tmux-ide 2.9.4 → 2.9.6

package/packages/daemon/src/terminal/session-runtime/registry.ts

@@ -1,9 +1,11 @@
+import { StockCaptureTabUnavailableError } from "./stock-capture-fidelity.ts";
 import type { OwnedNativePlanCompletion } from "../../lib/owned-native-interaction-bindings.ts";
 import type {
   NativeBackingIdentity,
   TerminalNativeBackingResponse,
 } from "./native-seed-backing.ts";
 import {
+  WorkspaceIdSchemaZ,
   SessionRuntimeClientIdSchemaZ,
   SessionRuntimeAuthorityLeaseSchemaZ,
   SessionRuntimeControllerLeaseSchemaZ,
@@ -119,14 +121,56 @@ export interface TrustedSessionInventoryCandidate {
   readonly token: object;
 }
 
+interface RuntimeListenerCounts {
+  readonly authority: number;
+  readonly mirrorSubscriptions: number;
+  readonly replicaSubscriptions: number;
+  readonly deliveryConnections: number;
+}
+// Final-disposal observations for owners still held by this runtime/registry.
+// This is not a historical count of owners retired by earlier incarnation changes.
+interface ListenerDisposalSummary {
+  readonly sessions: number;
+  readonly owners: number;
+  readonly failures: number;
+  readonly canonical: number;
+  readonly raw: number;
+  readonly upstream: number;
+  readonly authority: number;
+  readonly consumerHandles: number;
+  readonly deliveryConnections: number;
+  readonly deliverySources: number;
+  readonly pendingDeliverySources: number;
+  readonly pendingSourceCloses: number;
+  readonly pendingDeliveryClients: number;
+}
+const emptyListenerDisposal = (): ListenerDisposalSummary => ({
+  sessions: 0,
+  owners: 0,
+  failures: 0,
+  canonical: 0,
+  raw: 0,
+  upstream: 0,
+  authority: 0,
+  consumerHandles: 0,
+  deliveryConnections: 0,
+  deliverySources: 0,
+  pendingDeliverySources: 0,
+  pendingSourceCloses: 0,
+  pendingDeliveryClients: 0,
+});
+
 export interface SessionRuntimeQualificationSnapshot {
   readonly generation: SessionRuntimeGeneration;
   readonly controlChannels: number;
+  readonly mirrorListeners: ReturnType<MirrorService["qualificationListeners"]>;
+  readonly listenerDisposal: ListenerDisposalSummary | null;
   readonly controllerLeases: number;
   readonly sessions: readonly {
     readonly session: string;
     readonly consumers: number;
     readonly retained: boolean;
+    readonly listeners: RuntimeListenerCounts;
     readonly delivery: TerminalDeliveryMetrics;
     readonly convergence: TerminalDeliveryConvergenceSnapshot;
     readonly replicas: Readonly<Record<string, TerminalReplicaQualificationSnapshot>>;
@@ -179,6 +223,8 @@ export interface SessionRuntimeConsumer {
   noteActivity(activity: SessionRuntimeActivityKind): void;
   acquireAuthority(authority: SessionRuntimeAuthorityKind): SessionRuntimeAuthorityLease | null;
   releaseAuthority(authority: SessionRuntimeAuthorityKind): void;
+  /** Assert an existing exact geometry grant without acquiring authority or fitting. */
+  assertGeometryAuthority(lease: SessionRuntimeAuthorityLease): void;
   acquireController(): SessionRuntimeControllerLease;
   handoffController(
     lease: SessionRuntimeControllerLease,
@@ -231,6 +277,7 @@ export interface SessionRuntimeConsumer {
     semanticPaneId: string,
     offer: TerminalDeliveryOffer,
     onMessage: (message: TerminalDeliveryServerMessage) => void | Promise<void>,
+    deliveryWorkspaceName?: string,
   ): Promise<TerminalDeliveryConnection>;
   close(): Promise<void>;
 }
@@ -250,6 +297,7 @@ interface ExecutionHandleState {
   readonly allowedSourcePaneIds: ReadonlySet<string>;
   readonly sourceSemanticPaneId: string | null;
   readonly authorizeLiveScope: ((semanticPaneId?: string) => void) | null;
+  readonly authorizeGeometry: (() => void) | null;
 }
 
