76778c7a

refactor: a daemon's declaration stands with the leg that starts it

a73x 2026-08-26 18:42

Commit message

refactor: a daemon's declaration stands with the leg that starts it

445 lines of socket paths, keys, ports and state homes sat at the top of
the file, hundreds of lines from the scenarios that use them, because the
old trap named every one of them and `set -u` needed them bound before it
could. The trap reads a register now, so the reason is gone and the
declarations go back to their legs — the prose explaining WHY each daemon
is separate is worth most beside the daemon it argues for.

Two blocks move for the same reason. The long-lived daemon's teardown was
4,000 lines below its last user, in the middle of the pane legs; it now
stands where that user ends. The prose about the count pins was in the
same place, describing two literals at the far end of the file; it moves
to them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test/e2e.sh

@@ @@ -237,467 +237,6 @@ unset MUX_KEY_FILE @@
+# asserting against the developer's keyring. The legs that want an agent
+# export one per command, at a path this file made.
+unset SSH_AUTH_SOCK
+# One counter out of a MUX_PREDICT_STATS line. The client prints exactly one
+# such line on exit; every field is a key=value pair, so a rename or reorder
@@ @@ -1616,6 +1155,42 @@ cleanup() { @@
+trap cleanup EXIT INT TERM
+# Second daemon, used only by the M7 abort scenario.
+SOCK2="${TMPDIR:-/tmp}/muxd-e2e-abort-$$.sock"
+defer_sock "$SOCK2"
+# Third daemon, for the restart scenario: it gets killed and started again on
+# the same path, so it cannot share the long-lived one.
+SOCK3="${TMPDIR:-/tmp}/muxd-e2e-restart-$$.sock"
+defer_sock "$SOCK3"
+# Fourth daemon, for the M8 --quic scenario: it is the only one holding a UDP
+# port, so it gets its own path rather than sharing the long-lived one.
+SOCK4="${TMPDIR:-/tmp}/muxd-e2e-quic-$$.sock"
+defer_sock "$SOCK4" "$SOCK4.nokey" "$SOCK4.second"
+QKEY="${TMPDIR:-/tmp}/mux-e2e-key-$$"
+defer_rm "$QKEY" "$QKEY.wrong" "$QKEY.bad"
+# A port out of the way of the ephemeral range, made per-run so two suites can
+# overlap. Collisions surface as a loud bind failure, never as a silent pass.
+QPORT=$(( 21000 + ($$ % 4000) ))
+# M10 key-resolution daemons. Two, not one: the first scenario's client
+# detaches and its daemon is killed, and the second must not be sharing
+# either. Ports in bands of their own so a concurrent suite cannot collide.
+SOCK9="${TMPDIR:-/tmp}/muxd-e2e-envkey-$$.sock"
+defer_sock "$SOCK9"
+SOCK10="${TMPDIR:-/tmp}/muxd-e2e-flagwins-$$.sock"
+defer_sock "$SOCK10"
+QPORT2=$(( 26000 + ($$ % 4000) ))
+QPORT3=$(( 31000 + ($$ % 4000) ))
+# M10 `muxd start`. These daemons are spawned DETACHED, so the suite never
+# holds their pids as shell jobs — it reads them off the up-line and kills
+# by that tracked pid, never by name.
+SOCK8="${TMPDIR:-/tmp}/muxd-e2e-start-$$.sock"
+defer_sock "$SOCK8"
+SOCK8T="${TMPDIR:-/tmp}/muxd-e2e-trunc-$$.sock"
+defer_sock "$SOCK8T"
+SOCK11="${TMPDIR:-/tmp}/muxd-e2e-goal-$$.sock"
+defer_sock "$SOCK11"
+QPORT4=$(( 36000 + ($$ % 4000) ))
+# --- M10: --version answers "did the scp land" without a daemon anywhere.
+# No convergence: no daemon and no client, so there is no grid on either side.
+"$MUXD" --version | grep -q '^muxd 0\.' || { echo "e2e FAIL: muxd --version"; exit 1; }
@@ @@ -2542,6 +2117,27 @@ softkill "$GPID" || true @@
+GPID=""
+ok "keygen + start --quic + mux quic:// with no --key anywhere"
+# M9 prediction: each scenario needs a session whose LINE DISCIPLINE it
+# controls, so they cannot share the long-lived /bin/sh daemon.
+SOCK5="${TMPDIR:-/tmp}/muxd-e2e-pred-$$.sock"
+defer_sock "$SOCK5"
+SOCK6="${TMPDIR:-/tmp}/muxd-e2e-pw-$$.sock"
+defer_sock "$SOCK6"
+SOCK7="${TMPDIR:-/tmp}/muxd-e2e-raw-$$.sock"
+defer_sock "$SOCK7"
+PWSH="${TMPDIR:-/tmp}/mux-e2e-pw-$$.sh"
+defer_rm "$PWSH"
+# M12 pty scenarios. Each needs a daemon whose grid size it owns: tp2
+# resizes the grid twice and tp1's session is a scrollback-generating
+# wrapper, so neither can share the long-lived /bin/sh daemon.
