ci: check wrapper model join and identity preservation

.github/workflows/tests.yml

@@ -1,31 +1,15 @@
 name: Tests
-
-# Builds, type-checks and runs every test suite on a clean GitHub runner, and records the file
-# list each published package would contain. Each suite is its own job so one failure does not
-# hide the others. No provider credentials or operator configuration are supplied.
-# Package suites deny external networking; scenario runtime has no external route.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
+on: workflow_dispatch
 permissions:
   contents: read
-
-concurrency:
-  group: tests-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  build-and-package:
+  model-wrapper:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: bb4b892e8d7e2ce47cf9f5b520804c0c1772dd45
           persist-credentials: false
       - uses: actions/setup-node@v4
         with:
@@ -33,110 +17,23 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run build
-      - name: Record the published file list of each package
+      - name: Composed wrapper identity regression
+        shell: bash
         run: |
-          set -euo pipefail
-          mkdir -p pack-lists
-          for p in cli daemon tui; do
-            (cd packages/$p && npm pack --dry-run --json --ignore-scripts) \
-              | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{for(const f of JSON.parse(s)[0].files)console.log(f.path)})' \
-              | sort > pack-lists/$p.txt
-            echo "$p: $(wc -l < pack-lists/$p.txt) files"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pack-lists
-          path: pack-lists/
-
-  typecheck:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-
-  repo-checks:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run test:repo
-
-  package-tests:
-    if: ${{ github.event_name != 'push' }}
-    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
-    # file-inode behaviour and release tags.
-    runs-on: macos-latest
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        package: [daemon, cli, tui, ui]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: brew install tmux
-      - run: npm ci
-      - name: Build the packages the tests import
-        run: npm run build
-      - name: Run the suite without ambient credentials or external network
-        run: |
-          suite_root=$(mktemp -d "$RUNNER_TEMP/opr-test.XXXXXX")
-          suite_root=$(cd "$suite_root" && pwd -P)
-          mkdir -p "$suite_root/home" "$suite_root/bin"
-          # Same system bytes, nonprivileged mode; no system file is changed.
-          /usr/bin/install -m 0755 /bin/ps "$suite_root/bin/ps"
-          # Only this job's temporary sockets (including tmux) are reachable.
-          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" \
-            CI=true TERM=xterm-256color \
-            sandbox-exec -D IPC_ROOT="$suite_root" -p '(version 1)(allow default)(deny network-outbound)(allow network-outbound (remote ip "localhost:*"))(allow network-outbound (subpath (param "IPC_ROOT")))' \
-            /bin/bash -s "${{ matrix.package }}" <<'SUITE'
-          set -euo pipefail
-          node scripts/ci-macos-process-probe.mjs
-          # The production readers use bare ps. Select real system bytes only after
-          # self/owned-child observation and network/IPC confinement are proved.
-          export PATH="$TMPDIR/bin:$PATH"
-          test "$(command -v ps)" = "$TMPDIR/bin/ps"
-          exec npm run test -w "packages/$1"
-          SUITE
-
-  installed-scenario:
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - name: Installed package, daemon restart, and seeded durability failure
-        run: bash scripts/run-pr-scenarios.sh
+          set +e
+          set -uo pipefail
+          mkdir -p proof
+          git rev-parse HEAD HEAD^{tree} > proof/source.txt
+          npm --workspace @openrig/daemon test -- test/current-model-reader.test.ts test/current-generation-record.test.ts test/seat-identity-reconciler.test.ts test/seat-attention-reconciler.test.ts test/model-divergence-monitor.test.ts test/seat-identity-pane-pid.test.ts test/migration-fixture-parity.test.ts test/startup-migrations-mirror.test.ts --reporter=verbose 2>&1 | tee proof/daemon.log
+          result=${PIPESTATUS[0]}
+          npm run lint 2>&1 | tee proof/typecheck.log
+          lint_result=${PIPESTATUS[0]}
+          git diff --exit-code > proof/source-unchanged.txt
+          printf 'daemon=%s\ntypecheck=%s\n' "$result" "$lint_result" > proof/exits.txt
+          test "$result" -eq 0 && test "$lint_result" -eq 0
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: installed-scenario-evidence
-          path: dist/pr-scenarios/
+          name: model-wrapper-green
+          path: proof/
           if-no-files-found: error