 /**
@@ -272,6 +320,7 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
   readonly #observability: SessionRuntimeObservability;
   readonly #createTraceCorrelator: (scheduler: SessionRuntimeScheduler) => RuntimeTraceCorrelator;
   readonly #sessions = new Map<string, SessionRuntime>();
+  #listenerDisposal: ListenerDisposalSummary | null = null;
   readonly #proofPrewarmOwnership = new Map<SessionRuntime, { owned: boolean; claims: number }>();
   readonly #trustedInventoryTokens = new WeakMap<
     object,
@@ -310,30 +359,47 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
       ...(this.#observability.enabled
         ? {
             nowMicros: () => this.#observability.nowMicros(),
-            onInputWrite: (_session, action, startedAtMicros, endedAtMicros, pendingBeforeSend) => {
-              for (const traceId of action.traceIds ?? []) {
-                const trace = this.#observability.beginTrace(
-                  "terminal-input-to-paint",
-                  { generation: this.generation, incarnation: null },
-                  traceId,
-                );
-                this.#observability.recordSpan(
-                  "tmux",
-                  "control-write",
-                  startedAtMicros,
-                  endedAtMicros,
-                  trace,
-                );
-                this.#observability.recordSpan(
-                  "tmux",
-                  pendingBeforeSend === 0
-                    ? "control-queue-empty-at-send"
-                    : "control-queue-nonempty-at-send",
-                  endedAtMicros,
-                  endedAtMicros,
-                  trace,
-                );
-              }
+            captureInputWrite: (session, action, semanticPaneId) => {
+              const runtime = this.#sessions.get(session);
+              const binding = runtime?.captureInputDispatch(semanticPaneId);
+              return (startedAtMicros, endedAtMicros, pendingBeforeSend, paneCurrent) => {
+                const incarnation =
+                  paneCurrent && this.#sessions.get(session) === runtime
+                    ? (binding?.() ?? null)
+                    : null;
+                for (const traceId of action.traceIds ?? []) {
+                  const trace = this.#observability.beginTrace(
+                    "terminal-input-to-paint",
+                    {
+                      generation: this.generation,
+                      incarnation,
+                      controlDispatch: Object.freeze({
+                        workspaceName: session,
+                        nativePaneId: action.pane,
+                        semanticPaneId: paneCurrent ? semanticPaneId : null,
+                        scope: "dispatch-time" as const,
+                      }),
+                    },
+                    traceId,
+                  );
+                  this.#observability.recordSpan(
+                    "tmux",
+                    "control-write",
+                    startedAtMicros,
+                    endedAtMicros,
+                    trace,
+                  );
+                  this.#observability.recordSpan(
+                    "tmux",
+                    pendingBeforeSend === 0
+                      ? "control-queue-empty-at-send"
+                      : "control-queue-nonempty-at-send",
+                    endedAtMicros,
+                    endedAtMicros,
+                    trace,
+                  );
+                }
+              };
             },
           }
         : {}),
@@ -574,6 +640,21 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
     return this.#mirror.paneResizeTransport(session);
   }
 
