tmux-ide 2.9.5 → 2.9.6

package/packages/daemon/src/lib/tmux-pane-editor-context.ts

@@ -0,0 +1,124 @@
+import { isAbsolute, resolve } from "node:path";
+import { z } from "zod";
+import {
+  PaneEditorContextTargetSchemaZ,
+  WorkspacePaneCwdSchemaZ,
+  type PaneEditorContextTarget,
+  type PaneEditorContextObservation,
+} from "@tmux-ide/contracts";
+import type { LiveSessionSummary } from "../command-center/discovery.ts";
+import type {
+  NativeTerminalInventoryPaneSnapshot,
+  WorkspaceTerminalInventoryRuntime,
+} from "../terminal/attachments/native-runtime.ts";
+import type { WorkspaceRegistry } from "./workspace-registry.ts";
+import { materializePaneCwd, normalizePaneCwd } from "./workspace-state.ts";
+
+export type { PaneEditorContextTarget, PaneEditorContextObservation } from "@tmux-ide/contracts";
+
+interface Options {
+  readonly generation: string;
+  readonly assertOpen: () => void;
+  readonly registry: Pick<WorkspaceRegistry, "get">;
+  readonly catalog: () => Promise<LiveSessionSummary[]>;
+  readonly inventory: Pick<WorkspaceTerminalInventoryRuntime, "discoverTerminalInventory">;
+}
+
+/** Constructed only by the direct, generation-fenced local tmux server owner. */
+export function createPaneEditorContextResolver(options: Options) {
+  const generation = z.uuid().parse(options.generation);
+  return async (
+    input: PaneEditorContextTarget,
+    cancellation?: AbortSignal,
+  ): Promise<PaneEditorContextObservation> => {
+    const target = PaneEditorContextTargetSchemaZ.parse(input);
+    // A supplied signal selects a fresh inventory read, not an existing flight.
+    const signal = cancellation
+      ? AbortSignal.any([cancellation, AbortSignal.timeout(5_000)])
+      : AbortSignal.timeout(5_000);
+    const unavailable = (): never => {
+      throw new Error("Selected pane editor context is unavailable");
+    };
+    const assertOwner = () => {
+      options.assertOpen();
+      signal.throwIfAborted();
+      if (target.generation !== generation) unavailable();
+    };
+    assertOwner();
+    const workspace = options.registry.get(target.workspaceName);
+    if (!workspace) return unavailable();
+    const { sessionName, projectDir } = workspace;
+    if (!isAbsolute(projectDir)) return unavailable();
+    const assertScope = () => {
+      assertOwner();
+      const current = options.registry.get(target.workspaceName);
+      if (
+        current !== workspace ||
+        current.sessionName !== sessionName ||
+        current.projectDir !== projectDir
+      )
+        unavailable();
+    };
+    const checkCatalog = async () => {
+      assertScope();
+      const sessions = await options.catalog();
+      assertScope();
+      const matches = sessions.filter((session) => session.liveSessionId === target.liveSessionId);
+      if (matches.length !== 1 || matches[0]!.sessionName !== sessionName) unavailable();
+    };
+    const readPane = async (): Promise<NativeTerminalInventoryPaneSnapshot> => {
+      assertScope();
+      const snapshot = await options.inventory.discoverTerminalInventory(signal);
+      assertScope();
+      const analysis = snapshot.catalog;
+      if (
+        analysis.invalidRuntimeProof ||
+        analysis.duplicateSemanticStamp ||
+        analysis.duplicateRuntimePaneBinding
+      )
+        unavailable();
+      const matches = snapshot.panes.filter(
+        (pane) =>
+          pane.workspaceName === target.workspaceName &&
+          pane.semanticPaneId === target.semanticPaneId,
+      );
+      if (matches.length !== 1) return unavailable();
+      const pane = matches[0]!;
+      if (pane.sessionName !== sessionName || !pane.dir || !isAbsolute(pane.dir)) unavailable();
+      // Detach observations from mutable discovery/test adapters before another await.
+      return { ...pane };
+    };
+    await checkCatalog();
+    assertScope();
+    const before = await readPane();
+    assertScope();
+    await checkCatalog();
+    assertScope();
+    // Discovery already fences topology internally. This second read additionally
+    // refuses a cwd/binding change during resolution; it never retries a selection.
+    const after = await readPane();
+    assertScope();
+    for (const key of [
+      "sessionId",
+      "windowId",
+      "runtimePaneId",
+      "windowStamp",
+      "nativePaneBirthId",
+      "dir",
+    ] as const)
+      if ((before[key] ?? null) !== (after[key] ?? null)) unavailable();
+    // No saved layout fallback: projectDir only expresses the live cwd as a
+    // typed project-relative value when the existing containment policy permits it.
+    const absolute = WorkspacePaneCwdSchemaZ.parse({ kind: "absolute", path: resolve(after.dir) });
+    const relative = WorkspacePaneCwdSchemaZ.safeParse(normalizePaneCwd(after.dir, projectDir));
+    const cwd =
+      relative.success && materializePaneCwd(relative.data, projectDir) === absolute.path
+        ? relative.data
+        : absolute;
+    const directory = materializePaneCwd(cwd, projectDir);
+    // Portable project-relative paths accept both separator styles. A literal
+    // backslash on POSIX must not silently name a different local directory.
+    if (!directory || directory !== absolute.path) return unavailable();
+    return Object.freeze({ ...target, cwd: Object.freeze(cwd), directory });
+  };
+}