packages/daemon/src/db/all-migrations.ts

@@ -119,6 +119,7 @@ import { sessionAgentAppSchema as sessionCommunityHarnessSchema } from "./migrat
 import { threadSeatMapChannelKeySchema } from "./migrations/115_thread_seat_map_channel_key.js";
 import { providerAccountReadingsSchema } from "./migrations/117_provider_account_readings.js";
 import { humanQuietWindowsSchema } from "./migrations/118_human_quiet_windows.js";
+import { seatIdentityPanePidSchema } from "./migrations/119_seat_identity_pane_pid.js";
 
 /** Ordered migrations; numbers may be reserved by independent changes. */
 
@@ -237,4 +238,5 @@ export const ALL_MIGRATIONS: Migration[] = [
   threadSeatMapChannelKeySchema,
   providerAccountReadingsSchema,
   humanQuietWindowsSchema,
+  seatIdentityPanePidSchema,
 ];

packages/daemon/src/db/migrations/119_seat_identity_pane_pid.ts

@@ -0,0 +1,8 @@
+import type { Migration } from "../migrate.js";
+
+// observed_pid identifies the matched native process, which can be a child of the pane's shell.
+// Do not backfill the pane PID from it: old wrapper verdicts must be refreshed by the reconciler.
+export const seatIdentityPanePidSchema: Migration = {
+  name: "119_seat_identity_pane_pid.sql",
+  sql: "ALTER TABLE seat_identity_verdicts ADD COLUMN observed_pane_pid INTEGER;",
+};

packages/daemon/src/domain/model-divergence/current-generation-record.ts

@@ -42,7 +42,7 @@ export interface ClaudeOccupantRecordInput {
     verdict: string;
     sessionName: string | null;
     observedAt: string;
-    evidence: { registeredPane: string | null; observedPid: number | null };
+    evidence: { registeredPane: string | null; observedPid: number | null; observedPanePid?: number | null };
   } | null;
   sidecar: {
     session_id?: string;
@@ -111,7 +111,7 @@ export async function paneClaudeSessionIdArgument(
 
 /**
  * Resolve a Claude record only after the canonical seat's current occupant is joined to its
- * registered pane and the pane's PID still matches the durable identity verdict. The pane's launch
+ * registered pane and the pane's root and matched process still match the durable identity verdict. The pane's launch
  * argument is the legacy identity anchor. A generation-stamped sidecar may supersede it after a
  * provider-internal session rollover; an unstamped sidecar may locate files but cannot override it.
  */
@@ -151,10 +151,12 @@ export async function resolveIdentityVerifiedClaudeRecord(
   }
   const panePid = await deps.getPanePid(binding.tmuxPane);
   if (!panePid) return { ok: false, reason: `registered pane ${binding.tmuxPane} has no live pid` };
-  if (panePid !== identity.evidence.observedPid) {
+  // Legacy verdicts only recorded one PID; retain their old pane-root check until refreshed.
+  const verifiedPanePid = identity.evidence.observedPanePid ?? identity.evidence.observedPid;
+  if (panePid !== verifiedPanePid) {
     return {
       ok: false,
-      reason: `registered pane pid changed since identity verification (${identity.evidence.observedPid} -> ${panePid})`,
+      reason: `registered pane pid changed since identity verification (${verifiedPanePid} -> ${panePid})`,
     };
   }
 
