c5e30b30

feat: add independent native terminal panes

a73x 2026-09-05 06:42

Commit message

feat: add independent native terminal panes

CLAUDE.md

README.md

Old		New
@@ -19,24 +19,25 @@ make test && make e2e # verify
19	make install # the one binary to ~/.local/bin (override BINDIR)	19	make install # the one binary to ~/.local/bin (override BINDIR)
20	```	20	```
21		21
22	The native one-session viewer is an opt-in, dynamically linked second	22	The native client is an opt-in, dynamically linked second
23	binary. It needs SDL3, freetype2, fontconfig, HarfBuzz and OpenGL development	23	binary. It needs SDL3, freetype2, fontconfig, HarfBuzz and OpenGL development
24	packages; OpenGL functions are loaded through SDL, with no direct libGL	24	packages; OpenGL functions are loaded through SDL, with no direct libGL
25	link. It is outside the default build and CI gates:	25	link. It is outside the default build and CI gates:
26		26
27	```sh	27	```sh
28	make native # build muxg and run its no-window unit tests	28	make native # build muxg and run its no-window unit tests
29	make native-e2e # ReleaseSafe real-daemon, input, render, flood, resize and detach leg	29	make native-e2e # ReleaseSafe single- and two-pane integration checks; needs python3
30	./zig-out/bin/muxg [TARGET] [--session NAME] [--sock PATH] [--via CMD] [--key PATH] [--font-px N]	30	./zig-out/bin/muxg [TARGET] [--session NAME] [--sock PATH] [--via CMD] [--key PATH] [--font-px N]
31	```	31	```
32		32
33	`muxg` displays and types into one daemon session. With no target it uses	33	`muxg` displays daemon sessions in native terminal panes. With no target it uses
34	the local socket, whose daemon must already be running (`mux d start -d`);	34	the local socket; start its daemon with `mux d start -d`. It never starts a local
35	it never starts a local daemon itself. A remote `HOST` still uses mux's SSH	35	daemon itself, and an unavailable target is shown in its pane. A remote `HOST` uses mux's SSH
36	handoff, including that handoff's own remote-start behavior. `--via` uses a	36	handoff, including that handoff's own remote-start behavior. `--via` uses a
37	command's stdio, and `quic://HOST[:PORT]` uses `--key` or `MUX_KEY_FILE`.	37	command's stdio, and `quic://HOST[:PORT]` uses `--key` or `MUX_KEY_FILE`.
38	Closing the window detaches; the session stays on its daemon. When the shell	38	Closing the window detaches all panes; their sessions stay on their daemons. When
39	exits, the window closes with its exit code. `--font-px` sets the font size	39	a shell exits, its pane shows the exit status and the window remains open.
		40	`--font-px` sets the font size
40	at 100% display scale (default 16); glyphs are rasterized at the monitor's	41	at 100% display scale (default 16); glyphs are rasterized at the monitor's
41	actual scale and refreshed when the window moves between displays. Linux	42	actual scale and refreshed when the window moves between displays. Linux
42	prefers native Wayland, with X11 as a fallback. An explicit `SDL_VIDEO_DRIVER`	43	prefers native Wayland, with X11 as a fallback. An explicit `SDL_VIDEO_DRIVER`
@@ -46,6 +47,28 @@ The end-to-end leg checks the real build mode, reads rendered pixels back
46	from OpenGL, and measures a 20 ms p99 window-side budget under concurrent	47	from OpenGL, and measures a 20 ms p99 window-side budget under concurrent
47	output; pump apply time is reported separately.	48	output; pump apply time is reported separately.
48		49
		50	The first native tiling sprint supports one staged second target:
		51
		52	```sh
		53	./zig-out/bin/muxg alpha --session work --next-target beta --next-session logs
		54	# Local second daemon: --next-target '--sock /tmp/second.sock' --next-session logs
		55	```
		56
		57	Press Ctrl+Shift+Space, then v for side by side or b for above/below.
		58	This shows the intended split. Press the prefix again, then Enter, to insert
		59	the staged target. Cancellation creates no second pane or session. The split stays
		60	on the pane where it was armed, even if focus moves before insertion.
		61
		62	Prefix followed by h/j/k/l or an arrow moves focus; clicking a pane also focuses
		63	it. Prefix then Esc cancels a pending split. Press the prefix twice to send its
		64	normal terminal encoding through once. Window resizing updates every pane's PTY.
		65	An exited or unavailable pane leaves other panes usable.
		66
		67	Host/session pickers, divider resizing, and saved native layouts follow in later
		68	sprints. Tabs are represented in the ownership model but have no UI yet. Native
		69	layout choices are independent of terminal mux; both clients use the same daemon
		70	sessions.
		71
49	Binaries land in `zig-out/bin/`. For remote machines, build a static binary	72	Binaries land in `zig-out/bin/`. For remote machines, build a static binary
50	that runs on any x86_64 Linux:	73	that runs on any x86_64 Linux:
51		74

build.zig

Old		New
@@ -476,7 +476,7 @@ const source_bans = [_]SourceBan{
476	.rule = "8",	476	.rule = "8",
477	.folders = &.{"src/gui"},	477	.folders = &.{"src/gui"},
478	.needles = &.{ "@import(\"wall\")", "wall_host", "wall_layout", "wall_picker", "layoutfile", "sessionpoll" },	478	.needles = &.{ "@import(\"wall\")", "wall_host", "wall_layout", "wall_picker", "layoutfile", "sessionpoll" },
479	.why = "src/gui/ renders one session and contains no multi-session policy",	479	.why = "src/gui/ owns its workspace independently of terminal wall policy and persistence",
480	},	480	},
481	.{	481	.{
482	.rule = "9",	482	.rule = "9",
@@ -1161,8 +1161,12 @@ pub fn build(b: *std.Build) void {
1161	const native_e2e = b.addSystemCommand(&.{"test/native.sh"});	1161	const native_e2e = b.addSystemCommand(&.{"test/native.sh"});
1162	native_e2e.addArtifactArg(mux_exe);	1162	native_e2e.addArtifactArg(mux_exe);
1163	native_e2e.addArtifactArg(muxg_exe);	1163	native_e2e.addArtifactArg(muxg_exe);
		1164	const native_tiling = b.addSystemCommand(&.{ "python3", "test/native_tiling.py" });
		1165	native_tiling.addArtifactArg(mux_exe);
		1166	native_tiling.addArtifactArg(muxg_exe);
		1167	native_tiling.step.dependOn(&native_e2e.step);
1164	const native_e2e_step = b.step("native-e2e", "Run the native client's end-to-end leg (opt-in)");	1168	const native_e2e_step = b.step("native-e2e", "Run the native client's end-to-end leg (opt-in)");
1165	native_e2e_step.dependOn(&native_e2e.step);	1169	native_e2e_step.dependOn(&native_tiling.step);
1166		1170
1167	const soak = b.addSystemCommand(&.{"test/soak.sh"});	1171	const soak = b.addSystemCommand(&.{"test/soak.sh"});
1168	// The same list the e2e step passes, in the same order: soak IS that	1172	// The same list the e2e step passes, in the same order: soak IS that

docs/superpowers/plans/2026-09-05-native-tiling.md

@@ @@ -0,0 +1,305 @@ @@
+# Native tiling — delegated delivery plan
+Design authority: [native tiling spec](../specs/2026-09-05-native-tiling-design.md).
+Status: Sprint 1 implemented, refactored, reviewed, and validated; ready for ergonomic trial.
+## Working agreement
+Keep one sprint active. The root agent owns integration, user updates, acceptance
+evidence, and commits. Assign one implementer and one independent adversarial
+reviewer by default. Reuse those agents across packages; do not spawn a new agent
+for every file or test. A second implementer is useful only for an independent
+package with agreed interfaces and disjoint file ownership.
+Give each agent the spec, the current package below, relevant files, acceptance
+criteria, and the other agent's name. They inspect the code needed for that task;
+no blanket skill loading or repeated whole-repository surveys. The implementer
+owns edits. The reviewer sends concrete failures or counterexamples directly to
+the implementer, who fixes them and returns evidence. Review changed behavior
+and its tests, not just the implementation's own account.
+A review finding records the failing scenario, consequence, and expected result.
+Each is closed with a fix and verification, or a reason both agents accept that
+it does not apply. If they cannot agree, root adjudicates against the spec and
+observed behavior; do not iterate merely to manufacture agreement. Ask the user
+only for a product decision that existing requirements do not settle.
+Every sprint reserves an explicit refactoring package after functional integration
+and before final acceptance. The implementer and reviewer inspect the combined
+change for duplicated logic, unclear ownership, inconsistent interfaces or naming,
+unnecessary state, obsolete paths, temporary scaffolding, and technical debt in
+the touched code. Complete the cleanup as part of the sprint, including updating
+tests and documentation; it is not an optional follow-up after the feature ships.
+Deduplicate behavior where the responsibilities genuinely match, simplify ownership
+and error handling, and remove superseded helpers and test-only bypasses. Keep
+the GUI and terminal interaction policies separate. Do not introduce speculative
+frameworks or broaden into an unrelated CLI redesign to satisfy a cleanup quota.
+If a concrete debt item must remain, record its location, consequence, reason for
+deferral, and the package or trigger that will address it. Root resolves disputed
+deferrals; known correctness failures cannot be deferred past acceptance.
+The reviewer reports remaining findings explicitly and reviews the refactored
+result. Root inspects the final diff and runs the independent integration gate
+against that result. Earlier passes do not validate subsequent refactoring: rerun
+affected checks and the sprint acceptance scenario after cleanup. Commit a sprint
+only after required checks pass and review findings are resolved. Record the commit, exact validation
+commands/results, and material limits in the delivery record. Do not proceed to
+the next sprint with a broken build or an unresolved acceptance failure.
+## Sprint 1 — two real panes
+User-visible result: two terminals on independent hosts in one native window,
+with `v`/`b` insertion, prefix + `h/j/k/l` and click focus, independent input and
+PTY sizing. One flood, disconnect, or shell exit cannot take down the other pane.
+Window close detaches sessions. No picker, persistence, divider dragging, or tab
+UI is required yet. One tab exists in the model from the start.
+### 1A. Ownership and layout contract
+Implementer owns a new SDL-free GUI workspace model and its focused tests. Reuse
+`src/client/layout.zig` behind an adapter if it preserves the agreed semantics;
+do not change terminal-client tiling policy. Root owns any module registration
+and build rule changes once the model's location and exports are agreed.
+Define stable workspace-wide pane IDs, tab IDs, one-tab ownership, per-tab focus
+and pending direction, and leaf insertion/removal. Define a render-facing list
+of pane IDs and rectangles, including terminal content versus headers/dividers.
+Specify how layout units convert to physical pixels and terminal cells, how a
+too-small window is handled without discarding panes, and how transient IDs map
+to the existing tree's bounded leaf indices.
+For a window smaller than the tree's minimum footprint, retain a valid minimum
+layout and clip it to the window. Never send a zero PTY size or discard a leaf;
+hit-testing is restricted to visible rectangles. Refuse a new split that cannot
+fit the current viewport, while existing splits survive a later window shrink.
+Freeze the small model/painter interface with the reviewer before 1B: lifecycle
+ownership, rectangle units, insertion transaction, target-string lifetimes, and
+focus access. Include failure cleanup and a rule that callbacks use pane ID plus
+attachment generation, never array position or current focus.
+Acceptance: side-by-side and above/below splits, one nested split, directional
+neighbors, cancellation with unchanged geometry, minimum sizes, removal and stable
+IDs, and allocation failure without a half-inserted pane. Existing GUI still builds.
+### 1B. Multiple attachments and pane rendering
+Implementer owns `src/gui/frame.zig`, pane runtime integration, and any necessary
+changes to `src/gui/quads.zig` / `src/gui/gl.zig`. Root integrates exports in
+`src/gui/native.zig`. Depends on the reviewed 1A interface.
+Use one existing `client.session_pump` per pane. Own targets for the entire pump
+lifetime, keep wakes safe through removal/shutdown, and isolate dialing, exited,
+failed, and reconnecting state per pane. Stop treating one pane's phase as a
+reason to return from the whole window loop. The new pane-exit behavior also
+applies with one pane: revise the existing shell-exit-7 native test to assert an
+exited pane and a still-usable GUI, followed by an explicit quit. Update help/spec
+claims about process exit propagation deliberately; do not retain two competing
+pane lifecycle models merely to keep that old assertion.
+Build the whole active tab using physical content rectangles, pane-local offsets,
+clipping, labelled headers, and only the focused cursor. Prepare glyphs for ALL
+visible panes before normalizing any atlas UVs: another pane growing the shared
+atlas must not invalidate earlier instances. First copy visible cells and owned
+text into a reusable frame snapshot under one pump lock at a time; prepare and
+emit from those same snapshots. A second read of live grids could introduce new
+text after glyph preparation. Never borrow row text after releasing its pump lock.
+Bound work per pump and do not hold multiple pump mutexes together. Resize each
+attached PTY from its own content area.
+Acceptance: distinct grids produce distinct clipped pixels; shrinking a pane
+clears its old region; later-pane glyphs that grow the atlas do not corrupt earlier
+panes; font-scale changes update every pane. A failed or exited pane remains visible
+while another accepts input. Closing the window releases resources and preserves
+daemon sessions, including when a pane is still dialing.
+### 1C. Human-usable insertion and focus
+Implementer owns GUI command handling and `src/cli/muxg.zig` argument changes.
+Depends on 1B; the same implementer avoids competing edits to `frame.zig`.
+Provide `--next-target SPEC --next-session NAME` for one staged second pane, using
+the existing host-spec grammar (SSH host, `quic://...`, or the single string
+`--sock PATH`) and session
+name validation. Both flags are required together; reject repeated staged targets
+in this milestone. The primary target keeps its existing CLI syntax. For example:
+`muxg alpha --session work --next-target beta --next-session logs`.
+For a local fixture, use `--next-target '--sock /tmp/b.sock' --next-session logs`.
+The second target is staged until prefix + `v`/`b`, then prefix + Enter inserts it.
+This is a usable substitute for session selection in sprint 1;
+sprint 2 replaces target acquisition with the picker while retaining insertion.
+The target should be selectable from real CLI arguments, not only a test FIFO.
+Implement Ctrl+Shift+Space command mode, visible pending direction, `h/j/k/l`
+and arrow focus, click focus, cancellation, and prefix passthrough. Consume both
+key events and associated SDL text events correctly: commands must not leak bytes
+into a terminal or suppress subsequent ordinary text. Window resize remains live.
+Pending insertion retains the pane ID armed by `v`/`b` even if focus moves before
+Enter; the preview stays on that pane. Removing that pane cancels its pending
+insertion. Re-arming explicitly replaces the pending pane/direction.
+Acceptance: a person can launch and insert the second explicit target in either
+direction and type independently in both. Exercise actual prefix/key/text events,
+mouse coordinates at high DPI, cancellation, and input after command completion.
+Pressing the prefix twice forwards its normal terminal keymap encoding once and
+exits command mode. Test that passthrough explicitly rather than leaving it implicit.
+Extend test hooks only as needed to drive those same event paths.
+### 1D. Deduplication, refactoring, and debt cleanup
+Depends on integrated 1A–1C. The implementer owns cleanup; the reviewer challenges
+the resulting boundaries and any retained debt. Root coordinates changes to its
+harness files rather than allowing concurrent edits.
+Inspect the combined model, runtime, painter, CLI, and test changes. Consolidate
+repeated rectangle/cell calculations, target ownership and cleanup, input-mode
+transitions, and pane status handling where their semantics match. Remove obsolete
+single-pane paths and transitional helpers. Keep one authoritative source for
+focus, geometry, and attachment identity. Preserve the supported explicit-target
+launch surface; remove only scaffolding that the integrated implementation replaces.
+Acceptance: concrete cleanup completed and reviewed, with a concise account of
+what was simplified and any justified remaining debt. No requirement to invent
+an abstraction when the integrated code is already straightforward. Final tests
+and the GUI demonstration in 1E run on the cleaned-up implementation.
+### 1E. Independent acceptance and commit
+Root owns `test/native.sh` or a separate native-tiling integration leg, runs the
+GUI demonstration, and summarizes evidence. The reviewer reviews the harness as
+well as production changes, looking for checks that can pass with a broken GUI.
+Harness work can be prepared alongside 1B after hook and interface agreement;
+final acceptance runs after 1D. No other agent edits root's harness files.
+- Start two isolated daemons with separate sockets and state directories. Never
+  restart or alter the user's live sessions for automated checks.
+- Insert both orientations. Type unique markers through keyboard and click focus;
+  assert arrival in the intended daemon and absence from the other.
+- Inspect framebuffer regions for each pane's distinct content, focus indicator,
+  clipping, and erased pixels after shrink. A capture that forces a redraw is not
+  evidence that ordinary output wakes the painter; separately check frame progress.
+- Check BOTH reported PTY sizes against pane content geometry after window resize.
+- While A floods bounded output, send a marker to B and require its delivery and
+  painting within a stated deadline. Then make A unavailable; B remains usable.
+  Cover A's shell exit and an initially unreachable target as distinct cases.
+- Close the window and verify surviving daemon sessions can be attached again.
+- Run native Wayland at the real display scale. Validate an available real remote
+  transport separately; distinguish Unix-socket, SSH, and QUIC coverage in the report.
+  If no remote fixture is available, finish and report the isolated-daemon gate and
+  runnable build, with remote acceptance explicitly outstanding. Obtain a fixture
+  before claiming SSH/QUIC or real multi-host validation; do not stall unrelated work
+  waiting on external infrastructure or silently count local sockets as remote hosts.
+Run the ReleaseSafe native build/tests and relevant integration leg. Run repository
+checks and existing-client regressions if shared modules/build boundaries changed.
+Report measured deadlines and performance against the agreed single-window budget;
+do not broaden/repeat testing after a pass without a new change or unresolved risk.
+## Subsequent sprints
+The following packages use the same implementation → refactoring → adversarial
+review → root acceptance loop.
+Do not dispatch them while sprint 1 is still under integration or ergonomic review.
+| Sprint / package | Owned work and dependencies | Required demo / acceptance |
+| --- | --- | --- |
+| 2A: picker data | Cancellable host/session discovery and creation, through existing client APIs; depends on stable pane IDs | Slow/unreachable hosts do not block another picker request; stale responses cannot insert into a replaced pane |
+| 2B: picker UI | Host list → existing/new session list; command routing and insertion use 1C; depends on 2A | Nested splits across hosts; Esc/back creates nothing; session creation errors preserve the workspace; missing-session attach semantics explicitly checked |
+| 2C: ergonomic gate | Root trials selection, pending direction, insertion geometry, and prefix bindings with user | Fix confusing behavior before extending interactions; focused integration and adversarial review pass |
+| 2D: refactor and accept | Clean up picker states, discovery ownership, repeated host/session operations, and replaced staging scaffolding after the ergonomic trial | Reviewer approves cleanup/debt record; rerun picker acceptance before commit |
+| 3A: resize model | Divider geometry, weights, minimum dimensions; depends on reviewed insertion semantics | Nested splits resize predictably; minimum dimensions preserve pane identity; pure layout checks |
+| 3B: resize interaction | Divider dragging and keyboard resize mode; depends on 3A | Each PTY follows its pane; commands do not leak; clipped glyphs and old pixels remain correct at high DPI |
+| 3C: refactor and accept | Consolidate rectangle conversion, hit-testing, and resize constraints across keyboard and mouse paths | Reviewed cleanup; rerun resize and high-DPI acceptance before commit |
+| 4A: lifecycle/recovery | Distinct detach/end, retry and in-place retarget, missing/exited/offline state; depends on picker and stable identity | Detach preserves session; end respects daemon outcome; failure retains pane; restored missing sessions are not silently recreated |
+| 4B: native persistence | Versioned tabs-aware file, atomic save/load, default workspace ownership, explicit-target temporary workspace | Close/reopen restores layout, targets, focus and sizes; offline target retained; malformed state preserved; terminal layout untouched |
+| 4C: restore integration | Coordinate attachment restoration, cancellation, recovery UI, and shutdown; depends on 4A/4B | One unavailable host does not delay usable hosts; an unavailable host can return; no orphan pumps or accidental session termination |
+| 4D: refactor and accept | Deduplicate live/restore attachment lifecycle, simplify save/load ownership, and remove superseded recovery paths | Reviewed cleanup/debt record; rerun lifecycle and persistence acceptance before commit |
+| 5: final cleanup and review | Review accumulated debt across sprints, finish justified cross-package simplification, then run the complete workflow and final adversarial review | Multi-host acceptance, resource cleanup, persistence failures, high DPI and final ergonomic trial on final code; runnable build and commit |
+Package 2A must include cancellation during transport opening as well as request
+handling. Current `listSessions`/`endSession` paths open with no abort FD and start
+reply deadlines after dialing. Add narrow cancellable API support where necessary;
+moving those existing calls to workers alone does not bound shutdown. Test an
+unresponsive dial, a slow reply, cancellation, and late completion after retargeting.
+Resolve attach-existing versus create semantics in 2A before wiring 2B. A session
+can vanish between listing and attachment, and the current attach path may create
+it again. Establish an existing-only operation/capability or an explicitly refused
+unsupported path; a preflight list alone cannot provide that guarantee. Preserve
+legacy client behavior when extending shared wire handling and cover old-daemon
+compatibility. Reuse this guarantee for persistence in sprint 4.
+Possible later parallelism: 3A geometry versus root's resize harness, and 4A lifecycle
+versus 4B serialization after agreeing the serializable model. Discovery and picker
+UI, frame-loop rendering and input, and persistence plus concurrent workspace edits
+must stay sequential until their interfaces are settled.
+## Delivery record
+-09-05: independent planning review completed with no material findings left.
+Resolved frame snapshot ownership, cancellation during dialing, attach/create races,
+tiny-window behavior, command passthrough, and exact initial target syntax.
+### Sprint 1 — 2026-09-05
+Packages 1A–1D are complete. Native ownership now lives in `workspace.zig` and
+`runtime.zig`: a one-tab workspace, stable pane identities, independent pumps,
+pixel geometry, and owned snapshots for frame construction. The staged-target CLI,
+`v`/`b` insertion, keyboard/click focus, per-pane resize, retained exit/offline state,
+and window detach are implemented. No terminal-client interaction policy changed.
+The fixed binary pixel tree replaces the proposed adapter to the terminal tree:
+its fixed capacity permits transactional insertion, both divider orientations,
+and native pixel minima without changing the terminal tree's cell rails or policy.
+The first version divides each branch equally; weights arrive with Sprint 3.
+Refactoring completed before final native validation: one geometry policy, one
+target resolver, shared glyph preparation/clipping/artifact writing, removal of
+the single-pane process-exit path, and broadcast cancellation before pump joins.
+Review caught and fixed held command-key repeat leaking into terminal input.
+The two agents reached agreement on production code and the independent harness.
+Validation completed:
+- `ZIG_GLOBAL_CACHE_DIR=/tmp/muxg-zig-cache deps/zig/zig build native native-test
+  -Doptimize=ReleaseSafe --summary all`: 25 native tests passed; ReleaseSafe GUI built.
+- `ZIG_GLOBAL_CACHE_DIR=/tmp/muxg-zig-cache make native-e2e`: 10 existing native
+  checkpoints and 14 new tiling checkpoints passed against the current daemon.
+  Unix/Unix and Unix/QUIC pane pairs are covered. The measured quiet-pane input
+  reached an actual painted frame in 81 ms during a neighbouring flood; window
+  p99 was 72 microseconds against the 20 ms budget. Prefix passthrough produced
+  exactly NUL followed by A through a real PTY (`od`: `00 41`).
+- Native Wayland: 1698×2760 framebuffer at 849×1380 logical size, 200% density;
+  both daemon sizes, independent coloured pixels, and a non-origin pane click
+  converted from physical pixels to logical input coordinates passed.
+The full repository gate (`make ci`) passed on the final refactored source:
+formatting, unit tests, architecture checks, 114 end-to-end scenarios with 38
+convergence points, 10 agent checks, and throughput limits. Validation also fixed
+an unrelated mouse-test false positive: the literal `60` could match the runner
+PID in the pane's socket label. The assertion now uses `app-history-row-60`;
+terminal behavior is unchanged.
+Real remote-host validation passed against `ubuntu@10.78.5.4`, using the dedicated
+fixture SSH key and a static ReleaseSafe daemon built from the current source.
+`PYTHONDONTWRITEBYTECODE=1 python3 /tmp/muxg-remote-fixture/validate.py ubuntu@10.78.5.4`
+exited 0. Both local/SSH and local/direct-QUIC pairs demonstrated independent
+daemon grids, last-painted frame text, coloured pixels confined to each pane,
+keyboard refocus, and sessions surviving GUI close. SSH used the actual endpoint
+fallback; QUIC used a direct `quic://` target. Remote resize/flood coverage was
+not repeated; those cases passed in the isolated integration gate above.
+The fixture removed its temporary daemons and remote directory and left the VM
+running. Logs: `/tmp/muxg-tiling-real-remote.log`; local frame artifacts:
+`/tmp/muxg-tiling-rfzrpp0b`. Independent review found no outstanding blockers.
+Sprint commit: `feat: add independent native terminal panes`. The next gate is
+the user's ergonomic trial before Sprint 2 picker work.
+Retained debt for package 2A: transport opening still has inherited synchronous
+Unix connect and DNS resolution before cancellable waits. Broadcast cancellation
+improves multi-pane shutdown but does not make those stages interruptible. Extend
+transport cancellation with discovery/lifecycle work and add stalled-connect/DNS
+checks there; do not claim a universal shutdown bound from attached/missing-socket
+tests. GUI sessions/layout persistence, picker UI, divider resizing, and tab UI
+remain the explicitly deferred later sprints.

