tmux-ide 2.9.10 → 2.9.11

package/packages/daemon/dist/tui/mirror/runtime/application-terminal-interaction-controller.js

@@ -1,3 +1,4 @@
+import { createTerminalSelectionWaiter } from "./terminal-selection-waiter.js";
 import { WorkspaceWindowLinkSelectResultSchemaZ } from "@tmux-ide/contracts";
 import { windowLinkForPane, windowLinkTarget } from "./application-terminal-workspace-policy.js";
 import { createHash, randomUUID } from "node:crypto";
@@ -117,6 +118,10 @@ export function createApplicationTerminalInteractionController(options) {
         left.generation === right.generation &&
         left.workspace === right.workspace;
     let selectedControl = null;
+    const selectionWaiter = createTerminalSelectionWaiter();
+    let observedLayoutEpoch = null;
+    let selectionGeneration = null;
+    let selectionLayout = options.layout();
     const waitingInput = new Set();
     let waitingInputBytes = 0;
     let releasingInput = null;
@@ -522,8 +527,28 @@ export function createApplicationTerminalInteractionController(options) {
     const paneInput = new TerminalPaneInputRouter({
         select: async (paneId) => {
             finishLinkSelection(false);
+            const initial = options.generation();
+            const selectionControl = controlIdentity(initial);
+            const selectionVersion = paneInput.selectionVersion;
+            const selectionCurrent = () => paneInput.selectionVersion === selectionVersion &&
+                sameControl(selectionControl, controlIdentity(selectionGeneration));
+            const panePresent = () => selectionLayout.windows.some((window) => window.panes.some((pane) => pane.pane === paneId));
+            if (initial?.status === "rebinding") {
+                // Reserve the optimistic target now, but send its FIRST mutation only
+                // after this same control connection has a coherent terminal runtime.
+                const ready = await selectionWaiter.wait(() => {
+                    if (!selectionCurrent())
+                        return false;
+                    const active = selectionGeneration;
+                    if (active?.status !== "live" || observedLayoutEpoch !== active.rendererEpoch)
+                        return "pending";
+                    return panePresent();
+                });
+                if (!ready || !selectionCurrent())
+                    return false;
+            }
             const expected = liveSelectionTarget();
-            const selectionControl = controlIdentity(options.generation());
+            let dispatchedRendererEpoch;
             const selecting = pendingWindowSwitch;
             const operationId = selecting?.traceId;
             const selectionFailure = { current: null };
@@ -536,8 +561,36 @@ export function createApplicationTerminalInteractionController(options) {
                         : null;
                 }, paneId, operationId, (failure) => {
                     selectionFailure.current = failure;
-                }, windowLinkForPane(options.layout(), paneId) ?? undefined)
+                }, windowLinkForPane(options.layout(), paneId) ?? undefined, () => {
+                    dispatchedRendererEpoch = options.generation()?.rendererEpoch;
+                })
                 : null;
+            if (receipt === null &&
+                selectionFailure.current?.reason === "topology-changed" &&
+                selectionCurrent()) {
+                // The daemon may have selected the pane before retiring its stream.
+                // Observe the replacement runtime; never resubmit an uncertain command
+                // or manufacture an operation receipt. Input still waits on this promise.
+                const confirmed = await selectionWaiter.wait(() => {
+                    if (!selectionCurrent())
+                        return false;
+                    const active = selectionGeneration;
+                    if (active?.status !== "live" ||
+                        active.rendererEpoch === dispatchedRendererEpoch ||
+                        observedLayoutEpoch !== active.rendererEpoch)
+                        return "pending";
+                    if (!panePresent())
+                        return false;
+                    const current = selectionLayout.current;
+                    const activePanes = current?.panes.filter((pane) => pane.active) ?? [];
+                    if (!current?.currentWindow || activePanes.length !== 1)
+                        return "pending";
+                    return activePanes[0]?.pane === paneId ? true : "pending";
+                });
+                if (selecting && pendingWindowSwitch === selecting)
+                    pendingWindowSwitch = null;
+                return confirmed && selectionCurrent();
+            }
             if (selecting && pendingWindowSwitch === selecting) {
                 const receiptAtMicros = options.detailedWindowSwitchTiming ? diagnosticNowMicros() : null;
                 if (selecting.timing)
@@ -689,18 +742,21 @@ export function createApplicationTerminalInteractionController(options) {
     });
     return {
         cancelPendingInput() {
+            selectionWaiter.cancel();
             finishLinkSelection(false);
             paneInput.invalidateSelection();
             for (const entry of waitingInput)
                 entry.settle(false);
         },
         adoptGeneration(snapshot) {
+            selectionGeneration = snapshot;
             const control = controlIdentity(snapshot);
             if (!sameControl(selectedControl, control)) {
                 finishLinkSelection(false);
                 paneInput.invalidateSelection();
             }
             selectedControl = control;
+            selectionWaiter.reconcile();
             if (waitingInput.size > 0 && snapshot?.status === "live" && snapshot.fastLane) {
                 // Old waiters resume first; input admitted synchronously by the next
                 // layout publication must not overtake them in this microtask turn.
@@ -764,6 +820,9 @@ export function createApplicationTerminalInteractionController(options) {
             inputAuthorityIdentity = next;
         },
         adoptLayout(snapshot) {
+            selectionLayout = snapshot;
+            observedLayoutEpoch = snapshot.rendererEpoch ?? null;
+            selectionWaiter.reconcile();
             reconcileLinkSelection(snapshot);
             paneInput.adoptCanonicalPane(snapshot.current ? paneForWindow(snapshot.current) : null);
             const currentWindow = snapshot.current?.semanticWindowId ?? snapshot.current?.windowName;
@@ -850,6 +909,7 @@ export function createApplicationTerminalInteractionController(options) {
         selectPane: (paneId) => {
             finishLinkSelection(false);
             paneInput.selectPane(paneId);
+            selectionWaiter.reconcile();
         },
         async unlinkWindowLink(target) {
             const expected = liveSelectionTarget();