@@ -163,6 +165,9 @@ export async function resolveIdentityVerifiedClaudeRecord(
   if (claudePids.length === 0) {
     return { ok: false, reason: `no claude process under verified pane ${binding.tmuxPane}` };
   }
+  if (identity.evidence.observedPid !== panePid && !claudePids.includes(identity.evidence.observedPid)) {
+    return { ok: false, reason: `verified claude process ${identity.evidence.observedPid} is no longer under pane ${binding.tmuxPane}` };
+  }
   const paneIds = new Set<string>();
   for (const pid of claudePids) {
     const command = processes.find((process) => process.pid === pid)?.command ?? "";

packages/daemon/src/domain/seat-attention-reconciler.ts

@@ -260,6 +260,7 @@ export async function rebindAndVerifyPaneIdentity(input: {
     evidence: {
       registeredPane: pane.id,
       observedPid: lineageMatch?.pid ?? pid,
+      observedPanePid: pid,
       observedCommand: lineageMatch?.command ?? command,
       matchedLayer: pid === null || runtimeAmbiguous || unconfirmed ? null : 1,
     },

packages/daemon/src/domain/seat-identity-reconciler.ts

@@ -344,7 +344,7 @@ export class SeatIdentityReconciler {
       return {
         ...base, verdict: verified ? "verified" : "mismatch",
         evidenceSource: "pane_process", reason: verified ? null : "process_identity_ambiguous",
-        evidence: { registeredPane: seat.tmux_pane, observedPid: native?.process.pid ?? pid,
+        evidence: { registeredPane: seat.tmux_pane, observedPanePid: pid, observedPid: native?.process.pid ?? pid,
           observedCommand: native?.process.command ?? command, matchedLayer: verified ? 1 : null },
       };
     }

packages/daemon/src/domain/seat-identity-store.ts

@@ -8,6 +8,7 @@ interface VerdictRow {
   reason: string | null;
   registered_pane: string | null;
   observed_pid: number | null;
+  observed_pane_pid: number | null;
   observed_command: string | null;
   matched_layer: number | null;
   session_name: string | null;
@@ -23,6 +24,7 @@ function rowToVerdict(row: VerdictRow): SeatIdentityVerdict {
     evidence: {
       registeredPane: row.registered_pane,
       observedPid: row.observed_pid,
+      ...(row.observed_pane_pid != null ? { observedPanePid: row.observed_pane_pid } : {}),
       observedCommand: row.observed_command,
       matchedLayer: row.matched_layer,
     },
@@ -50,14 +52,15 @@ export class SeatIdentityStore {
   upsert(v: SeatIdentityVerdict): void {
     this.db.prepare(`
       INSERT INTO seat_identity_verdicts
-        (node_id, verdict, evidence_source, reason, registered_pane, observed_pid, observed_command, matched_layer, session_name, observed_at)
-      VALUES (@node_id, @verdict, @evidence_source, @reason, @registered_pane, @observed_pid, @observed_command, @matched_layer, @session_name, @observed_at)
+        (node_id, verdict, evidence_source, reason, registered_pane, observed_pid, observed_pane_pid, observed_command, matched_layer, session_name, observed_at)
+      VALUES (@node_id, @verdict, @evidence_source, @reason, @registered_pane, @observed_pid, @observed_pane_pid, @observed_command, @matched_layer, @session_name, @observed_at)
       ON CONFLICT(node_id) DO UPDATE SET
         verdict = excluded.verdict,
         evidence_source = excluded.evidence_source,
         reason = excluded.reason,
         registered_pane = excluded.registered_pane,
         observed_pid = excluded.observed_pid,
+        observed_pane_pid = excluded.observed_pane_pid,
         observed_command = excluded.observed_command,
         matched_layer = excluded.matched_layer,
         session_name = excluded.session_name,
@@ -69,6 +72,7 @@ export class SeatIdentityStore {
       reason: v.reason,
       registered_pane: v.evidence.registeredPane,
       observed_pid: v.evidence.observedPid,
+      observed_pane_pid: v.evidence.observedPanePid ?? null,
       observed_command: v.evidence.observedCommand,
       matched_layer: v.evidence.matchedLayer,
       session_name: v.sessionName,

packages/daemon/src/domain/types.ts

@@ -613,7 +613,10 @@ export interface SeatIdentityVerdict {
     | null;
   evidence: {
     registeredPane: string | null;
+    /** PID of the matched process (a native child for wrapper launches). */
     observedPid: number | null;
+    /** Pane root observed in the same verdict; absent on legacy verdicts. */
+    observedPanePid?: number | null;
     observedCommand: string | null;
     matchedLayer: number | null;
   };

