
-                catalogFleet: () => readAdoptedFleet(workspaceRegistry, catalogTmuxRunner),
+                catalogFleet: async () => {
+                    const fleet = readAdoptedFleet(workspaceRegistry, nativeGenerationTmuxRunner, (sessionName, pane) => pane.semanticPaneId
+                        ? (interactionEvidence?.captureInventoryEndpoint(sessionName, pane.runtimePaneId, pane.semanticPaneId) ?? null)
+                        : null, () => observationSelector?.nativeServerEpoch ?? null);
+                    if (!fleet)
+                        return null;
+                    const names = await readTeamMemberships(fleet.flatMap((session) => session.panes.map((pane) => ({
+                        runtimePaneId: pane.runtimePaneId,
+                        pid: pane.incarnation,
+                    }))));
+                    return fleet.map((session) => ({
+                        ...session,
+                        panes: session.panes.map((pane) => {
+                            const name = names.get(pane.runtimePaneId);
+                            return name
+                                ? { ...pane, teamMemberName: name.name, team: pane.team ?? name.team }
+                                : pane;
+                        }),
+                    }));
+                },
+                fleetPreviewCapture: createFleetPreviewCapture(fleetFactsTmuxRunner, {
+                    serverEpoch: () => observationSelector?.nativeServerEpoch ?? null,
+                    capture: (request, signal) => backgroundCapture?.(request, signal) ?? Promise.resolve(null),
+                }),
                 sessionRuntimeRegistry,
             });
         }
         catch (error) {
+            await serverOwners?.dispose();
             setFleetFactsTmuxRunner(null);
             await Promise.allSettled([
                 Promise.resolve().then(() => terminalAttachmentRuntime?.dispose()),
@@ -1033,10 +1430,14 @@ async function startEmbeddedDaemonGeneration(opts) {
                 workspacePaneCreation.dispose(),
                 workspaceOpen.dispose(),
                 Promise.resolve().then(() => workspaceOpenHandoff?.dispose()),
-                workspacePromotion.dispose(),
+                Promise.all([
+                    workspacePromotion.dispose(),
+                    defaultSessionOpener.dispose(),
+                    defaultSessionCreator.dispose(),
+                ]).then(() => { }),
                 appWindowMutation.dispose(),
                 workspaceMultiplexer.dispose(),
-                externalInteractionObserver.dispose(),
+                disposeInteractionObservation(),
                 closeRuntimeTraceStream(),
             ]);
             // The pane-stream coordinator may still hold runtime consumers while it
@@ -1057,6 +1458,7 @@ async function startEmbeddedDaemonGeneration(opts) {
             return [...transportResults, ...runtimeResults].flatMap((result) => result.status === "rejected" ? [result.reason] : []);
         };
         const abortStartedServer = async () => {
+            await serverOwners?.dispose();
             setFleetFactsTmuxRunner(null);
             const terminalFailures = [
                 ...(await retireTerminalAttachmentTransport(terminalAttachmentRuntime, terminalAttachmentBoundary)),
@@ -1066,10 +1468,14 @@ async function startEmbeddedDaemonGeneration(opts) {
             const paneDisposal = Promise.resolve().then(() => workspacePaneCreation.dispose());
             const workspaceOpenDisposal = Promise.resolve().then(() => workspaceOpen.dispose());
             const workspaceOpenHandoffDisposal = Promise.resolve().then(() => workspaceOpenHandoff?.dispose());
-            const workspacePromotionDisposal = Promise.resolve().then(() => workspacePromotion.dispose());
+            const workspacePromotionDisposal = Promise.resolve().then(() => Promise.all([
+                workspacePromotion.dispose(),
+                defaultSessionOpener.dispose(),
+                defaultSessionCreator.dispose(),
+            ]).then(() => { }));
             const appWindowMutationDisposal = Promise.resolve().then(() => appWindowMutation.dispose());
             const workspaceMultiplexerDisposal = Promise.resolve().then(() => workspaceMultiplexer.dispose());
-            const externalInteractionDisposal = Promise.resolve().then(() => externalInteractionObserver.dispose());
+            const externalInteractionDisposal = Promise.resolve().then(() => disposeInteractionObservation());
             const closePromise = Promise.resolve()
                 .then(() => waitForServerClose(server))
                 .catch(() => undefined);
@@ -1091,8 +1497,27 @@ async function startEmbeddedDaemonGeneration(opts) {
                 console.error("[daemon] Direct terminal startup rollback reported cleanup failures.");
             }
         };
+        // Provenance (launcher, supervisor, actual stdout/stderr destination) is
+        // derived from this process, never from file-name conventions, so a later
+        // `daemon info` reads the truth from the record. Capture never throws;
+        // whatever it could not determine is reported as a warning.