docs/superpowers/specs/2026-09-05-native-tiling-design.md

@@ @@ -0,0 +1,230 @@ @@
+# Native tiling — draft design and delivery plan
+-09-05. Status: Sprint 1 implemented and validated; ready for ergonomic trial.
+Execution: [delegated work packages and review gates](../plans/2026-09-05-native-tiling.md).
+## Agreed requirements
+- Sway-like directional splitting within a GUI window. Select horizontal or
+  vertical first; the layout changes only when a new pane is inserted.
+- Insert through a host picker, followed by a session picker offering existing
+  sessions and creation of a new session.
+- GUI layout persistence is independent of terminal mux's layout and pane choices.
+- Both clients use the same daemons and session catalogue. Keep terminal mux's
+  interaction model separate; native-client learning may inform it later.
+- Design pane ownership and persistence to accommodate tabs later. The initial
+  deliverable has one tab internally, without a tab bar or tab commands.
+- Multiple hosts and pane resizing are required for the first useful release.
+- Detaching a pane and ending its session are distinct actions.
+- An unreachable host retains its pane and displays its state; it is recoverable.
+- Rearranging panes is a stretch goal.
+This design supersedes the single-session limit and native-pane prerequisite in
+the 2026-09-04 native-client spec. It does not require migrating the terminal
+wall and browser to a common controller before native tiling can ship.
+## Workspace and future tabs
+Ownership is explicit from the first sprint:
+```text
+GUI window: SDL/GL resources, shared font atlas, workspace
+  Workspace: ordered tabs, active tab ID
+    Tab: stable ID, split tree, focused pane ID, pending split
+      Pane: stable ID, target/session identity, connection and terminal grid
+```
+The window owns rendering resources; each tab owns its layout and panes. A pane
+belongs to exactly one tab and owns its session attachment. Pane IDs are unique
+within the workspace and independent of array positions, so asynchronous replies
+cannot be routed by the active tab or a reused slot. Tab and pane actions take
+explicit IDs. Cancellation generations also distinguish replaced attachments.
+Only the active tab receives terminal input and supplies rectangles for drawing.
+Future tab switching changes visibility, not session ownership: hidden panes keep
+their connections and last valid PTY dimensions, without sending zero-sized
+resizes. They continue applying bounded output updates without requiring window
+repaints. Activation recalculates geometry at the current display scale and paints
+the latest state. An exited session or failed connection belongs to its pane even
+when its tab is inactive; it must not terminate the window or steal focus.
+Closing a pane changes its tab's tree. An empty tab remains an Add pane surface.
+Closing the window detaches every tab's panes. Future tab-close behavior will be
+specified with the tab UI; do not make it an alias for ending remote sessions.
+Keep global keyboard modes transient and cancel them on a future tab switch;
+focus and pending insertion belong to their tab. Picker operations capture their
+originating tab and pane and must never insert into whichever tab happens to be
+active when a network reply arrives.
+Implement only the ownership boundary needed for one tab now. Tab creation,
+switching, reordering, and background-tab scheduling tests arrive with that feature;
+they are not prerequisites for the two-pane deliverable.
+## Proposed interaction defaults
+The defaults below are proposals to trial, rather than additional requirements.
+Horizontal means side by side, with the new pane to the right. Vertical means
+above/below, with the new pane below. Show those words and a small preview so
+the orientation is unambiguous.
+Direction selection arms the focused pane for one insertion and changes no
+geometry. Opening the picker captures that pane and direction. Host selection
+opens its sessions; New session requests a name and creates it explicitly.
+Only committing a session selection inserts the pane and focuses it. Cancelling
+either level creates no pane or session. Esc in sessions returns to hosts;
+Esc in hosts dismisses the picker. Keep the pending direction visible until
+insertion or explicit cancellation. Start with side-by-side as the default.
+The pending split remains bound to its original pane if focus moves; its preview
+stays there. Re-arming replaces that choice, and removing the pane cancels it.
+Initially, split the armed leaf into two equally sized children. Other panes
+retain their allocated space. Repeated insertion semantics can be adjusted after
+the first ergonomic trial; do not silently rebalance unrelated branches.
+Keyboard prefix for the ergonomic trial: **Ctrl+Shift+Space**. It avoids Sway's usual Super
+bindings and the existing terminal mux prefix, including mux nested in a pane.
+The prefix opens a small command hint strip; its next key is consumed by the GUI.
+| After prefix | Action |
+| --- | --- |
+| `v` | Arm side-by-side insertion (vertical divider) |
+| `b` | Arm above/below insertion (new pane below) |
+| Enter | Open host picker for insertion |
+| `h` / `j` / `k` / `l`, or arrows | Focus left / down / up / right |
+| `r` | Enter resize mode; `h/j/k/l` or arrows resize, Esc/Enter exits |
+| `d` | Detach and remove the focused pane |
+| `x` | End the focused session through the daemon's existing end workflow |
+| `p` | Open recovery actions for the focused pane |
+| Esc | Cancel the command and pending split |
+The split and movement bindings above were agreed on 2026-09-05: reserve
+`h/j/k/l` for directional movement, with `v` and `b` selecting split direction.
+Pressing the prefix twice forwards its normal terminal keymap encoding once and
+exits command mode. Ordinary input
+goes only to the focused terminal; picker and resize-mode input never leaks to it.
+Mouse click focuses a pane, and dragging a divider resizes it. Terminal mouse
+reporting remains a separate feature. Pane headers identify host, session, focus,
+and connection state; both detach and end actions must be clearly labelled.
+## Lifecycle and persistence
+Closing the OS window saves the workspace and detaches all panes. It does not
+end their sessions. Explicit pane detach removes that leaf from the saved layout;
+its sibling fills the freed area. Closing the last pane leaves an empty tab
+with an Add pane action. An ordinary shell exit leaves an exited pane with recovery
+actions; it must not terminate the entire GUI or remove other hosts' panes. This
+also applies to a one-pane GUI, superseding the viewer's shell-exit-code propagation.
+End session uses the existing daemon request and its response, including its
+existing handling of other attached clients. A failure to end keeps the pane and
+shows the reason. Transport cancellation/GUI shutdown is not session termination:
+the current session pump's `quit` and `detach` both stop the attachment.
+Use a separate, versioned GUI state file, proposed at
+`$XDG_STATE_HOME/mux/native-workspace.json`. The initial schema has an ordered
+`tabs` collection and `active_tab_id`, even while only one tab is exposed. Persist
+each tab's stable ID, split tree, relative weights, panes, and focus. Pane records
+hold stable IDs, explicit host/transport references, and resolved session names.
+Pending commands and picker state are transient. Do not write terminal mux's
+layout file. Save atomically after
+committed changes; preserve unreadable state rather than overwriting it with an
+empty workspace. Save divider changes when a drag finishes. A saved host reference
+must survive removal from the shared host catalogue.
+No-argument `muxg` restores the GUI workspace; first launch presents the picker.
+An explicit CLI target opens a temporary workspace without replacing the default
+saved workspace. For this milestone, allow one writer for the default workspace;
+a second no-argument launch should report that it is already open. Multiple named
+workspaces and multiple persistent windows are deferred.
+Unreachable panes retain their identity, position, and last available content,
+with a clear offline indication. Keep other panes usable. Offer Retry and Choose
+session in place, plus Detach. Use bounded background reconnect attempts. Missing
+or exited sessions remain visible; restoration must not silently replace a missing
+session with a newly created shell. Check the existing attach/create semantics
+before implementing this guarantee and add a narrow protocol capability if needed.
+Confirmed: GUI and terminal clients can deliberately select the same daemon
+session from a shared catalogue, while their layouts and automatic pane choices
+remain independent. Sharing a session retains the daemon's existing resize and
+attachment semantics; GUI layout isolation does not create a separate PTY.
+## Implementation boundaries
+Reuse `client.session_pump` per pane, `client.listSessions`, session creation and
+`client.endSession`, plus existing target resolution and host catalogue support.
+Discovery and lifecycle requests run off the SDL thread with cancellation and
+generation checks so stale picker/retry results cannot mutate a replacement pane.
+One unreachable or flooding host must not block input or drawing on another.
+Keep the GUI workspace controller independent of SDL and terminal wall policy.
+Use the existing `client.layout.Tree` geometry where it fits: it already supports
+split-right, split-below, weights, removal, and directional neighbors. Its current
+cell-based rails and placement need evaluation for horizontal dividers and pixel
+hit-testing; use a narrow adapter or extension with existing-client regressions.
+Do not import the terminal wall picker or inherit its automatic pane selection.
+The controller owns per-tab focus; the SDL frame loop routes events to the active
+tab and computes physical pixel rectangles. Render that tab's panes with the
+existing shared font/atlas, clip content to each pane,
+draw only the focused cursor, and resize each PTY to its own content rectangle.
+Retain whole-frame clearing initially. Apply display-scale changes consistently
+to every pane, header, divider, and picker. Enforce minimum sizes during splits
+and divider drags; shrinking the OS window must not discard saved pane identity.
+If the existing layout cannot fit a tiny window, retain its minimum footprint and
+clip it to the viewport; never send zero PTY dimensions. Refuse new splits that
+cannot fit. For each frame, copy visible cells and their text under individual
+pump locks, then prepare all glyphs and generate all UVs from that frozen data.
+Revise build rule 8 and architecture comments to permit this explicit model while
+retaining the SDL boundary and separation from the terminal wall. No broad wall
+policy extraction is a prerequisite.
+## Small functional sprints
+. **Two real panes.** Introduce workspace/tab/pane ownership with one tab and a
+   pure split controller. Trial `v`/`b` insertion using explicit targets, focus via
+   prefix + `h/j/k/l` or mouse click, and route input/resize independently.
+   Demo two isolated daemons simultaneously, including one flooding and one idle.
+   Retain the current direct-target smoke test through a temporary workspace.
+. **Insertion workflow.** Connect pending direction to host and session pickers,
+   explicit creation, and expanded keyboard hints. Demo nested splits across
+   hosts; cancelling creates nothing; failed discovery keeps existing panes usable.
+   Trial the direction semantics and shortcuts here before expanding them.
+. **Resizing.** Add divider dragging and keyboard resize mode with minimum sizes.
+   Demo nested pane resizing, correct per-session PTY sizes, clipped glyphs, and
+   a high-DPI scale change. Assert old pixels disappear after shrinking regions.
+. **Lifecycle and restore.** Add separate native persistence, detach/end actions,
+   exited/offline pane recovery, and bounded shutdown. Demo close/reopen preserving
+   multiple hosts, an unavailable host returning, a missing session remaining
+   recoverable, and unchanged terminal mux layout state.
+. **Release review.** Exercise the full multi-host workflow, keyboard ergonomics,
+   failure isolation, default-workspace ownership, malformed saved state, and
+   high-DPI rendering. Review and commit the completed milestone.
+Each sprint must leave runnable code with a concrete GUI demo. Delegate bounded
+implementation and a separate adversarial review; they resolve findings directly
+before completion. Reserve explicit work at the end of every sprint to deduplicate,
+refactor, and clean up technical debt in the integrated code. Review ownership,
+interfaces, repeated logic, and temporary scaffolding; complete cleanup before
+final validation and commit. Record any justified remaining debt and its follow-up
+trigger. Keep native and terminal interaction policy separate while simplifying
+shared mechanics where appropriate. Run acceptance on the refactored result.
+Use focused state/lifecycle tests and actual framebuffer and
+daemon-size checks. Run broader repository checks when shared code changes.
+Do not add ceremony or broad test runs without a specific integration risk.
+First-sprint acceptance includes exact layout and focused-input tests, distinct
+typed markers checked in each daemon grid and framebuffer, clipping and erasure
+after resize, and each daemon reporting its own pane's PTY dimensions. Flood or
+disconnect one daemon while the other continues accepting input and painting;
+closing the GUI leaves sessions alive. Check native Wayland at the display's real
+scale. Isolated local daemons establish connection independence; a separate real
+remote-host check is needed to claim SSH/QUIC end-to-end validation, with any
+untested transport explicitly reported. Review and commit the runnable sprint.
+Rearranging panes, drag-and-drop movement, tab UI, container focus/reparenting,
+multiple persistent windows, and terminal-client tiling redesign are later work.

src/cli/muxg.zig

Old		New
@@ -1,11 +1,4 @@
1	//! `muxg`: the native client's entry. Parses ONE target the way `mux`	1	//! Native workspace entry; one primary attachment and one optional staged target.
2	//! does (HOST, --sock PATH, --via CMD, quic://HOST[:PORT]) plus --session
3	//! and --font-px, resolves it to a client.Target, and hands it to the
4	//! painter. A session viewer: no wall, no hosts file, no layout.
5	//!
6	//! No daemon is started here. The self-exec rule (CLAUDE.md) says an
7	//! auto-start may only run the image already running, and this image is
8	//! not the daemon's. A silent socket is a refusal with the command to run.
9	const std = @import("std");	2	const std = @import("std");
10	const native = @import("native");	3	const native = @import("native");
11	const client = @import("client");	4	const client = @import("client");
@@ -25,6 +18,8 @@ const usage =
25	\\ --via a command whose stdio is the daemon	18	\\ --via a command whose stdio is the daemon
26	\\ --key the QUIC key file (or MUX_KEY_FILE)	19	\\ --key the QUIC key file (or MUX_KEY_FILE)
27	\\ --font-px font pixels at 100% display scale (default 16)	20	\\ --font-px font pixels at 100% display scale (default 16)
		21	\\ --next-target stage one target specification for prefix v/b then prefix Enter
		22	\\ --next-session session name for the staged target (required with --next-target)
28	\\ --help --version	23	\\ --help --version
29	\\	24	\\
30	;	25	;
@@ -35,9 +30,27 @@ const Arguments = struct {
35	key: ?[]const u8 = null,	30	key: ?[]const u8 = null,
36	session: ?proto.SessionName = null,	31	session: ?proto.SessionName = null,
37	font_px: u16 = 16,	32	font_px: u16 = 16,
		33	_next_target: ?[]const u8 = null,
		34	_next_session: ?[]const u8 = null,
		35	_next_targets: usize = 0,
		36	_next_sessions: usize = 0,
38	_target: ?[]const u8 = null,	37	_target: ?[]const u8 = null,
39	_targets: usize = 0,	38	_targets: usize = 0,
40		39
		40	pub fn extra(self: *Arguments, rest: []const [:0]const u8) usize {
		41	if (rest.len < 2) return 0;
		42	if (std.mem.eql(u8, rest[0], "--next-target")) {
		43	self._next_target = rest[1];
		44	self._next_targets += 1;
		45	return 2;
		46	}
		47	if (std.mem.eql(u8, rest[0], "--next-session")) {
		48	self._next_session = rest[1];
		49	self._next_sessions += 1;
		50	return 2;
		51	}
		52	return 0;
		53	}
41	pub fn positional(self: *Arguments, word: []const u8) bool {	54	pub fn positional(self: *Arguments, word: []const u8) bool {
42	self._target = word;	55	self._target = word;
43	self._targets += 1;	56	self._targets += 1;
@@ -72,39 +85,36 @@ pub fn main() !u8 {
72	const session = if (o.session) \|n\| n.name else "";	85	const session = if (o.session) \|n\| n.name else "";
73	const key = std.posix.getenv("MUX_KEY_FILE");	86	const key = std.posix.getenv("MUX_KEY_FILE");
74		87
75	var target: client.Target = undefined;	88	if (o._next_targets > 1 or o._next_sessions > 1 or (o._next_target == null) != (o._next_session == null)) {
76	if (o.via) \|cmd\| {	89	std.debug.print("muxg: provide --next-target and --next-session exactly once together\n", .{});
77	target = .{ .via = cmd };	90	return 2;
78	} else if (o._target) \|word\| {	91	}
79	const spec = hosts.parse(word) catch \|err\| {	92	var next: @FieldType(native.frame.Options, "next") = null;
80	std.debug.print("muxg: bad target {s}: {s}\n", .{ word, @errorName(err) });	93	if (o._next_target) \|word\| {
81	return 2;	94	const name = o._next_session.?;
82	};	95	if (!proto.validSessionName(name)) {
83	target = client.Target.fromSpec(argv_alloc, spec, o.key orelse key, client.quic_idle_ms_default, false) catch \|err\| switch (err) {	96	std.debug.print("muxg: invalid --next-session\n", .{});
84	error.MissingKey => {
85	std.debug.print("muxg: no key: pass --key, set MUX_KEY_FILE, or run `mux d keygen`\n", .{});
86	return 2;
87	},
88	else => \|e\| return e,
89	};
90	if (target == .hand) target.hand.narrate = true;
91	} else {
92	const path = if (o.sock) \|s\| try argv_alloc.dupe(u8, s) else (try sockpath.defaultOrExplain(argv_alloc, "muxg") orelse return 1);
93	if (!sockpath.answers(path)) {
94	std.debug.print("muxg: no daemon at {s} (run: mux d start -d --sock {s})\n", .{ path, path });
95	return 2;	97	return 2;
96	}	98	}
97	return native.run(alloc, .{	99	next = .{ .target = resolve(argv_alloc, word, o.key orelse key) catch \|err\| {
98	.target = .{ .sock = path },	100	std.debug.print("muxg: bad staged target: {s}\n", .{@errorName(err)});
99	.session = session,	101	return 2;
100	.font_px = o.font_px,	102	}, .session = name };
101	.test_fifo = std.posix.getenv("MUXG_TEST_FIFO"),
102	});
103	}	103	}
		104	const target: client.Target = if (o.via) \|cmd\| .{ .via = cmd } else if (o._target) \|word\| resolve(argv_alloc, word, o.key orelse key) catch \|err\| {
		105	std.debug.print("muxg: bad target: {s}\n", .{@errorName(err)});
		106	return 2;
		107	} else .{ .sock = if (o.sock) \|path\| path else (try sockpath.defaultOrExplain(argv_alloc, "muxg") orelse return 1) };
104	return native.run(alloc, .{	108	return native.run(alloc, .{
105	.target = target,	109	.target = target,
		110	.next = next,
106	.session = session,	111	.session = session,
107	.font_px = o.font_px,	112	.font_px = o.font_px,
108	.test_fifo = std.posix.getenv("MUXG_TEST_FIFO"),	113	.test_fifo = std.posix.getenv("MUXG_TEST_FIFO"),
109	});	114	});
110	}	115	}
		116	fn resolve(alloc: std.mem.Allocator, word: []const u8, key: ?[]const u8) !client.Target {
		117	var target = try client.Target.fromSpec(alloc, try hosts.parse(word), key, client.quic_idle_ms_default, false);
		118	if (target == .hand) target.hand.narrate = true;
		119	return target;
		120	}