+SOCK12="${TMPDIR:-/tmp}/muxd-e2e-tp2-$$.sock"
+defer_sock "$SOCK12"
+SOCK13="${TMPDIR:-/tmp}/muxd-e2e-tp1-$$.sock"
+defer_sock "$SOCK13"
+# tp1's session: a wrapper that fills the scrollback and then becomes cat.
+TP1SH="${TMPDIR:-/tmp}/mux-e2e-tp1-$$.sh"
+defer_rm "$TP1SH"
+# ---- M9: prediction ---------------------------------------------------
+# Every scenario here asserts COUNTERS, because the screen cannot tell a
@@ @@ -3321,6 +2917,27 @@ D13PID="" @@
+rm_swept "$OUT.tp1" "$OUT.tp1.err" "$OUT.tp1.log" "$OUT.tp1.d" "$TP1SH"
+ok "reconnect while scrolled: view restored, prediction resumed"
+# tp1 runs its fixture in the BACKGROUND — the tear has to happen while the
+# script is mid-flight — so its pid is tracked and killed like a daemon's.
+# M13 auto-start + stop. Two paths: the proxy arc's daemon is spawned BY
+# the proxy, the pty leg's by local mux under the M12 fixture. Both are
+# torn down by `muxd stop` — the verb under test is also the cleanup, and
+# the trap only backstops it. Neither daemon is a child of this shell, so
+# each pid is read off the up-line its own spawner printed, which is the
+# only handle that can never name a bystander.
+SOCK14="${TMPDIR:-/tmp}/muxd-e2e-astart-$$.sock"
+defer_sock "$SOCK14"
+SOCK15="${TMPDIR:-/tmp}/muxd-e2e-aspty-$$.sock"
+defer_sock "$SOCK15"
+# The bell leg's own daemon. A socket of its own is load-bearing rather than
+# tidiness, and the argument is at the leg itself: that scenario counts BEL
+# BYTES in a host capture, and a BEL is also what terminates an OSC. $SOCK's
+# session has a window title set on it by the title leg, and every client
+# attaching there is told so as `ESC]0;...BEL` — which would land in the
+# capture and make the count assert something other than what it says.
+SOCK24="${TMPDIR:-/tmp}/muxd-e2e-bell-$$.sock"
+defer_sock "$SOCK24"
+# --- M13: attach auto-start (proxy) + muxd stop ------------------------
+# Nothing is serving SOCK14: the attach itself must produce the daemon.
@@ @@ -3854,6 +3471,53 @@ D21PID="" @@
+rm_swept "$OUT.bell" "$OUT.bell.err" "$OUT.bell.log" "$OUT.bell.sh" "$OUT.d21.d"
+ok "a burst of bells in one chunk reaches the host as exactly one"
+# The long-lived daemon has served every scenario that wanted it; stop it
+# NOW so its allocator verdict is written while the suite is still running
+# and can say so. SIGTERM runs the clean-shutdown path, so the defer chain
+# (and the verdict) runs.
+#
+# The sweep that READS that verdict is in the EXIT trap, not here: this line
+# is only reached by a run that passed, and a leak deserves reporting on the
+# runs that did not (see leak_sweep). Everything below it is a pin, and the
+# trap fires after all of them either way.
+softkill "$D1PID" || true
+wait "$D1PID" 2>/dev/null || true
+D1PID=""
+# M14 ssh→QUIC handoff. The shim that stands in for ssh (built where the
+# scenarios run), and a RUNTIME DIR
+# per daemon: the handoff dials the DEFAULT socket on the far side, and the
+# far side is this box, so each scenario's default socket has to be one of
+# ours rather than the operator's. Two daemons, no more — the one a cold
+# attach auto-starts, and the key-mismatch one that cannot be shared
+# because it holds a key nothing else on this box has.
+SSHIM_DIR="${TMPDIR:-/tmp}/muxd-e2e-sshim-$$"
+defer_rm "$SSHIM_DIR"
+SSHIM_PIDLOG="$SSHIM_DIR/pids"
+export SSHIM_PIDLOG
+HRUN="${TMPDIR:-/tmp}/mux-e2e-hrun-$$"
+defer_rm "$HRUN"
+HRUN2="${TMPDIR:-/tmp}/mux-e2e-hrun2-$$"
+defer_rm "$HRUN2"
+SOCK16="$HRUN/muxd.sock"
+SOCK17="$HRUN2/muxd.sock"
+defer_sock "$SOCK16" "$SOCK17"
+HKEY="${TMPDIR:-/tmp}/mux-e2e-hkey-$$"
+defer_rm "$HKEY"
+# A config home that is a FILE: `muxd endpoint` cannot create a key under
+# it and cannot find one, which is the announce-none scenario's lever.
