ff52fa6d

test: 13_birth moves to a file of its own

a73x 2026-08-26 19:18

Commit message

test: 13_birth moves to a file of its own

a tile born by spelling, and the saved line that comes back — 5 scenarios, 710 lines. The legs move unedited; the runner
sources the file where they used to stand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test/e2e.sh

Old		New
@@ -102,7 +102,7 @@ done
102	E2E_DIR=$(dirname "$0")	102	E2E_DIR=$(dirname "$0")
103	. "$E2E_DIR/e2e_lib.sh"	103	. "$E2E_DIR/e2e_lib.sh"
104		104
105	E2E_GROUPS='01_boot 02_predict 03_side 04_handoff 05_session 06_web 07_wallcli 08_mouse 09_wallhist 10_agent 11_select 12_panes'	105	E2E_GROUPS='01_boot 02_predict 03_side 04_handoff 05_session 06_web 07_wallcli 08_mouse 09_wallhist 10_agent 11_select 12_panes 13_birth'
106	# The groups that cannot stand alone, and what they need. E2E_ONLY refuses	106	# The groups that cannot stand alone, and what they need. E2E_ONLY refuses
107	# these by name rather than running them: a group whose fixtures are	107	# these by name rather than running them: a group whose fixtures are
108	# missing does not fail, it passes having tested something else — and a	108	# missing does not fail, it passes having tested something else — and a
@@ -145,713 +145,6 @@ for _g in $E2E_GROUPS; do
145	. "$E2E_DIR/e2e_$_g.sh"	145	. "$E2E_DIR/e2e_$_g.sh"
146	done	146	done
147		147
148	# The hydrated-create leg. One daemon, and it serves QUIC as well as its
149	# socket: the leg's whole point is the LOCAL/remote split, so both halves
150	# have to be the same run of the same daemon or the comparison is between
151	# two rigs rather than between two kinds of line. Short socket name on
152	# purpose — the assertion reads a label bar back off a 70-column render.
153	SOCK64="${TMPDIR:-/tmp}/muxd-e2e-hyd-$$.sock"
154	defer_sock "$SOCK64"
155	# Base 6000, below the 5000-spaced band the other QUIC ports share: every
156	# base from 11000 up is already taken, and a DUPLICATED base passes only
157	# for as long as the other leg's daemon happens to be dead by the time
158	# this one binds. A collision reads as this daemon's failure, not the
159	# suite's, which is why the base has to be the leg's own.
160	HYPORT=$(( 6000 + ($$ % 4000) ))
161	HYKEY="${TMPDIR:-/tmp}/mux-e2e-hydkey-$$"
162	defer_rm "$HYKEY"
163	HYSTATE="${TMPDIR:-/tmp}/mux-e2e-hyd-state-$$"
164	defer_rm "$HYSTATE"
165	HYWALL="$HYSTATE/mux/wall"
166	# The refused-attach leg: its own daemon, because its assertions are about
167	# what a daemon says to a name it does NOT have, and a socket shared with
168	# another leg would let that leg's sessions decide what "does not have"
169	# means.
170	SOCK66="${TMPDIR:-/tmp}/muxd-e2e-refuse-$$.sock"
171	defer_sock "$SOCK66"
172	REFSTATE="${TMPDIR:-/tmp}/mux-e2e-refuse-state-$$"
173	defer_rm "$REFSTATE"
174	# The browser half of the same ruling: one daemon serving a socket AND a
175	# QUIC listener, one hub, a state home of its own. Two ports, and the
176	# 5000-spaced bands are exhausted — 61000 is the last one that fits under
177	# 65535 — so this leg takes the tail ABOVE the ephemeral range
178	# (ip_local_port_range tops out at 60999 by default), halved. The narrow
179	# `%250` is the price of that tail: two runs whose pids differ by 250
180	# collide where the older bands need 4000. A collision reads as this leg's
181	# daemon failing to bind, which is also why the two halves cannot share a
182	# base.
183	SOCK67="${TMPDIR:-/tmp}/muxd-e2e-wg-$$.sock"
184	defer_sock "$SOCK67"
185	WGPORT=$(( 65000 + ($$ % 250) ))
186	WGQPORT=$(( 65250 + ($$ % 250) ))
187	WGKEY="${TMPDIR:-/tmp}/mux-e2e-wgkey-$$"
188	defer_rm "$WGKEY"
189	WGSTATE="${TMPDIR:-/tmp}/mux-e2e-wg-state-$$"
190	defer_rm "$WGSTATE"
191	WGWALL="$WGSTATE/mux/wall"
192	# The refusal-spin leg. Its own everything: a shim dir on PATH, a state
193	# home holding the wall it restores, and a dial log the shim appends to.
194	SOCK68="${TMPDIR:-/tmp}/muxd-e2e-sp-$$.sock"
195	defer_sock "$SOCK68"
196	SPPORT=$(( 26000 + ($$ % 4000) ))
197	SPSTATE="${TMPDIR:-/tmp}/mux-e2e-sp-state-$$"
198	defer_rm "$SPSTATE"
199	SPDIR="${TMPDIR:-/tmp}/mux-e2e-sp-shim-$$"
200	defer_rm "$SPDIR"
201	SPINLOG="$SPDIR/dials"
202
203	# ---- Ctrl-\ : adds a tile by spelling ---------------------------------
204	#
205	# Argv typed from inside. A spelling naming a session on ANOTHER daemon
206	# is born beside the focus, creates that session there, takes the focus,
207	# and is recorded into the wall file — mux TARGET's row of the birth
208	# table, without leaving the wall. A bad spelling is a notice and
209	# nothing else (the file does not grow). Esc eats the line: the shell
210	# never sees it, and the next keys reach the session again.
211	#
212	# The prompt echoes what is typed, so the born tile's witness is not its
213	# label on the capture (the echo would match) but a marker typed AFTER
214	# the birth landing in daemon B's session b — a hit is B's shell's work.
215	PRSTATE="${TMPDIR:-/tmp}/mux-e2e-prompt-state-$$"
216	defer_rm "$PRSTATE"
217	PRWALL="$PRSTATE/mux/wall"
218	start_daemon "$SOCK62" "$OUT.pra.d" "prompt daemon A never bound" --shell /bin/sh
219	D63PID=$DPID
220	start_daemon "$SOCK63" "$OUT.prb.d" "prompt daemon B never bound" --shell /bin/sh
221	D64PID=$DPID
222
223	pipe_mux "$OUT.pra" "$OUT.pra.err" timeout 40 "$MUX" --sock "$SOCK62" --session a
224	pipe_send 'printf "pr-%%s\\n" origin\n'
225	await_out "$OUT.pra" "pr-origin" "prompt: session a marker never reached the client"
226	pipe_detach
227	wait_grid "$SOCK62" "pr-origin" "prompt: session a marker" a
228
229	mkdir -p "$PRSTATE/mux"
230	printf -- '--sock %s#a\n' "$SOCK62" > "$PRWALL"
231
232	# The spelling goes in TWO sends with a settle between: the prompt paints
233	# its echo when a read ENDS with the prompt still open, so a spelling that
234	# arrives in the same read as its own \r paints nothing to assert on. The
235	# separating space is \x20 because parseLine trims a payload's trailing one.
236	set +e
237	XDG_STATE_HOME="$PRSTATE" timeout 90 "$PTYCLIENT" --cols 100 --rows 30 \
238	--out "$OUT.prcap" --err "$OUT.prcap.err" -- \
239	"$MUX" wall > "$OUT.prpc" 2>&1 <<EOF
240	expect pr-origin 20000
241	settle 700 20000
242	send \x1c:--sock\x20
243	settle 300 5000
244	send $SOCK63#b\r
245	settle 1000 20000
246	send printf 'pr-born-%s\n' marker\n
247	expect pr-born-marker 15000
248	send \x1c:x#bad name\r
249	expect [bad target 10000
250	settle 500 15000
251	send \x1c:-A nosuchhost.invalid\r
252	expect FlagLikeTarget 10000
253	settle 500 15000
254	send \x1c:zzz\x1b
255	settle 500 15000
256	send printf 'pr-after-%s\n' esc\n
257	expect pr-after-esc 10000
258	settle 500 15000
259	send \x1cd
260	waitexit 10000
261	EOF
262	RC=$?
263	set -e
264	[ "$RC" -eq 0 ] \|\| {
265	echo "e2e FAIL: prompt: ptyclient leg exited $RC (did \\x1c: add the tile?):"
266	cat "$OUT.prpc" "$OUT.prcap.err"; exit 1; }
267	# The oracle, not the byte stream: a banner LEFT on the screen is invisible
268	# to a grep of the emitted bytes — the `: zzz` that painted is in the
269	# capture either way. Only the render's final grid says what the human was
270	# still looking at when the wall came down.
271	"$RENDER" --cols 100 --rows 30 < "$OUT.prcap" > "$OUT.prgrid" \|\| {
272	echo "e2e FAIL: prompt: render oracle failed"
273	cat "$OUT.prgrid"; exit 1; }
274	grep -q ": zzz" "$OUT.prgrid" && {
275	echo "e2e FAIL: prompt: the Esc'd prompt is still on the screen:"
276	cat "$OUT.prgrid"; exit 1; }
277	grep -q "pr-after-esc" "$OUT.prgrid" \|\| {
278	echo "e2e FAIL: prompt: the tile's content did not come back after Esc:"
279	cat "$OUT.prgrid"; exit 1; }
280	# argv's refusal, at argv's other mouth: `-A host` is a mistyped flag and
281	# never becomes a tile for a host named `-A`. The bar is the witness — a
282	# born tile paints its spelling and a state word beside it, and the host
283	# here resolves nowhere, so the tile would sit there saying [refused].
284	grep -q -- "-A nosuchhost.invalid \[" "$OUT.prgrid" && {
285	echo "e2e FAIL: prompt: a flag-like spelling became a tile:"
286	cat "$OUT.prgrid"; exit 1; }
287	# The prompt is a line the typist can read back: -a because the capture is
288	# a terminal stream, escape bytes and all.
289	grep -aq ": --sock " "$OUT.prcap" \|\| {
290	echo "e2e FAIL: prompt: the prompt line never painted its echo:"
291	cat "$OUT.prpc"; exit 1; }
292	# Born on daemon B, focused: the marker typed after the birth is in B's
293	# session b, and so are the keys typed after the Esc.