src/gui/frame.zig

Old		New
@@ -1,18 +1,10 @@
1	//! The window thread: SDL owns the window and the GL context; this file	1	//! SDL window, workspace input, and whole-frame painting of owned pane snapshots.
2	//! owns the loop. It waits on SDL's event queue; a wake from the pump or a
3	//! resize locks the replica, rebuilds every instance from the whole grid,
4	//! unlocks, uploads, draws and swaps. Keys become keymap events, text
5	//! becomes input bytes, and both go to the pump's mailbox. The ONE file
6	//! under src/gui/ that names SDL (folder rule 9).
7	//!
8	//! Whole-grid rebuild every frame is deliberate for v1: a large window is
9	//! on the order of ten thousand cells, and the timing table is what will
10	//! say whether dirty rows ever matter.
11	const std = @import("std");	2	const std = @import("std");
12	const client = @import("client");	3	const client = @import("client");
13	const term = @import("term");	4	const term = @import("term");
14	const keymap = client.keymap;	5	const keymap = client.keymap;
15	const session_pump = client.session_pump;	6	const model = @import("workspace.zig");
		7	const runtime = @import("runtime.zig");
16	const font = @import("font.zig");	8	const font = @import("font.zig");
17	const atlas = @import("atlas.zig");	9	const atlas = @import("atlas.zig");
18	const quads = @import("quads.zig");	10	const quads = @import("quads.zig");
@@ -25,24 +17,16 @@ const c = @cImport({
25		17
26	pub const Options = struct {	18	pub const Options = struct {
27	target: client.Target,	19	target: client.Target,
		20	next: ?struct { target: client.Target, session: []const u8 } = null,
28	session: []const u8,	21	session: []const u8,
29	/// Face pixel size at 100% display scale.	22	/// Face pixel size at 100% display scale.
30	font_px: u16 = 16,	23	font_px: u16 = 16,
31	width: u32 = 960,	24	width: u32 = 960,
32	height: u32 = 600,	25	height: u32 = 600,
33	/// The e2e leg's hook: a FIFO of `text:`/`key:`/`resize:`/`quit` lines.	26	/// Optional integration FIFO; events use the ordinary window input paths.
34	test_fifo: ?[]const u8 = null,	27	test_fifo: ?[]const u8 = null,
35	};	28	};
36		29
37	pub const CellsOf = struct { cols: u16, rows: u16 };
38
39	pub fn cellsOf(px_w: u32, px_h: u32, cell_w: u16, cell_h: u16) CellsOf {
40	return .{
41	.cols = @intCast(@min(@max(px_w / @max(cell_w, 1), 1), term.protocol.max_cols)),
42	.rows = @intCast(@min(@max(px_h / @max(cell_h, 1), 1), std.math.maxInt(u16))),
43	};
44	}
45
46	/// SDL keycode + mods → the keymap's event, or null for a key that types	30	/// SDL keycode + mods → the keymap's event, or null for a key that types
47	/// (text input carries it) or means nothing to a session.	31	/// (text input carries it) or means nothing to a session.
48	pub fn keyEvent(key: u32, mod: u16) ?keymap.Event {	32	pub fn keyEvent(key: u32, mod: u16) ?keymap.Event {
@@ -91,7 +75,9 @@ pub fn keyEvent(key: u32, mod: u16) ?keymap.Event {
91		75
92	pub const Hook = union(enum) {	76	pub const Hook = union(enum) {
93	text: []const u8,	77	text: []const u8,
94	key: keymap.Key,	78	key: struct { code: u32, mods: u16 = 0 },
		79	click: struct { x: f32, y: f32 },
		80	state: []const u8,
95	resize: struct { w: u32, h: u32 },	81	resize: struct { w: u32, h: u32 },
96	capture: []const u8,	82	capture: []const u8,
97	quit,	83	quit,
@@ -99,12 +85,19 @@ pub const Hook = union(enum) {
99		85
100	pub fn parseHook(line: []const u8) ?Hook {	86	pub fn parseHook(line: []const u8) ?Hook {
101	if (std.mem.eql(u8, line, "quit")) return .quit;	87	if (std.mem.eql(u8, line, "quit")) return .quit;
		88	if (std.mem.startsWith(u8, line, "state:")) return .{ .state = line[6..] };
		89	if (std.mem.startsWith(u8, line, "click:")) {
		90	const comma = std.mem.indexOfScalar(u8, line, ',') orelse return null;
		91	return .{ .click = .{ .x = std.fmt.parseFloat(f32, line[6..comma]) catch return null, .y = std.fmt.parseFloat(f32, line[comma + 1 ..]) catch return null } };
		92	}
102	if (std.mem.startsWith(u8, line, "capture:")) return .{ .capture = line[8..] };	93	if (std.mem.startsWith(u8, line, "capture:")) return .{ .capture = line[8..] };
103	if (std.mem.startsWith(u8, line, "text:")) return .{ .text = line["text:".len..] };	94	if (std.mem.startsWith(u8, line, "text:")) return .{ .text = line["text:".len..] };
104	if (std.mem.startsWith(u8, line, "key:")) {	95	if (std.mem.startsWith(u8, line, "key:")) {
105	const name = line["key:".len..];	96	const name = line["key:".len..];
106	inline for (.{ "enter", "tab", "escape", "backspace", "up", "down", "left", "right" }) \|n\| {	97	if (std.mem.eql(u8, name, "prefix")) return .{ .key = .{ .code = c.SDLK_SPACE, .mods = c.SDL_KMOD_CTRL \| c.SDL_KMOD_SHIFT } };
107	if (std.mem.eql(u8, name, n)) return .{ .key = @field(keymap.Key, n) };	98	if (name.len == 1 and std.mem.indexOfScalar(u8, "hjklvb", name[0]) != null) return .{ .key = .{ .code = name[0] } };
		99	inline for (.{ .{ "enter", c.SDLK_RETURN }, .{ "tab", c.SDLK_TAB }, .{ "escape", c.SDLK_ESCAPE }, .{ "backspace", c.SDLK_BACKSPACE }, .{ "up", c.SDLK_UP }, .{ "down", c.SDLK_DOWN }, .{ "left", c.SDLK_LEFT }, .{ "right", c.SDLK_RIGHT } }) \|pair\| {
		100	if (std.mem.eql(u8, name, pair[0])) return .{ .key = .{ .code = pair[1] } };
108	}	101	}
109	return null;	102	return null;
110	}	103	}
@@ -127,14 +120,15 @@ fn onUsr1(_: c_int) callconv(.c) void {
127		120
128	const Wake = struct {	121	const Wake = struct {
129	event_type: u32,	122	event_type: u32,
130	pending: std.atomic.Value(bool) = .init(false),	123	fn ring(ctx: ?*anyopaque, key: model.Attachment) void {
131
132	fn ring(ctx: ?*anyopaque) void {
133	const self: *Wake = @ptrCast(@alignCast(ctx.?));	124	const self: *Wake = @ptrCast(@alignCast(ctx.?));
134	if (self.pending.swap(true, .acq_rel)) return;	125	var ev = std.mem.zeroes(c.SDL_Event);
135	var ev: c.SDL_Event = std.mem.zeroes(c.SDL_Event);
136	ev.type = self.event_type;	126	ev.type = self.event_type;
137	if (!c.SDL_PushEvent(&ev)) self.pending.store(false, .release);	127	ev.user.data1 = @ptrFromInt(key.pane);
		128	ev.user.data2 = @ptrFromInt(key.generation);
		129	// Runtime also polls atomic pending flags, so a full SDL queue cannot
		130	// strand an attachment. The queue holds IDs, never freed Live pointers.
		131	_ = c.SDL_PushEvent(&ev);
138	}	132	}
139	};	133	};
140		134
@@ -148,6 +142,7 @@ const HookReader = struct {
148	used: usize = 0,	142	used: usize = 0,
149	text: std.ArrayListUnmanaged([:0]u8) = .empty,	143	text: std.ArrayListUnmanaged([:0]u8) = .empty,
150	capture: ?[]u8 = null,	144	capture: ?[]u8 = null,
		145	state: ?[]u8 = null,
151		146
152	fn init(alloc: std.mem.Allocator, path: []const u8) !HookReader {	147	fn init(alloc: std.mem.Allocator, path: []const u8) !HookReader {
153	return .{ .alloc = alloc, .fd = try std.posix.open(path, .{ .ACCMODE = .RDONLY, .NONBLOCK = true, .CLOEXEC = true }, 0) };	148	return .{ .alloc = alloc, .fd = try std.posix.open(path, .{ .ACCMODE = .RDONLY, .NONBLOCK = true, .CLOEXEC = true }, 0) };
@@ -158,6 +153,7 @@ const HookReader = struct {
158	for (self.text.items) \|t\| self.alloc.free(t);	153	for (self.text.items) \|t\| self.alloc.free(t);
159	self.text.deinit(self.alloc);	154	self.text.deinit(self.alloc);
160	if (self.capture) \|p\| self.alloc.free(p);	155	if (self.capture) \|p\| self.alloc.free(p);
		156	if (self.state) \|p\| self.alloc.free(p);
161	}	157	}
162		158
163	fn releaseText(self: HookReader, p: [c]const u8) void {	159	fn releaseText(self: HookReader, p: [c]const u8) void {
@@ -200,17 +196,26 @@ const HookReader = struct {
200	.key => \|k\| {	196	.key => \|k\| {
201	ev.key.type = c.SDL_EVENT_KEY_DOWN;	197	ev.key.type = c.SDL_EVENT_KEY_DOWN;
202	ev.key.windowID = c.SDL_GetWindowID(win);	198	ev.key.windowID = c.SDL_GetWindowID(win);
203	ev.key.key = switch (k) {	199	ev.key.key = k.code;
204	.enter => c.SDLK_RETURN,	200	ev.key.mod = k.mods;
205	.tab => c.SDLK_TAB,	201	if (!c.SDL_PushEvent(&ev)) return error.EventInjectionFailed;
206	.escape => c.SDLK_ESCAPE,	202	if (k.code >= 0x20 and k.code < 0x7f) {
207	.backspace => c.SDLK_BACKSPACE,	203	const letter = [_]u8{@intCast(k.code)};
208	.up => c.SDLK_UP,	204	try self.inject(win, .{ .text = &letter });
209	.down => c.SDLK_DOWN,	205	}
210	.left => c.SDLK_LEFT,	206	ev.key.type = c.SDL_EVENT_KEY_UP;
211	.right => c.SDLK_RIGHT,	207	},
212	else => return,	208	.click => \|at\| {
213	};	209	ev.button.type = c.SDL_EVENT_MOUSE_BUTTON_DOWN;
		210	ev.button.button = c.SDL_BUTTON_LEFT;
		211	ev.button.x = at.x;
		212	ev.button.y = at.y;
		213	},
		214	.state => \|path\| {
		215	const copy = try self.alloc.dupe(u8, path);
		216	if (self.state) \|old\| self.alloc.free(old);
		217	self.state = copy;
		218	return;
214	},	219	},
215	.resize => \|r\| {	220	.resize => \|r\| {
216	if (!c.SDL_SetWindowSize(win, @intCast(r.w), @intCast(r.h))) return error.WindowResizeFailed;	221	if (!c.SDL_SetWindowSize(win, @intCast(r.w), @intCast(r.h))) return error.WindowResizeFailed;
@@ -231,92 +236,167 @@ const HookReader = struct {
231	}	236	}
232	};	237	};
233		238
234	fn setTitle(win: *c.SDL_Window, session: []const u8, reconnecting: bool, bell: bool) void {
235	var buf: [192]u8 = undefined;
236	const title = std.fmt.bufPrintZ(&buf, "muxg {s}{s}{s}", .{ session, if (reconnecting) " [reconnecting]" else "", if (bell) " [bell]" else "" }) catch "muxg";
237	_ = c.SDL_SetWindowTitle(win, title.ptr);
238	}
239
240	fn sdlFail(op: []const u8) u8 {	239	fn sdlFail(op: []const u8) u8 {
241	std.debug.print("muxg: {s}: {s}\n", .{ op, std.mem.span(c.SDL_GetError()) });	240	std.debug.print("muxg: {s}: {s}\n", .{ op, std.mem.span(c.SDL_GetError()) });
242	return 2;	241	return 2;
243	}	242	}
244		243
		244	/// This state belongs to the window thread. Geometry and input select stable
		245	/// pane IDs; transport ownership lives in Runtime and rendering uses snapshots.
245	const Events = struct {	246	const Events = struct {
246	pump: *session_pump.Pump,	247	rt: *runtime.Runtime,
247	win: *c.SDL_Window,	248	win: *c.SDL_Window,
248	wake: *Wake,	249	wake: *Wake,
249	hook: ?*HookReader,	250	hook: ?*HookReader,
250	cache: *font.GlyphCache,	251	cache: *font.GlyphCache,
251	base_font_px: u16,	252	base_font_px: u16,
252	cells: CellsOf,	253	staged: ?model.Identity = null,
		254	layout: model.Layout = .{},
		255	metrics: model.Metrics,
253	fb_w: c_int,	256	fb_w: c_int,
254	fb_h: c_int,	257	fb_h: c_int,
255	dirty: bool = true,	258	dirty: bool = true,
256	geometry_dirty: bool = false,	259	geometry_dirty: bool = false,
257	suppress_text: bool = false,	260	suppress_text: bool = false,
		261	command_mode: bool = false,
		262	consumed_key: ?u32 = null,
		263	notice: []const u8 = "",
		264
		265	fn command(self: *Events, key: u32) !void {
		266	self.command_mode = false;
		267	self.notice = "";
		268	const ws = &self.rt.workspace;
		269	switch (key) {
		270	c.SDLK_H, c.SDLK_LEFT => ws.moveFocus(&self.layout, .left),
		271	c.SDLK_J, c.SDLK_DOWN => ws.moveFocus(&self.layout, .down),
		272	c.SDLK_K, c.SDLK_UP => ws.moveFocus(&self.layout, .up),
		273	c.SDLK_L, c.SDLK_RIGHT => ws.moveFocus(&self.layout, .right),
		274	c.SDLK_V => ws.arm(.beside),
		275	c.SDLK_B => ws.arm(.stacked),
		276	c.SDLK_ESCAPE => ws.cancel(),
		277	c.SDLK_RETURN, c.SDLK_KP_ENTER => {
		278	if (ws.tab().pending != null) {
		279	if (self.staged) \|*target\| {
		280	_ = self.rt.add(target.target, target.session, @intCast(@max(self.fb_w, 0)), @intCast(@max(self.fb_h, 0)), self.metrics) catch \|err\| {
		281	self.notice = @errorName(err);
		282	self.dirty = true;
		283	return;
		284	};
		285	target.deinit();
		286	self.staged = null;
		287	try self.relayout();
		288	} else self.notice = "No staged target";
		289	}
		290	},
		291	else => self.notice = "v/b split, h/j/k/l focus, Enter insert, Esc cancel",
		292	}
		293	self.dirty = true;
		294	}
258		295
259	fn handle(self: *Events, ev: c.SDL_Event) !bool {	296	fn handle(self: *Events, ev: c.SDL_Event) !bool {
260	switch (ev.type) {	297	switch (ev.type) {
261	c.SDL_EVENT_QUIT, c.SDL_EVENT_WINDOW_CLOSE_REQUESTED => {	298	c.SDL_EVENT_QUIT, c.SDL_EVENT_WINDOW_CLOSE_REQUESTED => return false,
262	try self.pump.say(.detach);
263	return false;
264	},
265	c.SDL_EVENT_TEXT_INPUT => {	299	c.SDL_EVENT_TEXT_INPUT => {
266	defer if (self.hook) \|h\| h.releaseText(ev.text.text);	300	defer if (self.hook) \|h\| h.releaseText(ev.text.text);
267	if (!self.suppress_text) try self.pump.say(.{ .input = std.mem.span(ev.text.text) });	301	if (!self.suppress_text and !self.command_mode) try self.rt.input(std.mem.span(ev.text.text));
268	self.suppress_text = false;	302	self.suppress_text = false;
269	},	303	},
270	c.SDL_EVENT_KEY_DOWN => {	304	c.SDL_EVENT_KEY_DOWN => {
271	self.suppress_text = false;	305	self.suppress_text = false;
272	// Event keycodes normally ignore Shift. Ask the active layout	306	const key = ev.key.key;
273	// for its translated character before encoding a modifier chord.	307	if (self.consumed_key == key) {
274	const translated = if (ev.key.scancode != c.SDL_SCANCODE_UNKNOWN)	308	self.suppress_text = true;
275	c.SDL_GetKeyFromScancode(ev.key.scancode, ev.key.mod, false)	309	return true;
276	else	310	}
277	ev.key.key;	311	const prefix = key == c.SDLK_SPACE and ev.key.mod & c.SDL_KMOD_CTRL != 0 and ev.key.mod & c.SDL_KMOD_SHIFT != 0 and ev.key.mod & (c.SDL_KMOD_ALT \| c.SDL_KMOD_GUI \| c.SDL_KMOD_MODE) == 0;
278	if (keyEvent(translated, ev.key.mod)) \|key\| {	312	if (prefix) {
279	var buf: [keymap.max_seq_len]u8 = undefined;	313	self.suppress_text = true;
280	const bytes = keymap.encode(key, &buf);	314	if (!ev.key.repeat) {
281	if (bytes.len != 0) try self.pump.say(.{ .input = bytes });	315	if (self.command_mode) {
282	self.suppress_text = key.key == .char;	316	self.command_mode = false;
		317	try self.sendKey(keyEvent(key, ev.key.mod).?);
		318	} else self.command_mode = true;
		319	self.notice = "";
		320	self.dirty = true;
		321	}
		322	} else if (self.command_mode) {
		323	self.consumed_key = key;
		324	self.suppress_text = true;
		325	try self.command(key);
		326	} else if (key == c.SDLK_ESCAPE and self.rt.workspace.tab().pending != null) {
		327	self.rt.workspace.cancel();
		328	self.dirty = true;
		329	} else {
		330	const translated = if (ev.key.scancode != c.SDL_SCANCODE_UNKNOWN) c.SDL_GetKeyFromScancode(ev.key.scancode, ev.key.mod, false) else key;
		331	if (keyEvent(translated, ev.key.mod)) \|mapped\| {
		332	try self.sendKey(mapped);
		333	self.suppress_text = mapped.key == .char;
		334	}
		335	}
		336	},
		337	c.SDL_EVENT_KEY_UP => {
		338	if (self.consumed_key == ev.key.key) self.consumed_key = null;
		339	self.suppress_text = false;
		340	},
		341	c.SDL_EVENT_WINDOW_FOCUS_LOST => {
		342	self.suppress_text = false;
		343	self.command_mode = false;
		344	self.consumed_key = null;
		345	self.dirty = true;
		346	},
		347	c.SDL_EVENT_MOUSE_BUTTON_DOWN => if (ev.button.button == c.SDL_BUTTON_LEFT) {
		348	var w: c_int = 0;
		349	var h: c_int = 0;
		350	if (c.SDL_GetWindowSize(self.win, &w, &h)) {
		351	const at = physicalPoint(ev.button.x, ev.button.y, w, h, self.fb_w, self.fb_h);
		352	if (self.layout.hit(at.x, at.y)) \|id\| _ = self.rt.workspace.focus(id);
		353	self.dirty = true;
283	}	354	}
284	},	355	},
285	c.SDL_EVENT_KEY_UP => self.suppress_text = false,
286	c.SDL_EVENT_WINDOW_FOCUS_LOST => self.suppress_text = false,
287	c.SDL_EVENT_WINDOW_PIXEL_SIZE_CHANGED, c.SDL_EVENT_WINDOW_RESIZED, c.SDL_EVENT_WINDOW_DISPLAY_SCALE_CHANGED => self.geometry_dirty = true,	356	c.SDL_EVENT_WINDOW_PIXEL_SIZE_CHANGED, c.SDL_EVENT_WINDOW_RESIZED, c.SDL_EVENT_WINDOW_DISPLAY_SCALE_CHANGED => self.geometry_dirty = true,
288	c.SDL_EVENT_WINDOW_EXPOSED => self.dirty = true,	357	c.SDL_EVENT_WINDOW_EXPOSED => self.dirty = true,
289	else => if (ev.type == self.wake.event_type) {	358	else => if (ev.type == self.wake.event_type and self.rt.accepts(.{ .pane = @intFromPtr(ev.user.data1), .generation = @intFromPtr(ev.user.data2) })) {
290	self.dirty = true;	359	self.dirty = true;
291	},	360	},
292	}	361	}
293	return true;	362	return true;
294	}	363	}
295		364	fn sendKey(self: *Events, key: keymap.Event) !void {
296	/// Resize and scale notifications can arrive together in either order.	365	var buf: [keymap.max_seq_len]u8 = undefined;
297	/// Query once after the event batch, then use the same physical metrics	366	const bytes = keymap.encode(key, &buf);
298	/// for the daemon's size claim and this frame's glyphs.	367	if (bytes.len != 0) try self.rt.input(bytes);
		368	}
		369	fn relayout(self: *Events) !void {
		370	self.layout = self.rt.workspace.layout(@intCast(@max(self.fb_w, 0)), @intCast(@max(self.fb_h, 0)), self.metrics);
		371	try self.rt.resize(&self.layout);
		372	self.dirty = true;
		373	}
299	fn refreshGeometry(self: *Events) !void {	374	fn refreshGeometry(self: *Events) !void {
300	if (!self.geometry_dirty) return;	375	if (!self.geometry_dirty) return;
301	var fb_w: c_int = 0;	376	var w: c_int = 0;
302	var fb_h: c_int = 0;	377	var h: c_int = 0;
303	if (!c.SDL_GetWindowSizeInPixels(self.win, &fb_w, &fb_h)) return error.WindowSizeFailed;	378	if (!c.SDL_GetWindowSizeInPixels(self.win, &w, &h)) return error.WindowSizeFailed;
304	try self.updateGeometry(fb_w, fb_h, c.SDL_GetWindowDisplayScale(self.win));	379	try self.updateGeometry(w, h, c.SDL_GetWindowDisplayScale(self.win));
305	}	380	}
306		381	fn updateGeometry(self: *Events, w: c_int, h: c_int, scale: f32) !void {
307	fn updateGeometry(self: *Events, fb_w: c_int, fb_h: c_int, display_scale: f32) !void {	382	_ = try self.cache.setPixelSize(font.scaledPixels(self.base_font_px, scale));
308	_ = try self.cache.setPixelSize(font.scaledPixels(self.base_font_px, display_scale));	383	self.fb_w = w;
309	self.fb_w = fb_w;	384	self.fb_h = h;
310	self.fb_h = fb_h;	385	self.metrics = measuredMetrics(self.cache.face, scale);
311	const now = cellsOf(@intCast(@max(self.fb_w, 1)), @intCast(@max(self.fb_h, 1)), self.cache.face.cell_w, self.cache.face.cell_h);	386	try self.relayout();
312	if (!std.meta.eql(now, self.cells)) {
313	try self.pump.say(.{ .resize = .{ .cols = now.cols, .rows = now.rows } });
314	self.cells = now;
315	}
316	self.geometry_dirty = false;	387	self.geometry_dirty = false;
317	self.dirty = true;
318	}	388	}
319	};	389	};
		390	fn measuredMetrics(face: *const font.Face, scale: f32) model.Metrics {
		391	return .{ .cell_w = face.cell_w, .cell_h = face.cell_h, .divider = @intFromFloat(@round(if (std.math.isFinite(scale)) std.math.clamp(scale, 1, 32) else 1)) };
		392	}
		393	fn physicalPoint(x: f32, y: f32, logical_w: c_int, logical_h: c_int, fb_w: c_int, fb_h: c_int) struct { x: u32, y: u32 } {
		394	return .{ .x = physicalAxis(x, logical_w, fb_w), .y = physicalAxis(y, logical_h, fb_h) };
		395	}
		396	fn physicalAxis(v: f32, logical: c_int, pixels: c_int) u32 {
		397	if (!std.math.isFinite(v) or v < 0 or logical <= 0 or pixels <= 0) return std.math.maxInt(u32);
		398	return @intFromFloat(@min(@floor(v * @as(f32, @floatFromInt(pixels)) / @as(f32, @floatFromInt(logical))), 2147483648));
		399	}
320		400
321	pub fn run(alloc: std.mem.Allocator, opts: Options) !u8 {	401	pub fn run(alloc: std.mem.Allocator, opts: Options) !u8 {
322	var ring: bench.Ring = .{};	402	var ring: bench.Ring = .{};
@@ -366,16 +446,19 @@ pub fn run(alloc: std.mem.Allocator, opts: Options) !u8 {
366	var fb_w: c_int = 0;	446	var fb_w: c_int = 0;
367	var fb_h: c_int = 0;	447	var fb_h: c_int = 0;
368	if (!c.SDL_GetWindowSizeInPixels(win, &fb_w, &fb_h)) return sdlFail("SDL_GetWindowSizeInPixels");	448	if (!c.SDL_GetWindowSizeInPixels(win, &fb_w, &fb_h)) return sdlFail("SDL_GetWindowSizeInPixels");
369	const cells = cellsOf(@intCast(@max(fb_w, 1)), @intCast(@max(fb_h, 1)), face.cell_w, face.cell_h);	449	const metrics = measuredMetrics(&face, c.SDL_GetWindowDisplayScale(win));
370	var wake: Wake = .{ .event_type = c.SDL_RegisterEvents(1) };	450	var wake: Wake = .{ .event_type = c.SDL_RegisterEvents(1) };
371	if (wake.event_type == 0) return sdlFail("SDL_RegisterEvents");	451	if (wake.event_type == 0) return sdlFail("SDL_RegisterEvents");
372	const pump = try session_pump.Pump.start(alloc, .{ .target = opts.target, .session = opts.session, .cols = cells.cols, .rows = cells.rows, .wake = Wake.ring, .wake_ctx = &wake });	452	var rt = runtime.Runtime.init(alloc, .{ .ctx = &wake, .call = Wake.ring });
373	defer pump.stop();	453	defer rt.deinit();
		454	_ = try rt.add(opts.target, opts.session, @intCast(@max(fb_w, 0)), @intCast(@max(fb_h, 0)), metrics);
374	var hook: ?HookReader = if (opts.test_fifo) \|path\| try HookReader.init(alloc, path) else null;	455	var hook: ?HookReader = if (opts.test_fifo) \|path\| try HookReader.init(alloc, path) else null;
375	defer if (hook) \|*h\| h.deinit();	456	defer if (hook) \|*h\| h.deinit();
376	var events: Events = .{ .pump = pump, .win = win, .wake = &wake, .hook = if (hook) \|*h\| h else null, .cache = &cache, .base_font_px = opts.font_px, .cells = cells, .fb_w = fb_w, .fb_h = fb_h };	457	var events: Events = .{ .rt = &rt, .win = win, .wake = &wake, .hook = if (hook) \|*h\| h else null, .cache = &cache, .base_font_px = opts.font_px, .metrics = metrics, .fb_w = fb_w, .fb_h = fb_h };
377	var last_phase: ?session_pump.Phase = null;	458	if (opts.next) \|next\| events.staged = try model.Identity.init(alloc, next.target, next.session);
378	var bell_until: i64 = 0;	459	defer if (events.staged) \|*target\| target.deinit();
		460	try events.relayout();
		461	var headers: [model.max_panes]Header = @splat(.{});
379	var visible_blink = false;	462	var visible_blink = false;
380	var blink_phase = true;	463	var blink_phase = true;
381	var blink_until: i64 = 0;	464	var blink_until: i64 = 0;
@@ -395,33 +478,14 @@ pub fn run(alloc: std.mem.Allocator, opts: Options) !u8 {
395	}	478	}
396	}	479	}
397	try events.refreshGeometry();	480	try events.refreshGeometry();
398	// Clearing before painting lets a concurrent apply queue the next wake.
399	if (wake.pending.swap(false, .acq_rel)) events.dirty = true;
400	if (usr1_seen.swap(false, .acq_rel)) report(&ring);	481	if (usr1_seen.swap(false, .acq_rel)) report(&ring);
401	const now = std.time.milliTimestamp();	482	const now = std.time.milliTimestamp();
402	const state = pump.state();	483	events.dirty = rt.poll(now) or events.dirty;
403	if (last_phase == null or last_phase.? != state.phase) {	484	if (hook) \|*h\| if (h.state) \|path\| {
404	last_phase = state.phase;	485	defer alloc.free(path);
405	switch (state.phase) {	486	h.state = null;
406	.exited => return state.exit_code,	487	try writeState(alloc, path, &events);
407	.refused, .failed, .dial_failed => {	488	};
408	std.debug.print("muxg: {s}\n", .{state.reasonText()});
409	return if (state.phase == .dial_failed) 2 else 1;
410	},
411	.taken => {
412	std.debug.print("muxg: the session was taken by another client\n", .{});
413	return 0;
414	},
415	else => setTitle(win, opts.session, state.phase == .reconnecting, bell_until != 0),
416	}
417	}
418	if (state.bell) {
419	bell_until = now + 200;
420	setTitle(win, opts.session, state.phase == .reconnecting, true);
421	} else if (bell_until != 0 and now >= bell_until) {
422	bell_until = 0;
423	setTitle(win, opts.session, state.phase == .reconnecting, false);
424	}
425	if (visible_blink and now >= blink_until) {	489	if (visible_blink and now >= blink_until) {
426	blink_phase = !blink_phase;	490	blink_phase = !blink_phase;
427	blink_until = now + 500;	491	blink_until = now + 500;
@@ -434,54 +498,71 @@ pub fn run(alloc: std.mem.Allocator, opts: Options) !u8 {
434	instances.clearRetainingCapacity();	498	instances.clearRetainingCapacity();
435	lists.backgrounds.clearRetainingCapacity();	499	lists.backgrounds.clearRetainingCapacity();
436	lists.foregrounds.clearRetainingCapacity();	500	lists.foregrounds.clearRetainingCapacity();
437	{	501	// Freeze each pane under its own mutex. No transport locks are held
438	pump.mu.lock();	502	// during shaping, atlas growth, instance generation, or GL calls.