+  readWindowSplitLayout(
+    session: string,
+    target: Parameters<MirrorService["readWindowSplitLayout"]>[1],
+  ): ReturnType<MirrorService["readWindowSplitLayout"]> {
+    if (this.#disposed) return Promise.reject(new Error("Session runtime disposed"));
+    return this.#mirror.readWindowSplitLayout(session, target);
+  }
+
+  resizeWindowSplit(
+    ...args: Parameters<MirrorService["resizeWindowSplit"]>
+  ): ReturnType<MirrorService["resizeWindowSplit"]> {
+    if (this.#disposed) return Promise.reject(new Error("Session runtime disposed"));
+    return this.#mirror.resizeWindowSplit(...args);
+  }
+
   executeWindowLinkAction(
     session: string,
     request: Parameters<MirrorService["executeWindowLinkAction"]>[1],
@@ -607,6 +688,7 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
     lease: SessionRuntimeControllerLease,
     allowedSourcePaneIds: readonly string[],
     authorizeLiveScope?: (semanticPaneId?: string) => void,
+    authorizeGeometry?: () => void,
   ): SessionRuntimeExecutionHandle {
     const runtime = this.#sessions.get(consumer.session);
     if (!runtime || !runtime.ownsConsumer(consumer)) {
@@ -624,6 +706,7 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
       allowedSourcePaneIds: new Set(allowedSourcePaneIds),
       sourceSemanticPaneId: null,
       authorizeLiveScope: authorizeLiveScope ?? null,
+      authorizeGeometry: authorizeGeometry ?? null,
     });
     return handle;
   }
@@ -762,6 +845,7 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
       authenticatedSourceSemanticPaneId,
       () => this.#assertExecutionHandle(handle, state.sourceSemanticPaneId ?? undefined),
       authoredOriginForSurface(state.consumer.surface),
+      state.authorizeGeometry ?? undefined,
     );
   }
 
@@ -904,10 +988,20 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
     authenticatedSourceSemanticPaneId: string | null = null,
     authorizeBeforeEffect?: () => void,
     authenticatedOrigin?: AuthoredInteractionOrigin,
+    authorizeGeometry?: () => void,
   ): Promise<SessionRuntimeIntentResult> {
     if (this.#disposed) return Promise.reject(new Error("SessionRuntimeRegistry is disposed"));
     runtime.assertController(lease);
     let intent = SessionRuntimeSemanticIntentSchemaZ.parse(rawIntent);
+    const requiresGeometry = intent.verb === "workspace.window.split.resize";
+    if (requiresGeometry && !authorizeGeometry) {
+      return Promise.reject(
+        new SessionRuntimeControllerLeaseError(
+          "invalid-client-capability",
+          "Split resize requires explicit geometry authority.",
+        ),
+      );
+    }
     const resolvedSession =
       intent.verb === "workspace.session.kill" && intent.fleetTarget
         ? intent.fleetTarget.daemonInstanceId === this.generation
@@ -936,7 +1030,12 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
     return this.#semanticMutations.submit(operationId, intent, {
       origin: authenticatedOrigin ?? "sdk",
       authenticatedSourceSemanticPaneId,
-      authorizeBeforeEffect,
+      authorizeBeforeEffect: requiresGeometry
+        ? () => {
+            authorizeBeforeEffect?.();
+            authorizeGeometry!();
+          }
+        : authorizeBeforeEffect,
     });
   }
 
@@ -981,6 +1080,8 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
     return Object.freeze({
       generation: this.generation,
       controlChannels: this.activeControlChannelCount(),
+      mirrorListeners: this.#mirror.qualificationListeners(),
+      listenerDisposal: this.#listenerDisposal,
       controllerLeases: this.activeControllerLeaseCount(),
       sessions: Object.freeze(
         [...this.#sessions.values()].map((runtime) => runtime.qualificationSnapshot()),
@@ -996,7 +1097,30 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
       this.#stopExitObserver();
       this.#disposePromise = (async () => {
         await this.#semanticMutations?.dispose();
-        await Promise.allSettled([...this.#sessions.values()].map((runtime) => runtime.dispose()));
+        const runtimes = [...this.#sessions.values()];
+        const results = await Promise.allSettled(runtimes.map((runtime) => runtime.dispose()));
+        const final = { ...emptyListenerDisposal(), sessions: runtimes.length };
+        runtimes.forEach((runtime, index) => {
+          const counts = runtime.listenerDisposal;
+          if (!counts || results[index]?.status === "rejected") final.failures += 1;
+          if (counts)
+            for (const key of [
+              "owners",
+              "failures",
+              "canonical",
+              "raw",
+              "upstream",
+              "authority",
+              "consumerHandles",
+              "deliveryConnections",
+              "deliverySources",
+              "pendingDeliverySources",
+              "pendingSourceCloses",
+              "pendingDeliveryClients",
+            ] as const)
+              final[key] += counts[key];
+        });
+        this.#listenerDisposal = Object.freeze(final);
         this.#sessions.clear();
         this.#proofPrewarmOwnership.clear();
         await this.#mirror.dispose();
@@ -1099,6 +1223,7 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
 class SessionRuntime {
   readonly #mirror: MirrorService;
   readonly #consumers = new Set<SessionRuntimeConsumerImpl>();
+  listenerDisposal: ListenerDisposalSummary | null = null;
   readonly #consumersByClientId = new Map<string, SessionRuntimeConsumerImpl>();
   readonly #terminalReplicas = new Map<string, SessionRuntimeTerminalReplicaOwner>();
   readonly #terminalReplicaClocks = new Map<string, { epoch: number; revision: number }>();
@@ -1275,11 +1400,44 @@ class SessionRuntime {
     return this.#consumers.size > 0;
   }
 