294	timeout 20 "$MUXA" capture --sock "$SOCK63" --session b > "$OUT.prfb" 2>&1
295	grep -q "pr-born-marker" "$OUT.prfb" \|\| {
296	echo "e2e FAIL: prompt: marker not in daemon B's session b (tile not born there, or not focused):"
297	cat "$OUT.prfb"; exit 1; }
298	grep -q "pr-after-esc" "$OUT.prfb" \|\| {
299	echo "e2e FAIL: prompt: keys after Esc never reached session b (prompt did not close):"
300	cat "$OUT.prfb"; exit 1; }
301	grep -q "zzz" "$OUT.prfb" && {
302	echo "e2e FAIL: prompt: Esc leaked the line into the shell:"
303	cat "$OUT.prfb"; exit 1; }
304	# Recorded, and only the accepted spelling: two lines, the born one among them.
305	grep -qF -- "--sock $SOCK63#b" "$PRWALL" \|\| {
306	echo "e2e FAIL: prompt: the born tile was not recorded:"
307	cat "$PRWALL"; exit 1; }
308	[ "$(grep -c . "$PRWALL")" = "2" ] \|\| {
309	echo "e2e FAIL: prompt: wall file is not exactly two lines (a refused spelling recorded?):"
310	cat "$PRWALL"; exit 1; }
311	assert_stopped "$SOCK62" "$D63PID" "prompt A" "$OUT.prastop"
312	D63PID=""
313	assert_stopped "$SOCK63" "$D64PID" "prompt B" "$OUT.prbstop"
314	D64PID=""
315	rm -rf "$PRSTATE"
316	ok "Ctrl-\\ : adds a tile by spelling: born on another daemon, recorded, refusals narrated, Esc eats the line"
317
318	# ---- a saved local line comes back as a fresh session -------------------
319	#
320	# The wall file is attach history, and the daemon that held those sessions
321	# dies on every reboot. Joining only meant the wall came back as a grid of
322	# [refused] tiles nobody could do anything with but forget them by hand.
323	# A restored line naming the LOCAL socket now attaches-or-creates.
324	#
325	# The remote half is the same wall, the same run and the same daemon,
326	# reached the other way: a `quic://` line for a session that does not
327	# exist stays [refused] and creates nothing. Recreating a shell on your
328	# own box is cheap and expected; spawning one on another host out of a
329	# saved file is not, and the split is the whole ruling.
330	#
331	# Daemon truth, not paint, answers "was it created": `muxa status` on a
332	# name the daemon does not have exits non-zero, which is the same probe
333	# the leg runs BEFORE the wall so it cannot pass vacuously. The render
334	# oracle answers the other question — what the human was looking at —
335	# because a bar left saying [refused] is invisible to a grep of the
336	# emitted bytes.
337	#
338	# Both roads a restored line can take are here, because they are two call
339	# sites of the one rule: the no-argv `mux wall` below runs the startup tile
340	# loop, and the `Ctrl-\ w` half at the end of this leg runs `hydrate()`.
341	head -c 32 /dev/urandom > "$HYKEY"
342	chmod 600 "$HYKEY"
343	start_daemon "$SOCK64" "$OUT.hyd.d" "hydrate-create daemon never bound" --shell /bin/sh \
344	--quic "127.0.0.1:$HYPORT" --key "$HYKEY" --quic-idle-ms 15000
345	D65PID=$DPID
346
347	# The wall file names three sessions this daemon does not have. Written by
348	# hand rather than earned by an attach, because an attach that earned the
349	# line would also have created the session — and then there would be
350	# nothing for the restore to create.
351	mkdir -p "$HYSTATE/mux"
352	printf -- '--sock %s#hya\n--sock %s#hyb\nquic://127.0.0.1:%s#hyghost\n' \
353	"$SOCK64" "$SOCK64" "$HYPORT" > "$HYWALL"
354
355	# Vacuity guard: none of the three exists yet. A leg whose daemon already
356	# had them would pass without the restore creating anything.
357	for _hy in hya hyb hyghost; do
358	timeout 20 "$MUXA" status --sock "$SOCK64" --session "$_hy" > "$OUT.hydpre" 2>&1 && {
359	echo "e2e FAIL: hydrate-create: session $_hy existed before the wall ran:"
360	cat "$OUT.hydpre"; exit 1; }
361	done
362
363	# 70x36: under the aspect rule (70 < 2*36) the cut is stacked, so each of
364	# the three tiles gets the full width and its label bar survives the
365	# render intact — the socket path is in that label.
366	set +e
367	XDG_STATE_HOME="$HYSTATE" timeout 90 "$PTYCLIENT" --cols 70 --rows 36 \
368	--out "$OUT.hydcap" --err "$OUT.hydcap.err" -- \
369	"$MUX" wall --key "$HYKEY" > "$OUT.hydpc" 2>&1 <<'EOF'
370	expect [up] 25000
371	settle 1000 25000
372	send printf 'hyd-%s\n' marker\n
373	expect hyd-marker 15000
374	settle 600 15000
375	send \x1cd
376	waitexit 10000
377	EOF
378	RC=$?
379	set -e
380	[ "$RC" -eq 0 ] \|\| {
381	echo "e2e FAIL: hydrate-create: ptyclient exited $RC:"
382	cat "$OUT.hydpc" "$OUT.hydcap.err"; exit 1; }
383
384	# The local lines created their sessions, at the width of the stripe that
385	# created them. The width does not discriminate create from join on its own
386	# (a join's resize doorbell lands at 70 too, and the daemon refuses a create
387	# under min_session_cols) — the muxa exit code above is what says created.
388	# It is here to catch a session that came up at some OTHER client's size.
389	timeout 20 "$MUXA" status --sock "$SOCK64" --session hya > "$OUT.hydsta" 2>&1 \|\| {
390	echo "e2e FAIL: hydrate-create: the saved line for hya did not create it:"
391	cat "$OUT.hydsta"; exit 1; }
392	grep -q '"cols":70' "$OUT.hydsta" \|\| {
393	echo "e2e FAIL: hydrate-create: hya exists but not at the tile's width:"
394	cat "$OUT.hydsta"; exit 1; }
395	timeout 20 "$MUXA" status --sock "$SOCK64" --session hyb > "$OUT.hydstb" 2>&1 \|\| {
396	echo "e2e FAIL: hydrate-create: the saved line for hyb did not create it:"
397	cat "$OUT.hydstb"; exit 1; }
398
399	# ...and the created session runs a real shell: the marker typed into the
400	# focused tile (tile 0, the first wall line) is the shell's own work.
401	timeout 20 "$MUXA" capture --sock "$SOCK64" --session hya > "$OUT.hydfa" 2>&1
402	grep -q "hyd-marker" "$OUT.hydfa" \|\| {
403	echo "e2e FAIL: hydrate-create: the marker never reached the created session:"
404	cat "$OUT.hydfa"; exit 1; }
405
406	# The remote line created NOTHING. Same daemon, same run, same file — only
407	# the spelling differs.
408	timeout 20 "$MUXA" status --sock "$SOCK64" --session hyghost > "$OUT.hydghost" 2>&1 && {
409	echo "e2e FAIL: hydrate-create: a quic:// wall line created a session:"
410	cat "$OUT.hydghost"; exit 1; }
411
412	# What the human saw: two tiles up, the remote one still refused.
413	"$RENDER" --cols 70 --rows 36 < "$OUT.hydcap" > "$OUT.hydgrid" \|\| {
414	echo "e2e FAIL: hydrate-create: render oracle failed"
415	cat "$OUT.hydgrid"; exit 1; }
416	grep -q -- "#hya \[up\]" "$OUT.hydgrid" \|\| {
417	echo "e2e FAIL: hydrate-create: the hya tile never said [up]:"
418	cat "$OUT.hydgrid"; exit 1; }
419	grep -q -- "#hyb \[up\]" "$OUT.hydgrid" \|\| {
420	echo "e2e FAIL: hydrate-create: the hyb tile never said [up]:"
421	cat "$OUT.hydgrid"; exit 1; }
422	grep -q -- "#hyghost \[refused\]" "$OUT.hydgrid" \|\| {
423	echo "e2e FAIL: hydrate-create: the remote tile did not say [refused]:"
424	cat "$OUT.hydgrid"; exit 1; }
425	# ...and each bar carries the chord that reaches it. Ctrl-\ 1-9 focuses by
426	# POSITION while the bar named the session, and the two series disagree the
427	# moment a tile is forgotten or a session dies. Tile 1 has the focus here,
428	# so its digit carries the `>` and the other two the same-width blank.
429	grep -q -- " 1> .*#hya \[up\]" "$OUT.hydgrid" \|\| {
430	echo "e2e FAIL: hydrate-create: the focused bar does not read \` 1> \`:"
431	cat "$OUT.hydgrid"; exit 1; }
432	grep -q -- " 2 .*#hyb \[up\]" "$OUT.hydgrid" \|\| {
433	echo "e2e FAIL: hydrate-create: the second tile's bar does not read \` 2 \`:"
434	cat "$OUT.hydgrid"; exit 1; }
435	grep -q -- " 3 .*#hyghost \[refused\]" "$OUT.hydgrid" \|\| {
436	echo "e2e FAIL: hydrate-create: a refused tile lost its chord digit:"
437	cat "$OUT.hydgrid"; exit 1; }
438	# The OTHER road a restored line takes: `Ctrl-\ w`. A no-argv `mux wall`
439	# runs the startup tile loop; the fold runs `hydrate()`, a different call
440	# site of the same rule, and the ruling covers both. Same daemon, same
441	# state home, one more ptyclient — a `mux TARGET` is the entry tile, and
442	# the fold brings the rest of the file in around it.
443	#
444	# The file is rewritten to name a session this daemon does not have. The
445	# entry attach then records its OWN line into the same file (attach
446	# history), which the fold dedupes by spelling — so what the fold has left
447	# to add is exactly the absent one, and creating it is the whole claim.
448	printf -- '--sock %s#hyfold\n' "$SOCK64" > "$HYWALL"
449	timeout 20 "$MUXA" status --sock "$SOCK64" --session hyfold > "$OUT.hydpre" 2>&1 && {
450	echo "e2e FAIL: hydrate-create: session hyfold existed before the fold ran:"
451	cat "$OUT.hydpre"; exit 1; }
452
453	set +e
454	XDG_STATE_HOME="$HYSTATE" timeout 90 "$PTYCLIENT" --cols 70 --rows 36 \
455	--out "$OUT.hydfcap" --err "$OUT.hydfcap.err" -- \
456	"$MUX" --sock "$SOCK64" --session hya > "$OUT.hydfpc" 2>&1 <<'EOF'
457	settle 1000 25000
458	send printf 'hydf-%s\n' pre\n
459	expect hydf-pre 20000
460	settle 600 20000
461	send \x1cw
462	settle 1500 25000
463	send \x1cd
464	waitexit 10000
465	EOF
466	RC=$?
467	set -e
468	[ "$RC" -eq 0 ] \|\| {
469	echo "e2e FAIL: hydrate-create: fold ptyclient exited $RC:"
470	cat "$OUT.hydfpc" "$OUT.hydfcap.err"; exit 1; }
471
472	# Daemon truth again: the fold-born tile created the session its line named.