+HCFGBAD="${TMPDIR:-/tmp}/mux-e2e-hnokey-$$"
+defer_rm "$HCFGBAD"
+# Bands of their own, like every other port here, so a concurrent suite
+# cannot collide — and BELOW the ephemeral range (32768–60999 here), which
+# for HDEADPORT is not housekeeping but the scenario's correctness. It is
+# the port the poisoned cache points at, and the daemon it is poisoning
+# against holds a KERNEL-ASSIGNED ephemeral port: land on that one and the
+# "dead" port is live, the dial succeeds, and the self-heal scenario
+# quietly asserts a heal that never had to happen.
+HQPORT=$(( 11000 + ($$ % 4000) ))
+HDEADPORT=$(( 16000 + ($$ % 4000) ))
+# --- M14: the ssh→QUIC handoff -----------------------------------------
+# `mux HOST` fetches QUIC coordinates over ssh once, caches them, and
+    "$OUT.h4" "$OUT.h4.err" "$OUT.h5" "$OUT.h5.err" "$OUT.stop" "$HKEY" "$HCFGBAD"
+rm -rf "$SSHIM_DIR" "$HRUN" "$HRUN2"
+# M18. Two daemons — the CLI multi-session block's and the wall's — and one
+# more hub on the next 5000-spaced port. Only two sockets for four-and-some
+# sessions, which is the whole point of the milestone: sessions are named on
+# one socket, not spread across one socket each.
+SOCK21="${TMPDIR:-/tmp}/muxd-e2e-m18-$$.sock"
+defer_sock "$SOCK21"
+SOCK22="${TMPDIR:-/tmp}/muxd-e2e-m18web-$$.sock"
+defer_sock "$SOCK22"
+WPORT3=$(( 51000 + ($$ % 4000) ))
+# ...and a third, the only M18 daemon holding a UDP port: it serves the
+# session socket AND a QUIC listener at once, which is what lets one block
+# ask whether a session name means the same session on either transport.
+# Next 5000-spaced band after WPORT3.
+SOCK23="${TMPDIR:-/tmp}/muxd-e2e-m18quic-$$.sock"
+defer_sock "$SOCK23"
+QPORT5=$(( 56000 + ($$ % 4000) ))
+# A key of its own rather than the M8 block's $QKEY: that one is rm_swept
+# the moment the M8 scenarios finish (see the sweep after the key-source
+# block), which is hundreds of lines before this one runs. Reaching for a
+# deleted file would make this block's daemon fail to bind for a reason
+# that has nothing to do with sessions.
+M18KEY="${TMPDIR:-/tmp}/mux-e2e-m18key-$$"
+defer_rm "$M18KEY"
+# --- M18: two sessions on one daemon are two shells ---------------------
+# The milestone, observed from outside: ONE daemon, one socket path, one
+# key — and two sessions that share nothing. A connection IS a session
+D20PID=""
+ok "quic: two dials are two sessions, and one name is one session on either transport"
+# The pipe_mux client in flight, and its FIFO. Both are registered by
+# pipe_mux itself; its `timeout` stays the primary guarantee and the trap
+# is the backstop for a scenario that exits between pipe_mux and
+# pipe_detach, leaving a client the shell would otherwise orphan.
+# M-web. Three daemons (the passivity pin's, the hub-basic one, and the
+# tear scenario's two incarnations share SOCK20), two hub processes, and
+# a port band of its own following the 5000-spacing convention — INSIDE
+# the ephemeral range, which is fine for ports we bind (only provably-DEAD
+# ports must stay below 32768; see HDEADPORT above).
+SOCK18="${TMPDIR:-/tmp}/muxd-e2e-web-a-$$.sock"
+defer_sock "$SOCK18"
+SOCK19="${TMPDIR:-/tmp}/muxd-e2e-web-b-$$.sock"
+defer_sock "$SOCK19"
+SOCK20="${TMPDIR:-/tmp}/muxd-e2e-web-c-$$.sock"
+defer_sock "$SOCK20"
+WPORT=$(( 41000 + ($$ % 4000) ))
+WPORT2=$(( 46000 + ($$ % 4000) ))
+# The dynamic-wall leg: one daemon, one hub restarted three times, and a
+# STATE HOME of its own on the 61000 band — the last 5000-spaced one that
+# fits under 65535, the QUIC block's 56000 being the one before. The state
+# home is the load-bearing part: this leg reads the wall file back as an
+# artifact, and $XDG_STATE_HOME above is shared with every other scenario —
+# the M-web and M18 hubs write their argv walls there, so a wall read out of
+# it would be some other block's. Never the developer's ~/.local/state either; that is
+# why every muxweb here is spawned with the override in front of it.
+SOCK25="${TMPDIR:-/tmp}/muxd-e2e-dynwall-$$.sock"
+defer_sock "$SOCK25"
+WPORT4=$(( 61000 + ($$ % 4000) ))
+DWSTATE="${TMPDIR:-/tmp}/mux-e2e-dynwall-state-$$"
+defer_rm "$DWSTATE"
+# --- a 1x1 attach is refused the grid and can never claim it.