+  private listenerCounts(): RuntimeListenerCounts {
+    const counts = {
+      authority: this.#authorityListeners.size,
+      mirrorSubscriptions: 0,
+      replicaSubscriptions: 0,
+      deliveryConnections: 0,
+    };
+    for (const consumer of this.#consumers) {
+      const handles = consumer.qualificationListeners();
+      counts.mirrorSubscriptions += handles.mirrorSubscriptions;
+      counts.replicaSubscriptions += handles.replicaSubscriptions;
+      counts.deliveryConnections += handles.deliveryConnections;
+    }
+    return Object.freeze(counts);
+  }
+
+  captureInputDispatch(semanticPaneId: string | null): () => string | null {
+    const owner =
+      this.#disposed || semanticPaneId === null
+        ? undefined
+        : this.#terminalReplicas.get(semanticPaneId);
+    const incarnation = owner?.inputDispatchIncarnation() ?? null;
+    return () =>
+      !this.#disposed &&
+      semanticPaneId !== null &&
+      owner !== undefined &&
+      this.#terminalReplicas.get(semanticPaneId) === owner &&
+      owner.inputDispatchIncarnation() === incarnation
+        ? incarnation
+        : null;
+  }
+
   qualificationSnapshot(): SessionRuntimeQualificationSnapshot["sessions"][number] {
     return Object.freeze({
       session: this.session,
       consumers: this.#consumers.size,
       retained: this.#retention !== null,
+      listeners: this.listenerCounts(),
       delivery: this.#terminalDeliveryHub.metrics(),
       convergence: this.#terminalDeliveryHub.convergenceSnapshot(),
       replicas: Object.freeze(
@@ -1358,7 +1516,9 @@ class SessionRuntime {
     const candidate = this.#validatedLease(lease);
     const releaseKey = this.#leaseKey(candidate);
     if (this.#releasedLeases.has(releaseKey) && candidate.clientId === callerClientId) return;
-    this.assertController(candidate, callerClientId);
+    // Surrendering ownership must remain possible while topology is being verified.
+    // Exact lease identity is still required; only use/acquisition needs topology authority.
+    this.#assertControllerIdentity(candidate, callerClientId);
     this.#releasedLeases.add(releaseKey);
     if (this.#releasedLeases.size > 32) {
       this.#releasedLeases.delete(this.#releasedLeases.values().next().value!);
@@ -1370,6 +1530,10 @@ class SessionRuntime {
 
   assertController(lease: SessionRuntimeControllerLease, callerClientId?: string): void {
     this.assertNoSharedWindow();
+    this.#assertControllerIdentity(lease, callerClientId);
+  }
+
+  #assertControllerIdentity(lease: SessionRuntimeControllerLease, callerClientId?: string): void {
     const parsedLease = this.#validatedLease(lease);
     if (
       parsedLease.generation !== this.generation ||
@@ -1575,13 +1739,8 @@ class SessionRuntime {
     else this.#mirror.fitWindowViewport(this.session, semanticWindowId, cols, rows);
   }
 