473	timeout 20 "$MUXA" status --sock "$SOCK64" --session hyfold > "$OUT.hydfold" 2>&1 \|\| {
474	echo "e2e FAIL: hydrate-create: the folded line for hyfold did not create it:"
475	cat "$OUT.hydfold"; exit 1; }
476	# ...and it is a tile on the screen, not merely a session on the daemon.
477	"$RENDER" --cols 70 --rows 36 < "$OUT.hydfcap" > "$OUT.hydfgrid" \|\| {
478	echo "e2e FAIL: hydrate-create: fold render oracle failed"
479	cat "$OUT.hydfgrid"; exit 1; }
480	grep -q -- "#hyfold \[up\]" "$OUT.hydfgrid" \|\| {
481	echo "e2e FAIL: hydrate-create: the fold-born tile never said [up]:"
482	cat "$OUT.hydfgrid"; exit 1; }
483
484	assert_stopped "$SOCK64" "$D65PID" "hydrate-create" "$OUT.hydstop"
485	D65PID=""
486	rm -rf "$HYSTATE"
487	ok "a saved local line comes back as a fresh session, by wall and by fold; a remote one joins only"
488
489	# ---------------------------------------------------------------------------
490	# A refused attach is not a shell that exited.
491	#
492	# muxa attaches at 0x0, and a 0x0 attach is join-only: the daemon refuses a
493	# name it does not hold by sending exit_status 1 and closing — the same frame
494	# a real shell's exit sends. muxa used to report that as
495	# `{"reason":"session_ended","exit_code":1}` and `{"error":"session ended"}`,
496	# telling an agent a command had run and failed when no shell ever existed,
497	# while `status` got no answer at all and blamed the daemon (`DaemonGone`).
498	# The snapshot tells the two apart — a served attach always sends one first
499	# — and what this leg pins is the words an agent actually parses.
500	mkdir -p "$REFSTATE"
501	XDG_STATE_HOME="$REFSTATE" "$MUXD" run --sock "$SOCK66" --shell /bin/sh > "$OUT.ref.d" 2>&1 &
502	D66PID=$!
503	defer_kill "$D66PID"
504	wait_sock "$SOCK66" "$OUT.ref.d" "refused-attach daemon never bound"
505
506	# Each verb twice over: the words it must say, and the words it must not.
507	# The negative half is the whole regression — a reply that added "attach
508	# refused" while still claiming a session ended would pass a one-sided grep.
509	refuse_leg() {
510	_out="$OUT.ref$1"
511	_kind="$2"
512	shift 2
513	set +e
514	XDG_STATE_HOME="$REFSTATE" timeout 20 "$MUXA" "$@" --sock "$SOCK66" \
515	--session nosuch --timeout 5000 > "$_out" 2>&1
516	_rc=$?
517	set -e
518	[ "$_rc" -eq 1 ] \|\| {
519	echo "e2e FAIL: refused-attach: muxa $1 on a missing session exited $_rc, want 1:"
520	cat "$_out"; exit 1; }
521	grep -qF '"error":"attach refused"' "$_out" \|\| {
522	echo "e2e FAIL: refused-attach: muxa $1 did not name the refusal:"
523	cat "$_out"; exit 1; }
524	grep -qF 'so nosuch must already exist' "$_out" \|\| {
525	echo "e2e FAIL: refused-attach: muxa $1 did not name the session asked for:"
526	cat "$_out"; exit 1; }
527	# Only the verbs that attach have two causes. status and capture never
528	# attach, so no client slot was ever asked for and none can be blamed:
529	# an agent sent to read `muxd stats` over a name it mistyped burns a
530	# round trip on a table that is not full.
531	if [ "$_kind" = attach ]; then
532	grep -qF 'room for one more client' "$_out" \|\| {
533	echo "e2e FAIL: refused-attach: muxa $1 blamed absence for a refusal that has two causes:"
534	cat "$_out"; exit 1; }
535	else
536	grep -qF 'max_clients' "$_out" && {
537	echo "e2e FAIL: refused-attach: muxa $1 never attached, so it must not blame the client table:"
538	cat "$_out"; exit 1; }
539	fi
540	grep -qF 'session_ended' "$_out" && {
541	echo "e2e FAIL: refused-attach: muxa $1 still reports a session that ended:"
542	cat "$_out"; exit 1; }
543	grep -qF 'session ended' "$_out" && {
544	echo "e2e FAIL: refused-attach: muxa $1 still reports a session that ended:"
545	cat "$_out"; exit 1; }
546	grep -qF 'DaemonGone' "$_out" && {
547	echo "e2e FAIL: refused-attach: muxa $1 blamed the daemon for a missing name:"
548	cat "$_out"; exit 1; }
549	return 0
550	}
551	refuse_leg run attach run true
552	refuse_leg status query status
553	refuse_leg send attach send x
554
555	# ...and the daemon that said no three times is still serving. Refusing is
556	# an answer, not a fault: a daemon that died on a typed `--session` would
557	# turn one bad name into everyone else's outage.
558	XDG_STATE_HOME="$REFSTATE" timeout 20 "$MUXA" status --sock "$SOCK66" \
559	--session 0 > "$OUT.refalive" 2>&1 \|\| {
560	echo "e2e FAIL: refused-attach: the daemon stopped answering after refusing:"
561	cat "$OUT.refalive"; exit 1; }
562	grep -qF '"cols":' "$OUT.refalive" \|\| {
563	echo "e2e FAIL: refused-attach: status on the live session is not a status reply:"
564	cat "$OUT.refalive"; exit 1; }
565
566	assert_stopped "$SOCK66" "$D66PID" "refused-attach" "$OUT.refstop"
567	D66PID=""
568	rm -rf "$REFSTATE"
569	ok "muxa names a refused attach instead of a shell that never ran"
570
571	# --- the same ruling through the browser -------------------------------
572	#
573	# The hub's tiles attach at 0x0 — the passivity contract, so a browser can
574	# never move a shared grid — and the daemon reads 0x0 as join-only. A saved
575	# wall whose daemon has restarted was therefore a grid of dead tiles that
576	# the CLI, reading the same file, brought back. The hub now births the
577	# session on a connection of its own and re-dials; the browser re-attaches
578	# on `up` as it does after any tear and is never told a refusal happened.
579	#
580	# The split is the hydrate leg's, asserted the other side of the wire: the
581	# LOCAL line comes back, the `quic://` one still says refused. Same daemon,
582	# same run, reached both ways, so the comparison is between two kinds of
583	# line and not between two rigs.
584	#
585	# Daemon truth answers "was it created" — `muxa status` on a name the
586	# daemon does not have exits non-zero, and the same probe runs BEFORE the
587	# hub so the leg cannot pass vacuously. `sessions=1` at the end is the
588	# other half: one birth, not two, and nothing born for the remote line.
589	head -c 32 /dev/urandom > "$WGKEY"
590	chmod 600 "$WGKEY"
591	start_daemon "$SOCK67" "$OUT.wg.d" "web-restore daemon never bound" --shell /bin/sh \
592	--quic "127.0.0.1:$WGQPORT" --key "$WGKEY" --quic-idle-ms 15000
593	D67PID=$DPID
594
595	# Written by hand for the hydrate leg's reason: a line the hub had earned
596	# by attaching would name a session that already exists, and there would be
597	# nothing left for the restore to create.
598	mkdir -p "$WGSTATE/mux"
599	printf -- '--sock %s#wghost\nquic://127.0.0.1:%s#wghost2\n' \
600	"$SOCK67" "$WGQPORT" > "$WGWALL"
601
602	# Vacuity guard: neither exists yet.
603	for _wg in wghost wghost2; do
604	timeout 20 "$MUXA" status --sock "$SOCK67" --session "$_wg" > "$OUT.wgpre" 2>&1 && {
605	echo "e2e FAIL: web-restore: session $_wg existed before the hub ran:"
606	cat "$OUT.wgpre"; exit 1; }
607	done
608
609	# No argv: the hub restores the wall from the last run, which is the file
610	# written above. Its own state home, never the developer's.
611	XDG_STATE_HOME="$WGSTATE" "$MUXWEB" --port "$WGPORT" --key "$WGKEY" \
612	--quic-idle-ms 15000 > "$OUT.wgh" 2>&1 &
613	W5PID=$!
614	defer_kill "$W5PID"
615	wait_for "$OUT.wgh" "serving" 10 \|\| {
616	echo "e2e FAIL: web-restore: hub never reported serving"; cat "$OUT.wgh"; exit 1; }
617
618	# Tile 0, the LOCAL line. `expectups 2` is the assertion that the hub
619	# re-dialed: one `up` for the first dial, a second for the one after the
620	# birth. Counted rather than read off the last state, because a
621	# `reconnecting` → `up` pair can arrive inside one read and leave the last
622	# state saying exactly what it said before. The second attach is the
623	# browser's own — mux.js re-attaches on `up`, and nothing in the page
624	# decides anything about creation. Both scripts wait for the first `up`
625	# before attaching, for mux.js's reason: a message sent while the hub is
626	# still dialing is dropped, and an attach nobody read is a refusal that
627	# never arrives.
628	# Bracketing the script below is what makes "one birth" measurable at all
629	# — see the delta assertion after it.
630	WGATT_A=$(attaches_now "$SOCK67")
631	set +e
632	timeout 60 "$WSCLIENT" --port "$WGPORT" --tile 0 --out "$OUT.wgws" --err "$OUT.wgws.err" <<'EOF'
633	expectstate up 25000
634	attach 0 0 wghost
635	expectups 2 30000
636	attach 0 0 wghost
637	settle 500 20000
638	send printf 'wg-%s\n' born\n
639	expectgrid wg-born 25000
640	dumpexit
641	EOF
642	RC=$?
643	set -e
644	[ "$RC" -eq 0 ] \|\| {
645	echo "e2e FAIL: web-restore: the local tile's wsclient exited $RC"
646	cat -v "$OUT.wgws.err" 2>/dev/null; cat "$OUT.wgh"; exit 1; }
647	WGATT_B=$(attaches_now "$SOCK67")
648
649	# ONE birth. Counting sessions cannot say this: `resolveSession` is
650	# attach-or-create, so a second birth would find `wghost` and join, and
651	# the table would read 2 whether the hub birthed once or twenty times.