package/packages/daemon/dist/tui/mirror/runtime/open-tui-generation-host.js

@@ -371,7 +371,7 @@ export function createOpenTuiGenerationHost(sessionName, presentation, overrides
             // desired state against the fresh socket on the following live publish.
             publish({ ...snapshot, status: "rebinding" });
             owner.stopPresentation?.();
-            owner.stopPresentation = runtime ? presentation.adopt(runtime) : null;
+            owner.stopPresentation = runtime ? presentation.adopt(runtime, rendererEpoch + 1) : null;
             owner.runtime = runtime;
             owner.authorityClient = runtime ? runtimeAuthorityClient(owner.bundle, runtime) : null;
             if (!runtime)
@@ -394,7 +394,7 @@ export function createOpenTuiGenerationHost(sessionName, presentation, overrides
         if (candidate !== owner)
             return;
         if (runtime) {
-            owner.stopPresentation = presentation.adopt(runtime);
+            owner.stopPresentation = presentation.adopt(runtime, rendererEpoch + 1);
             diagnose?.("host-internal-snapshot-publication", {
                 publicationPhase: "presentation-adopted",
                 daemonGeneration: owner.bundle.connection.target.daemon.instanceId,

package/packages/daemon/dist/tui/mirror/runtime/runtime-layout-presentation.js

@@ -52,7 +52,7 @@ export function createOpenTuiRuntimeLayoutPresentation() {
             listener(windows);
             return () => windowListeners.delete(listener);
         },
-        adopt(port) {
+        adopt(port, rendererEpoch) {
             if (disposed)
                 return () => undefined;
             let candidate = true;
@@ -60,15 +60,18 @@ export function createOpenTuiRuntimeLayoutPresentation() {
             candidateStop = port.onLayout((layout) => {
                 if (disposed || !candidate || !layout.current)
                     return;
+                // A port may reuse its snapshot object. Own the provenance wrapper so
+                // a preparing runtime cannot relabel the retained coherent frame.
+                const presented = Object.freeze({ ...layout, rendererEpoch });
                 if (currentPort !== port) {
                     const previousStop = stopLayout;
                     currentPort = port;
                     stopLayout = candidateStop;
-                    publish(layout);
+                    publish(presented);
                     previousStop?.();
                     return;
                 }
-                publish(layout);
+                publish(presented);
             });
             // `onLayout` intentionally seeds synchronously. Capture the disposer
             // after that first callback has promoted this candidate.