-  fitViewportWithAuthority(
-    clientId: string,
-    lease: SessionRuntimeAuthorityLease,
-    cols: number,
-    rows: number,
-    semanticWindowId?: string,
-  ): void {
+  assertGeometryAuthority(clientId: string, lease: SessionRuntimeAuthorityLease): void {
+    if (this.#disposed) throw new Error(`SessionRuntime ${this.session} is disposed`);
     this.assertNoSharedWindow();
     const parsed = SessionRuntimeAuthorityLeaseSchemaZ.parse(lease);
     let exact: SessionRuntimeAuthorityLease;
@@ -1599,6 +1758,16 @@ class SessionRuntime {
         "The client does not own this geometry authority lease.",
       );
     }
+  }
+
+  fitViewportWithAuthority(
+    clientId: string,
+    lease: SessionRuntimeAuthorityLease,
+    cols: number,
+    rows: number,
+    semanticWindowId?: string,
+  ): void {
+    this.assertGeometryAuthority(clientId, lease);
     this.#mirror.setGeometryParticipation(this.session, true);
     if (semanticWindowId === undefined) this.#mirror.fitViewport(this.session, cols, rows);
     else this.#mirror.fitWindowViewport(this.session, semanticWindowId, cols, rows);
@@ -1731,7 +1900,9 @@ class SessionRuntime {
     semanticPaneId: string,
     offer: TerminalDeliveryOffer,
     onMessage: (message: TerminalDeliveryServerMessage) => void | Promise<void>,
+    deliveryWorkspaceName?: string,
   ): Promise<TerminalDeliveryConnection> {
+    const address = WorkspaceIdSchemaZ.parse(deliveryWorkspaceName ?? this.session);
     await this.whenReady();
     await this.#restartBarrier;
     this.#assertConnected(clientId);
@@ -1746,6 +1917,7 @@ class SessionRuntime {
         laneId: deliverySubscriberId,
         requestId: deliveryRequestId,
       }),
+      address,
     );
   }
 
@@ -1777,8 +1949,10 @@ class SessionRuntime {
             current.epoch += 1;
             this.#terminalReplicaClocks.set(semanticPaneId, current);
           },
-          onFault: () => {
+          onFault: (error) => {
             if (this.#terminalReplicas.get(semanticPaneId) !== candidate) return;
+            if (error instanceof StockCaptureTabUnavailableError)
+              this.#terminalDeliveryHub.failPaneCapture(semanticPaneId, error);
             this.#outputTraces?.clearPane(semanticPaneId);
             this.#terminalReplicas.delete(semanticPaneId);
             this.#restartBarrier = this.#restartBarrier.then(async () => {
@@ -1896,22 +2070,51 @@ class SessionRuntime {
     this.#trustedInventoryRuntimeSessionId = null;
     this.#trustedInventoryEpoch += 1;
     const consumers = [...this.#consumers];
-    await Promise.allSettled(consumers.map((consumer) => consumer.close()));
+    const consumerResults = await Promise.allSettled(consumers.map((consumer) => consumer.close()));
     this.#clearController();
     this.#authority.dispose();
     this.#authorityListeners.clear();
     this.#completedHandoffs.clear();
     this.#releasedLeases.clear();
     this.#outputTraces?.clear();
-    await Promise.allSettled(
-      [...this.#terminalReplicas.values()].map((owner) => owner.dispose("runtime-disposed")),
+    const owners = [...this.#terminalReplicas.values()];
+    const results = await Promise.allSettled(
+      owners.map((owner) => owner.dispose("runtime-disposed")),
     );
+    const final = {
+      ...emptyListenerDisposal(),
+      sessions: 1,
+      owners: owners.length,
+      failures: [...results, ...consumerResults].filter((result) => result.status === "rejected")
+        .length,
+    };
+    for (const owner of owners) {
+      const counts = owner.qualificationSnapshot().listeners;
+      final.canonical += counts.canonical;
+      final.raw += counts.raw;
+      final.upstream += counts.upstream;
+    }
+    for (const consumer of consumers) {
+      const counts = consumer.qualificationListeners();
+      final.failures += counts.closeFailures;
+      final.consumerHandles +=
+        counts.mirrorSubscriptions + counts.replicaSubscriptions + counts.deliveryConnections;
+    }
+    final.authority = this.#authorityListeners.size;
     this.#terminalReplicas.clear();
     await this.#terminalDeliveryHub.close();
     await this.#startPromise?.catch(() => undefined);
     await this.#restartBarrier;
     await this.#retention?.close();
     this.#retention = null;
+    const delivery = this.#terminalDeliveryHub.metrics();
+    final.deliveryConnections = delivery.connections;
+    final.deliverySources = delivery.sourceSubscriptions;
+    final.pendingDeliverySources = delivery.pendingSourceSubscriptions;
+    final.pendingSourceCloses = delivery.pendingSourceCloses;
+    final.pendingDeliveryClients = delivery.pendingClients;
+    final.failures += delivery.sourceCloseFailures;
+    this.listenerDisposal = Object.freeze(final);
   }
 