652	# `attaches` can, because a REFUSED attach deliberately does not move it:
653	# the two counted here are the birth's own and the browser's second one
654	# (the first was refused). A hub that re-birthed on every refused re-dial
655	# lands one extra per turn.
656	assert_attach_delta "$WGATT_A" "$WGATT_B" 2 \
657	"web-restore: the hub birthed once for one refused tile"
658
659	# Tile 1, the REMOTE line: the refusal is forwarded untouched, and the
660	# fixture tells it from a shell exiting exactly as the page does — an
661	# exit_status before any grid.
662	set +e
663	timeout 60 "$WSCLIENT" --port "$WGPORT" --tile 1 --out "$OUT.wgws2" --err "$OUT.wgws2.err" <<'EOF'
664	expectstate up 25000
665	attach 0 0 wghost2
666	expectrefused 25000
667	dumpexit
668	EOF
669	RC=$?
670	set -e
671	[ "$RC" -eq 0 ] \|\| {
672	echo "e2e FAIL: web-restore: the remote tile's wsclient exited $RC"
673	cat -v "$OUT.wgws2.err" 2>/dev/null; cat "$OUT.wgh"; exit 1; }
674
675	# Daemon truth: the local line's session exists, and at the size the birth
676	# claimed — a browser tile claims none, so a session born at the tile's 0x0
677	# would not have been born at all.
678	timeout 20 "$MUXA" status --sock "$SOCK67" --session wghost > "$OUT.wgsta" 2>&1 \|\| {
679	echo "e2e FAIL: web-restore: the saved local line did not come back:"
680	cat "$OUT.wgsta"; cat "$OUT.wgh"; exit 1; }
681
682	# The size is asserted against the DAEMON's own default, not against a
683	# literal: session 0 is seeded from `main.Opts` and this daemon was given
684	# no --cols/--rows, so it holds exactly the figure `client.birth_cols` and
685	# `client.birth_rows` claim to mirror. Grepping for 80x24 would pass just
686	# as happily if both sides drifted together, which is the drift that
687	# matters — nothing else links the two files.
688	timeout 20 "$MUXA" status --sock "$SOCK67" --session 0 > "$OUT.wgsta0" 2>&1 \|\| {
689	echo "e2e FAIL: web-restore: the daemon's own default session did not answer:"
690	cat "$OUT.wgsta0"; exit 1; }
691	_wg_size() { sed -n 's/^{$"cols":[0-9],"rows":[0-9]$.*/\1/p' "$1"; }
692	WG_BORN=$(_wg_size "$OUT.wgsta")
693	WG_DEFAULT=$(_wg_size "$OUT.wgsta0")
694	[ -n "$WG_BORN" ] && [ -n "$WG_DEFAULT" ] \|\| {
695	echo "e2e FAIL: web-restore: no size read out of muxa status"
696	echo " born='$WG_BORN' default='$WG_DEFAULT' — the pin would be vacuous"
697	cat "$OUT.wgsta" "$OUT.wgsta0"; exit 1; }
698	[ "$WG_BORN" = "$WG_DEFAULT" ] \|\| {
699	echo "e2e FAIL: web-restore: the birth size drifted from muxd's own default"
700	echo " wghost $WG_BORN, session 0 $WG_DEFAULT"
701	echo " — client.birth_cols/birth_rows must mirror main.Opts"
702	exit 1; }
703
704	# ...and it is a real shell: the marker the browser stand-in typed is the
705	# created session's own work.
706	grep -qF "wg-born" "$OUT.wgws" \|\| {
707	echo "e2e FAIL: web-restore: the marker never reached the created session:"
708	cat "$OUT.wgws"; exit 1; }
709
710	# The remote line created NOTHING. Same daemon, same file, same run.
711	timeout 20 "$MUXA" status --sock "$SOCK67" --session wghost2 > "$OUT.wgghost" 2>&1 && {
712	echo "e2e FAIL: web-restore: a quic:// wall line created a session:"
713	cat "$OUT.wgghost"; exit 1; }
714
715	# ...and nothing else was created behind either tile. Two, not one —
716	# `muxd run` makes the default session at startup, so the birth is the
717	# SECOND. How MANY births happened is the attach delta's claim above; this
718	# one is that the table holds exactly the expected set.
719	wait_sessions "$SOCK67" 2 "web-restore: the table holds the default session and wghost, nothing else"
720
721	# ...and a shell the user ENDS stays ended. Every refusal closes the hub's
722	# connection (`server.dropObserver` closes the fd), so `exit` reaches the
723	# same refuse-after-redial shape the restore does: the daemon reaps the
724	# session, the hub redials, the page re-attaches on `up`, and the attach is
725	# refused because the session is gone. A hub that could not tell those two
726	# apart hands the user a NEW shell every time they type `exit` — and with a
727	# short-lived shell, one forked process per turn, forever. The CLI's answer
728	# is `wallview`'s: its pump ends on an exit_status and the tile stays dead.
729	#
730	# The re-attach is spelled out here because it is the browser's, not the
731	# hub's: mux.js sends it on `up`, and the fixture stands in for that.
732	set +e
733	timeout 60 "$WSCLIENT" --port "$WGPORT" --tile 0 --out "$OUT.wgws3" --err "$OUT.wgws3.err" <<'EOF'
734	expectstate up 25000
735	attach 0 0 wghost
736	settle 500 20000
737	send exit\n
738	expectups 2 30000
739	attach 0 0 wghost
740	expectrefused 25000
741	dumpexit
742	EOF
743	RC=$?
744	set -e
745	[ "$RC" -eq 0 ] \|\| {
746	echo "e2e FAIL: web-restore: the exiting tile's wsclient exited $RC"
747	cat -v "$OUT.wgws3.err" 2>/dev/null; cat "$OUT.wgh"; exit 1; }
748
749	# Daemon truth for the same claim: the session the user ended is gone and
750	# stayed gone, and the daemon is back to the one session it started with.
751	timeout 20 "$MUXA" status --sock "$SOCK67" --session wghost > "$OUT.wgexit" 2>&1 && {
752	echo "e2e FAIL: web-restore: typing exit got the user a new shell:"
753	cat "$OUT.wgexit"; exit 1; }
754	wait_sessions "$SOCK67" 1 "web-restore: the ended session was not resurrected"
755
756	softkill "$W5PID" \|\| true
757	wait_pid_gone "$W5PID" "web-restore: hub killed by tracked pid"
758	W5PID=""
759	assert_stopped "$SOCK67" "$D67PID" "web-restore" "$OUT.wgstop"
760	D67PID=""
761	rm -rf "$WGSTATE"
762	ok "the browser wall restores a saved local line too, and still joins a remote one only"
763
764	# --- a refusal the birth cannot fix must not spin ----------------------
765	#
766	# The other end of the restore rule: a line the daemon will not attach and
767	# the hub may not create. `client.hydratedCreates` joins a remote spelling
768	# and never births it, so nothing the hub can do makes this attach land.
769	# Every refusal closes the connection (`server.dropObserver`), so the
770	# re-dial that follows succeeds on its first try, the page re-attaches on
771	# `up` as it always does, and the same no comes back — a connect/attach/
772	# close loop bounded by nothing but round-trip latency, on the hub, the
773	# daemon and the browser at once.
774	#
775	# Counted the one way the hub cannot flatter itself: a `.hand` dial forks
776	# its own ssh, and the shim logs its pid before exec, so `wc -l` is a
777	# count of PROCESSES the OS made. A hub counter would be the code under
778	# test grading its own homework.
779	start_daemon "$SOCK68" "$OUT.sp.d" "refusal-spin daemon never bound" --shell /bin/sh
780	D68PID=$DPID
781
782	# This shim ignores the remote command on purpose — it is not modelling
783	# ssh (the M14 shim above does that), it is the dial's process signature
784	# plus a byte pipe to a REAL daemon. `endpoint none` is what keeps every
785	# dial on this path: an announced QUIC endpoint would be cached, the
786	# second dial would skip ssh entirely, and the count with it.
787	mkdir -p "$SPDIR"
788	: > "$SPINLOG"
789	cat > "$SPDIR/ssh" <<SPSHIM
790	#!/bin/sh
791	echo \$\$ >> "$SPINLOG"
792	printf 'endpoint none\n'
793	exec "$MUXD" proxy --sock "$SOCK68"
794	SPSHIM
795	chmod +x "$SPDIR/ssh"
796
797	# One line, a HOST spelling, naming a session the daemon does not have:
798	# the tile attaches at 0x0 (passivity), 0x0 cannot create, and a remote
799	# line may not be birthed.
800	mkdir -p "$SPSTATE/mux"
801	printf 'mux-spin@127.0.0.1#spinghost\n' > "$SPSTATE/mux/wall"
802
803	XDG_STATE_HOME="$SPSTATE" XDG_CACHE_HOME="$SPSTATE/cache" PATH="$SPDIR:$PATH" \
804	"$MUXWEB" --port "$SPPORT" > "$OUT.sph" 2>&1 &
805	W6PID=$!
806	defer_kill "$W6PID"
807	wait_for "$OUT.sph" "serving" 10 \|\| {
808	echo "e2e FAIL: refusal-spin: hub never reported serving"; cat "$OUT.sph"; exit 1; }
809
810	# `reattach` is mux.js's ENV_CONTROL handler, which is the half of the
811	# loop the hub does not own: the page attaches again on every `up`. Six
812	# seconds of it, and the dial log is read the moment the window closes.
813	set +e
814	timeout 90 "$WSCLIENT" --port "$SPPORT" --tile 0 --out "$OUT.spws" --err "$OUT.spws.err" <<'EOF'
815	expectstate up 25000
816	reattach 0 0 6000 spinghost
817	expectrefused 25000
818	dumpexit
819	EOF
820	RC=$?
821	set -e
822	SPDIALS=$(wc -l < "$SPINLOG")
823	[ "$RC" -eq 0 ] \|\| {
824	echo "e2e FAIL: refusal-spin: the wsclient exited $RC after $SPDIALS dials"
825	cat -v "$OUT.spws.err" 2>/dev/null; cat "$OUT.sph"; exit 1; }
826
827	# The bound, and its vacuity guard. Backoff caps at client.nextBackoffMs's
828	# 2s, so six seconds of refusal is a handful of dials; unbounded it is one
829	# per round trip, hundreds. The lower bound is what stops this passing on
830	# a tile that never re-dialled at all — then the ceiling would be measuring
831	# nothing.