package/packages/daemon/dist/tui/mirror/runtime/select-terminal-pane.js

@@ -1,5 +1,5 @@
 /** Acquire controller authority before issuing the canonical pane-select intent. */
-export async function selectTerminalPane(expected, current, semanticPaneId, operationId, onFailure, windowLink) {
+export async function selectTerminalPane(expected, current, semanticPaneId, operationId, onFailure, windowLink, onDispatch) {
     const fail = (failure) => {
         try {
             onFailure?.(failure);
@@ -20,7 +20,11 @@ export async function selectTerminalPane(expected, current, semanticPaneId, oper
             : undefined;
         return fail({
             stage,
-            reason: code === "operation-timeout" ? "operation-timeout" : "transport-rejected",
+            reason: code === "operation-timeout"
+                ? "operation-timeout"
+                : code === "topology-changed" && stage === "dispatch"
+                    ? "topology-changed"
+                    : "transport-rejected",
             ...(backendReason ? { backendReason } : {}),
         });
     };
@@ -50,6 +54,7 @@ export async function selectTerminalPane(expected, current, semanticPaneId, oper
             return fail({ stage: "pre-dispatch", reason: "generation-replaced" });
         let result;
         try {
+            onDispatch?.();
             result = await expected.client.dispatch({
                 kind: "semantic-intent",
                 ...(operationId ? { operationId } : {}),

package/packages/daemon/dist/tui/mirror/runtime/terminal-selection-waiter.js

@@ -0,0 +1,36 @@
+/** One bounded selection observation; never submits or repeats a mutation. */
+export function createTerminalSelectionWaiter() {
+    let pending = null;
+    const cancel = () => pending?.finish(false);
+    const reconcile = () => {
+        const waiting = pending;
+        if (!waiting)
+            return;
+        const result = waiting.check();
+        if (result !== "pending")
+            waiting.finish(result);
+    };
+    return {
+        cancel,
+        reconcile,
+        wait(check) {
+            cancel();
+            return new Promise((resolve) => {
+                const timer = setTimeout(() => waiting.finish(false), 5000);
+                timer.unref?.();
+                const waiting = {
+                    check,
+                    finish(selected) {
+                        if (pending !== waiting)
+                            return;
+                        pending = null;
+                        clearTimeout(timer);
+                        resolve(selected);
+                    },
+                };
+                pending = waiting;
+                reconcile();
+            });
+        },
+    };
+}

package/packages/daemon/src/terminal/mirror/mirror-service.ts

@@ -237,14 +237,31 @@ export class MirrorService {
     }
   }
 
-  async describeSessionAuthority(session: string): Promise<{
+  async describeSessionAuthority(
+    session: string,
+    expectedSemanticPaneIds?: readonly string[],
+  ): Promise<{
     readonly description: MirrorSessionDescription;
     readonly runtimeSessionId: string;
   }> {
     const entry = await this.acquire(session);
     try {
       const identity = await entry.channel.attachedSessionIdentity();
-      return { description: entry.channel.describe(), runtimeSessionId: identity.runtimeSessionId };
+      let description = entry.channel.describe();
+      if (
+        expectedSemanticPaneIds?.some(
+          (id) => !description.panes.some((pane) => pane.semanticPaneId === id),
+        )
+      ) {
+        // A mutation receipt and fresh catalog can precede debounced mirror
+        // discovery. Join the verified native inventory before declaring a
+        // requested pane absent; never substitute receipt IDs for tmux truth.
+        await entry.channel.describeTrustedInventory(identity.runtimeSessionId, true);
+        description = entry.channel.describe();
+      }
+      if (this.disposed || entry.retired || this.channels.get(session) !== entry)
+        throw new Error("Mirror authority retired during description");
+      return { description, runtimeSessionId: identity.runtimeSessionId };
     } finally {
       this.release(session, entry);
     }

package/packages/daemon/src/terminal/mirror/session-channel.ts

@@ -507,6 +507,8 @@ export class SessionChannel {
   private readonly fittedWindows = new Map<string, { cols: number; rows: number }>();
   private cancelSync: (() => void) | null = null;
   private syncOrdinal = 0;
+  private identityJoinOrdinal = 0;
+  private trustedInventoryJoinsMissing = false;
   private completedSyncOrdinal = 0;
   private lastDisplayNameSyncAtMs = 0;
   private disposed = false;
@@ -799,22 +801,36 @@ export class SessionChannel {
 