+# The degenerate size a client can genuinely arrive with — a terminal one
+# column wide — driven here on a real 1x1 pty. Nothing spells passivity
+D22PID=""
+ok "the wall is runtime state: add, remove, reorder, restore, argv adds"
+# The CLI wall (`mux wall`): its own daemon, so its two sessions can't be
+# confused with any other block's.
+SOCK26="${TMPDIR:-/tmp}/muxd-e2e-cliwall-$$.sock"
+defer_sock "$SOCK26"
+# The prefix chord (Ctrl-\ as a command key): its own daemon, so a chord
+# that fails to detach cannot strand another block's session.
+SOCK27="${TMPDIR:-/tmp}/muxd-e2e-prefix-$$.sock"
+defer_sock "$SOCK27"
+# Ctrl-\ c (create a session and switch to it): its own daemon, because the
+# assertion is about which sessions EXIST — another block's session on the
+# same daemon would change the name the chord picks.
+SOCK28="${TMPDIR:-/tmp}/muxd-e2e-newsess-$$.sock"
+defer_sock "$SOCK28"
+# Ctrl-\ n / Ctrl-\ p (step around the ring): its own daemon for the same
+# reason as SOCK28, and more sharply — the ring IS the list of sessions on
+# one daemon, so a stray session from another block would change where a
+# step lands.
+SOCK29="${TMPDIR:-/tmp}/muxd-e2e-ring-$$.sock"
+defer_sock "$SOCK29"
+# M5 (the self-attach refusal): its own daemon because the assertion reads
+# the SOCKET PATH out of a session shell's environment and compares it to
+# the one this block started — a shared daemon would make the comparison a
+# tautology about whichever block bound first.
+SOCK31="${TMPDIR:-/tmp}/muxd-e2e-selfattach-$$.sock"
+defer_sock "$SOCK31"
+# ---- the CLI wall: the hub's multiattach, in one terminal --------------
+# One daemon, two named sessions, one `mux wall` on a real pty showing
+# both AT ONCE — the browser wall's claim, made by the CLI. Three facts,
+D28PID=""
+ok "a session shell carries MUX_SOCK/MUX_SESSION, and mux refuses to attach to itself"
+# The wheel pair. Each needs a scrollback of its own to scroll (or to prove
+# it did not), which the long-lived /bin/sh daemon has no way to hold still,
+# and the second one needs a session that ASKS for the mouse — a mode that
+# would follow every other scenario sharing the daemon around.
+SOCK33="${TMPDIR:-/tmp}/muxd-e2e-wheel-$$.sock"
+defer_sock "$SOCK33"
+WHEELSH="${TMPDIR:-/tmp}/mux-e2e-wheel-$$.sh"
+defer_rm "$WHEELSH"
+SOCK34="${TMPDIR:-/tmp}/muxd-e2e-appmouse-$$.sock"
+defer_sock "$SOCK34"
+MOUSESH="${TMPDIR:-/tmp}/mux-e2e-appmouse-$$.sh"
+defer_rm "$MOUSESH"
+# The alternate-screen half of the wheel: its own daemon because the
+# session under test is a PAGER holding the alt screen for its whole life,
+# which no other scenario could share a grid with. And the no-terminal
+# half, whose session is a bare `cat` so that what reaches the pty is
+# echoed back into the grid the assertion reads.
+SOCK35="${TMPDIR:-/tmp}/muxd-e2e-pager-$$.sock"
+defer_sock "$SOCK35"
+LESSSH="${TMPDIR:-/tmp}/mux-e2e-pager-$$.sh"
+defer_rm "$LESSSH"
+LESSDATA="${TMPDIR:-/tmp}/mux-e2e-pager-$$.txt"
+defer_rm "$LESSDATA"
+SOCK36="${TMPDIR:-/tmp}/muxd-e2e-pipestdin-$$.sock"
+defer_sock "$SOCK36"
+# The focus-skip leg, on a daemon of its own for the grid-size reason: it
+# asserts on grid sizes and on how many clients a session ever had at once,
+# and a session another block created — or another block's client sitting
+# on this daemon — would make both numbers say nothing.
+SOCK37="${TMPDIR:-/tmp}/muxd-e2e-focusskip-$$.sock"
+defer_sock "$SOCK37"
+# The dead tile. Its own daemon because the leg needs a session name that
+# does NOT exist — the daemon refuses the attach — and any other block's
+# daemon might have one by that name.
+SOCK39="${TMPDIR:-/tmp}/muxd-e2e-deadtile-$$.sock"
+defer_sock "$SOCK39"
+# The wheel inside the focused tile. Two daemons for the wheel pair's own
+# reason, turned up one notch: each needs a session whose SHELL is fixed for
+# the session's whole life — one that scrolls and one that ASKS for the
+# mouse — and a mode another scenario's session set would follow the wall's
+# terminal around. Both use the daemon's DEFAULT session, so the wall
+# spelling is a bare `--sock PATH` and nothing has to create anything.
