railmux 0.3.3.dev6__tar.gz → 0.3.4.dev1__tar.gz

{railmux-0.3.3.dev6/src/railmux.egg-info → railmux-0.3.4.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: railmux
-Version: 0.3.3.dev6
+Version: 0.3.4.dev1
 Summary: Terminal UI to navigate, resume, and start Claude Code and Codex sessions
 Author-email: Rightglow <zhang.taian@foxmail.com>
 License-Expression: MIT
@@ -169,7 +169,7 @@ for focus and layout limits.
 |--------|--------|
 | Left-click (non-running) | Preview session history in the Target pane |
 | Left-click (running) | Switch the Target pane to that session |
-| Wheel up over a live agent | Open its canonical current-branch history |
+| Wheel over a live agent | Scroll its live terminal history (native locally, Railmux-managed over `railmux ssh`) |
 | Double-click | Open/attach in the Target pane and move focus there |
 | Right-click | Context menu (Open, Preview, Info, Rename, Star, Copy title, Kill, Term, Delete) |
 
@@ -372,16 +372,21 @@ sessions move ahead of the other results.
 
 For a stopped session, left-click or press `␣` to view conversation history in
 the Target pane without starting or resuming the agent. For a running session,
-press `␣`, choose **Preview**, or wheel up over its live pane. Preview is
-read-only: it cannot send a message or change the session. User and assistant
-messages, tool calls, and abbreviated tool output are colour-coded, while
-internal context and encrypted reasoning are hidden. Codex rewind lineages and
-Claude Code `parentUuid` branches are projected onto the provider's current
-conversation: the retained prefix and replacement suffix remain visible, while
-the abandoned suffix is hidden. When Railmux observes a running Codex session
-advance after rewind or steering, it resets only the current terminal view
-before Codex redraws. Retained tmux scrollback is not erased, and managed
-history continues from the canonical rollout without its abandoned suffix.
+press `␣` or choose **Preview**. Preview is read-only: it cannot send a message
+or change the session. User and assistant messages, tool calls, and abbreviated
+tool output are colour-coded, while internal context and encrypted reasoning
+are hidden. Codex rewind lineages and Claude Code `parentUuid` branches are
+projected onto the provider's current conversation: the retained prefix and
+replacement suffix remain visible, while the abandoned suffix is hidden.
+
+Scrolling a live agent does not enter Preview. Direct `railmux` uses the
+terminal/tmux scrolling behavior; `railmux ssh` keeps its own bounded,
+per-pane history and normally preserves the live terminal's captured styling.
+When Railmux confirms that a running Codex session advanced after rewind or
+steering, it resets only the current terminal view before Codex redraws and
+invalidates that pane's SSH history generation. Retained tmux scrollback is not
+erased; the SSH history for that branched generation uses the canonical
+rollout so its abandoned suffix stays hidden.
 
 Preview opens at the latest activity in `less`; large sessions are limited to
 their latest 2,000 saved records. Press `/` to search, `n`/`N` to move between

{railmux-0.3.3.dev6 → railmux-0.3.4.dev1}/README.md

@@ -127,7 +127,7 @@ for focus and layout limits.
 |--------|--------|
 | Left-click (non-running) | Preview session history in the Target pane |
 | Left-click (running) | Switch the Target pane to that session |
-| Wheel up over a live agent | Open its canonical current-branch history |
+| Wheel over a live agent | Scroll its live terminal history (native locally, Railmux-managed over `railmux ssh`) |
 | Double-click | Open/attach in the Target pane and move focus there |
 | Right-click | Context menu (Open, Preview, Info, Rename, Star, Copy title, Kill, Term, Delete) |
 
@@ -330,16 +330,21 @@ sessions move ahead of the other results.
 