package/packages/daemon/src/lib/tmux-server-agent-admission.ts

@@ -0,0 +1,96 @@
+import { z } from "zod";
+import { TerminalAttachmentSemanticPaneIdSchemaZ } from "@tmux-ide/contracts";
+import {
+  agentIdForPaneStamp,
+  fallbackPaneId,
+} from "../command-center/resources/application-shell.ts";
+
+export const observedAgentSchema = z
+  .object({
+    observedPaneId: z.string().min(1).max(512),
+    observedAgentId: z.string().min(1).max(512),
+  })
+  .strict();
+export type ObservedAgent = z.infer<typeof observedAgentSchema>;
+type Binding = { pane: string; birth: string; window: string; stamp: string };
+
+/** Fresh daemon facts only. No label/index fallback and no client-supplied native IDs. */
+export async function captureAgentAdmission(
+  run: (args: readonly string[]) => Promise<string>,
+  session: { id: string; name: string },
+  observed: ObservedAgent,
+) {
+  const scan = async (): Promise<Binding[]> => {
+    const raw = await run([
+      "list-panes",
+      "-s",
+      "-t",
+      session.id,
+      "-F",
+      "#{session_id}\t#{window_id}\t#{pane_id}\t#{pane_birth_id}\t#{@tmux_ide_pane_id}",
+    ]);
+    if (Buffer.byteLength(raw) > 1024 * 1024)
+      throw new Error("Agent inventory exceeds admission bounds");
+    const rows = raw
+      .replace(/\n+$/u, "")
+      .split("\n")
+      .map((line) => {
+        const fields = line.split("\t");
+        const [id, window, pane, birth, stamp] = fields;
+        if (
+          fields.length !== 5 ||
+          id !== session.id ||
+          !/^@\d+$/.test(window!) ||
+          !/^%\d+$/.test(pane!) ||
+          !/^[1-9]\d*$/.test(birth!)
+        )
+          throw new Error("Agent native identity is unavailable");
+        return { window: window!, pane: pane!, birth: birth!, stamp: stamp! };
+      });
+    if (rows.length > 512) throw new Error("Agent inventory exceeds admission bounds");
+    return rows;
+  };
+  const initial = await scan();
+  const candidates = initial.filter((row) => {
+    const id =
+      row.stamp === ""
+        ? fallbackPaneId(
+            { name: session.name, runtimeSessionId: session.id },
+            { runtimePaneId: row.pane },
+          )
+        : row.stamp;
+    return id === observed.observedPaneId && agentIdForPaneStamp(id) === observed.observedAgentId;
+  });
+  if (candidates.length !== 1) throw new Error("Observed agent is no longer unique");
+  const captured = candidates[0]!;
+  if (
+    captured.stamp &&
+    (!TerminalAttachmentSemanticPaneIdSchemaZ.safeParse(captured.stamp).success ||
+      initial.filter((r) => r.stamp === captured.stamp).length !== 1)
+  )
+    throw new Error("Observed agent stamp is ambiguous");
+  return {
+    async verify(promoted: boolean) {
+      const rows = await scan();
+      const matching = rows.filter((row) => row.pane === captured.pane);
+      if (
+        matching.length !== 1 ||
+        matching[0]!.birth !== captured.birth ||
+        matching[0]!.window !== captured.window
+      )
+        throw new Error("Observed agent lifetime changed");
+      const current = matching[0]!;
+      if (captured.stamp && current.stamp !== captured.stamp)
+        throw new Error("Observed agent stamp changed");
+      if (!promoted && current.stamp !== captured.stamp)
+        throw new Error("Observed agent stamp changed");
+      if (
+        promoted &&
+        (!TerminalAttachmentSemanticPaneIdSchemaZ.safeParse(current.stamp).success ||
+          rows.filter((row) => row.stamp === current.stamp).length !== 1)
+      )
+        throw new Error("Promoted agent identity is unavailable");
+      return current.stamp;
+    },
+  };
+}