packages/daemon/test/current-model-reader.test.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { createFullTestDb, createTestApp } from "./helpers/test-app.js";
 import { RigRepository } from "../src/domain/rig-repository.js";
 import { SessionRegistry } from "../src/domain/session-registry.js";
+import { SeatIdentityReconciler } from "../src/domain/seat-identity-reconciler.js";
 import { SeatIdentityStore } from "../src/domain/seat-identity-store.js";
 import { ProcessCensus } from "../src/domain/process-census.js";
 import { CurrentModelReader } from "../src/domain/model-divergence/current-model-reader.js";
@@ -46,7 +47,7 @@ function fixture(runtime = "claude-code") {
     readAllPaneProcesses, census, now: () => boot + 60_000, native: { getPanePid, listProcesses: () => census.list(), readThreadIdByPid: thread },
   });
   const input = { nodeId: node.id, canonicalSessionName: "editor@studio", runtime, sessionStatus: "running" };
-  return { db, dir, rigs, rig, node, sessions, identities, session, tenure, boot, stamp, path, claudeRecord, reader, input, list, getPanePid, thread, processRows, readAllPaneProcesses };
+  return { db, dir, rigs, rig, node, sessions, identities, session, tenure, boot, stamp, path, id, claudeRecord, reader, input, list, getPanePid, thread, processRows, readAllPaneProcesses };
 }
 
 it("reports assistant-response evidence separately from the pin, with native time and no record contents", async () => {
@@ -274,3 +275,59 @@ it.each([false, true])("r3: retains observed PID-turnover reporting with a warme
   expect(await f.reader.observe(f.input)).toMatchObject({ status: "unknown", model: null, reason: "occupant-changed-during-read" });
   expect(f.getPanePid).toHaveBeenCalledTimes(3);
 });
+
+
+// Compose the real reconciler/store/record reader: a hand-seeded pane-PID verdict hides this bug.
+async function wrapperFixture() {
+  const f = fixture();
+  f.db.prepare("UPDATE sessions SET resume_token = ? WHERE id = ?").run(f.id, f.session.id);
+  const rows = [
+    { pid: 10, ppid: 1, pgid: 10, tpgid: 20, executableName: "sh", command: "sh", startedAt: f.stamp },
+    { pid: 20, ppid: 10, pgid: 20, tpgid: 20, executableName: "claude", command: `claude --resume ${f.id}`, startedAt: f.stamp },
+  ];
+  f.list.mockImplementation(async () => rows);
+  const reconciler = new SeatIdentityReconciler({ db: f.db, now: () => new Date(f.stamp), listProcesses: f.list,
+    tmux: { listSessions: async () => [{ name: "editor@studio" }], getPanePid: f.getPanePid,
+      getPaneCommand: async () => "sh" } as never });
+  await reconciler.reconcileAll();
+  expect(f.identities.getForNode(f.node.id)).toMatchObject({ verdict: "verified", evidence: { observedPid: 20 } });
+  const seat = { nodeId: f.node.id, sessionName: "editor@studio", runtime: "claude-code", generation: f.tenure.generationUuid,
+    rigId: f.rig.id, rigName: "studio", pinnedModel: "configured-model" };
+  return { ...f, rows, reconciler, seat };
+}
+
+it("reads the response model through a persisted wrapper-root/Claude-child verdict", async () => {
+  const f = await wrapperFixture();
+  expect(await f.reader.readEffectiveModel(f.seat)).toEqual({ ok: true, model: "response-model" });
+  expect(await f.reader.observe(f.input)).toMatchObject({ status: "observed", model: "response-model" });
+});
+
+it("the wrapper join ignores a newer retained predecessor record and process outside its pane", async () => {
+  const f = await wrapperFixture();
+  const priorId = "22222222-2222-4222-8222-222222222222", priorPath = join(f.dir, `${priorId}.jsonl`);
+  writeFileSync(priorPath, f.claudeRecord(new Date(f.boot + 3_000).toISOString(), "predecessor-model"));
+  f.rows.push({ pid: 30, ppid: 1, pgid: 30, tpgid: 40, executableName: "sh", command: "sh", startedAt: f.stamp },
+    { pid: 40, ppid: 30, pgid: 40, tpgid: 40, executableName: "claude", command: `claude --resume ${priorId}`, startedAt: f.stamp });
+  const { resolveIdentityVerifiedClaudeRecord } = await import("../src/domain/model-divergence/current-generation-record.js");
+  expect(await resolveIdentityVerifiedClaudeRecord({ sessionName: f.seat.sessionName, generation: f.seat.generation,
+    occupantBootAt: f.tenure.bootAt, binding: { tmuxSession: f.seat.sessionName, tmuxPane: "%1" },
+    identity: f.identities.getForNode(f.node.id), sidecar: { session_name: f.seat.sessionName, session_id: priorId,
+      transcript_path: priorPath, sampled_at: f.stamp, occupant_generation: "retained-generation" } },
+  { getPanePid: f.getPanePid, listProcesses: f.list }, () => true)).toMatchObject({ ok: true, id: f.id, path: f.path,
+    source: "verified-pane-argument" });
+});
+
+it.each(["child-replaced", "child-moved", "pane-replaced", "binding-changed", "old-verdict"])(
+  "does not read a wrapper record after %s", async kind => {
+    const f = await wrapperFixture();
+    if (kind === "child-replaced") f.rows[1]!.pid = 21;
+    if (kind === "child-moved") f.rows[1]!.ppid = 99;
+    if (kind === "pane-replaced") {
+      f.getPanePid.mockResolvedValue(99);
+      f.rows[0]!.pid = 99; f.rows[1]!.ppid = 99;
+    }
+    if (kind === "binding-changed") f.sessions.updateBinding(f.node.id, { tmuxSession: "editor@studio", tmuxPane: "%2" });
+    if (kind === "old-verdict") f.identities.upsert({ ...f.identities.getForNode(f.node.id)!, observedAt: new Date(f.boot - 1_000).toISOString() });
+    expect((await f.reader.readEffectiveModel(f.seat)).ok).toBe(false);
+  },
+);