 For a stopped session, left-click or press `␣` to view conversation history in
 the Target pane without starting or resuming the agent. For a running session,
-press `␣`, choose **Preview**, or wheel up over its live pane. Preview is
-read-only: it cannot send a message or change the session. User and assistant
-messages, tool calls, and abbreviated tool output are colour-coded, while
-internal context and encrypted reasoning are hidden. Codex rewind lineages and
-Claude Code `parentUuid` branches are projected onto the provider's current
-conversation: the retained prefix and replacement suffix remain visible, while
-the abandoned suffix is hidden. When Railmux observes a running Codex session
-advance after rewind or steering, it resets only the current terminal view
-before Codex redraws. Retained tmux scrollback is not erased, and managed
-history continues from the canonical rollout without its abandoned suffix.
+press `␣` or choose **Preview**. Preview is read-only: it cannot send a message
+or change the session. User and assistant messages, tool calls, and abbreviated
+tool output are colour-coded, while internal context and encrypted reasoning
+are hidden. Codex rewind lineages and Claude Code `parentUuid` branches are
+projected onto the provider's current conversation: the retained prefix and
+replacement suffix remain visible, while the abandoned suffix is hidden.
+
+Scrolling a live agent does not enter Preview. Direct `railmux` uses the
+terminal/tmux scrolling behavior; `railmux ssh` keeps its own bounded,
+per-pane history and normally preserves the live terminal's captured styling.
+When Railmux confirms that a running Codex session advanced after rewind or
+steering, it resets only the current terminal view before Codex redraws and
+invalidates that pane's SSH history generation. Retained tmux scrollback is not
+erased; the SSH history for that branched generation uses the canonical
+rollout so its abandoned suffix stays hidden.
 
 Preview opens at the latest activity in `less`; large sessions are limited to
 their latest 2,000 saved records. Press `/` to search, `n`/`N` to move between

railmux-0.3.4.dev1/src/railmux/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.4.dev1"

{railmux-0.3.3.dev6 → railmux-0.3.4.dev1}/src/railmux/fast_display_server.py

@@ -406,6 +406,7 @@ class _PaneGeometry:
     transcript_provider: str | None = None
     claude_history_policy: str = "ask"
     history_generation: int = 0
+    canonical_history: bool = False
 
 
 @dataclass(frozen=True)
@@ -432,11 +433,14 @@ _HISTORY_GENERATION_RE = re.compile(
 
 def _history_generation(marker: str) -> int:
     """Map one validated provider UUID to a bounded opaque wire epoch."""
+    generation_marker = marker
+    if marker.startswith(tmux_ctl.RAILMUX_CANONICAL_HISTORY_PREFIX):
+        marker = marker[len(tmux_ctl.RAILMUX_CANONICAL_HISTORY_PREFIX):]
     if not _HISTORY_GENERATION_RE.fullmatch(marker):
         return 0
     return int.from_bytes(
         hashlib.blake2b(
-            marker.lower().encode("ascii"),
+            generation_marker.lower().encode("ascii"),
             digest_size=8,
             person=b"railmux-history",
         ).digest(),
@@ -937,6 +941,15 @@ def _list_agent_panes(
             if opened is not None:
                 transcript_locator = opened[0]
                 os.close(opened[1])
+        history_marker = fields[15]
+        canonical_history = bool(
+            transcript_backed
+            and transcript_locator is not None
+            and history_marker == (
+                f"{tmux_ctl.RAILMUX_CANONICAL_HISTORY_PREFIX}"
+                f"{transcript_locator.session_id}"
+            )
+        )
         rows.append(
             (
                 fields[2] == "1",
@@ -960,7 +973,8 @@ def _list_agent_panes(
                         else None
                     ),
                     claude_history_policy=claude_history_policy,
-                    history_generation=_history_generation(fields[15]),
+                    history_generation=_history_generation(history_marker),
+                    canonical_history=canonical_history,
                 ),
             )
         )
@@ -1347,7 +1361,7 @@ def _capture_pane_history(
         pane.transcript_backed
         and pane.transcript_source
         and (
-            transcript_provider == "codex"
+            (transcript_provider == "codex" and pane.canonical_history)
             or (
                 transcript_provider == "claude"
                 and pane.claude_history_policy == "local"