+SOCK41="${TMPDIR:-/tmp}/muxd-e2e-wallwheel-$$.sock"
+defer_sock "$SOCK41"
+ZWHEELSH="${TMPDIR:-/tmp}/mux-e2e-wallwheel-$$.sh"
+defer_rm "$ZWHEELSH"
+SOCK42="${TMPDIR:-/tmp}/muxd-e2e-wallappmouse-$$.sock"
+defer_sock "$SOCK42"
+ZMOUSESH="${TMPDIR:-/tmp}/mux-e2e-wallappmouse-$$.sh"
+defer_rm "$ZMOUSESH"
+# ---- the wheel scrolls back, and an app that asks gets it instead -------
+# The pair is one claim seen from both sides, so the two legs are the same
+D36PID=""
+ok "a tile whose pump has died narrates on its bar and on its prompt, and the focus stays on the live one"
+# The wall as attach HISTORY (phase 2). A daemon AND a state home of its
+# own, for the dynamic-wall leg's reason turned up one notch: what these
+# two blocks read back is the wall FILE, and every `mux` in this suite now
+# writes a tile into the shared $XDG_STATE_HOME — so a file read out of
+# that one would be every other block's attaches as much as this one's.
+# The daemon is separate because the tile spelling contains the socket
+# path, which is what the assertions grep for.
+SOCK40="${TMPDIR:-/tmp}/muxd-e2e-wallhist-$$.sock"
+defer_sock "$SOCK40"
+WHSTATE="${TMPDIR:-/tmp}/mux-e2e-wallhist-state-$$"
+defer_rm "$WHSTATE"
+WHWALL="$WHSTATE/mux/wall"
+# A state home whose wall FILE is a directory: the unwritable case, which
+# has to warn and let the attach happen anyway.
+WHBAD="${TMPDIR:-/tmp}/mux-e2e-wallbad-$$"
+defer_rm "$WHBAD"
+# And a third, for the `x` block: its wall is built by two attaches and
+# then eaten by `x`, so it must start empty and stay its own.
+WHXSTATE="${TMPDIR:-/tmp}/mux-e2e-wallx-state-$$"
+defer_rm "$WHXSTATE"
+# The convergence block: `mux TARGET` is a wall of one tile whose rect is
+# the whole terminal. Three daemons and three state homes, each of them its own
+# for the same reason the attach-history block's is — what these legs read
+# back is the wall FILE, and the shared $XDG_STATE_HOME is every socket the
+# suite has ever attached to.
+SOCK45="${TMPDIR:-/tmp}/muxd-e2e-converge-$$.sock"
+defer_sock "$SOCK45"
+CVSTATE="${TMPDIR:-/tmp}/mux-e2e-converge-state-$$"
+defer_rm "$CVSTATE"
+CVWALL="$CVSTATE/mux/wall"
+# The ring-grows-the-wall leg needs TWO state homes: one for the client
+# under test, and one for the setup client whose attach must NOT leave a
+# tile the leg would then find already there. That absence is the case
+# under test — a sibling the daemon knows and the wall does not.
+SOCK46="${TMPDIR:-/tmp}/muxd-e2e-ringgrow-$$.sock"
+defer_sock "$SOCK46"
+RGSTATE="${TMPDIR:-/tmp}/mux-e2e-ringgrow-state-$$"
+defer_rm "$RGSTATE"
+RGOTHER="${TMPDIR:-/tmp}/mux-e2e-ringgrow-other-$$"
+defer_rm "$RGOTHER"
+# The exit-semantics leg: a session ending in the focused tile.
+SOCK47="${TMPDIR:-/tmp}/muxd-e2e-exitsem-$$.sock"
+defer_sock "$SOCK47"
+XESTATE="${TMPDIR:-/tmp}/mux-e2e-exitsem-state-$$"
+defer_rm "$XESTATE"
+# ---- the wall is attach HISTORY -----------------------------------------
+# The mechanical rule (wall-home-screen spec, phase 2): an attach that
+D47PID=""
+ok "a session ending in the focused tile exits mux alone, and leaves the focus to a neighbour"
+# Agent forwarding: one socket path, two daemons in turn. The positive leg
+# ends by typing `exit`, which ends that daemon's only session and takes the
+# daemon with it — so the refusal leg below starts its own on the freed path
+# rather than inheriting one that is already gone. Both are $MUXD; neither
+# may be auto-started (see the $PATH note at the top of this file).
+#
+# The agent lives beside the sockets rather than under $OUT: a unix path is
+# capped at 107 bytes by sun_path, and this one is dialled from inside a
+# session shell, so the room it has is the room every other socket in this
+# file was given.