packages/daemon/test/helpers/seed-host-shaped.ts

@@ -1,3 +1,4 @@
+import { seatIdentityPanePidSchema } from "../../src/db/migrations/119_seat_identity_pane_pid.js";
 // Host-shaped synthetic seeder for the /api/ps + /api/rigs/summary event-loop
 // regression asset (qitem-20260721000001-ps-stall-driver, slice-04).
 //
@@ -61,7 +62,7 @@ import { sessionStopIntentSchema } from "../../src/db/migrations/103_session_sto
 // index-independent).
 export function createMigratedDb(): Database.Database {
   const db = createDb();
-  migrate(db, [coreSchema, bindingsSessionsSchema, eventsSchema, snapshotsSchema, checkpointsSchema, resumeMetadataSchema, nodeSpecFieldsSchema, packagesSchema, installJournalSchema, journalSeqSchema, bootstrapSchema, discoverySchema, discoveryFkFix, agentspecRebootSchema, startupContextSchema, chatMessagesSchema, podNamespaceSchema, contextUsageSchema, externalCliAttachmentSchema, rigServicesSchema, seatHandoverObservabilitySchema, nodeCodexConfigProfileSchema, nodePermissionPolicySchema, rigPermissionPolicySchema, nodePolicyProvenanceSchema, rigPolicyProvenanceSchema, streamItemsSchema, queueItemsSchema, queueTransitionsSchema, rigPolicySchema, rigArchiveSchema, resumeProvenanceSchema, resumeVerificationSchema, seatIdentityVerdictsSchema, eventsNodeTypeIndexSchema, sessionsNodeIdIndexSchema, occupantTenuresSchema, sessionStopIntentSchema]);
+  migrate(db, [coreSchema, bindingsSessionsSchema, eventsSchema, snapshotsSchema, checkpointsSchema, resumeMetadataSchema, nodeSpecFieldsSchema, packagesSchema, installJournalSchema, journalSeqSchema, bootstrapSchema, discoverySchema, discoveryFkFix, agentspecRebootSchema, startupContextSchema, chatMessagesSchema, podNamespaceSchema, contextUsageSchema, externalCliAttachmentSchema, rigServicesSchema, seatHandoverObservabilitySchema, nodeCodexConfigProfileSchema, nodePermissionPolicySchema, rigPermissionPolicySchema, nodePolicyProvenanceSchema, rigPolicyProvenanceSchema, streamItemsSchema, queueItemsSchema, queueTransitionsSchema, rigPolicySchema, rigArchiveSchema, resumeProvenanceSchema, resumeVerificationSchema, seatIdentityVerdictsSchema, eventsNodeTypeIndexSchema, sessionsNodeIdIndexSchema, occupantTenuresSchema, sessionStopIntentSchema, seatIdentityPanePidSchema]);
   return db;
 }
 