{railmux-0.3.3.dev6 → railmux-0.3.4.dev1}/src/railmux/tmux_ctl.py

@@ -1434,6 +1434,18 @@ def set_pane_user_option(target_pane: str, name: str,
         return False
 
 
+def pane_user_option(target_pane: str, name: str) -> str | None:
+    """Read one pane-local user option, returning ``None`` when unavailable."""
+    try:
+        value = subprocess.check_output(
+            ["tmux", "show-options", "-pv", "-t", target_pane, name],
+            stderr=subprocess.DEVNULL,
+        ).decode().strip()
+    except (OSError, subprocess.CalledProcessError, UnicodeError):
+        return None
+    return value or None
+
+
 def unset_pane_user_option_if_value(target_pane: str, name: str,
                                     expected: str) -> bool:
     """Unset a pane option only when Railmux still owns its exact value."""
@@ -1824,15 +1836,14 @@ _PREFIX_TARGET_KEY = "Tab"
 _PREFIX_TARGET_MARKER = "railmux-target-toggle-v1"
 RAILMUX_CONTROLLER_OPTION = "@railmux_controller_pane"
 RAILMUX_TARGET_OPTION = "@railmux_target_pane"
-RAILMUX_HISTORY_PREVIEW_OPTION = "@railmux_history_preview_v1"
 RAILMUX_HISTORY_GENERATION_OPTION = "@railmux_history_generation_v1"
-# tmux names function keys only through F12. Private controller routes use
+# A confirmed branch transition prefixes the opaque SSH history cache epoch.
+# Plain generations use native pane history; only this explicit marker permits
+# the canonical transcript fallback that removes an abandoned rewind suffix.
+RAILMUX_CANONICAL_HISTORY_PREFIX = "canonical:"
+# tmux names function keys only through F12. Private restore routes use
 # canonical xterm sequences in literal mode, so they cannot be confused with
 # user input forwarded to an agent pane.
-RAILMUX_HISTORY_PREVIEW_KEYS = {
-    "primary": ("F21", "\x1b[35~"),
-    "secondary": ("F22", "\x1b[36~"),
-}
 RAILMUX_HISTORY_RESTORE_KEYS = {
     "primary": ("F23", "\x1b[42~"),
     "secondary": ("F24", "\x1b[43~"),
@@ -2165,69 +2176,30 @@ def set_root_wheel_forwarding(
     backup: RootWheelBindingBackup,
     token: str,
 ) -> bool:
-    """Open canonical live history on wheel-up, otherwise preserve tmux input.
+    """Preserve terminal-native wheel behavior under shared ownership.
 