832	[ "$SPDIALS" -ge 3 ] \|\| {
833	echo "e2e FAIL: refusal-spin: only $SPDIALS dials in 6s — the tile never"
834	echo " re-dialled, so the ceiling below measured nothing"
835	cat "$OUT.sph"; exit 1; }
836	[ "$SPDIALS" -le 15 ] \|\| {
837	echo "e2e FAIL: refusal-spin: $SPDIALS dials in 6s (want <= 15) — a refusal"
838	echo " the birth cannot fix is spinning with no backoff"
839	cat "$OUT.sph"; exit 1; }
840
841	# ...and it stayed refused: nothing was born behind the hub's back, which
842	# is what makes the count above a count of REFUSED dials.
843	timeout 20 "$MUXA" status --sock "$SOCK68" --session spinghost > "$OUT.spghost" 2>&1 && {
844	echo "e2e FAIL: refusal-spin: a remote wall line created a session:"
845	cat "$OUT.spghost"; exit 1; }
846
847	softkill "$W6PID" \|\| true
848	wait_pid_gone "$W6PID" "refusal-spin: hub killed by tracked pid"
849	W6PID=""
850	assert_stopped "$SOCK68" "$D68PID" "refusal-spin" "$OUT.spstop"
851	D68PID=""
852	rm -rf "$SPSTATE" "$SPDIR"
853	ok "a refusal the birth cannot fix backs off instead of spinning"
854
855	# `muxd upgrade` — four daemons, because each one is a different daemon	148	# `muxd upgrade` — four daemons, because each one is a different daemon
856	# LIFECYCLE and no two can share a process: the same-binary leg's daemon	149	# LIFECYCLE and no two can share a process: the same-binary leg's daemon
857	# ends up running a second image, the rollback leg's is born with the abort	150	# ends up running a second image, the rollback leg's is born with the abort

test/e2e_13_birth.sh

@@ @@ -0,0 +1,710 @@ @@
+# shellcheck shell=sh
+# e2e_13_birth.sh — sourced by test/e2e.sh after e2e_lib.sh. Scenarios run in
+# the order they stand in; see the lib's header for what this file may
+# assume and what it must register.
+# The hydrated-create leg. One daemon, and it serves QUIC as well as its
+# socket: the leg's whole point is the LOCAL/remote split, so both halves
+# have to be the same run of the same daemon or the comparison is between
+# two rigs rather than between two kinds of line. Short socket name on
+# purpose — the assertion reads a label bar back off a 70-column render.
+SOCK64="${TMPDIR:-/tmp}/muxd-e2e-hyd-$$.sock"
+defer_sock "$SOCK64"
+# Base 6000, below the 5000-spaced band the other QUIC ports share: every
+# base from 11000 up is already taken, and a DUPLICATED base passes only
+# for as long as the other leg's daemon happens to be dead by the time
+# this one binds. A collision reads as this daemon's failure, not the
+# suite's, which is why the base has to be the leg's own.
+HYPORT=$(( 6000 + ($$ % 4000) ))
+HYKEY="${TMPDIR:-/tmp}/mux-e2e-hydkey-$$"
+defer_rm "$HYKEY"
+HYSTATE="${TMPDIR:-/tmp}/mux-e2e-hyd-state-$$"
+defer_rm "$HYSTATE"
+HYWALL="$HYSTATE/mux/wall"
+# The refused-attach leg: its own daemon, because its assertions are about
+# what a daemon says to a name it does NOT have, and a socket shared with
+# another leg would let that leg's sessions decide what "does not have"
+# means.
+SOCK66="${TMPDIR:-/tmp}/muxd-e2e-refuse-$$.sock"
+defer_sock "$SOCK66"
+REFSTATE="${TMPDIR:-/tmp}/mux-e2e-refuse-state-$$"
+defer_rm "$REFSTATE"
+# The browser half of the same ruling: one daemon serving a socket AND a
+# QUIC listener, one hub, a state home of its own. Two ports, and the
+# 5000-spaced bands are exhausted — 61000 is the last one that fits under
+# 65535 — so this leg takes the tail ABOVE the ephemeral range
+# (ip_local_port_range tops out at 60999 by default), halved. The narrow
+# `%250` is the price of that tail: two runs whose pids differ by 250
+# collide where the older bands need 4000. A collision reads as this leg's
+# daemon failing to bind, which is also why the two halves cannot share a
+# base.
+SOCK67="${TMPDIR:-/tmp}/muxd-e2e-wg-$$.sock"
+defer_sock "$SOCK67"
+WGPORT=$(( 65000 + ($$ % 250) ))
+WGQPORT=$(( 65250 + ($$ % 250) ))
+WGKEY="${TMPDIR:-/tmp}/mux-e2e-wgkey-$$"
+defer_rm "$WGKEY"
+WGSTATE="${TMPDIR:-/tmp}/mux-e2e-wg-state-$$"
+defer_rm "$WGSTATE"
+WGWALL="$WGSTATE/mux/wall"
+# The refusal-spin leg. Its own everything: a shim dir on PATH, a state
+# home holding the wall it restores, and a dial log the shim appends to.
+SOCK68="${TMPDIR:-/tmp}/muxd-e2e-sp-$$.sock"
+defer_sock "$SOCK68"
+SPPORT=$(( 26000 + ($$ % 4000) ))
+SPSTATE="${TMPDIR:-/tmp}/mux-e2e-sp-state-$$"
+defer_rm "$SPSTATE"
+SPDIR="${TMPDIR:-/tmp}/mux-e2e-sp-shim-$$"
+defer_rm "$SPDIR"
+SPINLOG="$SPDIR/dials"
+# ---- Ctrl-\ : adds a tile by spelling ---------------------------------
+#
+# Argv typed from inside. A spelling naming a session on ANOTHER daemon
+# is born beside the focus, creates that session there, takes the focus,
+# and is recorded into the wall file — mux TARGET's row of the birth
+# table, without leaving the wall. A bad spelling is a notice and
+# nothing else (the file does not grow). Esc eats the line: the shell
+# never sees it, and the next keys reach the session again.
+#
+# The prompt echoes what is typed, so the born tile's witness is not its
+# label on the capture (the echo would match) but a marker typed AFTER
+# the birth landing in daemon B's session b — a hit is B's shell's work.
+PRSTATE="${TMPDIR:-/tmp}/mux-e2e-prompt-state-$$"
+defer_rm "$PRSTATE"
+PRWALL="$PRSTATE/mux/wall"
+start_daemon "$SOCK62" "$OUT.pra.d" "prompt daemon A never bound" --shell /bin/sh
+D63PID=$DPID
+start_daemon "$SOCK63" "$OUT.prb.d" "prompt daemon B never bound" --shell /bin/sh
+D64PID=$DPID
+pipe_mux "$OUT.pra" "$OUT.pra.err" timeout 40 "$MUX" --sock "$SOCK62" --session a
+pipe_send 'printf "pr-%%s\\n" origin\n'
+await_out "$OUT.pra" "pr-origin" "prompt: session a marker never reached the client"
+pipe_detach
+wait_grid "$SOCK62" "pr-origin" "prompt: session a marker" a
+mkdir -p "$PRSTATE/mux"
+printf -- '--sock %s#a\n' "$SOCK62" > "$PRWALL"
+# The spelling goes in TWO sends with a settle between: the prompt paints
+# its echo when a read ENDS with the prompt still open, so a spelling that
+# arrives in the same read as its own \r paints nothing to assert on. The
+# separating space is \x20 because parseLine trims a payload's trailing one.
+set +e
+XDG_STATE_HOME="$PRSTATE" timeout 90 "$PTYCLIENT" --cols 100 --rows 30 \
+    --out "$OUT.prcap" --err "$OUT.prcap.err" -- \
+    "$MUX" wall > "$OUT.prpc" 2>&1 <<EOF
+expect pr-origin 20000
+settle 700 20000
+send \x1c:--sock\x20
+settle 300 5000
+send $SOCK63#b\r
+settle 1000 20000
+send printf 'pr-born-%s\n' marker\n
+expect pr-born-marker 15000
+send \x1c:x#bad name\r
+expect [bad target 10000
+settle 500 15000
+send \x1c:-A nosuchhost.invalid\r
+expect FlagLikeTarget 10000
+settle 500 15000
+send \x1c:zzz\x1b
+settle 500 15000
+send printf 'pr-after-%s\n' esc\n
+expect pr-after-esc 10000
+settle 500 15000
+send \x1cd
+waitexit 10000
+EOF
+RC=$?
+set -e
+[ "$RC" -eq 0 ] || {
+    echo "e2e FAIL: prompt: ptyclient leg exited $RC (did \\x1c: add the tile?):"
+    cat "$OUT.prpc" "$OUT.prcap.err"; exit 1; }
+# The oracle, not the byte stream: a banner LEFT on the screen is invisible
+# to a grep of the emitted bytes — the `: zzz` that painted is in the
+# capture either way. Only the render's final grid says what the human was
+# still looking at when the wall came down.
+"$RENDER" --cols 100 --rows 30 < "$OUT.prcap" > "$OUT.prgrid" || {
+    echo "e2e FAIL: prompt: render oracle failed"
+    cat "$OUT.prgrid"; exit 1; }
+grep -q ": zzz" "$OUT.prgrid" && {
+    echo "e2e FAIL: prompt: the Esc'd prompt is still on the screen:"
+    cat "$OUT.prgrid"; exit 1; }
+grep -q "pr-after-esc" "$OUT.prgrid" || {
+    echo "e2e FAIL: prompt: the tile's content did not come back after Esc:"
+    cat "$OUT.prgrid"; exit 1; }
+# argv's refusal, at argv's other mouth: `-A host` is a mistyped flag and
+# never becomes a tile for a host named `-A`. The bar is the witness — a
+# born tile paints its spelling and a state word beside it, and the host
+# here resolves nowhere, so the tile would sit there saying [refused].
+grep -q -- "-A nosuchhost.invalid \[" "$OUT.prgrid" && {
+    echo "e2e FAIL: prompt: a flag-like spelling became a tile:"
+    cat "$OUT.prgrid"; exit 1; }
+# The prompt is a line the typist can read back: -a because the capture is
+# a terminal stream, escape bytes and all.
+grep -aq ": --sock " "$OUT.prcap" || {
+    echo "e2e FAIL: prompt: the prompt line never painted its echo:"
+    cat "$OUT.prpc"; exit 1; }
+# Born on daemon B, focused: the marker typed after the birth is in B's
+# session b, and so are the keys typed after the Esc.