+SOCK48="${TMPDIR:-/tmp}/muxd-e2e-agentfwd-$$.sock"
+defer_sock "$SOCK48"
+AGENT48="${TMPDIR:-/tmp}/mux-e2e-agent-$$.sock"
+defer_rm "$AGENT48"
+AGENT48KEY="${TMPDIR:-/tmp}/mux-e2e-agentkey-$$"
+defer_rm "$AGENT48KEY" "$AGENT48KEY.pub"
+# The flip leg gets a daemon of its own, and not for isolation's sake: the
+# one above is stopped by its own scenario's assert_stopped, so there is no
+# daemon left to reuse. Two agents, two keys, two sockets — one agent behind
+# both clients would print the same fingerprint whichever slot answered, and
+# the leg would pass having proved nothing. Beside the sockets for the
+# sun_path reason above; these are dialled from inside a session too.
+SOCK49="${TMPDIR:-/tmp}/muxd-e2e-agentflip-$$.sock"
+defer_sock "$SOCK49"
+AGENT49A="${TMPDIR:-/tmp}/mux-e2e-agent2a-$$.sock"
+defer_rm "$AGENT49A"
+AGENT49B="${TMPDIR:-/tmp}/mux-e2e-agent2b-$$.sock"
+defer_rm "$AGENT49B"
+AGENT49AKEY="${TMPDIR:-/tmp}/mux-e2e-agent2akey-$$"
+defer_rm "$AGENT49AKEY" "$AGENT49AKEY.pub"
+AGENT49BKEY="${TMPDIR:-/tmp}/mux-e2e-agent2bkey-$$"
+defer_rm "$AGENT49BKEY" "$AGENT49BKEY.pub"
+# --- agent forwarding: a real key in the client's agent answers in the session
+# Everything under this heading is a real program doing its real job: a real
@@ @@ -7012,6 +6887,12 @@ softkill "$AGENT49BPID" || true @@
+AGENT49BPID=""
+ok "agent forwarding: the agent that answers is whoever typed last"
+# The wall's own mouse claim needs a daemon of its own for the same reason
+# every other leg does: the wall scenario above stops its daemon on the way
+# out, so there is nothing left to reuse.
+SOCK50="${TMPDIR:-/tmp}/muxd-e2e-wallmouse-$$.sock"
+defer_sock "$SOCK50"
+# ---- the SOCK50 cluster: a daemon, two named sessions ------------------
+# A daemon and two named sessions (a, b) shared by the click leg below and
+D48PID=""
+ok "a drag copies on release, and a click copies nothing"
+# The in-band resize leg: a daemon of its own, so the grid it reports on is
+# the one this leg sized.
+SOCK51="${TMPDIR:-/tmp}/muxd-e2e-inband-$$.sock"
+defer_sock "$SOCK51"
+# --- a resize is told in-band to an app that asked for it (mode 2048) ------
+# nvim 0.11+ asks the terminal for in-band size reports (DECRQM 2048), and
+D42PID=""
+ok "agent forwarding: a mute offerer is hung up on, then no longer offered (${MUTE2MS}ms)"
+# The scrollback-rect leg: a focused tile's history page must own only its
+# sub-rect, so its daemon gets a socket of its own for the grid-size
+# reason every wall leg has.
+SOCK53="${TMPDIR:-/tmp}/muxd-e2e-sbrect-$$.sock"
+defer_sock "$SOCK53"
+SOCK54="${TMPDIR:-/tmp}/muxd-e2e-fullscreen-$$.sock"
+defer_sock "$SOCK54"
+SOCK55="${TMPDIR:-/tmp}/muxd-e2e-resize-$$.sock"
+defer_sock "$SOCK55"
+SOCK56="${TMPDIR:-/tmp}/muxd-e2e-spanclear-$$.sock"
+defer_sock "$SOCK56"
+SOCK57="${TMPDIR:-/tmp}/muxd-e2e-hjkl-$$.sock"
+defer_sock "$SOCK57"
+SOCK58="${TMPDIR:-/tmp}/muxd-e2e-splitbirth-$$.sock"
+defer_sock "$SOCK58"
+SOCK59="${TMPDIR:-/tmp}/muxd-e2e-lprrestore-$$.sock"
+defer_sock "$SOCK59"
+SOCK60="${TMPDIR:-/tmp}/muxd-e2e-lpheal-$$.sock"
+defer_sock "$SOCK60"
+SOCK61="${TMPDIR:-/tmp}/muxd-e2e-lpdegrade-$$.sock"
+defer_sock "$SOCK61"
+SOCK62="${TMPDIR:-/tmp}/muxd-e2e-promptA-$$.sock"
+defer_sock "$SOCK62"
+SOCK63="${TMPDIR:-/tmp}/muxd-e2e-promptB-$$.sock"
+defer_sock "$SOCK63"
+# --- the cursor rests in the focused tile, whoever painted last ----------
+# The cursor-ownership leg: a daemon of its own, for the grid-size reason
+# every wall leg has — the assertion is about where the cursor RESTS, and a
+# session another block created would change the tile it rests in.