     The literal marker makes crash recovery able to distinguish Railmux's
     wrapper from a binding the user installed while Railmux was running.
-    A pane-local primary/secondary marker routes the first live-agent wheel-up
-    to Railmux's controller; the transcript viewer clears that marker, so its
-    subsequent wheel events are forwarded normally.
-    Non-mouse-aware panes retain the exact stock fallback; WheelDownPane was
-    unbound by default and therefore has no false branch.
+    Mouse-aware panes receive the original report, while non-mouse-aware panes
+    retain the exact stock fallback (including native copy-mode on wheel-up).
+    A live wheel must never be converted into Railmux's transcript Preview.
     """
     marker = f"{_ROOT_WHEEL_MARKER}-{token}"
     mouse_condition = (
         "#{&&:#{mouse_any_flag},"
         f"#{{==:{marker},{marker}}}}}"
     )
-    controller_present = f"#{{!=:#{{{RAILMUX_CONTROLLER_OPTION}}},}}"
-
-    def _preview_condition(slot_key: str) -> str:
-        return (
-            "#{&&:"
-            f"#{{==:#{{{RAILMUX_HISTORY_PREVIEW_OPTION}}},{slot_key}}},"
-            f"{controller_present}}}"
-        )
-
-    def _send_preview(slot_key: str) -> str:
-        _key, sequence = RAILMUX_HISTORY_PREVIEW_KEYS[slot_key]
-        return (
-            f"send-keys -l -t '#{{{RAILMUX_CONTROLLER_OPTION}}}' -- "
-            f"'{sequence}'"
-        )
-
     try:
         for key in _ROOT_WHEEL_KEYS:
             binding = backup.get(key)
             fallback = _binding_command(binding) if binding is not None else ""
-            mouse_fallback = (
-                f"if-shell -F -t = '{mouse_condition}' 'send-keys -M'"
-            )
-            if fallback:
-                mouse_fallback += f" '{fallback}'"
             args = [
                 "tmux", "bind-key", "-T", "root", key,
+                "if-shell", "-F", "-t", "=", mouse_condition,
+                "send-keys -M",
             ]
-            if key == "WheelUpPane":
-                secondary_fallback = (
-                    "if-shell -F -t = "
-                    f"'{_preview_condition('secondary')}' "
-                    f"\"{_send_preview('secondary')}\" "
-                    f"\"{mouse_fallback}\""
-                )
-                args.extend([
-                    "if-shell", "-F", "-t", "=",
-                    _preview_condition("primary"),
-                    _send_preview("primary"),
-                    secondary_fallback,
-                ])
-            else:
-                args.extend([
-                    "if-shell", "-F", "-t", "=", mouse_condition,
-                    "send-keys -M",
-                ])
-                if fallback:
-                    args.append(fallback)
+            if fallback:
+                args.append(fallback)
             subprocess.check_call(
                 args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
     except (ValueError, subprocess.CalledProcessError, FileNotFoundError):
@@ -2248,7 +2220,7 @@ def root_wheel_bindings_owned_by(token: str) -> bool:
 
 
 def root_wheel_bindings_are_current(token: str) -> bool:
-    """Whether the owned wrapper includes canonical-history routing."""
+    """Whether the owned wrapper preserves native live-pane scrolling."""
     bindings = read_root_wheel_bindings()
     up = bindings.get("WheelUpPane")
     marker = f"{_ROOT_WHEEL_MARKER}-{token}"
@@ -2261,11 +2233,14 @@ def root_wheel_bindings_are_current(token: str) -> bool:
             for binding in bindings.values()
         )
         and up is not None
-        and RAILMUX_HISTORY_PREVIEW_OPTION in up
-        and all(
-            sequence in up or sequence.replace("\x1b", r"\033") in up
-            for _key, sequence in RAILMUX_HISTORY_PREVIEW_KEYS.values()
-        )
+        and "copy-mode -e" in up
+        # Reject the 0.3.3 wrapper during a soft upgrade. It routed live wheel
+        # input through private F21/F22 keys into transcript Preview.
+        and "@railmux_history_preview_v1" not in up
+        and r"\033[35~" not in up
+        and r"\033[36~" not in up
+        and "\x1b[35~" not in up
+        and "\x1b[36~" not in up
     )
 
 

{railmux-0.3.3.dev6 → railmux-0.3.4.dev1}/src/railmux/ui/app.py

@@ -1117,7 +1117,7 @@ class App:
         session_id: str | None,
         tmux_name: str | None,
     ) -> None:
-        """Stamp transcript/history routing for the displayed live agent."""
+        """Stamp the explicit transcript Preview source for a live agent."""
         pane_id = slot.pane_id
         if pane_id is None or not pane_id.startswith("%"):
             return
@@ -1156,19 +1156,6 @@ class App:
             tmux_server.TRANSCRIPT_SOURCE_OPTION,
             marker,
         )
-        history_slot = None
-        if (
-            running is not None
-            and running.session_type in ("claude", "codex")
-            and logical_id is not None
-            and not running.is_placeholder
-        ):
-            history_slot = slot.key
-        tmux_ctl.set_pane_user_option(
-            pane_id,
-            tmux_ctl.RAILMUX_HISTORY_PREVIEW_OPTION,
-            history_slot,
-        )
 
     def _paint_slot_active_target(
         self,
@@ -1973,9 +1960,9 @@ class App:
     def _on_session_preview(self, session: SessionMeta) -> None:
         """Show the provider's canonical current-branch history.
 