439	defer pump.mu.unlock();	503	for (events.layout.items(), 0..) \|p, i\| {
440	timing.apply_us = @intCast(@min(pump.last_apply_us, std.math.maxInt(u32)));	504	const live = rt.get(p.id).?;
441	const grid = pump.grid;	505	if (p.visible.w == 0 or p.visible.h == 0) continue;
442	const rows = @min(grid.rows, events.cells.rows);	506	timing.apply_us = @max(timing.apply_us, try live.capture(p.cols, p.rows));
443	const cols = @min(grid.cols, events.cells.cols);	507	headers[i].set(&events, p, live);
444	// Every glyph must be inserted before UV normalization for this frame.	508	}
445	for (0..rows) \|y\| {	509	// Prepare ALL pane and header glyphs before normalizing ANY UV. A
446	const row = grid.row(@intCast(y));	510	// later pane may grow the shared atlas and change every earlier UV.
447	for (row.cells[0..cols]) \|cell\| {	511	for (events.layout.items(), 0..) \|p, i\| {
448	if (cell.text_len == 0 or cell.wide == .spacer_tail) continue;	512	if (p.visible.w == 0 or p.visible.h == 0) continue;
449	try cache.prepare(row.textOf(cell), @enumFromInt(cell.style.flags & 3));	513	try prepareGrid(&cache, rt.get(p.id).?.snapshot);
450	}	514	var header_row = headers[i].row();
451	}	515	try prepareRow(&cache, &header_row);
452	const qctx: quads.Ctx = .{ .cell_w = face.cell_w, .cell_h = face.cell_h, .ascent = face.ascent, .atlas_w = @floatFromInt(glyph_atlas.width), .atlas_h = @floatFromInt(glyph_atlas.height), .glyphs = .{ .ctx = &cache, .resolve = font.GlyphCache.resolve }, .blink_visible = blink_phase };	516	}
453	const had_blink = visible_blink;	517	const had_blink = visible_blink;
454	visible_blink = false;	518	visible_blink = false;
455	for (0..rows) \|y\| {	519	const base_ctx: quads.Ctx = .{ .cell_w = face.cell_w, .cell_h = face.cell_h, .ascent = face.ascent, .atlas_w = @floatFromInt(glyph_atlas.width), .atlas_h = @floatFromInt(glyph_atlas.height), .glyphs = .{ .ctx = &cache, .resolve = font.GlyphCache.resolve }, .blink_visible = blink_phase };
456	const blinking = try quads.rowInstances(&lists, alloc, grid.row(@intCast(y)), cols, 0, @intCast(y), qctx);	520	for (events.layout.items(), 0..) \|p, i\| {
457	visible_blink = visible_blink or blinking;	521	if (p.visible.w == 0 or p.visible.h == 0) continue;
458	}	522	const live = rt.get(p.id).?;
459	if (visible_blink and !had_blink) blink_until = now + 500;	523	const grid = live.snapshot;
460	if (!visible_blink) blink_phase = true;	524	// Opaque content rectangles leave the clear color in dividers.
461	if (grid.cursor.x < cols and grid.cursor.y < rows) try lists.foregrounds.append(alloc, quads.cursorInstance(grid.cursor.x, grid.cursor.y, qctx));	525	try lists.backgrounds.append(alloc, quads.solid(@floatFromInt(p.content.x), @floatFromInt(p.content.y), @floatFromInt(p.content.w), @floatFromInt(p.content.h), 0x101010ff));
		526	var ctx = base_ctx;
		527	ctx.x0 = @floatFromInt(p.content.x);
		528	ctx.y0 = @floatFromInt(p.content.y);
		529	const bg_start = lists.backgrounds.items.len;
		530	const fg_start = lists.foregrounds.items.len;
		531	for (0..grid.rows) \|y\| visible_blink = (try quads.rowInstances(&lists, alloc, grid.row(@intCast(y)), grid.cols, 0, @intCast(y), ctx)) or visible_blink;
		532	if (rt.workspace.tab().focus == p.id and grid.cursor.x < grid.cols and grid.cursor.y < grid.rows) try lists.foregrounds.append(alloc, quads.cursorInstance(grid.cursor.x, grid.cursor.y, ctx));
		533	clipPane(&lists, bg_start, fg_start, model.Rect.intersect(p.content, p.visible));
		534	ctx.x0 = @floatFromInt(p.header.x);
		535	ctx.y0 = @floatFromInt(p.header.y);
		536	ctx.default_bg = if (rt.workspace.tab().focus == p.id) 0x304860ff else 0x24282cff;
		537	if (live.bell_until != 0) ctx.default_bg = 0x705020ff;
		538	try lists.backgrounds.append(alloc, quads.solid(ctx.x0, ctx.y0, @floatFromInt(p.header.w), @floatFromInt(p.header.h), ctx.default_bg));
		539	const header_start = lists.foregrounds.items.len;
		540	var header_row = headers[i].row();
		541	_ = try quads.rowInstances(&lists, alloc, &header_row, @intCast(header_row.cells.len), 0, 0, ctx);
		542	clipPane(&lists, lists.backgrounds.items.len, header_start, model.Rect.intersect(p.header, p.visible));
462	}	543	}
		544	if (visible_blink and !had_blink) blink_until = now + 500;
		545	if (!visible_blink) blink_phase = true;
463	try lists.flatten(&instances, alloc);	546	try lists.flatten(&instances, alloc);
464	timing.rebuild_us = bench.usSince(&timer);	547	timing.rebuild_us = bench.usSince(&timer);
465	if (glyph_atlas.dirty) renderer.uploadAtlas(&glyph_atlas);	548	if (glyph_atlas.dirty) renderer.uploadAtlas(&glyph_atlas);
466	timing.atlas_us = bench.usSince(&timer);	549	timing.atlas_us = bench.usSince(&timer);
467	renderer.uploadInstances(instances.items);	550	renderer.uploadInstances(instances.items);
468	timing.upload_us = bench.usSince(&timer);	551	timing.upload_us = bench.usSince(&timer);
469	renderer.draw(instances.items.len, events.fb_w, events.fb_h, 0x101010ff);	552	renderer.draw(instances.items.len, events.fb_w, events.fb_h, 0x687888ff);
470	if (hook) \|*h\| if (h.capture) \|path\| {	553	if (hook) \|*h\| if (h.capture) \|path\| {
471	defer alloc.free(path);	554	defer alloc.free(path);
472	h.capture = null;	555	h.capture = null;
473	const pixels = try renderer.readPixels(alloc, @intCast(events.fb_w), @intCast(events.fb_h));	556	const pixels = try renderer.readPixels(alloc, @intCast(events.fb_w), @intCast(events.fb_h));
474	defer alloc.free(pixels);	557	defer alloc.free(pixels);
475	const temporary = try std.fmt.allocPrint(alloc, "{s}.tmp", .{path});
476	defer alloc.free(temporary);
477	const file = try std.fs.cwd().createFile(temporary, .{});
478	defer file.close();
479	var header: [64]u8 = undefined;	558	var header: [64]u8 = undefined;
480	try file.writeAll(try std.fmt.bufPrint(&header, "P6\n{d} {d}\n255\n", .{ events.fb_w, events.fb_h }));	559	try writeArtifact(alloc, path, &.{ try std.fmt.bufPrint(&header, "P6\n{d} {d}\n255\n", .{ events.fb_w, events.fb_h }), pixels });
481	try file.writeAll(pixels);
482	try std.fs.cwd().rename(temporary, path);
483	};	560	};
484	if (!c.SDL_GL_SwapWindow(win)) return sdlFail("SDL_GL_SwapWindow");	561	if (!c.SDL_GL_SwapWindow(win)) return sdlFail("SDL_GL_SwapWindow");
		562	for (events.layout.items()) \|p\| if (p.visible.w != 0 and p.visible.h != 0) {
		563	const live = rt.get(p.id).?;
		564	live.painted_seq = live.snapshot_seq;
		565	};
485	timing.draw_us = bench.usSince(&timer);	566	timing.draw_us = bench.usSince(&timer);
486	ring.record(timing);	567	ring.record(timing);
487	}	568	}
@@ -506,60 +587,240 @@ test "key mapping sends modifier punctuation and space through the shared encode
506	try std.testing.expect(keyEvent(c.SDLK_Q, c.SDL_KMOD_LCTRL \| c.SDL_KMOD_RALT) == null);	587	try std.testing.expect(keyEvent(c.SDLK_Q, c.SDL_KMOD_LCTRL \| c.SDL_KMOD_RALT) == null);
507	}	588	}
508		589
509	test "drawable dimensions floor, clamp small windows, and cap wire columns" {	590	test "test hook rejects zero resize and retains text exactly" {
510	try std.testing.expectEqual(CellsOf{ .cols = 120, .rows = 37 }, cellsOf(963, 601, 8, 16));
511	try std.testing.expectEqual(CellsOf{ .cols = 1, .rows = 1 }, cellsOf(3, 5, 8, 16));
512	try std.testing.expectEqual(term.protocol.max_cols, cellsOf(100000, 800, 1, 16).cols);
513	try std.testing.expect(parseHook("resize:0x400") == null);	591	try std.testing.expect(parseHook("resize:0x400") == null);
514	try std.testing.expectEqualStrings("hi", parseHook("text:hi").?.text);	592	try std.testing.expectEqualStrings("hi", parseHook("text:hi").?.text);
515	}	593	}
516		594
517	test "display-scale events rebuild physical font metrics and coalesce drawable resize" {	595	const Header = struct {
518	const alloc = std.testing.allocator;	596	bytes: [512]u8 = undefined,
		597	cells: [512]term.grid.Cell = undefined,
		598	len: usize = 0,
		599	fn set(self: Header, events: Events, p: model.Placement, live: *const runtime.Live) void {
		600	const focused = events.rt.workspace.tab().focus == p.id;
		601	const pending = events.rt.workspace.tab().pending;
		602	const hint = if (focused and events.command_mode) " [command: v/b split, h/j/k/l focus, Enter insert, Esc cancel]" else if (pending != null and pending.?.pane == p.id) (if (pending.?.direction == .beside) " [split beside: prefix Enter inserts, Esc cancels]" else " [split below: prefix Enter inserts, Esc cancels]") else events.notice;
		603	const label = events.rt.workspace.pane(p.id).?.identity.label;
		604	var status_buf: [48]u8 = undefined;
		605	const status: []const u8 = switch (live.status.phase) {
		606	.attached => "",
		607	.dialing => "[connecting] ",
		608	.reconnecting => "[reconnecting] ",
		609	.dial_failed => "[unreachable] ",
		610	.failed => "[failed] ",
		611	.refused => "[refused] ",
		612	.taken => "[taken by another client] ",
		613	.exited => std.fmt.bufPrint(&status_buf, "[exited ({d})] ", .{live.status.exit_code}) catch unreachable,
		614	};
		615	const text = std.fmt.bufPrint(&self.bytes, "{s}{s}{s} {s}", .{ if (focused) "> " else " ", status, hint, label }) catch self.bytes[0..];
		616	self.len = @min(text.len, @min(self.cells.len, p.header.w / events.metrics.cell_w));
		617	for (self.bytes[0..self.len], 0..) \|*ch, i\| {
		618	if (ch.* < 0x20 or ch.* >= 0x7f) ch.* = '?';
		619	self.cells[i] = .{ .text_off = @intCast(i), .text_len = 1 };
		620	}
		621	}
		622	fn row(self: *Header) term.grid.Row {
		623	return .{ .cells = self.cells[0..self.len], .text = .{ .items = self.bytes[0..self.len], .capacity = 0 } };
		624	}
		625	};
		626	fn prepareRow(cache: font.GlyphCache, row: const term.grid.Row) !void {
		627	for (row.cells) \|cell\| {
		628	if (cell.text_len == 0 or cell.wide == .spacer_tail) continue;
		629	try cache.prepare(row.textOf(cell), quads.variantOf(cell.style.flags));
		630	}
		631	}
		632	fn prepareGrid(cache: font.GlyphCache, grid: const term.grid.Grid) !void {
		633	for (grid.lines) \|*row\| try prepareRow(cache, row);
		634	}
		635	fn clipPane(lists: *quads.Lists, bg: usize, fg: usize, rect: model.Rect) void {
		636	quads.clip(&lists.backgrounds, bg, @floatFromInt(rect.x), @floatFromInt(rect.y), @floatFromInt(rect.w), @floatFromInt(rect.h));
		637	quads.clip(&lists.foregrounds, fg, @floatFromInt(rect.x), @floatFromInt(rect.y), @floatFromInt(rect.w), @floatFromInt(rect.h));
		638	}
		639	fn writeState(alloc: std.mem.Allocator, path: []const u8, events: *Events) !void {
		640	// Called before capture/rebuild, without forcing dirty. Snapshot and sequence
		641	// are those of the last completed draw, rather than a newer live replica.
		642	var arena = std.heap.ArenaAllocator.init(alloc);
		643	defer arena.deinit();
		644	const a = arena.allocator();
		645	const PaneState = struct {
		646	id: model.PaneId,
		647	generation: u64,
		648	label: []const u8,
		649	outer: model.Rect,
		650	header: model.Rect,
		651	content: model.Rect,
		652	visible: model.Rect,
		653	cols: u16,
		654	rows: u16,
		655	phase: []const u8,
		656	exit_code: u8,
		657	painted_seq: u64,
		658	painted_text: []const u8,
		659	};
		660	var panes: [model.max_panes]PaneState = undefined;
		661	for (events.layout.items(), 0..) \|p, i\| {
		662	const live = events.rt.get(p.id).?;
		663	panes[i] = .{ .id = p.id, .generation = live.key.generation, .label = events.rt.workspace.pane(p.id).?.identity.label, .outer = p.outer, .header = p.header, .content = p.content, .visible = p.visible, .cols = p.cols, .rows = p.rows, .phase = @tagName(live.status.phase), .exit_code = live.status.exit_code, .painted_seq = live.painted_seq, .painted_text = if (live.painted_seq == 0) "" else try live.snapshot.dumpPlain(a) };
		664	}
		665	var w: c_int = 0;
		666	var h: c_int = 0;
		667	_ = c.SDL_GetWindowSize(events.win, &w, &h);
		668	const bytes = try std.json.Stringify.valueAlloc(a, .{ .width = events.fb_w, .height = events.fb_h, .logical_width = w, .logical_height = h, .cell_w = events.metrics.cell_w, .cell_h = events.metrics.cell_h, .divider = events.metrics.divider, .header_h = events.metrics.cell_h, .tab = events.rt.workspace.active_tab_id, .focus = events.rt.workspace.tab().focus, .pending = events.rt.workspace.tab().pending, .command_mode = events.command_mode, .panes = panes[0..events.layout.len] }, .{});
		669	try writeArtifact(a, path, &.{bytes});
		670	}
		671	fn writeArtifact(alloc: std.mem.Allocator, path: []const u8, parts: []const []const u8) !void {
		672	const temporary = try std.fmt.allocPrint(alloc, "{s}.tmp", .{path});
		673	defer alloc.free(temporary);
		674	const file = try std.fs.cwd().createFile(temporary, .{});
		675	defer file.close();
		676	errdefer std.fs.cwd().deleteFile(temporary) catch {};
		677	for (parts) \|bytes\| try file.writeAll(bytes);
		678	try std.fs.cwd().rename(temporary, path);
		679	}
		680
		681	test "logical pointer coordinates use drawable density independently of font scale" {
		682	const p = physicalPoint(480, 300, 960, 600, 1920, 1200);
		683	try std.testing.expectEqual(@as(u32, 960), p.x);
		684	try std.testing.expectEqual(@as(u32, 600), p.y);
		685	// A content scale of two with a density of one must keep these unchanged.
		686	try std.testing.expectEqual(@as(u32, 480), physicalPoint(480, 300, 960, 600, 960, 600).x);
		687	try std.testing.expectEqual(std.math.maxInt(u32), physicalAxis(-1, 960, 1920));
		688	}
		689
		690	test "multi-pane scale transitions resize every content claim and preserve stable attachment keys" {
		691	const a = std.testing.allocator;
519	var face = try font.Face.open(16);	692	var face = try font.Face.open(16);
520	defer face.deinit();	693	defer face.deinit();
521	var glyph_atlas = try atlas.Atlas.init(alloc, font.atlasWidth(16), 256);	694	var glyph_atlas = try atlas.Atlas.init(a, font.atlasWidth(16), 256);
522	defer glyph_atlas.deinit(alloc);	695	defer glyph_atlas.deinit(a);
523	var cache: font.GlyphCache = .{ .alloc = alloc, .face = &face, .glyph_atlas = &glyph_atlas };	696	var cache: font.GlyphCache = .{ .alloc = a, .face = &face, .glyph_atlas = &glyph_atlas };
524	defer cache.deinit();	697	defer cache.deinit();
525	const initial = cellsOf(960, 600, face.cell_w, face.cell_h);	698	var rt = runtime.Runtime.init(a, .{});
526	const pump = try session_pump.Pump.start(alloc, .{ .target = .{ .via = "cat" }, .cols = initial.cols, .rows = initial.rows });	699	defer rt.deinit();
527	defer pump.stop();	700	const metrics = measuredMetrics(&face, 1);
		701	const first = try rt.add(.{ .via = "cat" }, "left", 960, 600, metrics);
		702	rt.workspace.arm(.beside);
		703	const second = try rt.add(.{ .via = "cat" }, "right", 960, 600, metrics);
528	var wake: Wake = .{ .event_type = c.SDL_EVENT_USER };	704	var wake: Wake = .{ .event_type = c.SDL_EVENT_USER };
529	var events: Events = .{ .pump = pump, .win = undefined, .wake = &wake, .hook = null, .cache = &cache, .base_font_px = 16, .cells = initial, .fb_w = 960, .fb_h = 600, .dirty = false };	705	var events: Events = .{ .rt = &rt, .win = undefined, .wake = &wake, .hook = null, .cache = &cache, .base_font_px = 16, .metrics = metrics, .fb_w = 960, .fb_h = 600 };
		706	try events.relayout();
		707	const initial = events.layout;
		708	const old_key = rt.get(first).?.key;
530	var event = std.mem.zeroes(c.SDL_Event);	709	var event = std.mem.zeroes(c.SDL_Event);
531	event.type = c.SDL_EVENT_WINDOW_DISPLAY_SCALE_CHANGED;	710	event.type = c.SDL_EVENT_WINDOW_DISPLAY_SCALE_CHANGED;
532	try std.testing.expect(try events.handle(event));	711	try std.testing.expect(try events.handle(event));
533	try std.testing.expect(events.geometry_dirty);	712	try std.testing.expect(events.geometry_dirty);
534	event.type = c.SDL_EVENT_WINDOW_PIXEL_SIZE_CHANGED;
535	try std.testing.expect(try events.handle(event));
536	// A scale-only change must alter the cell claim even if the compositor
537	// has not changed the framebuffer size yet.
538	try events.updateGeometry(960, 600, 2);	713	try events.updateGeometry(960, 600, 2);
539	try std.testing.expect(events.cells.cols < initial.cols);	714	for (events.layout.items(), initial.items()) \|p, before\| {
540	try std.testing.expect(events.cells.rows < initial.rows);	715	try std.testing.expect(p.cols < before.cols and p.rows < before.rows);
		716	try std.testing.expectEqual(p.cols, rt.get(p.id).?.size.cols);
		717	try std.testing.expectEqual(p.rows, rt.get(p.id).?.size.rows);
		718	}
541	try events.updateGeometry(1920, 1200, 2);	719	try events.updateGeometry(1920, 1200, 2);
542	try std.testing.expectEqual(@as(u16, 32), face.pixels);	720	for (events.layout.items(), initial.items()) \|p, before\| {
543	// Hinting rounds metrics to whole pixels at each size; doubling the	721	try std.testing.expect(@abs(@as(i32, p.cols) - before.cols) <= @max(@as(u32, before.cols) / 8, 1));
544	// raster and drawable preserves the grid within that small rounding gap.	722	try std.testing.expect(@abs(@as(i32, p.rows) - before.rows) <= @max(@as(u32, before.rows) / 8, 1));
545	try std.testing.expect(@abs(@as(i32, events.cells.cols) - initial.cols) <= @max(@as(u32, initial.cols) / 8, 1));	723	try std.testing.expectEqual(@as(u32, face.cell_h), p.content.y);
546	try std.testing.expect(@abs(@as(i32, events.cells.rows) - initial.rows) <= @max(@as(u32, initial.rows) / 8, 1));	724	}
547	try std.testing.expectEqual(cellsOf(1920, 1200, face.cell_w, face.cell_h), events.cells);
548	try std.testing.expect(events.dirty);
549	try std.testing.expect(!events.geometry_dirty);
550
551	// A drawable resize still updates the grid when rounding leaves the
552	// raster size unchanged, and it preserves the prepared glyph cache.
553	try cache.prepare("M", .regular);	725	try cache.prepare("M", .regular);
554	try events.updateGeometry(1600, 1000, 2.001);	726	try events.updateGeometry(1600, 1000, 2.001);
555	try std.testing.expectEqual(@as(u16, 32), face.pixels);
556	try std.testing.expectEqual(@as(usize, 1), cache.runs.count());	727	try std.testing.expectEqual(@as(usize, 1), cache.runs.count());
557	try std.testing.expectEqual(cellsOf(1600, 1000, face.cell_w, face.cell_h), events.cells);	728	try std.testing.expectEqual(@as(u16, 32), face.pixels);
558	try events.updateGeometry(1200, 750, 1.25);
559	try std.testing.expectEqual(@as(u16, 20), face.pixels);
560	try std.testing.expectEqual(@as(usize, 0), cache.runs.count());
561	try std.testing.expectEqual(cellsOf(1200, 750, face.cell_w, face.cell_h), events.cells);
562	try events.updateGeometry(960, 600, 1);	729	try events.updateGeometry(960, 600, 1);
563	try std.testing.expectEqual(@as(u16, 16), face.pixels);	730	try std.testing.expectEqualDeep(initial.items(), events.layout.items());
564	try std.testing.expectEqual(initial, events.cells);	731	try std.testing.expect(rt.accepts(old_key));
		732	// Removal joins before destroying the identity/context. A queued old key
		733	// cannot select a new slot occupant, even after a further insertion.
		734	rt.remove(first);
		735	try std.testing.expect(!rt.accepts(old_key));
		736	rt.workspace.arm(.stacked);
		737	const third = try rt.add(.{ .via = "cat" }, "third", 960, 600, metrics);
		738	try std.testing.expect(third != first and third != second);
		739	try std.testing.expect(!rt.accepts(old_key));
		740	}
		741
		742	test "command key text is consumed and subsequent ordinary text is not suppressed" {
		743	const a = std.testing.allocator;
		744	var rt = runtime.Runtime.init(a, .{});
		745	defer rt.deinit();
		746	// No live attachment is needed to test the actual SDL event routing state.
		747	var wake: Wake = .{ .event_type = c.SDL_EVENT_USER };
		748	var events: Events = .{ .rt = &rt, .win = undefined, .wake = &wake, .hook = null, .cache = undefined, .base_font_px = 16, .metrics = .{ .cell_w = 8, .cell_h = 16 }, .fb_w = 960, .fb_h = 600 };
		749	var event = std.mem.zeroes(c.SDL_Event);
		750	event.key.type = c.SDL_EVENT_KEY_DOWN;
		751	event.key.key = c.SDLK_SPACE;
		752	event.key.mod = c.SDL_KMOD_CTRL \| c.SDL_KMOD_SHIFT;
		753	try std.testing.expect(try events.handle(event));
		754	try std.testing.expect(events.command_mode and events.suppress_text);
		755	event.text.type = c.SDL_EVENT_TEXT_INPUT;
		756	event.text.text = " ";
		757	try std.testing.expect(try events.handle(event));
		758	event = std.mem.zeroes(c.SDL_Event);
		759	event.key.type = c.SDL_EVENT_KEY_DOWN;
		760	event.key.key = c.SDLK_H;
		761	try std.testing.expect(try events.handle(event));
		762	try std.testing.expect(!events.command_mode and events.suppress_text);
		763	event.text.type = c.SDL_EVENT_TEXT_INPUT;
		764	event.text.text = "h";
		765	try std.testing.expect(try events.handle(event));
		766	try std.testing.expect(!events.suppress_text);
		767	event = std.mem.zeroes(c.SDL_Event);
		768	event.key.type = c.SDL_EVENT_KEY_DOWN;
		769	event.key.key = c.SDLK_H;
		770	event.key.repeat = true;
		771	try std.testing.expect(try events.handle(event));
		772	try std.testing.expect(events.suppress_text);
		773	event.key.type = c.SDL_EVENT_KEY_UP;
		774	try std.testing.expect(try events.handle(event));
		775	try std.testing.expect(events.consumed_key == null);
		776	event.key.type = c.SDL_EVENT_KEY_DOWN;
		777	event.key.repeat = false;
		778	event.key.key = c.SDLK_X;
		779	try std.testing.expect(try events.handle(event));
		780	try std.testing.expect(!events.suppress_text);
		781	// Repeated prefix exits mode; its shared keymap encoding is NUL.
		782	// The integration fixture verifies the emitted byte count with a real PTY.
		783	event.key.key = c.SDLK_SPACE;
		784	event.key.mod = c.SDL_KMOD_CTRL \| c.SDL_KMOD_SHIFT;
		785	try std.testing.expect(try events.handle(event));
		786	try std.testing.expect(events.command_mode);
		787	try std.testing.expect(try events.handle(event));
		788	try std.testing.expect(!events.command_mode);
		789	var bytes: [keymap.max_seq_len]u8 = undefined;
		790	try std.testing.expectEqualSlices(u8, &.{0}, keymap.encode(keyEvent(c.SDLK_SPACE, event.key.mod).?, &bytes));
		791	}
		792
		793	test "later pane atlas growth precedes earlier pane UV generation" {
		794	const a = std.testing.allocator;
		795	var face = try font.Face.open(16);
		796	defer face.deinit();
		797	var glyph_atlas = try atlas.Atlas.init(a, 128, 1);
		798	defer glyph_atlas.deinit(a);
		799	var cache: font.GlyphCache = .{ .alloc = a, .face = &face, .glyph_atlas = &glyph_atlas };
		800	defer cache.deinit();
		801	const left = try term.grid.Grid.init(a, 1, 1);
		802	defer left.deinit();
		803	try left.lines[0].text.appendSlice(a, "M");
		804	left.lines[0].cells[0] = .{ .text_len = 1 };
		805	const right = try term.grid.Grid.init(a, 94, 1);
		806	defer right.deinit();
		807	for (right.lines[0].cells, 0..) \|*cell, i\| {
		808	try right.lines[0].text.append(a, @intCast(33 + i));
		809	cell.* = .{ .text_off = @intCast(i), .text_len = 1, .style = .{ .flags = 3 } };
		810	}
		811	try prepareGrid(&cache, left);
		812	const before = glyph_atlas.height;
		813	try prepareGrid(&cache, right);
		814	try std.testing.expect(glyph_atlas.height > before);
		815	const shaped = try font.GlyphCache.resolve(@ptrCast(&cache), "M", .regular);
		816	const entry = shaped[0].entry;
		817	const ctx: quads.Ctx = .{ .cell_w = face.cell_w, .cell_h = face.cell_h, .ascent = face.ascent, .atlas_w = @floatFromInt(glyph_atlas.width), .atlas_h = @floatFromInt(glyph_atlas.height), .glyphs = .{ .ctx = &cache, .resolve = font.GlyphCache.resolve } };
		818	var lists: quads.Lists = .{};
		819	defer lists.deinit(a);
		820	_ = try quads.rowInstances(&lists, a, left.row(0), 1, 0, 0, ctx);
		821	try std.testing.expect(lists.foregrounds.items.len > 0);
		822	const glyph = lists.foregrounds.items[0];
		823	const expected = @as(f32, @floatFromInt(entry.y)) / @as(f32, @floatFromInt(glyph_atlas.height));
		824	try std.testing.expectApproxEqAbs(expected, glyph.v0, 0.00001);
		825	try std.testing.expect(glyph.v1 <= @as(f32, @floatFromInt(entry.y + entry.h)) / @as(f32, @floatFromInt(glyph_atlas.height)));
565	}	826	}