   /**
    * Strict daemon-internal inventory from this channel's current tmux truth.
-   * Unlike the background discovery path, this query awaits descriptor
-   * reconciliation before projecting and rejects incomplete identity rather
-   * than returning the previous descriptor snapshot.
+   * Unlike background discovery, this query verifies current native membership
+   * before projecting and rejects incomplete identity. Stream admission may
+   * explicitly join missing pane records after that verification; ordinary
+   * inventory readers retain their existing fail-closed no-join contract.
    */
   describeTrustedInventory(
     expectedRuntimeSessionId: string,
+    joinMissingPanes = false,
   ): Promise<TrustedMirrorSessionInventory> {
     if (this.disposed) {
       return Promise.reject(new Error(`mirror session ${this.opts.session} is disposed`));
     }
     if (this.trustedInventoryFlight) {
+      // A default read can fail precisely because it does not join new panes.
+      // Preserve that failure for its caller, then qualify admission separately.
+      if (
+        joinMissingPanes &&
+        !this.trustedInventoryJoinsMissing &&
+        this.trustedInventoryFlightSessionId === expectedRuntimeSessionId
+      )
+        return this.trustedInventoryFlight.then(
+          () => this.describeTrustedInventory(expectedRuntimeSessionId, true),
+          () => this.describeTrustedInventory(expectedRuntimeSessionId, true),
+        );
       return this.trustedInventoryFlightSessionId === expectedRuntimeSessionId
         ? this.trustedInventoryFlight
         : Promise.reject(new Error(`trusted inventory identity changed for ${this.opts.session}`));
     }
-    const flight = this.refreshTrustedInventory(expectedRuntimeSessionId)
+    this.trustedInventoryJoinsMissing = joinMissingPanes;
+    const flight = this.refreshTrustedInventory(expectedRuntimeSessionId, 0, joinMissingPanes)
       .catch((error) => {
         this.windowLinkAuthority?.invalidate();
         this.latestWindowStage = null;
@@ -3387,6 +3403,7 @@ export class SessionChannel {
   private async refreshTrustedInventory(
     expectedRuntimeSessionId: string,
     attempt = 0,
+    joinMissingPanes = false,
   ): Promise<TrustedMirrorSessionInventory> {
     const authorityOrdinal = this.windowIdentityOrdinal;
     const beforeLines = await this.io.request(
@@ -3486,7 +3503,11 @@ export class SessionChannel {
     ) {
       if (attempt >= 1)
         throw new Error(`trusted inventory for ${this.opts.session} did not settle`);
-      return await this.refreshTrustedInventory(expectedRuntimeSessionId, attempt + 1);
+      return await this.refreshTrustedInventory(
+        expectedRuntimeSessionId,
+        attempt + 1,
+        joinMissingPanes,
+      );
     }
     if (this.disposed) throw new Error(`mirror session ${this.opts.session} is disposed`);
     const activeWindowId = activeWindowIds.values().next().value;
@@ -3521,7 +3542,28 @@ export class SessionChannel {
       stagedPaneIds.size !== descriptors.length ||
       [...computedWindowCounts.keys()].some(
         (runtimeWindowId) => !confirmedWindowStage.windows.has(runtimeWindowId),
-      ) ||
+      )
+    )
+      throw new Error(`trusted inventory for ${this.opts.session} lacks verified identity`);
+    // Fresh native inventory can beat background discovery after window creation.
+    // Join verified stable membership before projecting semantic records.
+    if (
+      joinMissingPanes &&
+      descriptors.some(
+        (pane) => this.panesByRuntime.get(pane.runtimePaneId)?.semanticId !== pane.semanticPaneId,
+      )
+    ) {
+      this.discovery.invalidate();
+      await this.reconcileIdentity(
+        descriptors,
+        runtimePaneIds,
+        () => authorityOrdinal === this.windowIdentityOrdinal,
+        false,
+      );
+    }
+    if (this.disposed || authorityOrdinal !== this.windowIdentityOrdinal)
+      throw new Error(`trusted inventory for ${this.opts.session} changed during identity join`);
+    if (
       descriptors.some((descriptor) => {
         const pane = this.panesByRuntime.get(descriptor.runtimePaneId);
         const window = confirmedWindowStage.windows.get(descriptor.windowId!);
@@ -3934,7 +3976,10 @@ export class SessionChannel {
   private async reconcileIdentity(
     descriptors: readonly SessionPaneDescriptor[],
     listed: ReadonlySet<string>,
+    current: () => boolean = () => true,
+    publish = true,
   ): Promise<boolean> {
+    const joinOrdinal = ++this.identityJoinOrdinal;
     if (this.disposed) return false;
     if (this.opts.hasSharedWindowConflict?.()) {
       this.settleFirstJoin();
@@ -3973,7 +4018,8 @@ export class SessionChannel {
           ),
       ),
     );
-    if (this.disposed) return plan.stampEffects.length > 0;
+    if (this.disposed || !current() || joinOrdinal !== this.identityJoinOrdinal)
+      return plan.stampEffects.length > 0;
     const reconciliation = finalizeWorkspaceTmuxReconciliation(plan, outcomes);
     const descriptorByRuntime = new Map(descriptors.map((d) => [d.runtimePaneId, d]));
     for (const verified of reconciliation.panes) {
@@ -4080,8 +4126,10 @@ export class SessionChannel {
      * without this the new pane stays invisible until something else happens to
      * move a layout, and a split looks like it did not reach the view.
      */
-    for (const runtimeId of this.layoutByWindow.keys()) this.emitLayout(runtimeId);
-    this.emitLayoutAuthority();
+    if (publish) {
+      for (const runtimeId of this.layoutByWindow.keys()) this.emitLayout(runtimeId);
+      this.emitLayoutAuthority();
+    }
     this.settleFirstJoin();
     return plan.stampEffects.length > 0;
   }