+        const provenance = captureDaemonProvenance({
+            launcher: opts.launcher ?? "embedded",
+            ...(opts.supervisionId ? { supervisionId: opts.supervisionId } : {}),
+        });
+        if (provenance.warnings?.length && !opts.silent) {
+            for (const warning of provenance.warnings) {
+                console.warn(`[daemon] log provenance degraded: ${warning}`);
+            }
+        }
+        // Every structured record now carries this generation's identity, and the
+        // local bypass / shared tokens are redacted wherever they might appear.
+        setLogIdentity({ instanceId, version: productVersion });
+        registerLogSecret(localBypassToken);
+        registerLogSecret(opts.authToken);
         try {
             writeCanonicalDaemonInfo({
+                ...(opts.supervisionId ? { supervisionId: opts.supervisionId } : {}),
                 pid: process.pid,
                 port,
                 protocolVersion: DAEMON_WIRE_PROTOCOL_VERSION,
@@ -1102,6 +1527,8 @@ async function startEmbeddedDaemonGeneration(opts) {
                 environmentId,
                 bindHostname,
                 authToken: localBypassToken,
+                tmuxServerProofVersion: 1,
+                provenance,
             }, claim);
             const published = inspectCanonicalDaemonInfo();
             if (published.status !== "valid" ||
@@ -1148,14 +1575,14 @@ async function startEmbeddedDaemonGeneration(opts) {
                 stop.stop();
             },
         });
-        const sessionMonitor = sessionless
+        sessionMonitor = sessionless
             ? null
             : new DaemonSessionMonitor({
                 sessionName,
                 backend: {
                     inspectSession: async (candidate, signal) => {
                         try {
-                            await execTmuxAsync(["has-session", "-t", candidate], signal);
+                            await fleetFactsTmuxRunner(["has-session", "-t", candidate], signal);
                             return "yes";
                         }
                         catch (error) {
@@ -1178,7 +1605,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     },
                     hasClients: async (signal) => {
                         try {
-                            return (await execTmuxAsync(["list-clients"], signal)).length > 0;
+                            return (await fleetFactsTmuxRunner(["list-clients"], signal)).length > 0;
                         }
                         catch {
                             return null;
@@ -1186,7 +1613,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     },
                     listPanes: async (candidate, signal) => {
                         try {
-                            const raw = await execTmuxAsync([
+                            const raw = await fleetFactsTmuxRunner([
                                 "list-panes",
                                 "-t",
                                 candidate,
@@ -1209,7 +1636,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     },
                     setPaneOption: async (paneId, option, value, signal) => {
                         try {
-                            await execTmuxAsync(["set-option", "-pt", paneId, option, value], signal);
+                            await fleetFactsTmuxRunner(["set-option", "-pt", paneId, option, value], signal);
                         }
                         catch (error) {
                             if (!isConfirmedMissingTmuxTarget(error))
@@ -1218,7 +1645,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     },
                     setPaneTitle: async (paneId, title, signal) => {
                         try {
-                            await execTmuxAsync(["select-pane", "-t", paneId, "-T", title], signal);
+                            await fleetFactsTmuxRunner(["select-pane", "-t", paneId, "-T", title], signal);
                         }
                         catch (error) {
                             if (!isConfirmedMissingTmuxTarget(error))
@@ -1227,7 +1654,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     },
                     refreshClients: async (signal) => {
                         try {
-                            await execTmuxAsync(["refresh-client", "-S"], signal);