src/gui/native.zig

Old		New
@@ -1,9 +1,8 @@
1	//! The native client's painter: a window onto one daemon session, rendered	1	//! The native client's workspace and painter. Each pane renders the grid
2	//! directly from the grid delivered on the wire.	2	//! delivered by its own session connection.
3	//!	3	//!
4	//! Folder rules 8 and 9 in build.zig keep this directory limited to rendering	4	//! Folder rules 8 and 9 in build.zig keep this workspace independent of the
5	//! and window integration for a single session. Multi-session placement and	5	//! terminal wall and confine the window API to frame.zig. The
6	//! discovery remain outside it. The window API is confined to frame.zig; the
7	//! remaining painter code stays usable in unit tests that open no window.	6	//! remaining painter code stays usable in unit tests that open no window.
8	//!	7	//!
9	//! Imports `client` and `term` and nothing else of ours.	8	//! Imports `client` and `term` and nothing else of ours.
@@ -12,6 +11,8 @@ const client = @import("client");
12	const term = @import("term");	11	const term = @import("term");
13		12
14	pub const frame = @import("frame.zig");	13	pub const frame = @import("frame.zig");
		14	pub const workspace = @import("workspace.zig");
		15	pub const runtime = @import("runtime.zig");
15	pub const bench = @import("bench.zig");	16	pub const bench = @import("bench.zig");
16	pub const atlas = @import("atlas.zig");	17	pub const atlas = @import("atlas.zig");
17	pub const font = @import("font.zig");	18	pub const font = @import("font.zig");
@@ -26,6 +27,8 @@ test {
26	_ = client;	27	_ = client;
27	_ = term;	28	_ = term;
28	_ = frame;	29	_ = frame;
		30	_ = workspace;
		31	_ = runtime;
29	_ = bench;	32	_ = bench;
30	_ = atlas;	33	_ = atlas;
31	_ = font;	34	_ = font;