-        Stopped-row clicks, Space, context Preview, and live-pane wheel-up use
-        this read-only projection. A Codex rewind lineage is represented by its
-        newest rollout; Claude branches are projected by ``transcript``.
+        Stopped-row clicks, Space, and context Preview use this read-only
+        projection. A Codex rewind lineage is represented by its newest
+        rollout; Claude branches are projected by ``transcript``.
         """
         if session.session_type == "codex":
             representative = self._codex_representative(session.session_id)
@@ -2038,20 +2025,6 @@ class App:
         self._set_workspace_target(slot.key)
         self._on_session_preview(session)
 
-    def _preview_slot_history(self, slot: AgentSlot) -> None:
-        """Handle a pane-local wheel-up routed through the controller."""
-        tmux_name = slot.agent_tmux_name
-        if tmux_name is None:
-            return
-        running = self._by_tmux(tmux_name)
-        if running is None:
-            return
-        self._preview_running_history(RunningEntry(
-            tmux_name=tmux_name,
-            label=running.label,
-            status=running.status,
-        ))
-
     def _restore_history_slot(self, slot: AgentSlot) -> None:
         """Return a closed live-history viewer to the exact saved agent."""
         if not slot.in_history_mode:
@@ -7458,18 +7431,6 @@ class App:
         if key == COMPACT_RESIZE_KEY.lower():
             self._handle_remote_compact_prepare()
             return
-        for slot_key, (preview_key, _sequence) in (
-                tmux_ctl.RAILMUX_HISTORY_PREVIEW_KEYS.items()):
-            if key == preview_key.lower():
-                if (getattr(self, "_loop", None) is not None
-                        and self._loop.widget is not self._frame):
-                    return
-                workspace = self._agent_workspace()
-                self._preview_slot_history(
-                    workspace.primary
-                    if slot_key == AgentWorkspace.PRIMARY
-                    else workspace.secondary)
-                return
         for slot_key, (restore_key, _sequence) in (
                 tmux_ctl.RAILMUX_HISTORY_RESTORE_KEYS.items()):
             if key == restore_key.lower():
@@ -8627,11 +8588,13 @@ class App:
         therefore survive in raw tmux scrollback even though the canonical
         JSONL is already correct. Baseline the first observed rollout, then
         reset only the live terminal view when the next canonical rollout names
-        that baseline as its parent. Managed local/SSH history reads the stamped
-        canonical transcript instead of the abandoned raw suffix. On procfs
-        systems the new rollout must also be open in this exact pane's process
-        tree; an unavailable probe degrades to the provider lineage link, while
-        a negative probe waits for a later refresh.
+        that baseline as its parent. Local wheel scrolling remains terminal-
+        native. The SSH display keeps owning wheel history and normally reads
+        raw pane capture; only this confirmed transition marks that history as
+        canonical-transcript-backed so the abandoned suffix stays hidden. On
+        procfs systems the new rollout must also be open in this exact pane's
+        process tree; an unavailable probe degrades to the provider lineage
+        link, while a negative probe waits for a later refresh.
         """
         current_id = meta.session_id
         previous_id = running.codex_canonical_session_id
@@ -8663,7 +8626,7 @@ class App:
         if identity is None or not tmux_ctl.reset_pane_view(identity):
             return
         running.codex_canonical_session_id = current_id
-        self._stamp_codex_history_state(running, meta)
+        self._stamp_codex_history_state(running, meta, canonical=True)
 
     def _codex_real_pane_identity(
         self, running: _Running,
@@ -8677,9 +8640,18 @@ class App:
         return topology.single_live_pane if topology is not None else None
 