+timeout 20 "$MUXA" capture --sock "$SOCK63" --session b > "$OUT.prfb" 2>&1
+grep -q "pr-born-marker" "$OUT.prfb" || {
+    echo "e2e FAIL: prompt: marker not in daemon B's session b (tile not born there, or not focused):"
+    cat "$OUT.prfb"; exit 1; }
+grep -q "pr-after-esc" "$OUT.prfb" || {
+    echo "e2e FAIL: prompt: keys after Esc never reached session b (prompt did not close):"
+    cat "$OUT.prfb"; exit 1; }
+grep -q "zzz" "$OUT.prfb" && {
+    echo "e2e FAIL: prompt: Esc leaked the line into the shell:"
+    cat "$OUT.prfb"; exit 1; }
+# Recorded, and only the accepted spelling: two lines, the born one among them.
+grep -qF -- "--sock $SOCK63#b" "$PRWALL" || {
+    echo "e2e FAIL: prompt: the born tile was not recorded:"
+    cat "$PRWALL"; exit 1; }
+[ "$(grep -c . "$PRWALL")" = "2" ] || {
+    echo "e2e FAIL: prompt: wall file is not exactly two lines (a refused spelling recorded?):"
+    cat "$PRWALL"; exit 1; }
+assert_stopped "$SOCK62" "$D63PID" "prompt A" "$OUT.prastop"
+D63PID=""
+assert_stopped "$SOCK63" "$D64PID" "prompt B" "$OUT.prbstop"
+D64PID=""
+rm -rf "$PRSTATE"
+ok "Ctrl-\\ : adds a tile by spelling: born on another daemon, recorded, refusals narrated, Esc eats the line"
+# ---- a saved local line comes back as a fresh session -------------------
+#
+# The wall file is attach history, and the daemon that held those sessions
+# dies on every reboot. Joining only meant the wall came back as a grid of
+# [refused] tiles nobody could do anything with but forget them by hand.
+# A restored line naming the LOCAL socket now attaches-or-creates.
+#
+# The remote half is the same wall, the same run and the same daemon,
+# reached the other way: a `quic://` line for a session that does not
+# exist stays [refused] and creates nothing. Recreating a shell on your
+# own box is cheap and expected; spawning one on another host out of a
+# saved file is not, and the split is the whole ruling.
+#
+# Daemon truth, not paint, answers "was it created": `muxa status` on a
+# name the daemon does not have exits non-zero, which is the same probe
+# the leg runs BEFORE the wall so it cannot pass vacuously. The render
+# oracle answers the other question — what the human was looking at —
+# because a bar left saying [refused] is invisible to a grep of the
+# emitted bytes.
+#
+# Both roads a restored line can take are here, because they are two call
+# sites of the one rule: the no-argv `mux wall` below runs the startup tile
+# loop, and the `Ctrl-\ w` half at the end of this leg runs `hydrate()`.
+head -c 32 /dev/urandom > "$HYKEY"
+chmod 600 "$HYKEY"
+start_daemon "$SOCK64" "$OUT.hyd.d" "hydrate-create daemon never bound" --shell /bin/sh \
+    --quic "127.0.0.1:$HYPORT" --key "$HYKEY" --quic-idle-ms 15000
+D65PID=$DPID
+# The wall file names three sessions this daemon does not have. Written by
+# hand rather than earned by an attach, because an attach that earned the
+# line would also have created the session — and then there would be
+# nothing for the restore to create.
+mkdir -p "$HYSTATE/mux"
+printf -- '--sock %s#hya\n--sock %s#hyb\nquic://127.0.0.1:%s#hyghost\n' \
+    "$SOCK64" "$SOCK64" "$HYPORT" > "$HYWALL"
+# Vacuity guard: none of the three exists yet. A leg whose daemon already
+# had them would pass without the restore creating anything.
+for _hy in hya hyb hyghost; do
+    timeout 20 "$MUXA" status --sock "$SOCK64" --session "$_hy" > "$OUT.hydpre" 2>&1 && {
+        echo "e2e FAIL: hydrate-create: session $_hy existed before the wall ran:"
+        cat "$OUT.hydpre"; exit 1; }
+done
+# 70x36: under the aspect rule (70 < 2*36) the cut is stacked, so each of
+# the three tiles gets the full width and its label bar survives the
+# render intact — the socket path is in that label.
+set +e
+XDG_STATE_HOME="$HYSTATE" timeout 90 "$PTYCLIENT" --cols 70 --rows 36 \
+    --out "$OUT.hydcap" --err "$OUT.hydcap.err" -- \
+    "$MUX" wall --key "$HYKEY" > "$OUT.hydpc" 2>&1 <<'EOF'
+expect [up] 25000
+settle 1000 25000
+send printf 'hyd-%s\n' marker\n
+expect hyd-marker 15000
+settle 600 15000
+send \x1cd
+waitexit 10000
+EOF
+RC=$?
+set -e
+[ "$RC" -eq 0 ] || {
+    echo "e2e FAIL: hydrate-create: ptyclient exited $RC:"
+    cat "$OUT.hydpc" "$OUT.hydcap.err"; exit 1; }
+# The local lines created their sessions, at the width of the stripe that
+# created them. The width does not discriminate create from join on its own
+# (a join's resize doorbell lands at 70 too, and the daemon refuses a create
+# under min_session_cols) — the muxa exit code above is what says created.
+# It is here to catch a session that came up at some OTHER client's size.
+timeout 20 "$MUXA" status --sock "$SOCK64" --session hya > "$OUT.hydsta" 2>&1 || {
+    echo "e2e FAIL: hydrate-create: the saved line for hya did not create it:"
+    cat "$OUT.hydsta"; exit 1; }
+grep -q '"cols":70' "$OUT.hydsta" || {
+    echo "e2e FAIL: hydrate-create: hya exists but not at the tile's width:"
+    cat "$OUT.hydsta"; exit 1; }
+timeout 20 "$MUXA" status --sock "$SOCK64" --session hyb > "$OUT.hydstb" 2>&1 || {
+    echo "e2e FAIL: hydrate-create: the saved line for hyb did not create it:"
+    cat "$OUT.hydstb"; exit 1; }
+# ...and the created session runs a real shell: the marker typed into the
+# focused tile (tile 0, the first wall line) is the shell's own work.
+timeout 20 "$MUXA" capture --sock "$SOCK64" --session hya > "$OUT.hydfa" 2>&1
+grep -q "hyd-marker" "$OUT.hydfa" || {
+    echo "e2e FAIL: hydrate-create: the marker never reached the created session:"
+    cat "$OUT.hydfa"; exit 1; }
+# The remote line created NOTHING. Same daemon, same run, same file — only
+# the spelling differs.
+timeout 20 "$MUXA" status --sock "$SOCK64" --session hyghost > "$OUT.hydghost" 2>&1 && {
+    echo "e2e FAIL: hydrate-create: a quic:// wall line created a session:"
+    cat "$OUT.hydghost"; exit 1; }
+# What the human saw: two tiles up, the remote one still refused.
+"$RENDER" --cols 70 --rows 36 < "$OUT.hydcap" > "$OUT.hydgrid" || {
+    echo "e2e FAIL: hydrate-create: render oracle failed"
+    cat "$OUT.hydgrid"; exit 1; }
+grep -q -- "#hya \[up\]" "$OUT.hydgrid" || {
+    echo "e2e FAIL: hydrate-create: the hya tile never said [up]:"
+    cat "$OUT.hydgrid"; exit 1; }
+grep -q -- "#hyb \[up\]" "$OUT.hydgrid" || {
+    echo "e2e FAIL: hydrate-create: the hyb tile never said [up]:"
+    cat "$OUT.hydgrid"; exit 1; }
+grep -q -- "#hyghost \[refused\]" "$OUT.hydgrid" || {
+    echo "e2e FAIL: hydrate-create: the remote tile did not say [refused]:"
+    cat "$OUT.hydgrid"; exit 1; }
+# ...and each bar carries the chord that reaches it. Ctrl-\ 1-9 focuses by
+# POSITION while the bar named the session, and the two series disagree the
+# moment a tile is forgotten or a session dies. Tile 1 has the focus here,
+# so its digit carries the `>` and the other two the same-width blank.
+grep -q -- " 1> .*#hya \[up\]" "$OUT.hydgrid" || {
+    echo "e2e FAIL: hydrate-create: the focused bar does not read \` 1> \`:"
+    cat "$OUT.hydgrid"; exit 1; }
+grep -q -- " 2  .*#hyb \[up\]" "$OUT.hydgrid" || {
+    echo "e2e FAIL: hydrate-create: the second tile's bar does not read \` 2  \`:"
+    cat "$OUT.hydgrid"; exit 1; }
+grep -q -- " 3  .*#hyghost \[refused\]" "$OUT.hydgrid" || {
+    echo "e2e FAIL: hydrate-create: a refused tile lost its chord digit:"
+    cat "$OUT.hydgrid"; exit 1; }
+# The OTHER road a restored line takes: `Ctrl-\ w`. A no-argv `mux wall`
+# runs the startup tile loop; the fold runs `hydrate()`, a different call
+# site of the same rule, and the ruling covers both. Same daemon, same
+# state home, one more ptyclient — a `mux TARGET` is the entry tile, and
+# the fold brings the rest of the file in around it.
+#
+# The file is rewritten to name a session this daemon does not have. The
+# entry attach then records its OWN line into the same file (attach
+# history), which the fold dedupes by spelling — so what the fold has left
+# to add is exactly the absent one, and creating it is the whole claim.
+printf -- '--sock %s#hyfold\n' "$SOCK64" > "$HYWALL"
+timeout 20 "$MUXA" status --sock "$SOCK64" --session hyfold > "$OUT.hydpre" 2>&1 && {
+    echo "e2e FAIL: hydrate-create: session hyfold existed before the fold ran:"
+    cat "$OUT.hydpre"; exit 1; }
+set +e
+XDG_STATE_HOME="$HYSTATE" timeout 90 "$PTYCLIENT" --cols 70 --rows 36 \
+    --out "$OUT.hydfcap" --err "$OUT.hydfcap.err" -- \
+    "$MUX" --sock "$SOCK64" --session hya > "$OUT.hydfpc" 2>&1 <<'EOF'
+settle 1000 25000
+send printf 'hydf-%s\n' pre\n
+expect hydf-pre 20000
+settle 600 20000
+send \x1cw
+settle 1500 25000
+send \x1cd
+waitexit 10000
+EOF
+RC=$?
+set -e
+[ "$RC" -eq 0 ] || {
+    echo "e2e FAIL: hydrate-create: fold ptyclient exited $RC:"
+    cat "$OUT.hydfpc" "$OUT.hydfcap.err"; exit 1; }
+# Daemon truth again: the fold-born tile created the session its line named.