src/gui/quads.zig

@@ @@ -54,7 +54,7 @@ pub fn rgbaOf(c: u32, d: u32) u32 { @@
+        else => d,
+    };
+pub fn solid(x: f32, y: f32, w: f32, h: f32, color: u32) Instance {
+    return .{ .x = x, .y = y, .w = w, .h = h, .u0 = 0, .v0 = 0, .u1 = 0, .v1 = 0, .rgba = color, .kind = Instance.solid };
+pub fn variantOf(flags: u16) atlas.Variant {
+    try std.testing.expect(glyph.u0 > @as(f32, 2) / ctx.atlas_w);
+    try std.testing.expect(glyph.u1 < @as(f32, 22) / ctx.atlas_w);
+/// Clip only the newly emitted range, adjusting glyph UVs proportionally.
+/// Removed instances are compacted without changing background/foreground order.
+pub fn clip(list: *std.ArrayListUnmanaged(Instance), start: usize, x: f32, y: f32, w: f32, h: f32) void {
+    var out = start;
+    for (list.items[start..]) |old| {
+        const left = @max(x, old.x);
+        const top = @max(y, old.y);
+        const right = @min(x + w, old.x + old.w);
+        const bottom = @min(y + h, old.y + old.h);
+        if (right <= left or bottom <= top) continue;
+        var v = old;
+        v.x = left;
+        v.y = top;
+        v.w = right - left;
+        v.h = bottom - top;
+        v.u0 = old.u0 + (old.u1 - old.u0) * (left - old.x) / old.w;
+        v.u1 = old.u0 + (old.u1 - old.u0) * (right - old.x) / old.w;
+        v.v0 = old.v0 + (old.v1 - old.v0) * (top - old.y) / old.h;
+        v.v1 = old.v0 + (old.v1 - old.v0) * (bottom - old.y) / old.h;
+        list.items[out] = v;
+        out += 1;
+    }
+    list.items.len = out;
+}
+test "pane clipping preserves adjacent stream and crops glyph UVs on both axes" {
+    const a = std.testing.allocator;
+    var list: std.ArrayListUnmanaged(Instance) = .empty;
+    defer list.deinit(a);
+    try list.append(a, solid(0, 0, 5, 5, 0));
+    var glyph = solid(10, 10, 20, 20, 0);
+    glyph.kind = Instance.glyph;
+    glyph.u1 = 1;
+    glyph.v1 = 1;
+    try list.append(a, glyph);
+    try list.append(a, solid(100, 100, 5, 5, 0));
+    clip(&list, 1, 15, 20, 10, 5);
+    try std.testing.expectEqual(@as(usize, 2), list.items.len);
+    try std.testing.expectEqual(@as(f32, 0), list.items[0].x);
+    const v = list.items[1];
+    try std.testing.expectEqual(@as(f32, 15), v.x);
+    try std.testing.expectEqual(@as(f32, 5), v.h);
+    try std.testing.expectEqual(@as(f32, 0.25), v.u0);
+    try std.testing.expectEqual(@as(f32, 0.75), v.u1);
+    try std.testing.expectEqual(@as(f32, 0.5), v.v0);
+    try std.testing.expectEqual(@as(f32, 0.75), v.v1);
+}

src/gui/runtime.zig

@@ @@ -0,0 +1,156 @@ @@
+//! Pane attachments and reusable owned frame snapshots. Transport threads
+//! never touch workspace geometry; notifications carry stable attachment keys.
+const std = @import("std");
+const client = @import("client");
+const term = @import("term");
+const model = @import("workspace.zig");
+const Pump = client.session_pump.Pump;
+pub const Notify = struct { ctx: ?*anyopaque = null, call: ?*const fn (?*anyopaque, model.Attachment) void = null };
+pub const Live = struct {
+    key: model.Attachment,
+    pump: *Pump,
+    snapshot: *term.grid.Grid,
+    snapshot_seq: u64 = 0,
+    painted_seq: u64 = 0,
+    status: client.session_pump.State = .{},
+    size: term.protocol.Size,
+    notify: Notify,
+    pending: std.atomic.Value(bool) = .init(false),
+    bell_until: i64 = 0,
+    fn wake(ctx: ?*anyopaque) void {
+        const self: *Live = @ptrCast(@alignCast(ctx.?));
+        if (self.pending.swap(true, .acq_rel)) return;
+        if (self.notify.call) |f| f(self.notify.ctx, self.key);
+    }
+    pub fn capture(self: *Live, cols: u16, rows: u16) !u32 {
+        self.pump.mu.lock();
+        defer self.pump.mu.unlock();
+        const src = self.pump.grid;
+        try copyGrid(self.snapshot, src, @min(cols, src.cols), @min(rows, src.rows));
+        self.snapshot_seq = self.pump.replica.last_seq;
+        return self.pump.last_apply_us;
+    }
+};
+pub fn copyGrid(dst: *term.grid.Grid, src: *const term.grid.Grid, cols: u16, rows: u16) !void {
+    if (dst.cols != cols or dst.rows != rows) try dst.resize(cols, rows);
+    for (dst.lines, 0..) |*row, y| {
+        const from = src.row(@intCast(y));
+        // Offsets are copied with their text arena; no borrowed source text
+        // survives the pump mutex, even if another frame arrives immediately.
+        try row.text.resize(dst.alloc, from.text.items.len);
+        @memcpy(row.text.items, from.text.items);
+        @memcpy(row.cells, from.cells[0..cols]);
+    }
+    dst.cursor = src.cursor;
+}
+pub const Runtime = struct {
+    alloc: std.mem.Allocator,
+    workspace: model.Workspace,
+    lives: [model.max_panes]?*Live = @splat(null),
+    notify: Notify,
+    pub fn init(alloc: std.mem.Allocator, notify: Notify) Runtime {
+        return .{ .alloc = alloc, .workspace = model.Workspace.init(alloc), .notify = notify };
+    }
+    pub fn deinit(self: *Runtime) void {
+        for (self.lives) |p| if (p) |live| {
+            live.pump.say(.quit) catch unreachable;
+        };
+        for (self.lives) |p| if (p) |live| {
+            live.pump.stop();
+            live.snapshot.deinit();
+            self.alloc.destroy(live);
+        };
+        self.workspace.deinit();
+    }
+    pub fn get(self: *Runtime, id: model.PaneId) ?*Live {
+        for (self.lives) |p| if (p) |live| {
+            if (live.key.pane == id) return live;
+        };
+        return null;
+    }
+    pub fn accepts(self: *Runtime, key: model.Attachment) bool {
+        const live = self.get(key.pane) orelse return false;
+        return live.key.generation == key.generation;
+    }
+    pub fn add(self: *Runtime, target: client.Target, session: []const u8, width: u32, height: u32, metrics: model.Metrics) !model.PaneId {
+        var prepared = try self.workspace.prepare(target, session, width, height, metrics);
+        errdefer prepared.discard(self.alloc);
+        const live = try self.alloc.create(Live);
+        errdefer self.alloc.destroy(live);
+        const grid = try term.grid.Grid.init(self.alloc, 1, 1);
+        errdefer grid.deinit();
+        live.* = .{ .key = .{ .pane = prepared.pane.id, .generation = prepared.pane.generation }, .pump = undefined, .snapshot = grid, .size = .{ .cols = prepared.placement.cols, .rows = prepared.placement.rows }, .notify = self.notify };
+        live.pump = try Pump.start(self.alloc, .{ .target = prepared.pane.identity.target, .session = prepared.pane.identity.session, .cols = live.size.cols, .rows = live.size.rows, .wake = Live.wake, .wake_ctx = live });
+        for (&self.lives) |*slot| if (slot.* == null) {
+            slot.* = live;
+            break;
+        };
+        self.workspace.commit(prepared);
+        return live.key.pane;
+    }
+    pub fn remove(self: *Runtime, id: model.PaneId) void {
+        for (&self.lives) |*slot| if (slot.*) |live| {
+            if (live.key.pane == id) {
+                live.pump.stop();
+                live.snapshot.deinit();
+                self.alloc.destroy(live);
+                slot.* = null;
+                break;
+            }
+        };
+        self.workspace.remove(id);
+    }
+    pub fn resize(self: *Runtime, layout: *const model.Layout) !void {
+        for (layout.items()) |p| {
+            const live = self.get(p.id) orelse continue;
+            const size: term.protocol.Size = .{ .cols = p.cols, .rows = p.rows };
+            if (!std.meta.eql(live.size, size)) {
+                try live.pump.say(.{ .resize = size });
+                live.size = size;
+            }
+        }
+    }
+    pub fn input(self: *Runtime, text: []const u8) !void {
+        const live = self.get(self.workspace.tab().focus orelse return) orelse return;
+        switch (live.status.phase) {
+            .dialing, .attached, .reconnecting => try live.pump.say(.{ .input = text }),
+            else => {},
+        }
+    }
+    pub fn poll(self: *Runtime, now: i64) bool {
+        var changed = false;
+        for (self.lives) |p| if (p) |live| {
+            changed = live.pending.swap(false, .acq_rel) or changed;
+            const status = live.pump.state();
+            if (status.phase != live.status.phase or status.exit_code != live.status.exit_code) changed = true;
+            live.status = status;
+            if (status.bell) {
+                live.bell_until = now + 200;
+                changed = true;
+            }
+            if (live.bell_until != 0 and now >= live.bell_until) {
+                live.bell_until = 0;
+                changed = true;
+            }
+        };
+        return changed;
+    }
+};
+test "frozen pane grids own text and survive live mutation and shrink" {
+    const a = std.testing.allocator;
+    const src = try term.grid.Grid.init(a, 4, 2);
+    defer src.deinit();
+    const dst = try term.grid.Grid.init(a, 1, 1);
+    defer dst.deinit();
+    try src.lines[1].text.appendSlice(a, "old");
+    src.lines[1].cells[2] = .{ .text_len = 3 };
+    try copyGrid(dst, src, 4, 2);
+    @memcpy(src.lines[1].text.items, "new");
+    src.clear();
+    try std.testing.expectEqualStrings("old", dst.row(1).textOf(dst.row(1).cells[2]));
+    try copyGrid(dst, src, 2, 1);
+    try std.testing.expectEqual(@as(u16, 2), dst.cols);
+    try std.testing.expectEqual(@as(u16, 1), dst.rows);
+    try std.testing.expectEqual(@as(usize, 0), dst.row(0).text.items.len);
+}