     def _stamp_codex_history_state(
-        self, running: _Running, meta: SessionMeta,
+        self,
+        running: _Running,
+        meta: SessionMeta,
+        *,
+        canonical: bool = False,
     ) -> None:
-        """Publish the canonical transcript and its content-free cache epoch."""
+        """Publish Preview source plus the SSH history-source cache epoch.
+
+        A plain UUID keeps managed SSH history on raw pane capture. Only a
+        confirmed rewind transition writes ``canonical:<uuid>`` and permits a
+        transcript projection. Preserve that exact marker across app restarts.
+        """
         if running.is_legacy:
             return
         identity = self._codex_real_pane_identity(running)
@@ -8704,14 +8676,21 @@ class App:
             ) for pane_id in sorted(pane_ids)]
             if marker is not None else []
         )
-        generation_results = [
-            tmux_ctl.set_pane_user_option(
+        canonical_generation = (
+            f"{tmux_ctl.RAILMUX_CANONICAL_HISTORY_PREFIX}{meta.session_id}"
+        )
+        generation_results = []
+        for pane_id in sorted(pane_ids):
+            existing = tmux_ctl.pane_user_option(
+                pane_id, tmux_ctl.RAILMUX_HISTORY_GENERATION_OPTION)
+            if not canonical and existing == canonical_generation:
+                generation_results.append(True)
+                continue
+            generation_results.append(tmux_ctl.set_pane_user_option(
                 pane_id,
                 tmux_ctl.RAILMUX_HISTORY_GENERATION_OPTION,
-                meta.session_id,
-            )
-            for pane_id in sorted(pane_ids)
-        ]
+                canonical_generation if canonical else meta.session_id,
+            ))
         transcript_stamped = marker is not None and all(transcript_results)
         generation_stamped = all(generation_results)
         running.codex_history_generation_stamped = bool(

{railmux-0.3.3.dev6 → railmux-0.3.4.dev1/src/railmux.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: railmux
-Version: 0.3.3.dev6
+Version: 0.3.4.dev1
 Summary: Terminal UI to navigate, resume, and start Claude Code and Codex sessions
 Author-email: Rightglow <zhang.taian@foxmail.com>
 License-Expression: MIT
@@ -169,7 +169,7 @@ for focus and layout limits.
 |--------|--------|
 | Left-click (non-running) | Preview session history in the Target pane |
 | Left-click (running) | Switch the Target pane to that session |
-| Wheel up over a live agent | Open its canonical current-branch history |
+| Wheel over a live agent | Scroll its live terminal history (native locally, Railmux-managed over `railmux ssh`) |
 | Double-click | Open/attach in the Target pane and move focus there |
 | Right-click | Context menu (Open, Preview, Info, Rename, Star, Copy title, Kill, Term, Delete) |
 
@@ -372,16 +372,21 @@ sessions move ahead of the other results.
 
 For a stopped session, left-click or press `␣` to view conversation history in
 the Target pane without starting or resuming the agent. For a running session,
-press `␣`, choose **Preview**, or wheel up over its live pane. Preview is
-read-only: it cannot send a message or change the session. User and assistant
-messages, tool calls, and abbreviated tool output are colour-coded, while
-internal context and encrypted reasoning are hidden. Codex rewind lineages and
-Claude Code `parentUuid` branches are projected onto the provider's current
-conversation: the retained prefix and replacement suffix remain visible, while
-the abandoned suffix is hidden. When Railmux observes a running Codex session
-advance after rewind or steering, it resets only the current terminal view
-before Codex redraws. Retained tmux scrollback is not erased, and managed
-history continues from the canonical rollout without its abandoned suffix.
+press `␣` or choose **Preview**. Preview is read-only: it cannot send a message
+or change the session. User and assistant messages, tool calls, and abbreviated
+tool output are colour-coded, while internal context and encrypted reasoning
+are hidden. Codex rewind lineages and Claude Code `parentUuid` branches are
+projected onto the provider's current conversation: the retained prefix and
+replacement suffix remain visible, while the abandoned suffix is hidden.
+
+Scrolling a live agent does not enter Preview. Direct `railmux` uses the
+terminal/tmux scrolling behavior; `railmux ssh` keeps its own bounded,
+per-pane history and normally preserves the live terminal's captured styling.
+When Railmux confirms that a running Codex session advanced after rewind or
+steering, it resets only the current terminal view before Codex redraws and
+invalidates that pane's SSH history generation. Retained tmux scrollback is not
+erased; the SSH history for that branched generation uses the canonical
+rollout so its abandoned suffix stays hidden.
 