+timeout 20 "$MUXA" status --sock "$SOCK64" --session hyfold > "$OUT.hydfold" 2>&1 || {
+    echo "e2e FAIL: hydrate-create: the folded line for hyfold did not create it:"
+    cat "$OUT.hydfold"; exit 1; }
+# ...and it is a tile on the screen, not merely a session on the daemon.
+"$RENDER" --cols 70 --rows 36 < "$OUT.hydfcap" > "$OUT.hydfgrid" || {
+    echo "e2e FAIL: hydrate-create: fold render oracle failed"
+    cat "$OUT.hydfgrid"; exit 1; }
+grep -q -- "#hyfold \[up\]" "$OUT.hydfgrid" || {
+    echo "e2e FAIL: hydrate-create: the fold-born tile never said [up]:"
+    cat "$OUT.hydfgrid"; exit 1; }
+assert_stopped "$SOCK64" "$D65PID" "hydrate-create" "$OUT.hydstop"
+D65PID=""
+rm -rf "$HYSTATE"
+ok "a saved local line comes back as a fresh session, by wall and by fold; a remote one joins only"
+# ---------------------------------------------------------------------------
+# A refused attach is not a shell that exited.
+#
+# muxa attaches at 0x0, and a 0x0 attach is join-only: the daemon refuses a
+# name it does not hold by sending exit_status 1 and closing — the same frame
+# a real shell's exit sends. muxa used to report that as
+# `{"reason":"session_ended","exit_code":1}` and `{"error":"session ended"}`,
+# telling an agent a command had run and failed when no shell ever existed,
+# while `status` got no answer at all and blamed the daemon (`DaemonGone`).
+# The snapshot tells the two apart — a served attach always sends one first
+# — and what this leg pins is the words an agent actually parses.
+mkdir -p "$REFSTATE"
+XDG_STATE_HOME="$REFSTATE" "$MUXD" run --sock "$SOCK66" --shell /bin/sh > "$OUT.ref.d" 2>&1 &
+D66PID=$!
+defer_kill "$D66PID"
+wait_sock "$SOCK66" "$OUT.ref.d" "refused-attach daemon never bound"
+# Each verb twice over: the words it must say, and the words it must not.
+# The negative half is the whole regression — a reply that added "attach
+# refused" while still claiming a session ended would pass a one-sided grep.
+refuse_leg() {
+    _out="$OUT.ref$1"
+    _kind="$2"
+    shift 2
+    set +e
+    XDG_STATE_HOME="$REFSTATE" timeout 20 "$MUXA" "$@" --sock "$SOCK66" \
+        --session nosuch --timeout 5000 > "$_out" 2>&1
+    _rc=$?
+    set -e
+    [ "$_rc" -eq 1 ] || {
+        echo "e2e FAIL: refused-attach: muxa $1 on a missing session exited $_rc, want 1:"
+        cat "$_out"; exit 1; }
+    grep -qF '"error":"attach refused"' "$_out" || {
+        echo "e2e FAIL: refused-attach: muxa $1 did not name the refusal:"
+        cat "$_out"; exit 1; }
+    grep -qF 'so nosuch must already exist' "$_out" || {
+        echo "e2e FAIL: refused-attach: muxa $1 did not name the session asked for:"
+        cat "$_out"; exit 1; }
+    # Only the verbs that attach have two causes. status and capture never
+    # attach, so no client slot was ever asked for and none can be blamed:
+    # an agent sent to read `muxd stats` over a name it mistyped burns a
+    # round trip on a table that is not full.
+    if [ "$_kind" = attach ]; then
+        grep -qF 'room for one more client' "$_out" || {
+            echo "e2e FAIL: refused-attach: muxa $1 blamed absence for a refusal that has two causes:"
+            cat "$_out"; exit 1; }
+    else
+        grep -qF 'max_clients' "$_out" && {
+            echo "e2e FAIL: refused-attach: muxa $1 never attached, so it must not blame the client table:"
+            cat "$_out"; exit 1; }
+    fi
+    grep -qF 'session_ended' "$_out" && {
+        echo "e2e FAIL: refused-attach: muxa $1 still reports a session that ended:"
+        cat "$_out"; exit 1; }
+    grep -qF 'session ended' "$_out" && {
+        echo "e2e FAIL: refused-attach: muxa $1 still reports a session that ended:"
+        cat "$_out"; exit 1; }
+    grep -qF 'DaemonGone' "$_out" && {
+        echo "e2e FAIL: refused-attach: muxa $1 blamed the daemon for a missing name:"
+        cat "$_out"; exit 1; }
+    return 0
+}
+refuse_leg run attach run true
+refuse_leg status query status
+refuse_leg send attach send x
+# ...and the daemon that said no three times is still serving. Refusing is
+# an answer, not a fault: a daemon that died on a typed `--session` would
+# turn one bad name into everyone else's outage.
+XDG_STATE_HOME="$REFSTATE" timeout 20 "$MUXA" status --sock "$SOCK66" \
+    --session 0 > "$OUT.refalive" 2>&1 || {
+    echo "e2e FAIL: refused-attach: the daemon stopped answering after refusing:"
+    cat "$OUT.refalive"; exit 1; }
+grep -qF '"cols":' "$OUT.refalive" || {
+    echo "e2e FAIL: refused-attach: status on the live session is not a status reply:"
+    cat "$OUT.refalive"; exit 1; }
+assert_stopped "$SOCK66" "$D66PID" "refused-attach" "$OUT.refstop"
+D66PID=""
+rm -rf "$REFSTATE"
+ok "muxa names a refused attach instead of a shell that never ran"
+# --- the same ruling through the browser -------------------------------
+#
+# The hub's tiles attach at 0x0 — the passivity contract, so a browser can
+# never move a shared grid — and the daemon reads 0x0 as join-only. A saved
+# wall whose daemon has restarted was therefore a grid of dead tiles that
+# the CLI, reading the same file, brought back. The hub now births the
+# session on a connection of its own and re-dials; the browser re-attaches
+# on `up` as it does after any tear and is never told a refusal happened.
+#
+# The split is the hydrate leg's, asserted the other side of the wire: the
+# LOCAL line comes back, the `quic://` one still says refused. Same daemon,
+# same run, reached both ways, so the comparison is between two kinds of
+# line and not between two rigs.
+#
+# Daemon truth answers "was it created" — `muxa status` on a name the
+# daemon does not have exits non-zero, and the same probe runs BEFORE the
+# hub so the leg cannot pass vacuously. `sessions=1` at the end is the
+# other half: one birth, not two, and nothing born for the remote line.
+head -c 32 /dev/urandom > "$WGKEY"
+chmod 600 "$WGKEY"
+start_daemon "$SOCK67" "$OUT.wg.d" "web-restore daemon never bound" --shell /bin/sh \
+    --quic "127.0.0.1:$WGQPORT" --key "$WGKEY" --quic-idle-ms 15000
+D67PID=$DPID
+# Written by hand for the hydrate leg's reason: a line the hub had earned
+# by attaching would name a session that already exists, and there would be
+# nothing left for the restore to create.
+mkdir -p "$WGSTATE/mux"
+printf -- '--sock %s#wghost\nquic://127.0.0.1:%s#wghost2\n' \
+    "$SOCK67" "$WGQPORT" > "$WGWALL"
+# Vacuity guard: neither exists yet.
+for _wg in wghost wghost2; do
+    timeout 20 "$MUXA" status --sock "$SOCK67" --session "$_wg" > "$OUT.wgpre" 2>&1 && {
+        echo "e2e FAIL: web-restore: session $_wg existed before the hub ran:"
+        cat "$OUT.wgpre"; exit 1; }
+done
+# No argv: the hub restores the wall from the last run, which is the file
+# written above. Its own state home, never the developer's.
+XDG_STATE_HOME="$WGSTATE" "$MUXWEB" --port "$WGPORT" --key "$WGKEY" \
+    --quic-idle-ms 15000 > "$OUT.wgh" 2>&1 &
+W5PID=$!
+defer_kill "$W5PID"
+wait_for "$OUT.wgh" "serving" 10 || {
+    echo "e2e FAIL: web-restore: hub never reported serving"; cat "$OUT.wgh"; exit 1; }
+# Tile 0, the LOCAL line. `expectups 2` is the assertion that the hub
+# re-dialed: one `up` for the first dial, a second for the one after the
+# birth. Counted rather than read off the last state, because a
+# `reconnecting` → `up` pair can arrive inside one read and leave the last
+# state saying exactly what it said before. The second attach is the
+# browser's own — mux.js re-attaches on `up`, and nothing in the page
+# decides anything about creation. Both scripts wait for the first `up`
+# before attaching, for mux.js's reason: a message sent while the hub is
+# still dialing is dropped, and an attach nobody read is a refusal that
+# never arrives.
+# Bracketing the script below is what makes "one birth" measurable at all
+# — see the delta assertion after it.
+WGATT_A=$(attaches_now "$SOCK67")
+set +e
+timeout 60 "$WSCLIENT" --port "$WGPORT" --tile 0 --out "$OUT.wgws" --err "$OUT.wgws.err" <<'EOF'
+expectstate up 25000
+attach 0 0 wghost
+expectups 2 30000
+attach 0 0 wghost
+settle 500 20000
+send printf 'wg-%s\n' born\n
+expectgrid wg-born 25000
+dumpexit
+EOF
+RC=$?
+set -e
+[ "$RC" -eq 0 ] || {
+    echo "e2e FAIL: web-restore: the local tile's wsclient exited $RC"
+    cat -v "$OUT.wgws.err" 2>/dev/null; cat "$OUT.wgh"; exit 1; }
+WGATT_B=$(attaches_now "$SOCK67")
+# ONE birth. Counting sessions cannot say this: `resolveSession` is
+# attach-or-create, so a second birth would find `wghost` and join, and
+# the table would read 2 whether the hub birthed once or twenty times.
+# `attaches` can, because a REFUSED attach deliberately does not move it:
+# the two counted here are the birth's own and the browser's second one
+# (the first was refused). A hub that re-birthed on every refused re-dial
+# lands one extra per turn.
+assert_attach_delta "$WGATT_A" "$WGATT_B" 2 \
+    "web-restore: the hub birthed once for one refused tile"
+# Tile 1, the REMOTE line: the refusal is forwarded untouched, and the
+# fixture tells it from a shell exiting exactly as the page does — an
+# exit_status before any grid.
+set +e
+timeout 60 "$WSCLIENT" --port "$WGPORT" --tile 1 --out "$OUT.wgws2" --err "$OUT.wgws2.err" <<'EOF'
+expectstate up 25000
+attach 0 0 wghost2
+expectrefused 25000
+dumpexit
+EOF
+RC=$?