package/packages/daemon/src/lib/tmux-server-owner.ts

@@ -1,3 +1,10 @@
+import { shellEscape } from "./shell.ts";
+import {
+  createNativeSplitCapabilityProbe,
+  createNativeSplitReadiness,
+} from "./native-split-capability.ts";
+import { executeCanonicalSplitMutation } from "./canonical-split-mutation.ts";
+import { createGuardedNativeSplitResize } from "./guarded-native-split-resize.ts";
 import { execFileSync } from "node:child_process";
 import { requireSupportedTmuxVersion } from "./tmux-version.ts";
 import { PaneSourceDiscovery } from "./pane-source-discovery.ts";
@@ -19,8 +26,15 @@ import { createNativeTmuxSessionCreator } from "./tmux-server-session-create.ts"
 import type { WorkspacePaneCreateMutationRequest } from "@tmux-ide/contracts";
 import { createTmuxSessionMutationFence } from "./tmux-session-mutation-fence.ts";
 import { createNativeTmuxSessionOpener } from "./tmux-server-session-open.ts";
+import { observedAgentSchema } from "./tmux-server-agent-admission.ts";
+import { createPaneEditorContextResolver } from "./tmux-pane-editor-context.ts";
 import { createHash, randomUUID } from "node:crypto";
-import { WorkspaceIdSchemaZ } from "@tmux-ide/contracts";
+import {
+  WorkspaceIdSchemaZ,
+  WindowLinkTargetSchemaZ,
+  type WindowLinkTarget,
+} from "@tmux-ide/contracts";
+import { WindowSplitLayoutUnavailable } from "../terminal/mirror/window-split-authority.ts";
 import { mkdirSync } from "node:fs";
 import { z } from "zod";
 import type { WorkspaceMultiplexerBackend } from "../command-center/actions/handlers/workspace-multiplexer.ts";
@@ -88,10 +102,19 @@ export function createNativeTmuxServerCatalog(
     assertOpen();
     const raw = await run(
       [
-        "list-panes",
-        "-a",
+        "-N",
+        "if-shell",
         "-F",
-        "#{pid}\t#{session_id}\t#{session_created}\t#{session_name}\t#{pane_id}\t#{session_path}",
+        "#{==:#{server_sessions},0}",
+        "display-message -p 'tmux-ide-empty-catalog-v1'",
+        [
+          "list-panes",
+          "-a",
+          "-F",
+          "#{pid}\t#{session_id}\t#{session_created}\t#{session_name}\t#{pane_id}\t#{session_path}",
+        ]
+          .map(shellEscape)
+          .join(" "),
       ],
       AbortSignal.timeout(2_000),
     );
@@ -100,7 +123,10 @@ export function createNativeTmuxServerCatalog(
       string,
       { summary: LiveSessionSummary; panes: Set<string>; dir: string }
     >();
-    for (const line of raw.trim().split("\n")) {
+    // Only the successful server-side zero-session branch proves emptiness.
+    // Command errors, unsupported formats and unwitnessed blank output stay failures.
+    const lines = raw.trim() === "tmux-ide-empty-catalog-v1" ? [] : raw.trim().split("\n");
+    for (const line of lines) {
       const [pid, id, created, name, pane, dir] = line.split("\t");
       if (
         !pid ||
@@ -272,8 +298,27 @@ export async function createNativeTmuxServerOwner(options: NativeTmuxServerOwner
           throw new Error("Interaction target lifetime is no longer current");
       },
       resolveSession: (name) => workspaceRegistry.get(name)?.sessionName ?? null,
-      execute: (operationId, intent, timing, execution) => {
+      execute: (operationId, intent, timing, execution, authorizeBeforeEffect) => {
         assertOpen();
+        if (intent.verb === "workspace.window.split.resize")
+          return executeCanonicalSplitMutation(