 Preview opens at the latest activity in `less`; large sessions are limited to
 their latest 2,000 saved records. Press `/` to search, `n`/`N` to move between

{railmux-0.3.3.dev6 → railmux-0.3.4.dev1}/tests/test_codex_lineage.py

@@ -106,6 +106,7 @@ def test_live_rewind_resets_view_and_stamps_canonical_transcript(
     monkeypatch.setattr(tmux_ctl, "reset_pane_view", reset)
     stamped = MagicMock(return_value=True)
     monkeypatch.setattr(tmux_ctl, "set_pane_user_option", stamped)
+    monkeypatch.setattr(tmux_ctl, "pane_user_option", lambda *_args: None)
     probes: dict[str, set[str] | None] = {}
 
     # An indexed child is not enough: on procfs the exact live writer must
@@ -127,7 +128,10 @@ def test_live_rewind_resets_view_and_stamps_canonical_transcript(
     )
     assert leaf_id in transcript_call.args[2]
     assert generation_call.args == (
-        "%9", tmux_ctl.RAILMUX_HISTORY_GENERATION_OPTION, leaf_id)
+        "%9",
+        tmux_ctl.RAILMUX_HISTORY_GENERATION_OPTION,
+        f"{tmux_ctl.RAILMUX_CANONICAL_HISTORY_PREFIX}{leaf_id}",
+    )
 
 
 def test_first_codex_generation_only_establishes_scrollback_baseline(
@@ -197,9 +201,53 @@ def test_codex_history_state_stamps_nested_wrapper_and_real_pane(
     app._codex_real_pane_identity = MagicMock(return_value=identity)
     stamped = MagicMock(return_value=True)
     monkeypatch.setattr(tmux_ctl, "set_pane_user_option", stamped)
+    monkeypatch.setattr(tmux_ctl, "pane_user_option", lambda *_args: None)
 
     app._stamp_codex_history_state(running, meta)
 
     assert running.codex_history_generation_stamped
     assert {call.args[0] for call in stamped.call_args_list} == {"%9", "%10"}
     assert stamped.call_count == 4
+
+
+def test_codex_history_state_preserves_confirmed_canonical_marker_on_restart(
+    monkeypatch, tmp_path,
+) -> None:
+    session_id = "019fc7c1-a27c-7ae0-9937-7570552a112a"
+    project = Project(tmp_path, "-project", Path(), 1, 0.0)
+    running = _Running(
+        key=session_id,
+        tmux_name="cx-live",
+        label="project/conversation",
+        project=project,
+        session_type="codex",
+    )
+    meta = SessionMeta(
+        project=project,
+        session_id=session_id,
+        jsonl_path=tmp_path / (
+            f"rollout-2026-08-03T13-13-03-{session_id}.jsonl"),
+        title="current",
+        message_count=2,
+        token_total=0,
+        last_mtime=2.0,
+        session_type="codex",
+    )
+    identity = tmux_ctl.PaneIdentity(
+        "%9", 123, "cx-live", "$4", "@5", False, 80, 24)
+    app = App.__new__(App)
+    app._codex_real_pane_identity = MagicMock(return_value=identity)
+    stamped = MagicMock(return_value=True)
+    monkeypatch.setattr(tmux_ctl, "set_pane_user_option", stamped)
+    canonical_marker = (
+        f"{tmux_ctl.RAILMUX_CANONICAL_HISTORY_PREFIX}{session_id}"
+    )
+    monkeypatch.setattr(
+        tmux_ctl, "pane_user_option", lambda *_args: canonical_marker)
+
+    app._stamp_codex_history_state(running, meta)
+
+    assert running.codex_history_generation_stamped
+    assert stamped.call_count == 1
+    assert stamped.call_args.args[:2] == (
+        "%9", tmux_server.TRANSCRIPT_SOURCE_OPTION)