+set -e
+[ "$RC" -eq 0 ] || {
+    echo "e2e FAIL: web-restore: the remote tile's wsclient exited $RC"
+    cat -v "$OUT.wgws2.err" 2>/dev/null; cat "$OUT.wgh"; exit 1; }
+# Daemon truth: the local line's session exists, and at the size the birth
+# claimed — a browser tile claims none, so a session born at the tile's 0x0
+# would not have been born at all.
+timeout 20 "$MUXA" status --sock "$SOCK67" --session wghost > "$OUT.wgsta" 2>&1 || {
+    echo "e2e FAIL: web-restore: the saved local line did not come back:"
+    cat "$OUT.wgsta"; cat "$OUT.wgh"; exit 1; }
+# The size is asserted against the DAEMON's own default, not against a
+# literal: session 0 is seeded from `main.Opts` and this daemon was given
+# no --cols/--rows, so it holds exactly the figure `client.birth_cols` and
+# `client.birth_rows` claim to mirror. Grepping for 80x24 would pass just
+# as happily if both sides drifted together, which is the drift that
+# matters — nothing else links the two files.
+timeout 20 "$MUXA" status --sock "$SOCK67" --session 0 > "$OUT.wgsta0" 2>&1 || {
+    echo "e2e FAIL: web-restore: the daemon's own default session did not answer:"
+    cat "$OUT.wgsta0"; exit 1; }
+_wg_size() { sed -n 's/^{\("cols":[0-9]*,"rows":[0-9]*\).*/\1/p' "$1"; }
+WG_BORN=$(_wg_size "$OUT.wgsta")
+WG_DEFAULT=$(_wg_size "$OUT.wgsta0")
+[ -n "$WG_BORN" ] && [ -n "$WG_DEFAULT" ] || {
+    echo "e2e FAIL: web-restore: no size read out of muxa status"
+    echo "          born='$WG_BORN' default='$WG_DEFAULT' — the pin would be vacuous"
+    cat "$OUT.wgsta" "$OUT.wgsta0"; exit 1; }
+[ "$WG_BORN" = "$WG_DEFAULT" ] || {
+    echo "e2e FAIL: web-restore: the birth size drifted from muxd's own default"
+    echo "          wghost $WG_BORN, session 0 $WG_DEFAULT"
+    echo "          — client.birth_cols/birth_rows must mirror main.Opts"
+    exit 1; }
+# ...and it is a real shell: the marker the browser stand-in typed is the
+# created session's own work.
+grep -qF "wg-born" "$OUT.wgws" || {
+    echo "e2e FAIL: web-restore: the marker never reached the created session:"
+    cat "$OUT.wgws"; exit 1; }
+# The remote line created NOTHING. Same daemon, same file, same run.
+timeout 20 "$MUXA" status --sock "$SOCK67" --session wghost2 > "$OUT.wgghost" 2>&1 && {
+    echo "e2e FAIL: web-restore: a quic:// wall line created a session:"
+    cat "$OUT.wgghost"; exit 1; }
+# ...and nothing else was created behind either tile. Two, not one —
+# `muxd run` makes the default session at startup, so the birth is the
+# SECOND. How MANY births happened is the attach delta's claim above; this
+# one is that the table holds exactly the expected set.
+wait_sessions "$SOCK67" 2 "web-restore: the table holds the default session and wghost, nothing else"
+# ...and a shell the user ENDS stays ended. Every refusal closes the hub's
+# connection (`server.dropObserver` closes the fd), so `exit` reaches the
+# same refuse-after-redial shape the restore does: the daemon reaps the
+# session, the hub redials, the page re-attaches on `up`, and the attach is
+# refused because the session is gone. A hub that could not tell those two
+# apart hands the user a NEW shell every time they type `exit` — and with a
+# short-lived shell, one forked process per turn, forever. The CLI's answer
+# is `wallview`'s: its pump ends on an exit_status and the tile stays dead.
+#
+# The re-attach is spelled out here because it is the browser's, not the
+# hub's: mux.js sends it on `up`, and the fixture stands in for that.
+set +e
+timeout 60 "$WSCLIENT" --port "$WGPORT" --tile 0 --out "$OUT.wgws3" --err "$OUT.wgws3.err" <<'EOF'
+expectstate up 25000
+attach 0 0 wghost
+settle 500 20000
+send exit\n
+expectups 2 30000
+attach 0 0 wghost
+expectrefused 25000
+dumpexit
+EOF
+RC=$?
+set -e
+[ "$RC" -eq 0 ] || {
+    echo "e2e FAIL: web-restore: the exiting tile's wsclient exited $RC"
+    cat -v "$OUT.wgws3.err" 2>/dev/null; cat "$OUT.wgh"; exit 1; }
+# Daemon truth for the same claim: the session the user ended is gone and
+# stayed gone, and the daemon is back to the one session it started with.
+timeout 20 "$MUXA" status --sock "$SOCK67" --session wghost > "$OUT.wgexit" 2>&1 && {
+    echo "e2e FAIL: web-restore: typing exit got the user a new shell:"
+    cat "$OUT.wgexit"; exit 1; }
+wait_sessions "$SOCK67" 1 "web-restore: the ended session was not resurrected"
+softkill "$W5PID" || true
+wait_pid_gone "$W5PID" "web-restore: hub killed by tracked pid"
+W5PID=""
+assert_stopped "$SOCK67" "$D67PID" "web-restore" "$OUT.wgstop"
+D67PID=""
+rm -rf "$WGSTATE"
+ok "the browser wall restores a saved local line too, and still joins a remote one only"
+# --- a refusal the birth cannot fix must not spin ----------------------
+#
+# The other end of the restore rule: a line the daemon will not attach and
+# the hub may not create. `client.hydratedCreates` joins a remote spelling
+# and never births it, so nothing the hub can do makes this attach land.
+# Every refusal closes the connection (`server.dropObserver`), so the
+# re-dial that follows succeeds on its first try, the page re-attaches on
+# `up` as it always does, and the same no comes back — a connect/attach/
+# close loop bounded by nothing but round-trip latency, on the hub, the
+# daemon and the browser at once.
+#
+# Counted the one way the hub cannot flatter itself: a `.hand` dial forks
+# its own ssh, and the shim logs its pid before exec, so `wc -l` is a
+# count of PROCESSES the OS made. A hub counter would be the code under
+# test grading its own homework.
+start_daemon "$SOCK68" "$OUT.sp.d" "refusal-spin daemon never bound" --shell /bin/sh
+D68PID=$DPID
+# This shim ignores the remote command on purpose — it is not modelling
+# ssh (the M14 shim above does that), it is the dial's process signature
+# plus a byte pipe to a REAL daemon. `endpoint none` is what keeps every
+# dial on this path: an announced QUIC endpoint would be cached, the
+# second dial would skip ssh entirely, and the count with it.
+mkdir -p "$SPDIR"
+: > "$SPINLOG"
+cat > "$SPDIR/ssh" <<SPSHIM
+#!/bin/sh
+echo \$\$ >> "$SPINLOG"
+printf 'endpoint none\n'
+exec "$MUXD" proxy --sock "$SOCK68"
+SPSHIM
+chmod +x "$SPDIR/ssh"
+# One line, a HOST spelling, naming a session the daemon does not have:
+# the tile attaches at 0x0 (passivity), 0x0 cannot create, and a remote
+# line may not be birthed.
+mkdir -p "$SPSTATE/mux"
+printf 'mux-spin@127.0.0.1#spinghost\n' > "$SPSTATE/mux/wall"
+XDG_STATE_HOME="$SPSTATE" XDG_CACHE_HOME="$SPSTATE/cache" PATH="$SPDIR:$PATH" \
+    "$MUXWEB" --port "$SPPORT" > "$OUT.sph" 2>&1 &
+W6PID=$!
+defer_kill "$W6PID"
+wait_for "$OUT.sph" "serving" 10 || {
+    echo "e2e FAIL: refusal-spin: hub never reported serving"; cat "$OUT.sph"; exit 1; }
+# `reattach` is mux.js's ENV_CONTROL handler, which is the half of the
+# loop the hub does not own: the page attaches again on every `up`. Six
+# seconds of it, and the dial log is read the moment the window closes.
+set +e
+timeout 90 "$WSCLIENT" --port "$SPPORT" --tile 0 --out "$OUT.spws" --err "$OUT.spws.err" <<'EOF'
+expectstate up 25000
+reattach 0 0 6000 spinghost
+expectrefused 25000
+dumpexit
+EOF
+RC=$?
+set -e
+SPDIALS=$(wc -l < "$SPINLOG")
+[ "$RC" -eq 0 ] || {
+    echo "e2e FAIL: refusal-spin: the wsclient exited $RC after $SPDIALS dials"
+    cat -v "$OUT.spws.err" 2>/dev/null; cat "$OUT.sph"; exit 1; }
+# The bound, and its vacuity guard. Backoff caps at client.nextBackoffMs's
+# 2s, so six seconds of refusal is a handful of dials; unbounded it is one
+# per round trip, hundreds. The lower bound is what stops this passing on
+# a tile that never re-dialled at all — then the ceiling would be measuring
+# nothing.
+[ "$SPDIALS" -ge 3 ] || {
+    echo "e2e FAIL: refusal-spin: only $SPDIALS dials in 6s — the tile never"
+    echo "          re-dialled, so the ceiling below measured nothing"
+    cat "$OUT.sph"; exit 1; }
+[ "$SPDIALS" -le 15 ] || {
+    echo "e2e FAIL: refusal-spin: $SPDIALS dials in 6s (want <= 15) — a refusal"
+    echo "          the birth cannot fix is spinning with no backoff"
+    cat "$OUT.sph"; exit 1; }
+# ...and it stayed refused: nothing was born behind the hub's back, which
+# is what makes the count above a count of REFUSED dials.
+timeout 20 "$MUXA" status --sock "$SOCK68" --session spinghost > "$OUT.spghost" 2>&1 && {
+    echo "e2e FAIL: refusal-spin: a remote wall line created a session:"
+    cat "$OUT.spghost"; exit 1; }
+softkill "$W6PID" || true
+wait_pid_gone "$W6PID" "refusal-spin: hub killed by tracked pid"
+W6PID=""
+assert_stopped "$SOCK68" "$D68PID" "refusal-spin" "$OUT.spstop"
+D68PID=""
+rm -rf "$SPSTATE" "$SPDIR"
+ok "a refusal the birth cannot fix backs off instead of spinning"