packages/daemon/test/helpers/test-app.ts

@@ -1,3 +1,4 @@
+import { seatIdentityPanePidSchema } from "../../src/db/migrations/119_seat_identity_pane_pid.js";
 import { rigInstallRootSchema } from "../../src/db/migrations/096_rig_install_root.js";
 import { threadPartMapSchema } from "../../src/db/migrations/097_thread_part_map.js";
 import { queueTransitionsQitemIdOrderSchema } from "../../src/db/migrations/098_queue_transitions_qitem_id_order.js";
@@ -134,7 +135,7 @@ import fs from "node:fs";
 
 /** Seam B R6: the canonical full-fixture migration list, exported so file-backed
  *  DB-reopen tests migrate IDENTICALLY to createFullTestDb. */
-export const migrationsForFullTestDb = [coreSchema, bindingsSessionsSchema, eventsSchema, snapshotsSchema, checkpointsSchema, resumeMetadataSchema, nodeSpecFieldsSchema, packagesSchema, installJournalSchema, journalSeqSchema, bootstrapSchema, discoverySchema, discoveryFkFix, agentspecRebootSchema, startupContextSchema, chatMessagesSchema, podNamespaceSchema, contextUsageSchema, externalCliAttachmentSchema, rigServicesSchema, seatHandoverObservabilitySchema, nodeCodexConfigProfileSchema, nodePermissionPolicySchema, rigPermissionPolicySchema, nodePolicyProvenanceSchema, rigPolicyProvenanceSchema, streamItemsSchema, queueItemsSchema, queueTransitionsSchema, rigPolicySchema, rigArchiveSchema, resumeProvenanceSchema, resumeVerificationSchema, seatIdentityVerdictsSchema, selfHostIdentitySchema, occupantTenuresSchema, daemonLifecycleSchema, watchdogJobsSchema, occupantGenerationStampsSchema, projectionManifestSchema, watchdogTargetGenerationSchema, appliedLaunchObservationsSchema, appliedLaunchObservationInvalidationsSchema, threadSeatMapSchema, queueTransitionWakesSchema, nodeSessionSourceSchema, scopedOperatingPostureSchema, humanNotificationIntentSchema, reviewReadIndexesSchema, inventoryEventIndexesSchema, rigClaudeManagedBlockFileSchema, nodePermissionSelectionsSchema, humanReplyToSchema, humanQuestionsSchema, nodeEffortSchema, rigNonInterruptiveSchema, rigInstallRootSchema, threadPartMapSchema, queueTransitionsQitemIdOrderSchema, queueItemsRecoveryTagsSchema, resumeRotationSchema, sessionStopIntentSchema, nodeEffortChoiceSchema, modePostureCoexistSchema, seatEnvSchema, appliedLaunchDaemonOptOutSchema, sessionCommunityHarnessSchema, threadSeatMapChannelKeySchema, providerAccountReadingsSchema, humanQuietWindowsSchema];
+export const migrationsForFullTestDb = [coreSchema, bindingsSessionsSchema, eventsSchema, snapshotsSchema, checkpointsSchema, resumeMetadataSchema, nodeSpecFieldsSchema, packagesSchema, installJournalSchema, journalSeqSchema, bootstrapSchema, discoverySchema, discoveryFkFix, agentspecRebootSchema, startupContextSchema, chatMessagesSchema, podNamespaceSchema, contextUsageSchema, externalCliAttachmentSchema, rigServicesSchema, seatHandoverObservabilitySchema, nodeCodexConfigProfileSchema, nodePermissionPolicySchema, rigPermissionPolicySchema, nodePolicyProvenanceSchema, rigPolicyProvenanceSchema, streamItemsSchema, queueItemsSchema, queueTransitionsSchema, rigPolicySchema, rigArchiveSchema, resumeProvenanceSchema, resumeVerificationSchema, seatIdentityVerdictsSchema, selfHostIdentitySchema, occupantTenuresSchema, daemonLifecycleSchema, watchdogJobsSchema, occupantGenerationStampsSchema, projectionManifestSchema, watchdogTargetGenerationSchema, appliedLaunchObservationsSchema, appliedLaunchObservationInvalidationsSchema, threadSeatMapSchema, queueTransitionWakesSchema, nodeSessionSourceSchema, scopedOperatingPostureSchema, humanNotificationIntentSchema, reviewReadIndexesSchema, inventoryEventIndexesSchema, rigClaudeManagedBlockFileSchema, nodePermissionSelectionsSchema, humanReplyToSchema, humanQuestionsSchema, nodeEffortSchema, rigNonInterruptiveSchema, rigInstallRootSchema, threadPartMapSchema, queueTransitionsQitemIdOrderSchema, queueItemsRecoveryTagsSchema, resumeRotationSchema, sessionStopIntentSchema, nodeEffortChoiceSchema, modePostureCoexistSchema, seatEnvSchema, appliedLaunchDaemonOptOutSchema, sessionCommunityHarnessSchema, threadSeatMapChannelKeySchema, providerAccountReadingsSchema, humanQuietWindowsSchema, seatIdentityPanePidSchema];
 