+            {
+              generation,
+              registry: sessionRuntimeRegistry,
+              resolveSession: (name) => workspaceRegistry.get(name)?.sessionName ?? null,
+              runNative: createGuardedNativeSplitResize({
+                observation: () => observationSelector,
+                runPinnedTmux: generationRun,
+              }),
+            },
+            operationId,
+            intent,
+            () => {
+              assertOpen();
+              if (!authorizeBeforeEffect) throw new Error("Missing execution authorization");
+              authorizeBeforeEffect();
+            },
+          );
         if (intent.verb === "workspace.pane.read")
           return multiplexer.readPane(operationId, intent, execution);
         if (
@@ -306,6 +351,15 @@ export async function createNativeTmuxServerOwner(options: NativeTmuxServerOwner
       traceAuthority: { generation, incarnation: null },
     },
     mirror: {
+      splitLayoutEpoch: () => observationSelector.nativeServerEpoch,
+      splitLayoutPrepare: createNativeSplitReadiness({
+        observation: () => observationSelector ?? null,
+        runPinnedTmux: generationRun,
+      }),
+      splitLayoutCapability: createNativeSplitCapabilityProbe({
+        observation: () => observationSelector ?? null,
+        runPinnedTmux: generationRun,
+      }),
       createOwnedViewerAdapter: createOwnedViewerAdapterFactory({
         environmentId: options.environmentId,
         serverScope: { serverId: options.serverId, generation },
@@ -464,6 +518,13 @@ export async function createNativeTmuxServerOwner(options: NativeTmuxServerOwner
     terminalInventoryRuntime.invalidate();
     return result;
   };
+  const resolvePaneEditorContext = createPaneEditorContextResolver({
+    generation,
+    assertOpen,
+    registry: workspaceRegistry,
+    catalog,
+    inventory: terminalInventoryRuntime,
+  });
   const multiplexerBackend: WorkspaceMultiplexerBackend = {
     mutate: async (...args) => {
       assertOpen();
@@ -535,8 +596,38 @@ export async function createNativeTmuxServerOwner(options: NativeTmuxServerOwner
   return {
     serverId: options.serverId,
     generation,
+    resolvePaneEditorContext,
     catalog,
+    readWindowSplitLayout: async (workspaceName: string, input: WindowLinkTarget) => {
+      assertOpen();
+      const target = WindowLinkTargetSchemaZ.parse(input);
+      const sessions = await catalog();
+      assertOpen();
+      const sessionName = workspaceRegistry.get(workspaceName)?.sessionName;
+      if (
+        !sessionName ||
+        !sessions.some(
+          (row) => row.sessionName === sessionName && row.liveSessionId === target.liveSessionId,
+        )
+      )
+        throw new WindowSplitLayoutUnavailable();
+      const resource = await sessionRuntimeRegistry.readWindowSplitLayout(sessionName, target);
+      assertOpen();
+      return resource;
+    },
     openSession,
+    openAgent: async (
+      liveSessionId: string,
+      observed: Parameters<typeof sessionOpener.openAgent>[1],
+    ) => {
+      const target = observedAgentSchema.parse(observed);
+      await catalog();
+      try {
+        return await sessionOpener.openAgent(liveSessionId, target);
+      } finally {
+        terminalInventoryRuntime.invalidate();
+      }
+    },
     createSession: sessionCreator.createSession,
     createSessionPane: async (
       liveSessionId: string,