package/packages/daemon/src/terminal/pane-stream/pane-stream-websocket.ts

@@ -1,3 +1,7 @@
+import {
+  PANE_STREAM_INPUT_LIFETIME_CAPABILITY_VERSION,
+  type PaneStreamInputLifetime,
+} from "@tmux-ide/contracts";
 import { inflateSync } from "node:zlib";
 import { PaneStreamLayoutSnapshotFrameSchemaZ, type WindowLinkTopology } from "@tmux-ide/contracts";
 import type { TerminalDeliveryGraphics } from "../session-runtime/terminal-delivery-hub.ts";
@@ -149,6 +153,7 @@ export interface PaneStreamMirror {
   describeSession(session: string): Promise<MirrorSessionDescription>;
   describeSessionAuthority?(
     session: string,
+    expectedSemanticPaneIds?: readonly string[],
   ): Promise<{ readonly description: MirrorSessionDescription; readonly runtimeSessionId: string }>;
   subscribe(request: MirrorSubscribeRequest): Promise<MirrorSubscription>;
   subscribeLayout?(
@@ -304,6 +309,7 @@ export interface SessionRuntimePaneStreamTransportBinding {
     performanceTraceId?: string,
     causalProbe?: CausalCellProbeV1,
     onCausalResult?: (result: CausalCellLedgerResult) => void,
+    expectedLifetime?: PaneStreamInputLifetime,
   ): void;
   fitViewport(
     lease: SessionRuntimeAuthorityLease,
@@ -493,7 +499,10 @@ export class PaneStreamAdmissionCoordinator {
       try {
         const describeStartedAtMicros = trace ? this.#observability!.nowMicros() : 0;
         if (this.#mirror.describeSessionAuthority) {
-          const authority = await this.#mirror.describeSessionAuthority(context.sessionName);
+          const authority = await this.#mirror.describeSessionAuthority(
+            context.sessionName,
+            request.panes,
+          );
           described = authority.description;
           runtimeSessionId = authority.runtimeSessionId;
         } else {
@@ -1279,6 +1288,12 @@ export class PaneStreamLiveConnection {
     try {
       sendControl(this.#socket, {
         type: "ready",
+        ...(this.#sessionRuntimeBinding &&
+        this.#descriptor.terminalDelivery?.protocolVersions.includes(
+          PANE_STREAM_INPUT_LIFETIME_CAPABILITY_VERSION,
+        )
+          ? { inputLifetime: true as const }
+          : {}),
         protocolVersion: PANE_STREAM_PROTOCOL_VERSION,
         daemonInstanceId: this.#binding.daemonInstanceId,
         requestId: this.#binding.requestId,
@@ -2560,6 +2575,7 @@ export class PaneStreamLiveConnection {
       ingressAtMicros,
       callbackAtSharedMicros,
       ingressAtSharedMicros,
+      frame.expectedLifetime,
     );
   };
 