+SOCK52="${TMPDIR:-/tmp}/muxd-e2e-cursor-$$.sock"
+defer_sock "$SOCK52"
+# Every painter ends by showing the cursor where its own stripe sits, so
+# without an owner the visible cursor lands on whichever pump painted last:
+D54PID=""
+ok "a focused tile's scrollback page owns only its sub-rect, and the neighbour's pin stays"
+# ---- fullscreen: f toggles, focus follows, restore -------------------
+# `f` is a layout op, not a mode: the focused tile takes the whole
@@ @@ -8191,6 +8073,61 @@ D62PID="" @@
+rm -rf "$LPDSTATE"
+ok "a corrupted sidecar degrades silently to the default layout"
+# The hydrated-create leg. One daemon, and it serves QUIC as well as its
+# socket: the leg's whole point is the LOCAL/remote split, so both halves
+# have to be the same run of the same daemon or the comparison is between
+# two rigs rather than between two kinds of line. Short socket name on
+# purpose — the assertion reads a label bar back off a 70-column render.
+SOCK64="${TMPDIR:-/tmp}/muxd-e2e-hyd-$$.sock"
+defer_sock "$SOCK64"
+# Base 6000, below the 5000-spaced band the other QUIC ports share: every
+# base from 11000 up is already taken, and a DUPLICATED base passes only
+# for as long as the other leg's daemon happens to be dead by the time
+# this one binds. A collision reads as this daemon's failure, not the
+# suite's, which is why the base has to be the leg's own.
+HYPORT=$(( 6000 + ($$ % 4000) ))
+HYKEY="${TMPDIR:-/tmp}/mux-e2e-hydkey-$$"
+defer_rm "$HYKEY"
+HYSTATE="${TMPDIR:-/tmp}/mux-e2e-hyd-state-$$"
+defer_rm "$HYSTATE"
+HYWALL="$HYSTATE/mux/wall"
+# The refused-attach leg: its own daemon, because its assertions are about
+# what a daemon says to a name it does NOT have, and a socket shared with
+# another leg would let that leg's sessions decide what "does not have"
+# means.
+SOCK66="${TMPDIR:-/tmp}/muxd-e2e-refuse-$$.sock"
+defer_sock "$SOCK66"
+REFSTATE="${TMPDIR:-/tmp}/mux-e2e-refuse-state-$$"
+defer_rm "$REFSTATE"
+# The browser half of the same ruling: one daemon serving a socket AND a
+# QUIC listener, one hub, a state home of its own. Two ports, and the
+# 5000-spaced bands are exhausted — 61000 is the last one that fits under
+# 65535 — so this leg takes the tail ABOVE the ephemeral range
+# (ip_local_port_range tops out at 60999 by default), halved. The narrow
+# `%250` is the price of that tail: two runs whose pids differ by 250
+# collide where the older bands need 4000. A collision reads as this leg's
+# daemon failing to bind, which is also why the two halves cannot share a
+# base.
+SOCK67="${TMPDIR:-/tmp}/muxd-e2e-wg-$$.sock"
+defer_sock "$SOCK67"
+WGPORT=$(( 65000 + ($$ % 250) ))
+WGQPORT=$(( 65250 + ($$ % 250) ))
+WGKEY="${TMPDIR:-/tmp}/mux-e2e-wgkey-$$"
+defer_rm "$WGKEY"
+WGSTATE="${TMPDIR:-/tmp}/mux-e2e-wg-state-$$"
+defer_rm "$WGSTATE"
+WGWALL="$WGSTATE/mux/wall"
+# The refusal-spin leg. Its own everything: a shim dir on PATH, a state
+# home holding the wall it restores, and a dial log the shim appends to.
+SOCK68="${TMPDIR:-/tmp}/muxd-e2e-sp-$$.sock"
+defer_sock "$SOCK68"
+SPPORT=$(( 26000 + ($$ % 4000) ))
+SPSTATE="${TMPDIR:-/tmp}/mux-e2e-sp-state-$$"
+defer_rm "$SPSTATE"
+SPDIR="${TMPDIR:-/tmp}/mux-e2e-sp-shim-$$"
+defer_rm "$SPDIR"
+SPINLOG="$SPDIR/dials"
+# ---- Ctrl-\ : adds a tile by spelling ---------------------------------
+# Argv typed from inside. A spelling naming a session on ANOTHER daemon
@@ @@ -8843,6 +8780,44 @@ D68PID="" @@
+rm -rf "$SPSTATE" "$SPDIR"
+ok "a refusal the birth cannot fix backs off instead of spinning"
+# `muxd upgrade` — four daemons, because each one is a different daemon
+# LIFECYCLE and no two can share a process: the same-binary leg's daemon
+# ends up running a second image, the rollback leg's is born with the abort
+# armed in its environment, the agent leg's holds an `-A` client, and the
+# QUIC leg's owns a UDP socket. They run one after another, so the last of
+# them is the only leg here that needs a port.