package/packages/daemon/src/lib/tmux-server-session-open.ts

@@ -1,3 +1,8 @@
+import {
+  captureAgentAdmission,
+  observedAgentSchema,
+  type ObservedAgent,
+} from "./tmux-server-agent-admission.ts";
 import { randomUUID } from "node:crypto";
 import { WorkspaceCatalogLiveSessionIdSchemaZ } from "@tmux-ide/contracts";
 import { liveSessionIdForNativeIdentity } from "../terminal/protocol/live-session-identity.ts";
@@ -21,15 +26,16 @@ export function createNativeTmuxSessionOpener(options: {
     options.assertOpen();
     if (disposed) throw new Error("Session admission is retired");
   };
-  const open = async (liveSessionId: string) => {
+  const open = async (liveSessionId: string, observed?: ObservedAgent) => {
     assertOpen();
     const records = await options.run([
       "list-sessions",
       "-F",
       "#{pid}\t#{session_id}\t#{session_created}\t#{session_name}",
     ]);
+    // The final field is an exact session identity; spaces are valid name bytes.
     const matches = records
-      .trim()
+      .replace(/\n+$/u, "")
       .split("\n")
       .map((line) => line.split("\t"))
       .filter(
@@ -67,6 +73,10 @@ export function createNativeTmuxSessionOpener(options: {
         throw new Error("Selected live tmux session changed during admission");
       return output;
     };
+    const agent = observed
+      ? await captureAgentAdmission(run, { id: nativeSessionId!, name: name! }, observed)
+      : null;
+    await agent?.verify(false);
     const promotion = new WorkspacePromotionAuthority({
       daemonInstanceId: options.generation,
       registry: options.registry,
@@ -79,7 +89,12 @@ export function createNativeTmuxSessionOpener(options: {
         intent: { sessionId: fleetSessionIdForName(name!) },
       });
       await run(["display-message", "-p", "-t", nativeSessionId!, "#{session_id}"]);
-      return { workspaceName: result.resource.workspaceName, liveSessionId };
+      const semanticPaneId = await agent?.verify(true);
+      return {
+        workspaceName: result.resource.workspaceName,
+        liveSessionId,
+        ...(semanticPaneId ? { semanticPaneId } : {}),
+      };
     } finally {
       await promotion.dispose();
     }
@@ -98,6 +113,26 @@ export function createNativeTmuxSessionOpener(options: {
       tail = operation.catch(() => {});
       return operation;
     },
+    openAgent(
+      liveSessionId: string,
+      input: ObservedAgent,
+    ): Promise<{ workspaceName: string; liveSessionId: string; semanticPaneId: string }> {
+      WorkspaceCatalogLiveSessionIdSchemaZ.parse(liveSessionId);
+      const observed = observedAgentSchema.parse(input);
+      assertOpen();
+      if (pending.size >= 16) throw new Error("Session admission capacity reached");
+      const key = randomUUID();
+      const operation = tail
+        .then(async () => {
+          const result = await open(liveSessionId, observed);
+          if (!result.semanticPaneId) throw new Error("Agent admission returned no target");
+          return { ...result, semanticPaneId: result.semanticPaneId };
+        })
+        .finally(() => pending.delete(key));
+      pending.set(key, operation);
+      tail = operation.catch(() => {});
+      return operation;
+    },
     async dispose() {
       disposed = true;
       await tail;

package/packages/daemon/src/lib/tui-binary.ts

@@ -31,8 +31,8 @@ import { gunzipSync } from "node:zlib";
 import { acquirePrivateOperationLock } from "./private-operation-lock.ts";
 import { getCurrentVersion } from "./update-check.ts";
 
-/** The `<os>-<arch>` tags we publish a prebuilt TUI binary for. */
-export type TuiPlatformTag = "darwin-arm64" | "darwin-x64" | "linux-x64" | "linux-arm64";
+/** The `<os>-<arch>` tags we publish a prebuilt TUI binary for. Intel macOS is unsupported as of 2.9.6. */
+export type TuiPlatformTag = "darwin-arm64" | "linux-x64" | "linux-arm64";
 