src/gui/workspace.zig

@@ @@ -0,0 +1,448 @@ @@
+//! Native workspace ownership and pixel geometry. One tab today; pane IDs
+//! and attachment generations never depend on array slots or current focus.
+//! A bounded binary tree keeps leaf insertion transactional without importing
+//! the terminal wall's cell rails, allocation paths, or insertion policy.
+const std = @import("std");
+const client = @import("client");
+pub const PaneId = u64;
+pub const TabId = u64;
+pub const max_panes = 32;
+pub const Direction = enum { beside, stacked };
+pub const Neighbor = enum { left, down, up, right };
+pub const Attachment = struct { pane: PaneId, generation: u64 };
+pub const Rect = struct {
+    x: u32 = 0,
+    y: u32 = 0,
+    w: u32 = 0,
+    h: u32 = 0,
+    pub fn intersect(a: Rect, b: Rect) Rect {
+        const x = @max(a.x, b.x);
+        const y = @max(a.y, b.y);
+        return .{ .x = x, .y = y, .w = @min(a.x + a.w, b.x + b.w) -| x, .h = @min(a.y + a.h, b.y + b.h) -| y };
+    }
+    pub fn contains(r: Rect, x: u32, y: u32) bool {
+        return x >= r.x and y >= r.y and x - r.x < r.w and y - r.y < r.h;
+    }
+};
+pub const Metrics = struct {
+    cell_w: u16,
+    cell_h: u16,
+    divider: u16 = 1,
+    fn minimum(self: Metrics) Rect {
+        std.debug.assert(self.cell_w > 0 and self.cell_h > 0);
+        return .{ .w = @as(u32, self.cell_w) * 2, .h = @as(u32, self.cell_h) * 2 };
+    }
+};
+pub const Placement = struct { id: PaneId, outer: Rect, header: Rect, content: Rect, visible: Rect, cols: u16, rows: u16 };
+pub const Layout = struct {
+    panes: [max_panes]Placement = undefined,
+    len: usize = 0,
+    pub fn items(self: *const Layout) []const Placement {
+        return self.panes[0..self.len];
+    }
+    pub fn get(self: *const Layout, id: PaneId) ?Placement {
+        for (self.items()) |p| if (p.id == id) return p;
+        return null;
+    }
+    pub fn hit(self: *const Layout, x: u32, y: u32) ?PaneId {
+        for (self.items()) |p| if (p.visible.contains(x, y)) return p.id;
+        return null;
+    }
+};
+pub const Identity = struct {
+    arena: std.heap.ArenaAllocator,
+    target: client.Target,
+    session: []const u8,
+    label: []const u8,
+    pub fn init(alloc: std.mem.Allocator, target: client.Target, session: []const u8) !Identity {
+        if (session.len > 0 and !@import("term").protocol.validSessionName(session)) return error.InvalidSession;
+        var arena = std.heap.ArenaAllocator.init(alloc);
+        errdefer arena.deinit();
+        const a = arena.allocator();
+        const owned = try cloneTarget(a, target);
+        const name = try a.dupe(u8, @import("term").protocol.resolveName(session));
+        const host = switch (owned) {
+            .sock => |s| s,
+            .via => |s| s,
+            .quic => |q| q.host_port,
+            .hand => |h| h.host,
+        };
+        const label = try std.fmt.allocPrint(a, "{s}#{s}", .{ host, name });
+        return .{ .arena = arena, .target = owned, .session = name, .label = label };
+    }
+    pub fn deinit(self: *Identity) void {
+        self.arena.deinit();
+    }
+};
+fn cloneTarget(a: std.mem.Allocator, target: client.Target) !client.Target {
+    return switch (target) {
+        .sock => |s| .{ .sock = try a.dupe(u8, s) },
+        .via => |s| .{ .via = try a.dupe(u8, s) },
+        .quic => |q| blk: {
+            var copy = q;
+            copy.host_port = try a.dupe(u8, q.host_port);
+            copy.key_path = try a.dupe(u8, q.key_path);
+            break :blk .{ .quic = copy };
+        },
+        .hand => |h| blk: {
+            var copy = h;
+            copy.host = try a.dupe(u8, h.host);
+            copy.ssh_argv = try cloneArgv(a, h.ssh_argv);
+            copy.asked_argv = try cloneArgv(a, h.asked_argv);
+            if (h.cache_path) |s| copy.cache_path = try a.dupe(u8, s);
+            if (h.ask_sock) |s| copy.ask_sock = try a.dupe(u8, s);
+            copy.ask_exe = try a.dupe(u8, h.ask_exe);
+            break :blk .{ .hand = copy };
+        },
+    };
+}
+fn cloneArgv(a: std.mem.Allocator, args: []const []const u8) ![]const []const u8 {
+    const out = try a.alloc([]const u8, args.len);
+    for (args, out) |s, *d| d.* = try a.dupe(u8, s);
+    return out;
+}
+pub const Pane = struct { id: PaneId, generation: u64 = 1, identity: Identity };
+const Node = union(enum) { empty, leaf: PaneId, split: struct { direction: Direction, a: u8, b: u8 } };
+const Tree = struct {
+    nodes: [max_panes * 2 - 1]Node = @splat(.empty),
+    root: ?u8 = null,
+    fn free(self: *Tree) !u8 {
+        for (self.nodes, 0..) |n, i| if (n == .empty) return @intCast(i);
+        return error.WorkspaceFull;
+    }
+    fn leaf(self: *const Tree, id: PaneId) ?u8 {
+        for (self.nodes, 0..) |n, i| if (n == .leaf and n.leaf == id) return @intCast(i);
+        return null;
+    }
+    fn insert(self: *Tree, origin: ?PaneId, id: PaneId, direction: Direction) !void {
+        if (self.root == null) {
+            const at = try self.free();
+            self.nodes[at] = .{ .leaf = id };
+            self.root = at;
+            return;
+        }
+        const at = self.leaf(origin orelse return error.MissingPane) orelse return error.MissingPane;
+        const a = try self.free();
+        self.nodes[a] = self.nodes[at];
+        const b = try self.free();
+        self.nodes[b] = .{ .leaf = id };
+        self.nodes[at] = .{ .split = .{ .direction = direction, .a = a, .b = b } };
+    }
+    fn remove(self: *Tree, id: PaneId) void {
+        const at = self.leaf(id) orelse return;
+        if (self.root == at) {
+            self.nodes[at] = .empty;
+            self.root = null;
+            return;
+        }
+        for (&self.nodes) |*node| {
+            if (node.* != .split) continue;
+            const s = node.split;
+            if (s.a == at or s.b == at) {
+                const sibling = if (s.a == at) s.b else s.a;
+                node.* = self.nodes[sibling];
+                self.nodes[sibling] = .empty;
+                self.nodes[at] = .empty;
+                return;
+            }
+        }
+    }
+    fn minimum(self: *const Tree, at: u8, m: Metrics) Rect {
+        return switch (self.nodes[at]) {
+            .leaf => m.minimum(),
+            .split => |s| blk: {
+                const a = self.minimum(s.a, m);
+                const b = self.minimum(s.b, m);
+                break :blk switch (s.direction) {
+                    .beside => .{ .w = a.w + b.w + m.divider, .h = @max(a.h, b.h) },
+                    .stacked => .{ .w = @max(a.w, b.w), .h = a.h + b.h + m.divider },
+                };
+            },
+            .empty => unreachable,
+        };
+    }
+    fn flatten(self: *const Tree, at: u8, rect: Rect, viewport: Rect, m: Metrics, out: *Layout) void {
+        switch (self.nodes[at]) {
+            .leaf => |id| {
+                const content: Rect = .{ .x = rect.x, .y = rect.y + m.cell_h, .w = rect.w, .h = rect.h - m.cell_h };
+                out.panes[out.len] = .{ .id = id, .outer = rect, .header = .{ .x = rect.x, .y = rect.y, .w = rect.w, .h = m.cell_h }, .content = content, .visible = rect.intersect(viewport), .cols = @intCast(@min(@max(content.w / m.cell_w, 1), @import("term").protocol.max_cols)), .rows = @intCast(@min(@max(content.h / m.cell_h, 1), std.math.maxInt(u16))) };
+                out.len += 1;
+            },
+            .split => |s| {
+                const amin = self.minimum(s.a, m);
+                const bmin = self.minimum(s.b, m);
+                var a = rect;
+                var b = rect;
+                switch (s.direction) {
+                    .beside => {
+                        const space = rect.w - m.divider;
+                        a.w = std.math.clamp((space + 1) / 2, amin.w, space - bmin.w);
+                        b.x += a.w + m.divider;
+                        b.w = space - a.w;
+                    },
+                    .stacked => {
+                        const space = rect.h - m.divider;
+                        a.h = std.math.clamp((space + 1) / 2, amin.h, space - bmin.h);
+                        b.y += a.h + m.divider;
+                        b.h = space - a.h;
+                    },
+                }
+                self.flatten(s.a, a, viewport, m, out);
+                self.flatten(s.b, b, viewport, m, out);
+            },
+            .empty => unreachable,
+        }
+    }
+};
+pub const Pending = struct { pane: PaneId, direction: Direction };
+pub const Tab = struct { id: TabId = 1, tree: Tree = .{}, focus: ?PaneId = null, pending: ?Pending = null, panes: [max_panes]?*Pane = @splat(null) };
+pub const Prepared = struct {
+    pane: *Pane,
+    tree: Tree,
+    placement: Placement,
+    pub fn discard(self: *Prepared, alloc: std.mem.Allocator) void {
+        self.pane.identity.deinit();
+        alloc.destroy(self.pane);
+    }
+};
+pub const Workspace = struct {
+    alloc: std.mem.Allocator,
+    tabs: [1]Tab = .{.{}},
+    active_tab_id: TabId = 1,
+    next_pane_id: PaneId = 1,
+    pub fn init(alloc: std.mem.Allocator) Workspace {
+        return .{ .alloc = alloc };
+    }
+    pub fn tab(self: *Workspace) *Tab {
+        return &self.tabs[0];
+    }
+    pub fn deinit(self: *Workspace) void {
+        for (self.tab().panes) |p| if (p) |v| {
+            v.identity.deinit();
+            self.alloc.destroy(v);
+        };
+    }
+    pub fn pane(self: *Workspace, id: PaneId) ?*Pane {
+        for (self.tab().panes) |p| if (p) |v| {
+            if (v.id == id) return v;
+        };
+        return null;
+    }
+    pub fn layout(self: *Workspace, width: u32, height: u32, m: Metrics) Layout {
+        var out: Layout = .{};
+        if (self.tab().tree.root) |root| {
+            const min = self.tab().tree.minimum(root, m);
+            self.tab().tree.flatten(root, .{ .w = @max(width, min.w), .h = @max(height, min.h) }, .{ .w = width, .h = height }, m, &out);
+        }
+        return out;
+    }
+    pub fn arm(self: *Workspace, direction: Direction) void {
+        if (self.tab().focus) |id| self.tab().pending = .{ .pane = id, .direction = direction };
+    }
+    pub fn cancel(self: *Workspace) void {
+        self.tab().pending = null;
+    }
+    pub fn focus(self: *Workspace, id: PaneId) bool {
+        if (self.pane(id) == null) return false;
+        self.tab().focus = id;
+        return true;
+    }
+    pub fn prepare(self: *Workspace, target: client.Target, session: []const u8, width: u32, height: u32, m: Metrics) !Prepared {
+        const t = self.tab();
+        var count: usize = 0;
+        for (t.panes) |p| {
+            if (p != null) count += 1;
+        }
+        if (count == max_panes) return error.WorkspaceFull;
+        const origin = if (t.pending) |p| p.pane else t.focus;
+        const direction = if (t.pending) |p| p.direction else Direction.beside;
+        if (t.tree.root) |r| {
+            const min = t.tree.minimum(r, m);
+            if (min.w > width or min.h > height) return error.TooSmall;
+            const flat = self.layout(width, height, m);
+            const old = flat.get(origin orelse return error.MissingPane) orelse return error.MissingPane;
+            const leaf_min = m.minimum();
+            if ((direction == .beside and old.outer.w < leaf_min.w * 2 + m.divider) or (direction == .stacked and old.outer.h < leaf_min.h * 2 + m.divider)) return error.TooSmall;
+        }
+        var tree = t.tree;
+        const id = self.next_pane_id;
+        try tree.insert(origin, id, direction);
+        const p = try self.alloc.create(Pane);
+        errdefer self.alloc.destroy(p);
+        p.* = .{ .id = id, .identity = try Identity.init(self.alloc, target, session) };
+        self.next_pane_id += 1;
+        var flat: Layout = .{};
+        const min = tree.minimum(tree.root.?, m);
+        tree.flatten(tree.root.?, .{ .w = @max(width, min.w), .h = @max(height, min.h) }, .{ .w = width, .h = height }, m, &flat);
+        return .{ .pane = p, .tree = tree, .placement = flat.get(id).? };
+    }
+    /// Call immediately after preparing the attachment; no other model edits
+    /// may occur between prepare and commit. This operation cannot allocate.
+    pub fn commit(self: *Workspace, prepared: Prepared) void {
+        const t = self.tab();
+        for (&t.panes) |*p| if (p.* == null) {
+            p.* = prepared.pane;
+            break;
+        };
+        t.tree = prepared.tree;
+        t.focus = prepared.pane.id;
+        t.pending = null;
+    }
+    /// The caller has already joined this pane's pump and discarded its wake
+    /// context. Removing a pending origin cancels that pending insertion.
+    pub fn remove(self: *Workspace, id: PaneId) void {
+        const t = self.tab();
+        for (&t.panes) |*p| if (p.*) |v| {
+            if (v.id == id) {
+                v.identity.deinit();
+                self.alloc.destroy(v);
+                p.* = null;
+                break;
+            }
+        };
+        t.tree.remove(id);
+        if (t.pending) |p| if (p.pane == id) {
+            t.pending = null;
+        };
+        if (t.focus == id) {
+            t.focus = null;
+            for (t.panes) |p| if (p) |v| {
+                t.focus = v.id;
+                break;
+            };
+        }
+    }
+    pub fn moveFocus(self: *Workspace, flat: *const Layout, direction: Neighbor) void {
+        const from = flat.get(self.tab().focus orelse return) orelse return;
+        var best: ?PaneId = null;
+        var score: u64 = std.math.maxInt(u64);
+        for (flat.items()) |p| {
+            if (p.id == from.id) continue;
+            const f = from.outer;
+            const r = p.outer;
+            const valid = switch (direction) {
+                .left => r.x + r.w <= f.x,
+                .right => r.x >= f.x + f.w,
+                .up => r.y + r.h <= f.y,
+                .down => r.y >= f.y + f.h,
+            };
+            if (!valid) continue;
+            const main: u32 = switch (direction) {
+                .left => f.x - (r.x + r.w),
+                .right => r.x - (f.x + f.w),
+                .up => f.y - (r.y + r.h),
+                .down => r.y - (f.y + f.h),
+            };
+            const mid = switch (direction) {
+                .left, .right => f.y + f.h / 2,
+                .up, .down => f.x + f.w / 2,
+            };
+            const lo = switch (direction) {
+                .left, .right => r.y,
+                .up, .down => r.x,
+            };
+            const hi = lo + switch (direction) {
+                .left, .right => r.h,
+                .up, .down => r.w,
+            };
+            const perp = if (mid < lo) lo - mid else mid -| hi;
+            const value = @as(u64, main) * 1_000_000 + perp;
+            if (value < score) {
+                score = value;
+                best = p.id;
+            }
+        }
+        if (best) |id| _ = self.focus(id);
+    }
+};
+fn add(w: *Workspace, width: u32, height: u32) !PaneId {
+    const p = try w.prepare(.{ .via = "cat" }, "test", width, height, .{ .cell_w = 10, .cell_h = 20 });
+    w.commit(p);
+    return p.pane.id;
+}
+test "workspace nested insertion focus cancellation removal and tiny clipping preserve IDs" {
+    var w = Workspace.init(std.testing.allocator);
+    defer w.deinit();
+    const a = try add(&w, 800, 600);
+    w.arm(.beside);
+    const unchanged = w.layout(800, 600, .{ .cell_w = 10, .cell_h = 20 });
+    w.cancel();
+    try std.testing.expectEqualDeep(unchanged.items(), w.layout(800, 600, .{ .cell_w = 10, .cell_h = 20 }).items());
+    w.arm(.beside);
+    const b = try add(&w, 800, 600);
+    var flat = w.layout(800, 600, .{ .cell_w = 10, .cell_h = 20 });
+    const left = flat.get(a).?.outer;
+    w.arm(.stacked);
+    _ = w.focus(a);
+    const c = try add(&w, 800, 600);
+    flat = w.layout(800, 600, .{ .cell_w = 10, .cell_h = 20 });
+    try std.testing.expectEqual(left, flat.get(a).?.outer);
+    try std.testing.expect(flat.get(c).?.outer.y > flat.get(b).?.outer.y);
+    w.moveFocus(&flat, .up);
+    try std.testing.expectEqual(b, w.tab().focus.?);
+    w.moveFocus(&flat, .left);
+    try std.testing.expectEqual(a, w.tab().focus.?);
+    const tiny = w.layout(5, 5, .{ .cell_w = 10, .cell_h = 20 });
+    try std.testing.expectEqual(@as(usize, 3), tiny.len);
+    try std.testing.expect(tiny.hit(6, 2) == null);
+    for (tiny.items()) |p| {
+        try std.testing.expect(p.cols > 0 and p.rows > 0);
+    }
+    try std.testing.expectError(error.TooSmall, w.prepare(.{ .via = "cat" }, "x", 5, 5, .{ .cell_w = 10, .cell_h = 20 }));
+    w.arm(.beside);
+    w.remove(a);
+    try std.testing.expect(w.tab().pending == null);
+    const d = try add(&w, 800, 600);
+    try std.testing.expect(d > c);
+}
+test "workspace refuses a nested leaf split even if global minima would fit" {
+    var w = Workspace.init(std.testing.allocator);
+    defer w.deinit();
+    const a = try add(&w, 100, 100);
+    _ = try add(&w, 100, 100);
+    _ = w.focus(a);
+    _ = try add(&w, 100, 100);
+    // Four leaves need83px globally, but the armed25px leaf needs41px.
+    try std.testing.expectError(error.TooSmall, w.prepare(.{ .via = "cat" }, "x", 100, 100, .{ .cell_w = 10, .cell_h = 20 }));
+}
+fn allocationCase(alloc: std.mem.Allocator) !void {
+    var w = Workspace.init(alloc);
+    defer w.deinit();
+    _ = try add(&w, 800, 600);
+    w.arm(.stacked);
+    const before = w.tab().focus;
+    const p = w.prepare(.{ .hand = .{ .host = "host", .ssh_argv = &.{ "ssh", "host" }, .cache_path = "/tmp/cache" } }, "other", 800, 600, .{ .cell_w = 10, .cell_h = 20 }) catch |err| {
+        try std.testing.expectEqual(before, w.tab().focus);
+        try std.testing.expectEqual(@as(usize, 1), w.layout(800, 600, .{ .cell_w = 10, .cell_h = 20 }).len);
+        return err;
+    };
+    w.commit(p);
+}
+test "workspace insertion allocation failures leave no half insertion or identity leak" {
+    try std.testing.checkAllAllocationFailures(std.testing.allocator, allocationCase, .{});
+}
+test "workspace identity owns nested target arguments beyond caller buffers" {
+    var host = [_]u8{ 'h', 'o', 's', 't' };
+    var key = [_]u8{ '/', 'k', 'e', 'y' };
+    var name = [_]u8{ 'w', 'o', 'r', 'k' };
+    var hand = try Identity.init(std.testing.allocator, .{ .hand = .{ .host = &host, .ssh_argv = &.{ "ssh", &host }, .asked_argv = &.{ "ssh", &host, "start" }, .cache_path = &key, .ask_sock = &key, .ask_exe = &key } }, &name);
+    defer hand.deinit();
+    var quic = try Identity.init(std.testing.allocator, .{ .quic = .{ .host_port = &host, .key_path = &key } }, &name);
+    defer quic.deinit();
+    @memset(&host, 'x');
+    @memset(&key, 'x');
+    @memset(&name, 'x');
+    try std.testing.expectEqualStrings("host", hand.target.hand.ssh_argv[1]);
+    try std.testing.expectEqualStrings("host", hand.target.hand.asked_argv[1]);
+    try std.testing.expectEqualStrings("/key", hand.target.hand.cache_path.?);
+    try std.testing.expectEqualStrings("/key", hand.target.hand.ask_sock.?);
+    try std.testing.expectEqualStrings("/key", hand.target.hand.ask_exe);
+    try std.testing.expectEqualStrings("host", quic.target.quic.host_port);
+    try std.testing.expectEqualStrings("/key", quic.target.quic.key_path);
+    try std.testing.expectEqualStrings("work", hand.session);
+    try std.testing.expectEqualStrings("host#work", hand.label);
+}

test/e2e_08_mouse.sh

Old		New
@@ -147,7 +147,7 @@ ok "the wheel scrolls back and returns to live, and never reaches the pty"
147	# script asks for it on top of vim's `set mouse=a` set.	147	# script asks for it on top of vim's `set mouse=a` set.
148	cat > "$MOUSESH" <<'EOF'	148	cat > "$MOUSESH" <<'EOF'
149	#!/bin/sh	149	#!/bin/sh
150	seq 1 100	150	seq 1 100 \| sed 's/^/app-history-row-/'
151	printf '\033[?1000h\033[?1002h\033[?1003h\033[?1006h'	151	printf '\033[?1000h\033[?1002h\033[?1003h\033[?1006h'
152	printf 'app-holds-the-mouse\n'	152	printf 'app-holds-the-mouse\n'
153	exec /bin/cat	153	exec /bin/cat
@@ -186,7 +186,8 @@ grep -qaF "$(printf '\033[?1003h')" "$OUT.mse" \|\| {
186	echo "e2e FAIL: app mouse: the client never mirrored the session's any-motion mode"; exit 1; }	186	echo "e2e FAIL: app mouse: the client never mirrored the session's any-motion mode"; exit 1; }
187	# And the negative that makes the pair a pair: this session has the same	187	# And the negative that makes the pair a pair: this session has the same
188	# 77 rows of history as (a), and the same wheel byte moved none of it.	188	# 77 rows of history as (a), and the same wheel byte moved none of it.
189	grep -qF -- "60" "$OUT.mse" && {	189	# A bare number also matches the PID in the pane's socket label.
		190	grep -qF -- "app-history-row-60" "$OUT.mse" && {
190	echo "e2e FAIL: app mouse: the client scrolled back on a wheel the app owned"; exit 1; }	191	echo "e2e FAIL: app mouse: the client scrolled back on a wheel the app owned"; exit 1; }
191	assert_stopped "$SOCK34" "$D31PID" "app mouse" "$OUT.msestop"	192	assert_stopped "$SOCK34" "$D31PID" "app mouse" "$OUT.msestop"
192	D31PID=""	193	D31PID=""

test/native.sh

Old		New
@@ -160,10 +160,15 @@ EXITPID=$!
160	defer_kill "$EXITPID"	160	defer_kill "$EXITPID"
161	wait_until 100 "named native session attached" '[ "$(attaches_now "$SOCK")" -gt "$attaches_before" ]'	161	wait_until 100 "named native session attached" '[ "$(attaches_now "$SOCK")" -gt "$attaches_before" ]'
162	printf '%s\n' 'text:exit 7' 'key:enter' >&8	162	printf '%s\n' 'text:exit 7' 'key:enter' >&8
163	wait_pid_gone "$EXITPID" "native window follows shell exit"	163	exited_state() {
164	exit_rc=0	164	[ -s "$1" ] \|\| return 1
165	wait "$EXITPID" \|\| exit_rc=$?	165	python3 -c 'import json,sys; p=json.load(open(sys.argv[1]))["panes"][0]; sys.exit(not (p["phase"] == "exited" and p["exit_code"] == 7))' "$1"
166	[ "$exit_rc" -eq 7 ] \|\| { echo "native FAIL: shell exit 7 became $exit_rc"; cat "$OUT.native-exit.log"; exit 1; }	166	}
167	ok "a named native session returns the shell's exit code"	167	wait_until 50 "native pane retains shell exit 7" 'printf "state:%s\n" "$OUT.native-exit.json" >&8; exited_state "$OUT.native-exit.json"'
		168	kill -0 "$EXITPID" \|\| { echo "native FAIL: one exited pane closed the window"; exit 1; }
		169	printf 'quit\n' >&8
		170	wait_pid_gone "$EXITPID" "native window exits after explicit quit"
		171	wait "$EXITPID" \|\| { echo "native FAIL: explicit quit did not detach cleanly"; exit 1; }
		172	ok "a named native session retains its exit code in an open pane until explicit quit"
168		173
169	echo "native OK ($OK_COUNT checkpoints)"	174	echo "native OK ($OK_COUNT checkpoints)"