 /**
  * P24 — the DECLARED exclusions for {@link migrationsForFullTestDb}. That list is deliberately a

packages/daemon/test/seat-identity-pane-pid.test.ts

@@ -0,0 +1,29 @@
+import Database from "better-sqlite3";
+import { expect, it } from "vitest";
+import { migrate } from "../src/db/migrate.js";
+import { seatIdentityVerdictsSchema } from "../src/db/migrations/046_seat_identity_verdicts.js";
+import { seatIdentityPanePidSchema } from "../src/db/migrations/119_seat_identity_pane_pid.js";
+import { SeatIdentityStore } from "../src/domain/seat-identity-store.js";
+
+it("upgrades legacy verdicts without inventing a pane root from the native child PID", () => {
+  const db = new Database(":memory:");
+  try {
+    migrate(db, [seatIdentityVerdictsSchema]);
+    db.prepare(`INSERT INTO seat_identity_verdicts
+      (node_id, verdict, observed_pid, observed_at) VALUES ('legacy', 'verified', 20, '2026-10-01T00:00:00Z')`).run();
+    migrate(db, [seatIdentityVerdictsSchema, seatIdentityPanePidSchema]);
+    const store = new SeatIdentityStore(db);
+    expect(db.prepare("SELECT observed_pid, observed_pane_pid FROM seat_identity_verdicts").get())
+      .toEqual({ observed_pid: 20, observed_pane_pid: null });
+    expect(store.getForNode("legacy")!.evidence).not.toHaveProperty("observedPanePid");
+    const verdict = { ...store.getForNode("legacy")!, evidence: { registeredPane: "%1", observedPid: 20,
+      observedPanePid: 10, observedCommand: "claude", matchedLayer: 1 } };
+    store.upsert(verdict);
+    expect(store.getForNode("legacy")!.evidence).toEqual(verdict.evidence);
+    // A later unavailable observation must clear both PIDs, not retain an old root.
+    store.upsert({ ...verdict, verdict: "tmux_unavailable", reason: "tmux_unavailable",
+      evidence: { registeredPane: "%1", observedPid: null, observedCommand: null, matchedLayer: null } });
+    expect(db.prepare("SELECT observed_pid, observed_pane_pid FROM seat_identity_verdicts").get())
+      .toEqual({ observed_pid: null, observed_pane_pid: null });
+  } finally { db.close(); }
+});