   #assertConnected(clientId: string): void {
@@ -2045,6 +2248,11 @@ class SessionRuntimeConsumerImpl implements SessionRuntimeConsumer {
     return this.#runtime.acquireAuthority(this.clientId, authority);
   }
 
+  assertGeometryAuthority(lease: SessionRuntimeAuthorityLease): void {
+    this.#assertOpen();
+    this.#runtime.assertGeometryAuthority(this.clientId, lease);
+  }
+
   releaseAuthority(authority: SessionRuntimeAuthorityKind): void {
     this.#assertOpen();
     this.#runtime.releaseAuthority(this.clientId, authority);
@@ -2185,7 +2393,9 @@ class SessionRuntimeConsumerImpl implements SessionRuntimeConsumer {
     semanticPaneId: string,
     offer: TerminalDeliveryOffer,
     onMessage: (message: TerminalDeliveryServerMessage) => void | Promise<void>,
+    deliveryWorkspaceName?: string,
   ): Promise<TerminalDeliveryConnection> {
+    const address = WorkspaceIdSchemaZ.parse(deliveryWorkspaceName ?? this.session);
     this.#assertOpen();
     const upstream = await this.#runtime.openTerminalDelivery(
       this.clientId,
@@ -2195,6 +2405,7 @@ class SessionRuntimeConsumerImpl implements SessionRuntimeConsumer {
       semanticPaneId,
       offer,
       onMessage,
+      address,
     );
     if (this.#closed) {
       await upstream.close();
@@ -2218,6 +2429,17 @@ class SessionRuntimeConsumerImpl implements SessionRuntimeConsumer {
     return connection;
   }
 
+  #closeFailures = 0;
+
+  qualificationListeners() {
+    return Object.freeze({
+      closeFailures: this.#closeFailures,
+      mirrorSubscriptions: this.#subscriptions.size,
+      replicaSubscriptions: this.#replicaSubscriptions.size,
+      deliveryConnections: this.#deliveryConnections.size,
+    });
+  }
+
   async close(): Promise<void> {
     if (this.#closed) return;
     this.#closed = true;
@@ -2230,9 +2452,18 @@ class SessionRuntimeConsumerImpl implements SessionRuntimeConsumer {
     // Authority retirement is synchronous. A slow/frozen mirror subscription
     // must never keep controller leases or previously issued handles alive.
     this.#runtime.release(this);
-    await Promise.allSettled(subscriptions.map((subscription) => subscription.close()));
-    await Promise.allSettled(replicaSubscriptions.map((subscription) => subscription.close()));
-    await Promise.allSettled(deliveryConnections.map((connection) => connection.close()));
+    const mirrorResults = await Promise.allSettled(
+      subscriptions.map((subscription) => subscription.close()),
+    );
+    const replicaResults = await Promise.allSettled(
+      replicaSubscriptions.map((subscription) => subscription.close()),
+    );
+    const deliveryResults = await Promise.allSettled(
+      deliveryConnections.map((connection) => connection.close()),
+    );
+    this.#closeFailures += [...mirrorResults, ...replicaResults, ...deliveryResults].filter(
+      (result) => result.status === "rejected",
+    ).length;
   }
 