test/native_tiling.py

@@ @@ -0,0 +1,418 @@ @@
+#!/usr/bin/env python3
+"""Two independent daemons through the native client's real SDL event paths.
+The state hook describes geometry; daemon grids, PTY dimensions, and framebuffer
+pixels independently establish that input and rendering use that geometry.
+"""
+import json
+import os
+from pathlib import Path
+import re
+import shlex
+import signal
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+DEADLINE = 5.0
+def require(condition, message):
+    if not condition:
+        raise AssertionError(message)
+def eventually(probe, message, seconds=DEADLINE):
+    deadline = time.monotonic() + seconds
+    while time.monotonic() < deadline:
+        result = probe()
+        if result:
+            return result
+        time.sleep(0.04)
+    raise AssertionError(message)
+class Rig:
+    def __init__(self, mux, muxg):
+        self.mux, self.muxg = str(Path(mux).resolve()), str(Path(muxg).resolve())
+        self.root = Path(tempfile.mkdtemp(prefix="muxg-tiling-"))
+        self.env = os.environ.copy()
+        # Preserve the compositor address before isolating runtime state.
+        self.env["WAYLAND_DISPLAY"] = str(Path(self.env.get("XDG_RUNTIME_DIR", "/tmp")) /
+                                          self.env.get("WAYLAND_DISPLAY", "wayland-0"))
+        for key in ("XDG_STATE_HOME", "XDG_RUNTIME_DIR", "XDG_CONFIG_HOME", "XDG_CACHE_HOME"):
+            path = self.root / key
+            path.mkdir(mode=0o700)
+            self.env[key] = str(path)
+        self.env["SHELL"] = "/bin/sh"
+        self.env["SDL_VIDEO_DRIVER"] = os.environ.get("MUXG_VIDEODRIVER", "offscreen")
+        self.env.pop("SDL_VIDEODRIVER", None)
+        self.procs, self.logs, self.daemons = [], [], []
+        self.targets = {}
+        self.gui = None
+        self.fd = None
+        self.serial = 0
+        self.checkpoints = 0
+    def spawn(self, argv, label, env=None):
+        log = (self.root / (label + ".log")).open("wb")
+        self.logs.append(log)
+        proc = subprocess.Popen(argv, env=self.env if env is None else env,
+                                stdout=log, stderr=subprocess.STDOUT)
+        self.procs.append(proc)
+        return proc
+    def command(self, *args, check=True):
+        return subprocess.run([self.mux, *args], env=self.env, capture_output=True,
+                              text=True, timeout=3, check=check)
+    def stop_daemon(self, sock, proc):
+        # `mux d stop` waits for its peer PID to disappear. Reap our child while
+        # that command waits, otherwise its zombie keeps the PID alive forever.
+        stop = self.spawn([self.mux, "d", "stop", "--sock", sock], f"stop-{proc.pid}")
+        def reaped():
+            daemon_done = proc.poll() is not None
+            stop_done = stop.poll() is not None
+            return daemon_done and stop_done
+        eventually(reaped, "daemon did not stop and get reaped")
+        require(stop.returncode == 0, "daemon stop command failed")
+    def daemon(self, label, quic=False):
+        sock = str(self.root / (label + ".sock"))
+        env = self.env.copy()
+        home = self.root / (label + "-state")
+        home.mkdir()
+        for key in ("XDG_STATE_HOME", "XDG_RUNTIME_DIR", "XDG_CONFIG_HOME", "XDG_CACHE_HOME"):
+            path = home / key
+            path.mkdir(mode=0o700)
+            env[key] = str(path)
+        args = [self.mux, "d", "start", "--sock", sock]
+        if quic:
+            self.command("d", "keygen")
+            with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as reserve:
+                reserve.bind(("127.0.0.1", 0))
+                port = reserve.getsockname()[1]
+            args += ["--quic", f"127.0.0.1:{port}", "--key",
+                     str(Path(self.env["XDG_CONFIG_HOME"]) / "mux/key")]
+            self.targets[sock] = f"quic://127.0.0.1:{port}"
+        proc = self.spawn(args, label, env)
+        self.daemons.append((sock, proc))
+        eventually(lambda: Path(sock).exists(), label + " daemon did not start")
+        return sock, proc
+    def start_gui(self, first, second, label):
+        fifo = self.root / (label + ".fifo")
+        os.mkfifo(fifo)
+        self.fd = os.open(fifo, os.O_RDWR | os.O_NONBLOCK)
+        self.env["MUXG_TEST_FIFO"] = str(fifo)
+        self.gui_log = self.root / (label + ".log")
+        self.gui = self.spawn([self.muxg, "--sock", first, "--session", "left",
+                               "--next-target", self.targets.get(second, "--sock " + second),
+                               "--next-session", "right"], label)
+        return self.wait_state(lambda s: len(s["panes"]) == 1 and
+                               s["panes"][0]["phase"] == "attached")
+    def send(self, *lines):
+        require(self.gui.poll() is None, "GUI exited unexpectedly")
+        data = ("\n".join(lines) + "\n").encode()
+        require(os.write(self.fd, data) == len(data), "short FIFO write")
+    def key(self, name):
+        self.send("key:" + name)
+    def chord(self, key):
+        self.send("key:prefix", "key:" + key)
+    def shell(self, command):
+        self.send("text:" + command, "key:enter")
+    def artifact(self, command, suffix):
+        self.serial += 1
+        path = self.root / (str(self.serial) + suffix)
+        self.send(command + ":" + str(path))
+        eventually(lambda: path.exists() or self.gui.poll() is not None,
+                   "GUI did not produce " + command)
+        require(path.exists(), "GUI exited while producing " + command)
+        return path
+    def state(self):
+        return json.loads(self.artifact("state", ".json").read_text())
+    def wait_state(self, predicate):
+        def probe():
+            state = self.state()
+            return state if predicate(state) else None
+        return eventually(probe, "GUI state did not converge")
+    def pixels(self):
+        raw = self.artifact("capture", ".ppm").read_bytes()
+        magic, dims, maximum, pixels = raw.split(b"\n", 3)
+        require(magic == b"P6" and maximum == b"255", "invalid framebuffer capture")
+        width, height = map(int, dims.split())
+        require(len(pixels) == width * height * 3, "truncated framebuffer capture")
+        return width, height, pixels
+    def dump(self, sock, session):
+        return self.command("d", "dump", "--sock", sock, "--session", session,
+                            check=False).stdout
+    def wait_marker(self, sock, session, marker):
+        eventually(lambda: marker in self.dump(sock, session), marker + " did not reach grid")
+    def status(self, sock, session):
+        return json.loads(self.command("a", "status", "--sock", sock,
+                                       "--session", session, "--timeout", "2000").stdout)
+    def frames(self):
+        before = self.gui_log.read_text().count("\ntotal ")
+        self.gui.send_signal(signal.SIGUSR1)
+        def fresh():
+            text = self.gui_log.read_text()
+            return text if text.count("\ntotal ") > before else None
+        report = eventually(fresh, "no fresh completed frame report")
+        count = int(re.findall(r"timing \((\d+) frames\)", report)[-1])
+        p99 = int(re.findall(r"^total\s+\d+\s+\d+\s+(\d+)", report, re.M)[-1])
+        return count, p99
+    def quit(self):
+        self.send("quit")
+        require(self.gui.wait(timeout=3) == 0, "GUI failed to detach cleanly")
+        os.close(self.fd)
+        self.fd = None
+        self.gui = None
+    def ok(self, message):
+        self.checkpoints += 1
+        print(f"tiling OK ({self.checkpoints}): {message}", flush=True)
+    def close(self):
+        if self.gui is not None and self.gui.poll() is None:
+            self.gui.terminate()
+        for sock, proc in self.daemons:
+            if proc.poll() is None:
+                try:
+                    self.stop_daemon(sock, proc)
+                except (subprocess.TimeoutExpired, AssertionError):
+                    proc.terminate()
+        for proc in self.procs:
+            if proc.poll() is None:
+                proc.terminate()
+                try:
+                    proc.wait(timeout=3)
+                except subprocess.TimeoutExpired:
+                    proc.kill()
+                    proc.wait(timeout=3)
+        if self.fd is not None:
+            os.close(self.fd)
+        for log in self.logs:
+            log.close()
+def rect_contains(rect, x, y):
+    return rect["x"] <= x < rect["x"] + rect["w"] and rect["y"] <= y < rect["y"] + rect["h"]
+def colour_counts(capture, rect, colour):
+    width, height, pixels = capture
+    inside = outside = 0
+    for offset in range(0, len(pixels), 3):
+        r, g, b = pixels[offset:offset + 3]
+        if colour == "red":
+            hit = r > 80 and r > g * 2 and r > b * 2
+        elif colour == "green":
+            hit = g > 80 and g > r * 2 and g > b * 2
+        else:
+            hit = b > 80 and b > r * 2 and b > g * 2
+        if hit:
+            y, x = divmod(offset // 3, width)
+            if rect_contains(rect, x, y):
+                inside += 1
+            else:
+                outside += 1
+    return inside, outside
+def check_geometry(rig, state, first, second, axis):
+    a, b = state["panes"]
+    ar, br = a["outer"], b["outer"]
+    size_axis, pos_axis = ("w", "x") if axis == "v" else ("h", "y")
+    require(abs(ar[size_axis] - br[size_axis]) <= 1, "split did not divide the armed pane equally")
+    require(br[pos_axis] >= ar[pos_axis] + ar[size_axis], "panes overlap")
+    for pane, sock, session in ((a, first, "left"), (b, second, "right")):
+        content = pane["content"]
+        cols = content["w"] // state["cell_w"]
+        rows = content["h"] // state["cell_h"]
+        require(cols >= 2 and rows >= 1, "invalid terminal footprint")
+        require((pane["cols"], pane["rows"]) == (cols, rows), "GUI cell sizing differs from physical content")
+        eventually(lambda: (lambda s: (s["cols"], s["rows"]) == (cols, rows))(rig.status(sock, session)),
+                   "daemon did not receive its pane's physical size")
+def normal_scenario(rig, axis):
+    first, _ = rig.daemon("first-" + axis)
+    second, second_proc = rig.daemon("second-" + axis, quic=axis == "b")
+    if axis == "v":
+        for flags in (("--next-target", "box"), ("--next-session", "right"),
+                      ("--next-target", "box", "--next-session", "bad name"),
+                      ("--next-target", "box", "--next-target", "other", "--next-session", "right")):
+            result = subprocess.run([rig.muxg, "--sock", first, *flags], env=rig.env,
+                                    capture_output=True, timeout=3)
+            require(result.returncode == 2, "invalid staged-target arguments were accepted")
+        rig.ok("staged target arguments reject missing partners, invalid sessions and repeated targets")
+    before = rig.start_gui(first, second, "gui-" + axis)
+    rig.chord(axis)
+    armed = rig.state()
+    require(len(armed["panes"]) == 1 and armed["panes"][0]["outer"] == before["panes"][0]["outer"],
+            "arming split changed geometry")
+    stats = rig.command("d", "stats", "--sock", second).stdout
+    require(re.search(r"\battaches=0\b", stats),
+            "staged target attached before insertion: " + stats)
+    # Daemons may start a default session themselves. The staged named session
+    # must still be absent, and this observer query cannot create one.
+    require(rig.command("a", "status", "--sock", second, "--session", "right",
+                        "--timeout", "200", check=False).returncode != 0,
+            "staged named session exists before insertion")
+    rig.chord("escape")
+    require(len(rig.state()["panes"]) == 1, "cancel inserted a pane")
+    rig.chord(axis)
+    rig.chord("enter")
+    state = rig.wait_state(lambda s: len(s["panes"]) == 2 and all(p["phase"] == "attached" for p in s["panes"]))
+    check_geometry(rig, state, first, second, axis)
+    transport = "Unix + QUIC" if axis == "b" else "two Unix sockets"
+    rig.ok(axis + " split over " + transport + "; both PTYs have exact pane sizes")
+    rig.shell("printf '\\033[2J\\033[H\\033[38;2;0;255;0mRIGHT-%s\\033[0m\\n' MARK")
+    rig.wait_marker(second, "right", "RIGHT-MARK")
+    require("RIGHT-MARK" not in rig.dump(first, "left"), "right input leaked into left pane")
+    rig.chord("h" if axis == "v" else "k")
+    rig.shell("printf '\\033[2J\\033[H\\033[31mLEFT-%s\\033[0m\\n' MARK")
+    rig.wait_marker(first, "left", "LEFT-MARK")
+    require("LEFT-MARK" not in rig.dump(second, "right"), "left input leaked into right pane")
+    state = rig.state()
+    def correct_pixels():
+        pixels = rig.pixels()
+        red = colour_counts(pixels, state["panes"][0]["content"], "red")
+        green = colour_counts(pixels, state["panes"][1]["content"], "green")
+        return red[0] > 30 and green[0] > 30 and red[1] == green[1] == 0
+    eventually(correct_pixels, "coloured glyphs missing or spill into another pane")
+    rig.ok("focus routes input independently and framebuffer regions contain only their own coloured glyphs")
+    rig.send("resize:640x400")
+    state = rig.wait_state(lambda s: (s["width"], s["height"]) == (640, 400))
+    check_geometry(rig, state, first, second, axis)
+    eventually(correct_pixels, "resized framebuffer lost or misplaced pane content")
+    # Clear red content after shrinking; the other pane's green text must survive.
+    rig.shell("printf '\\033[2J\\033[H'")
+    def cleared():
+        pixels = rig.pixels()
+        red = colour_counts(pixels, state["panes"][0]["content"], "red")
+        green = colour_counts(pixels, state["panes"][1]["content"], "green")
+        return sum(red) == 0 and green[0] > 30 and green[1] == 0
+    eventually(cleared, "clear/shrink left old pixels or erased a neighbour")
+    # Click uses logical coordinates; offscreen is 100%, Wayland checked separately.
+    content = state["panes"][1]["content"]
+    rig.send(f"click:{content['x'] + content['w']//2},{content['y'] + content['h']//2}")
+    rig.shell("printf 'CLICK-%s\\n' RIGHT")
+    rig.wait_marker(second, "right", "CLICK-RIGHT")
+    require("CLICK-RIGHT" not in rig.dump(first, "left"), "click focus routed to wrong pane")
+    rig.ok("window resize, neighbour-safe clearing, and mouse focus work")
+    if axis == "v":
+        rig.shell("stty -echo -icanon min 1 time 0; printf 'RAW-%s\\n' READY; "
+                  "od -An -tx1 -N2; stty sane; printf 'RAW-%s\\n' DONE")
+        rig.wait_marker(second, "right", "RAW-READY")
+        rig.send("key:prefix", "key:prefix", "text:A")
+        rig.wait_marker(second, "right", "RAW-DONE")
+        require("00 41" in rig.dump(second, "right"), "prefix passthrough did not send one NUL then A")
+        rig.ok("double prefix sends the terminal encoding exactly once; ordinary input follows")
+        # A bounded flood with an external stop signal. During the frame-count
+        # interval only nonforcing state observations are allowed, never captures.
+        stop = rig.root / "stop-flood"
+        progress = rig.root / "flood-progress"
+        rig.chord("h")
+        flood = (f"i=0; while [ $i -lt 4096 ] && [ ! -e {shlex.quote(str(stop))} ]; do "
+                 "head -c 262144 /dev/zero | tr '\\000' X; "
+                 f"i=$((i+1)); echo $i > {shlex.quote(str(progress))}; done; echo FLOOD-DONE")
+        rig.shell(flood)
+        eventually(lambda: progress.exists() and progress.stat().st_size > 0, "flood did not start")
+        count1, _ = rig.frames()
+        rig.chord("l")
+        started = time.monotonic()
+        rig.shell("printf '\\033[38;2;0;0;255mRESPONSIVE-%s\\033[0m\\n' RIGHT")
+        rig.wait_marker(second, "right", "RESPONSIVE-RIGHT")
+        # State observes the last completed frame and must not itself request a
+        # repaint. This detects B staying visually stale while A keeps painting.
+        rig.wait_state(lambda s: "RESPONSIVE-RIGHT" in s["panes"][1]["painted_text"])
+        latency = time.monotonic() - started
+        time.sleep(0.3)
+        require("FLOOD-DONE" not in rig.dump(first, "left"), "flood ended before concurrent check")
+        count2, p99 = rig.frames()
+        require(colour_counts(rig.pixels(), state["panes"][1]["content"], "blue")[0] > 30,
+                "new responsive marker was not rendered in the other pane")
+        stop.touch()
+        rig.wait_marker(first, "left", "FLOOD-DONE")
+        require(count2 > count1, "no frames painted while output flooded")
+        require(latency < DEADLINE and p99 < 20000, f"flood isolation exceeded budget: {latency}s / {p99}us")
+        rig.ok(f"flood leaves other pane responsive ({latency*1000:.0f} ms input-to-frame, {p99} us frame p99)")
+        # Disconnect one daemon while the other continues accepting input.
+        rig.stop_daemon(second, second_proc)
+        rig.wait_state(lambda s: s["panes"][1]["phase"] != "attached")
+        rig.chord("h")
+        rig.shell("printf 'SURVIVOR-%s\\n' OK")
+        rig.wait_marker(first, "left", "SURVIVOR-OK")
+        rig.ok("a disconnected daemon cannot take down the other pane")
+    else:
+        rig.shell("exit 7")
+        rig.wait_state(lambda s: s["panes"][1]["phase"] == "exited" and s["panes"][1]["exit_code"] == 7)
+        rig.chord("k")
+        rig.shell("printf 'AFTER-EXIT-%s\\n' OK")
+        rig.wait_marker(first, "left", "AFTER-EXIT-OK")
+        rig.ok("shell exit is retained in its pane while its neighbour remains usable")
+    rig.quit()
+    require(("SURVIVOR-OK" if axis == "v" else "AFTER-EXIT-OK") in rig.dump(first, "left"),
+            "window close ended or replaced the surviving session")
+    rig.ok("closing the window preserves the surviving daemon session")
+def unavailable_scenario(rig):
+    first, _ = rig.daemon("first-unavailable")
+    missing = str(rig.root / "missing.sock")
+    rig.start_gui(first, missing, "gui-unavailable")
+    rig.chord("v")
+    rig.chord("enter")
+    rig.wait_state(lambda s: len(s["panes"]) == 2 and s["panes"][1]["phase"] in ("dial_failed", "failed", "reconnecting"))
+    rig.chord("h")
+    rig.shell("printf 'OFFLINE-NEIGHBOUR-%s\\n' OK")
+    rig.wait_marker(first, "left", "OFFLINE-NEIGHBOUR-OK")
+    rig.send("resize:8x8")
+    state = rig.wait_state(lambda s: s["width"] == 8 and s["height"] == 8)
+    require(len(state["panes"]) == 2 and all(p["cols"] > 0 and p["rows"] > 0 for p in state["panes"]),
+            "tiny window destroyed panes or sent invalid sizes")
+    rig.quit()
+    rig.ok("initially unreachable target stays local to its pane; tiny window and shutdown remain safe")
+def main():
+    rig = Rig(*sys.argv[1:3])
+    try:
+        version = subprocess.check_output([rig.muxg, "--version"], text=True)
+        require("ReleaseSafe" in version or "ReleaseFast" in version, "native tiling requires a release build")
+        for axis in ("v", "b"):
+            normal_scenario(rig, axis)
+        unavailable_scenario(rig)
+        print(f"native tiling OK ({rig.checkpoints} checkpoints); artifacts: {rig.root}")
+    except BaseException:
+        print("Native tiling failure artifacts:", rig.root, file=sys.stderr)
+        for path in rig.root.glob("gui*.log"):
+            print(path.name + ":\n" + path.read_text()[-2000:], file=sys.stderr)
+        raise
+    finally:
+        rig.close()
+if __name__ == "__main__":
+    main()

Old		New
@@ -17,7 +17,7 @@ make build test e2e # Makefile already points at it
17	make check # fmt + unit tests + shell syntax + comment-claim refs — pre-commit gate	17	make check # fmt + unit tests + shell syntax + comment-claim refs — pre-commit gate
18	make ci # check + e2e + agent + throughput — the delivery gate	18	make ci # check + e2e + agent + throughput — the delivery gate
19	make agent soak bench throughput	19	make agent soak bench throughput
20	make native native-e2e # opt-in muxg viewer; system SDL3/freetype/fontconfig/HarfBuzz + GL headers, never in ci	20	make native native-e2e # opt-in muxg; SDL3/freetype/fontconfig/HarfBuzz + GL headers; e2e also needs python3
21	make vm # real user journeys against the mux-e2e VM (test/vm.sh)	21	make vm # real user journeys against the mux-e2e VM (test/vm.sh)
22	make mac xos # macOS journeys (test/mac.sh); the cross-OS gate (test/xos.sh).	22	make mac xos # macOS journeys (test/mac.sh); the cross-OS gate (test/xos.sh).
23	# Both take their boxes BY NAME and have no default	23	# Both take their boxes BY NAME and have no default
@@ -79,7 +79,7 @@ a symbol by its FILE stem (`wall_pump.askOn`) — a file, not a module.
79	\| `src/engine/` \| `term`(`term.zig`) — `protocol` `replica` `grid` · `engine`(`engine.zig`) — `delta` — the daemon's ghostty-vt; no client row imports it outside a test \|	79	\| `src/engine/` \| `term`(`term.zig`) — `protocol` `replica` `grid` · `engine`(`engine.zig`) — `delta` — the daemon's ghostty-vt; no client row imports it outside a test \|
80	\| `src/server/` \| `daemon`(`server.zig`) — `server_agent` `server_sessions` `cmd` `shellint` `quic_server` `upgrade` `server_test_*` · `pty` \|	80	\| `src/server/` \| `daemon`(`server.zig`) — `server_agent` `server_sessions` `cmd` `shellint` `quic_server` `upgrade` `server_test_*` · `pty` \|
81	\| `src/client/` \| `client` — `client_core` `hosts` `handoff` `layout` `keymap` `askpass` `session_pump` · `webhub` · `wasm_core` `client_core_wasm_check` (wasm roots the build wires outside the table) \|	81	\| `src/client/` \| `client` — `client_core` `hosts` `handoff` `layout` `keymap` `askpass` `session_pump` · `webhub` · `wasm_core` `client_core_wasm_check` (wasm roots the build wires outside the table) \|
82	\| `src/gui/` \| `native`(`native.zig`) — `font` `atlas` `quads` `gl` `frame` `bench` \|	82	\| `src/gui/` \| `native`(`native.zig`) — `workspace` `runtime` `font` `atlas` `quads` `gl` `frame` `bench` \|
83	\| `src/tui/` \| `wall`(`wallview.zig`) — `interact` `paint` `select` `predict` `wall_host` `wall_picker` `wall_pump` `wall_layout` `wall_test_*` \|	83	\| `src/tui/` \| `wall`(`wallview.zig`) — `interact` `paint` `select` `predict` `wall_host` `wall_picker` `wall_pump` `wall_layout` `wall_test_*` \|
84	\| `src/cli/` \| `mux`(dispatch) — `main`(daemon) `mux_main`(client) `webhub_main`(hub) · `muxg`(native viewer) · `agent`(`muxa.zig`) · `cliflags`(`flags.zig`) \|	84	\| `src/cli/` \| `mux`(dispatch) — `main`(daemon) `mux_main`(client) `webhub_main`(hub) · `muxg`(native viewer) · `agent`(`muxa.zig`) · `cliflags`(`flags.zig`) \|
85	\| `src/os/` \| `server_os`(`server_os.zig`) — `server_os_linux` `server_os_macos` · `client_os`(`client_os.zig`) — `client_os_linux` `client_os_macos` · `spawn` — the platform layer, one row per side so the client never links a fork or a pty; imports nothing of ours (spec 2026-09-03) \|	85	\| `src/os/` \| `server_os`(`server_os.zig`) — `server_os_linux` `server_os_macos` · `client_os`(`client_os.zig`) — `client_os_linux` `client_os_macos` · `spawn` — the platform layer, one row per side so the client never links a fork or a pty; imports nothing of ours (spec 2026-09-03) \|
@@ -117,7 +117,7 @@ the OS for a terminal is platform code, and rule 4 forbids a client module
117	from doing it.	117	from doing it.
118		118
119	Rules 5, 6 and 7 also cover `src/gui/`. Rule 8 keeps multi-session policy	119	Rules 5, 6 and 7 also cover `src/gui/`. Rule 8 keeps multi-session policy
120	out of that folder. Rule 9 confines SDL to `src/gui/frame.zig`; the separate	120	independent of terminal wall policy and persistence. Rule 9 confines SDL to `src/gui/frame.zig`; the separate
121	entry `src/cli/muxg.zig` may also use it. Everything else in the painter is	121	entry `src/cli/muxg.zig` may also use it. Everything else in the painter is
122	unit-tested without opening a window.	122	unit-tested without opening a window.
123		123
@@ -133,7 +133,7 @@ own. Test fixtures in `test/`:
133	`ptyclient` (real client on a real pty), `wsclient` (browser stand-in),	133	`ptyclient` (real client on a real pty), `wsclient` (browser stand-in),
134	`rawmode`, `delaypipe`, `render` — those stay separate binaries.	134	`rawmode`, `delaypipe`, `render` — those stay separate binaries.
135	The opt-in second product binary is `muxg`, a dynamically linked window on	135	The opt-in second product binary is `muxg`, a dynamically linked window on
136	one session; it is built only by the native steps and is never installed by	136	native session panes; it is built only by the native steps and is never installed by
137	`make install` or included in `ci`.	137	`make install` or included in `ci`.
138		138
139	## Invariants — do not break, they are load-bearing	139	## Invariants — do not break, they are load-bearing