 /** The GitHub repo the release assets live under. */
 export const RELEASE_REPO = "wavyrai/tmux-ide";
@@ -49,7 +49,6 @@ const MAX_CHECKSUM_MANIFEST_BYTES = 4 * 1024;
 
 const SUPPORTED: Record<string, TuiPlatformTag> = {
   "darwin-arm64": "darwin-arm64",
-  "darwin-x64": "darwin-x64",
   "linux-x64": "linux-x64",
   "linux-arm64": "linux-arm64",
 };

package/packages/daemon/src/lib/workspace-multiplexer-verbs.ts

@@ -887,6 +887,8 @@ export class WorkspaceMultiplexerAuthority {
     } as const;
 
     switch (intent.verb) {
+      case "workspace.window.split.resize":
+        throw new WorkspaceMultiplexerError("workspace_unavailable");
       case "workspace.window.link.select":
       case "workspace.window.link.unlink":
         throw new WorkspaceMultiplexerError("workspace_unavailable", {

package/packages/daemon/src/lib/workspace-state.ts

@@ -794,7 +794,7 @@ function requireProjectRoot(projectRoot: string): string {
   return resolve(root);
 }
 
-function normalizePaneCwd(cwd: string | null, projectRoot: string): WorkspacePaneCwd | null {
+export function normalizePaneCwd(cwd: string | null, projectRoot: string): WorkspacePaneCwd | null {
   if (cwd === null) return null;
   const absolutePath = resolve(projectRoot, cwd);
   const portablePath = relative(projectRoot, absolutePath);
@@ -806,7 +806,10 @@ function normalizePaneCwd(cwd: string | null, projectRoot: string): WorkspacePan
     : { kind: "absolute", path: absolutePath };
 }
 
-function materializePaneCwd(cwd: WorkspacePaneCwd | null, projectRoot: string): string | null {
+export function materializePaneCwd(
+  cwd: WorkspacePaneCwd | null,
+  projectRoot: string,
+): string | null {
   if (!cwd) return null;
   if (cwd.kind === "absolute") return cwd.path;
   const root = requireProjectRoot(projectRoot);

package/packages/daemon/src/terminal/mirror/mirror-service.ts

@@ -1,3 +1,15 @@
+import { setTimeout as waitForPublication } from "node:timers/promises";
+import {
+  WindowSplitResizeTargetSchemaZ,
+  type WindowLinkTarget,
+  type WindowSplitLayoutResource,
+  type WindowSplitResizeTarget,
+} from "@tmux-ide/contracts";
+import type {
+  createGuardedNativeSplitResize,
+  GuardedNativeSplitResizeResult,
+} from "../../lib/guarded-native-split-resize.ts";
+import { WindowSplitAuthority, WindowSplitLayoutUnavailable } from "./window-split-authority.ts";
 import { SharedWindowIndex } from "./shared-window-index.ts";
 import { RegisteredWindowGuard, type RegisteredWindowReader } from "./registered-window-guard.ts";
 import type { OwnedViewerAdapter } from "./owned-viewer-adapter.ts";
@@ -9,7 +21,6 @@ import {
   revalidateUnixSocketIdentity,
 } from "../../lib/unix-socket-authority.ts";
 import { execFile } from "node:child_process";
-import type { WindowLinkTarget } from "@tmux-ide/contracts";
 /**
  * MirrorService — the daemon-side shared mirror layer (m43 card 1).
  *
@@ -49,6 +60,12 @@ import {
 } from "./control-mode-ownership.ts";
 
 export interface MirrorServiceOptions {
+  /** Native server epoch for split observations; absent means unsupported. */
+  splitLayoutEpoch?: () => string | null;
+  /** Explicit split reads may prepare a supported observation owner once. */
+  splitLayoutPrepare?: () => Promise<boolean>;
+  /** Positively probe this native epoch before issuing handles; absent denies. */
+  splitLayoutCapability?: (epoch: string) => boolean | Promise<boolean>;
   onSharedWindowConflict?: (session: string, conflicted: boolean) => void;
   createOwnedViewerAdapter?: (session: string) => OwnedViewerAdapter | undefined;
   nativeServerIdentity?: import("../../lib/tmux-server-generation-runner.ts").NativeTmuxServerIdentity;
@@ -145,6 +162,7 @@ export interface MirrorSessionRetention {
 }
 
 interface ChannelEntry {
+  splitAuthority?: WindowSplitAuthority;
   channel: SessionChannel;
   started: Promise<void>;
   refs: number;
@@ -362,6 +380,99 @@ export class MirrorService {
     };
   }
 