@@ -2712,7 +2728,18 @@ export class PaneStreamLiveConnection {
     ingressAtMicros: number | null = null,
     callbackAtSharedMicros: number | null = null,
     ingressAtSharedMicros: number | null = null,
+    expectedLifetime?: PaneStreamInputLifetime,
   ): void {
+    if (
+      expectedLifetime &&
+      (!this.#sessionRuntimeBinding ||
+        !this.#descriptor.terminalDelivery?.protocolVersions.includes(
+          PANE_STREAM_INPUT_LIFETIME_CAPABILITY_VERSION,
+        ))
+    ) {
+      this.#failProtocol("input-rejected");
+      return;
+    }
     if (this.#descriptor.viewerMode !== "interactive") {
       this.#failProtocol("input-rejected");
       return;
@@ -2832,6 +2859,7 @@ export class PaneStreamLiveConnection {
                 }
               }
             : undefined,
+          expectedLifetime,
         );
       else if (kind === "text") channel.sub!.sendText(data);
       else channel.sub!.sendKey(data);

package/packages/daemon/src/terminal/session-runtime/registry.ts

@@ -30,6 +30,7 @@ import {
   type CanonicalTerminalReplicaUpdate,
   type CausalCellFailureReasonV1,
   type CausalCellProbeV1,
+  type PaneStreamInputLifetime,
   type TerminalDeliveryAck,
   type TerminalDeliveryNack,
   type TerminalDeliveryOffer,
@@ -244,6 +245,7 @@ export interface SessionRuntimeConsumer {
     performanceTraceId?: string,
     causalProbe?: CausalCellProbeV1,
     onCausalResult?: (result: CausalCellLedgerResult) => void,
+    expectedLifetime?: PaneStreamInputLifetime,
   ): void;
   failCausalCellProbe(
     semanticPaneId: string,
@@ -896,13 +898,16 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
     return result;
   }
 
-  async describeSessionAuthority(session: string): Promise<{
+  async describeSessionAuthority(
+    session: string,
+    expectedSemanticPaneIds?: readonly string[],
+  ): Promise<{
     readonly description: MirrorSessionDescription;
     readonly runtimeSessionId: string;
   }> {
     const runtime = this.#runtime(session);
     await runtime.whenReady();
-    const authority = await this.#mirror.describeSessionAuthority(session);
+    const authority = await this.#mirror.describeSessionAuthority(session, expectedSemanticPaneIds);
     if (this.#disposed || this.#sessions.get(session) !== runtime) {
       const error = new Error(`session runtime ${session} changed topology`);
       error.name = "MirrorTopologyChangedError";
@@ -1589,6 +1594,7 @@ class SessionRuntime {
     performanceTraceId?: string,
     rawCausalProbe?: CausalCellProbeV1,
     onCausalResult?: (result: CausalCellLedgerResult) => void,
+    expectedLifetime?: PaneStreamInputLifetime,
   ): void {
     this.assertController(lease, clientId);
     const inputLease = this.#authority.leaseFor(clientId, "input");
@@ -1626,7 +1632,10 @@ class SessionRuntime {
           })
         : null;
     const started = this.#observability.enabled ? this.#observability.nowMicros() : 0;
-    const replicaOwner = this.#terminalReplicaOwner(semanticPaneId);
+    const replicaOwner = expectedLifetime
+      ? this.#terminalReplicas.get(semanticPaneId)
+      : this.#terminalReplicaOwner(semanticPaneId);
+    if (!replicaOwner) throw new Error("Input target lifetime unavailable");
     if (causalProbe) {
       this.#activeCausalCellProbes += 1;
       let settled = false;
@@ -1649,6 +1658,15 @@ class SessionRuntime {
       this.#outputTraces.arm(semanticPaneId, trace);
     }
     try {
+      // Synchronous final admission: never create a new owner to satisfy a stale
+      // held-input fence, and never await between this check and mirror dispatch.
+      if (
+        expectedLifetime &&
+        (expectedLifetime.generation !== this.generation ||
+          this.#terminalReplicas.get(semanticPaneId) !== replicaOwner ||
+          replicaOwner.inputAdmissionIncarnation() !== expectedLifetime.incarnation)
+      )
+        throw new Error("Input target lifetime changed");
       if (input.kind === "text")
         this.#mirror.sendText(
           this.session,
@@ -2323,6 +2341,7 @@ class SessionRuntimeConsumerImpl implements SessionRuntimeConsumer {
     performanceTraceId?: string,
     causalProbe?: CausalCellProbeV1,
     onCausalResult?: (result: CausalCellLedgerResult) => void,
+    expectedLifetime?: PaneStreamInputLifetime,
   ): void {
     this.#assertOpen();
     this.#runtime.sendInput(
@@ -2333,6 +2352,7 @@ class SessionRuntimeConsumerImpl implements SessionRuntimeConsumer {
       performanceTraceId,
       causalProbe,
       onCausalResult,
+      expectedLifetime,
     );
   }