   #assertOpen(): void {

package/packages/daemon/src/terminal/session-runtime/runtime-observability.ts

@@ -9,6 +9,13 @@ import { z } from "zod";
 export interface SessionRuntimeTraceAuthority {
   readonly generation: SessionRuntimeGeneration;
   readonly incarnation: string | null;
+  /** Current dispatch target only; neither admission authority nor native acceptance. */
+  readonly controlDispatch?: Readonly<{
+    workspaceName: string;
+    nativePaneId: string;
+    semanticPaneId: string | null;
+    scope: "dispatch-time";
+  }>;
 }
 
 export interface SessionRuntimeTraceContext {

package/packages/daemon/src/terminal/session-runtime/semantic-mutation-executor.ts

@@ -98,6 +98,8 @@ export interface SessionSemanticMutationExecutorOptions {
       record(operation: string, startedAtMicros: number, endedAtMicros: number): void;
     }>,
     execution?: AuthoredExecutionContext,
+    /** Revalidate immediately before dispatch after any asynchronous preparation. */
+    authorizeBeforeEffect?: () => void,
   ) => SessionRuntimeIntentResult | Promise<SessionRuntimeIntentResult>;
   /** Publishes through the daemon's existing replayable interaction journal. */
   readonly publishReceipt: (receipt: SessionRuntimeReceiptInput) => InteractionReceipt;
@@ -545,11 +547,21 @@ export class SessionSemanticMutationExecutor {
         tmuxStarted = null;
       }
     }
+    let executionActive = true;
     try {
       // Admission can wait behind prior work. Revalidate the opaque principal
       // at the last synchronous boundary before tmux receives any effect.
-      if (interactionContext) this.#options.validateInteractionContext?.(interactionContext);
-      authorizeBeforeEffect?.();
+      const revalidateBeforeEffect = () => {
+        if (this.#disposed || !executionActive) {
+          throw new SessionRuntimeIntentError(
+            "rejected",
+            "Semantic execution authority is no longer active",
+          );
+        }
+        if (interactionContext) this.#options.validateInteractionContext?.(interactionContext);
+        authorizeBeforeEffect?.();
+      };
+      revalidateBeforeEffect();
       result = await this.#options.execute(
         operationId,
         intent,
@@ -557,17 +569,24 @@ export class SessionSemanticMutationExecutor {
         interactionContext
           ? { interactionContext, origin, executionId, authoredReceiptAdmissionSequence }
           : undefined,
+        revalidateBeforeEffect,
       );
     } catch (cause) {
       if (needsTmuxObservation) this.#deletePending(session, operationId);
       const error = new SessionRuntimeIntentError(
         "rejected",
-        "tmux rejected the semantic interaction",
+        cause &&
+          typeof cause === "object" &&
+          "code" in cause &&
+          cause.code === "mutation_unverified"
+          ? "Mutation outcome is uncertain; do not retry with a new operation ID."
+          : "tmux rejected the semantic interaction",
         { cause },
       );
       this.#publish(operationId, intent, "rejected", null, undefined, origin, interactionContext);
       throw error;
     } finally {
+      executionActive = false;
       if (tmuxStarted !== null)
         try {
           const tmuxEnded = this.#observability.nowMicros();

package/packages/daemon/src/terminal/session-runtime/stock-capture-fidelity.ts

@@ -0,0 +1,13 @@
+import { STOCK_CAPTURE_TAB_UNAVAILABLE } from "@tmux-ide/contracts";
+
+export class StockCaptureTabUnavailableError extends Error {
+  constructor() {
+    super(STOCK_CAPTURE_TAB_UNAVAILABLE);
+    this.name = "StockCaptureTabUnavailableError";
+  }
+}
+
+/** ANSI capture drops stored tab widths. Live HT is cursor motion, not capture paint. */
+export function assertStockCaptureRepresentable(chunks: readonly Uint8Array[]): void {
+  if (chunks.some((chunk) => chunk.includes(9))) throw new StockCaptureTabUnavailableError();
+}