+SOCK69="${TMPDIR:-/tmp}/muxd-e2e-upgrade-$$.sock"
+defer_sock "$SOCK69"
+SOCK70="${TMPDIR:-/tmp}/muxd-e2e-uproll-$$.sock"
+defer_sock "$SOCK70"
+SOCK71="${TMPDIR:-/tmp}/muxd-e2e-upagent-$$.sock"
+defer_sock "$SOCK71"
+SOCK72="${TMPDIR:-/tmp}/muxd-e2e-upquic-$$.sock"
+defer_sock "$SOCK72"
+SOCK73="${TMPDIR:-/tmp}/muxd-e2e-stopgone-$$.sock"
+defer_sock "$SOCK73"
+# The next 4000-wide band DOWN from the hydrate leg's 6000: every base from
+# 11000 up is taken, and the 61000+ tail above the ephemeral range is spoken
+# for by the two browser ports. A collision here reads as this leg's daemon
+# failing to bind, the same verdict every other band gives.
+UPQPORT=$(( 2000 + ($$ % 4000) ))
+UPKEY="${TMPDIR:-/tmp}/mux-e2e-upkey-$$"
+defer_rm "$UPKEY"
+# A HOME of its own for the session shell. The title assertion below is
+# about a title the SESSION set, and a distribution's rc file repaints the
+# window title from PROMPT_COMMAND on every prompt (shellint.bash_init says
+# so of Arch's) — read out of the developer's own dotfiles, this leg would
+# assert on whatever their prompt happens to spell.
+UPHOME="${TMPDIR:-/tmp}/mux-e2e-uphome-$$"
+defer_rm "$UPHOME"
+# The candidate binary the refusal leg offers: a copy, so its exec bit can
+# be taken away without touching the one every other scenario runs.
+UPBIN="${TMPDIR:-/tmp}/mux-e2e-upcand-$$"
+defer_rm "$UPBIN"
+UPAGENT="${TMPDIR:-/tmp}/mux-e2e-upagent-$$.sock"
+defer_rm "$UPAGENT"
+UPAGKEY="${TMPDIR:-/tmp}/mux-e2e-upagkey-$$"
+defer_rm "$UPAGKEY" "$UPAGKEY.pub"
+# --- muxd upgrade: the daemon becomes the new binary, holding everything ---
@@ @@ -9377,6 +9352,50 @@ grep -q '^muxd: stopped' "$OUT.sg.stop" || { @@
+D73PID=""
+ok "muxd stop returns when the process is gone, not when the socket is"
+# The pins. Literals, not variables set from counting something else —
+# "assert the literal, never the constant the code under test reads"
+# (decisions.md, M10). The two figures live at the END of this file and
+# nowhere else: a count repeated in prose is a count nothing gates, and
+# both of the ones that used to stand here had drifted away from the pins
+# they described. Adding a scenario means editing those two literals by
+# hand, on purpose.
+#
+# Why most legs carry no convergence point. `assert_converged` replays one
+# client capture into an engine and diffs it against one daemon grid, so it
+# can only speak where BOTH exist and the grid is the subject. It says
+# nothing about a side channel (OSC 52, a window title, pty modes, a
+# fingerprint ssh printed, bytes counted rather than read), about a file an
+# editor or the wall wrote, about an exit code or a status field, about
+# WHICH of two sessions a keystroke reached, about scrollback the live grid
+# does not hold, about the absence of bytes two agreeing empties would
+# agree on anyway, or about a leg that never attaches at all. It also does
+# not claim to reproduce a full-screen application's redraws byte for byte,
+# which is why the alternate-screen legs stay out. A leg that asserts on
+# one of those and adds a convergence point would be pinning a fact every
+# leg above already establishes.
+# The pins. Literals, not variables set from counting something else —
+# "assert the literal, never the constant the code under test reads"
+# (decisions.md, M10). The two figures live at the END of this file and
+# nowhere else: a count repeated in prose is a count nothing gates, and
+# both of the ones that used to stand here had drifted away from the pins
+# they described. Adding a scenario means editing those two literals by
+# hand, on purpose.
+#
+# Why most legs carry no convergence point. `assert_converged` replays one
+# client capture into an engine and diffs it against one daemon grid, so it
+# can only speak where BOTH exist and the grid is the subject. It says
+# nothing about a side channel (OSC 52, a window title, pty modes, a
+# fingerprint ssh printed, bytes counted rather than read), about a file an
+# editor or the wall wrote, about an exit code or a status field, about
+# WHICH of two sessions a keystroke reached, about scrollback the live grid
+# does not hold, about the absence of bytes two agreeing empties would
+# agree on anyway, or about a leg that never attaches at all. It also does
+# not claim to reproduce a full-screen application's redraws byte for byte,
+# which is why the alternate-screen legs stay out. A leg that asserts on
+# one of those and adds a convergence point would be pinning a fact every
+# leg above already establishes.
+[ "$OK_COUNT" = "82" ] || {
+    echo "e2e FAIL: $OK_COUNT scenario checkpoints ran, the pin says 82 —"
+    echo "          a scenario was added (update the pin) or silently lost"