+                            await fleetFactsTmuxRunner(["refresh-client", "-S"], signal);
                         }
                         catch (error) {
                             if (!isConfirmedMissingTmuxTarget(error))
@@ -1241,7 +1668,20 @@ async function startEmbeddedDaemonGeneration(opts) {
         const apiBaseUrl = canonicalDaemonUrl("http", bindHostname, port);
         const wsUrl = canonicalDaemonUrl("ws", bindHostname, port, "/ws/events");
         const handle = {
-            tmuxAuthorityReplaced,
+            tmuxAuthorityReplaced: async () => {
+                if (serverOwners?.defaultRetired)
+                    return false;
+                const replaced = await tmuxAuthorityReplaced();
+                // A native server replacement cannot restart unrelated server owners.
+                // Legacy default-only callers retain the established restart adapter.
+                if (replaced &&
+                    serverOwners &&
+                    (serverOwners.owners.list().length > 1 || serverOwners.defaultRetired)) {
+                    await serverOwners.owners.refresh();
+                    return false;
+                }
+                return replaced;
+            },
             instanceId,
             pid: process.pid,
             port,
@@ -1269,6 +1709,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                         await capture(() => setActivationBackend(null));
                         await capture(() => sessionMonitor?.stop());
                         paneSourceCredentials.dispose();
+                        await capture(() => serverOwners?.dispose());
                         // Retire direct-ticket admission, live PTYs, and the direct upgrade
                         // listener before touching the legacy WS or HTTP surfaces.
                         failures.push(...(await retireTerminalAttachmentTransport(terminalAttachmentRuntime, terminalAttachmentBoundary)));
@@ -1277,10 +1718,14 @@ async function startEmbeddedDaemonGeneration(opts) {
                         await capture(() => workspacePaneCreation.dispose());
                         await capture(() => workspaceOpen.dispose());
                         await capture(() => workspaceOpenHandoff?.dispose());
-                        await capture(() => workspacePromotion.dispose());
+                        await capture(() => Promise.all([
+                            workspacePromotion.dispose(),
+                            defaultSessionOpener.dispose(),
+                            defaultSessionCreator.dispose(),
+                        ]).then(() => { }));
                         await capture(() => appWindowMutation.dispose());
                         await capture(() => workspaceMultiplexer.dispose());
-                        await capture(() => externalInteractionObserver.dispose());
+                        await capture(() => disposeInteractionObservation());
                         let closePromise;
                         try {
                             closePromise = waitForServerClose(server);
@@ -1308,6 +1753,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                         await capture(() => closeRuntimeTraceStream());
                         await capture(() => setRemoteAccessRestartBackend(null));
                         await capture(() => setDaemonShutdownBackend(null));
+                        await capture(() => setDaemonRestartBackend(null));
                         if (failures.length > 0) {
                             const cause = failures.length === 1
                                 ? failures[0]
@@ -1331,6 +1777,13 @@ async function startEmbeddedDaemonGeneration(opts) {
         setDaemonShutdownBackend(async () => {
             await handle.stop({ gracefulMs: 500 });
         }, instanceId);
+        setDaemonRestartBackend(opts.requestRestart
+            ? async () => {
+                // Let the accepted action response leave the listener before retiring it.
+                await delay(50);
+                await opts.requestRestart({ kind: "runtime", bindHostname, token: authToken, port });
+            }
+            : null, instanceId);
         setRemoteAccessRestartBackend((request) => {
             setTimeout(() => {
                 void (async () => {