+  /** Read existing canonical ownership only; never attach or retain a new channel. */
+  async readWindowSplitLayout(
+    session: string,
+    target: WindowLinkTarget,
+  ): Promise<WindowSplitLayoutResource> {
+    const entry = this.channels.get(session);
+    if (this.disposed || !entry || entry.retired) throw new WindowSplitLayoutUnavailable();
+    await entry.started;
+    if (this.disposed || entry.retired || this.channels.get(session) !== entry)
+      throw new WindowSplitLayoutUnavailable();
+    if (this.opts.splitLayoutPrepare) {
+      let ready = false;
+      try {
+        ready = await this.opts.splitLayoutPrepare();
+      } catch {
+        /* Unavailable owner. */
+      }
+      if (!ready || this.disposed || entry.retired || this.channels.get(session) !== entry)
+        throw new WindowSplitLayoutUnavailable();
+    }
+    const epoch = this.opts.splitLayoutEpoch?.();
+    let supported = false;
+    try {
+      supported = Boolean(epoch && (await this.opts.splitLayoutCapability?.(epoch)));
+    } catch {
+      // Unsupported/retired servers never receive actionable split handles.
+    }
+    if (
+      !supported ||
+      this.disposed ||
+      entry.retired ||
+      this.channels.get(session) !== entry ||
+      this.opts.splitLayoutEpoch?.() !== epoch
+    )
+      throw new WindowSplitLayoutUnavailable();
+    entry.splitAuthority ??= new WindowSplitAuthority({
+      describe: (window) => entry.channel.describeSplitLayout(window),
+      serverEpoch: () => this.opts.splitLayoutEpoch?.() ?? null,
+    });
+    return entry.splitAuthority.read(target);
+  }
+
+  /** Resolve only issued handles, then revalidate immediately at native dispatch. */
+  async resizeWindowSplit(
+    session: string,
+    target: WindowSplitResizeTarget,
+    operationId: string,
+    authorizeBeforeEffect: () => void,
+    runNative: ReturnType<typeof createGuardedNativeSplitResize>,
+  ): Promise<
+    GuardedNativeSplitResizeResult & {
+      successor?: { resource: WindowSplitLayoutResource; splitId: string } | null;
+    }
+  > {
+    const captured = WindowSplitResizeTargetSchemaZ.parse(target);
+    const entry = this.channels.get(session);
+    const current = () => {
+      if (this.disposed || !entry || entry.retired || this.channels.get(session) !== entry)
+        throw new WindowSplitLayoutUnavailable();
+      if (!entry.splitAuthority) throw new WindowSplitLayoutUnavailable();
+      return entry.splitAuthority;
+    };
+    current();
+    await entry!.started;
+    const resolved = current().resolve(captured);
+    const successor = current().prepareSuccessor(captured);
+    const result = await runNative(resolved.request, {
+      operationId,
+      serverEpoch: resolved.serverEpoch,
+      session: resolved.session,
+      anchor: resolved.anchor,
+      authorizeBeforeEffect: () => {
+        current().resolve(captured);
+        authorizeBeforeEffect();
+      },
+    });
+    if (result.status !== "applied") return result;
+    // Native success is retained even if canonical publication is late or diverges.
+    // This grace period observes only; it never retries a native mutation.
+    const deadline = performance.now() + 100;
+    for (;;) {
+      try {
+        current();
+      } catch {
+        return { ...result, successor: null };
+      }
+      const next = successor(result.layout);
+      if (next !== undefined) return { ...result, successor: next };
+      if (performance.now() >= deadline) return { ...result, successor: null };
+      await waitForPublication(5);
+    }
+  }
+
   async executeWindowLinkAction(
     session: string,
     request: { action: "select" | "unlink"; target?: WindowLinkTarget; paneId?: string },
@@ -554,6 +665,7 @@ export class MirrorService {
     await Promise.allSettled(
       entries.map(async (entry) => {
         entry.retired = true;
+        entry.splitAuthority?.dispose();
         this.updateWindowMembership(entry.channel, []);
         this.channelSessions.delete(entry.channel);
         try {
@@ -730,6 +842,7 @@ export class MirrorService {
   private retire(session: string, entry: ChannelEntry): void {
     if (entry.retired) return;
     entry.retired = true;
+    entry.splitAuthority?.dispose();
     this.updateWindowMembership(entry.channel, []);
     this.channelSessions.delete(entry.channel);
     if (this.channels.get(session) === entry) this.channels.delete(session);