Two canonical facts: the seat's agmsg id and its current pane. Everything else is derived, and the seat writes it

[fujibee]

A day of repairs to team --fix kept producing the same shape of bug, and the
shape follows from where the authority sits rather than from any of the
individual defects.

Today: the hook short-circuited on an environment it should not trust (#1130);
--fix followed a record into another seat's pane (#1131); it declined a seat
with no record at all (#1140); it could not search tmux from outside a pane
(#1146); it counted a malformed row and suppressed a valid one (#1134); and two
seats claiming one pane went unreported (#1144). Every one of those is
arbitration -- deciding whose claim about a pane is right when several writers
disagree.

There is no need to arbitrate if only one writer exists.

The change

Make correcting a seat's own identity a command the seat runs about itself,
and nothing else. A leader who wants the fleet corrected pokes every seat to run
it. Messaging does not consult the placement record -- verified: send.sh never
reads it, and a seat with no record at all was reachable all day -- so telling a
broken seat to fix itself does not depend on the thing that is broken.

What that deletes:

• resolving another seat's pane, in every form
• the guard that decides whether a seat may take a pane another record claims
• searching terminals from outside a pane
• writing to the pane a record names, which is the operation that nearly
  destroyed a live seat's label today

What remains is small: a seat derives its own pane, writes its own three cells,
and a leader fans out. Fan-out becomes an instruction rather than code, so the
command carries no waiting, no aggregation and no timeout.

What it rests on

A seat must always be able to derive its own pane. The environment does not
provide that: it reports where the process runs, which for a CLI reached
through a shared server is not the seat's pane. Output does -- a tool's output is
rendered into the seat's own pane wherever it executed. Measured: two seats whose
environments named the same pane echoed a token into two different panes, each its
own. That is #1124, and it is the prerequisite.

The honest exception is a terminal with no addressable pane (plain), where the
answer is unsupported rather than a guess.

What is not solved by this

A seat that does not answer. Its row stays stale, and nothing should invent a
correction -- guessing is how wrong records get written. What a leader needs is to
see it: which seats answered and which did not. Today, work dispatched to two
names arrived at neither, and nothing said so for hours. That is #1144, and it
stays read-only.

A seat that can derive its pane but cannot write every cell -- a sandbox refusing
terminal operations -- records itself and fails to label. Measured on a live seat:
echo and writing a file are permitted, renaming the pane is not. So "fix
yourself" is the rule and labelling from outside is the exception, rather than
everything being done from outside as it is now.

Sequencing

Not a refactor to start under release pressure, and there is none: this addressing
mechanism is the base for the daemon work, so it is worth getting right before
more is built on it. #1124 first, measured to the end -- what a seat emits so it
cannot be confused with content, how deep the scan reads, what two simultaneous
probes do. The inversion follows from it.

[fujibee]

One more simplification, and it removes the last fleet-shaped thing.

The leader chooses who to poke, per situation -- one seat, a few, everyone. So the
command needs no notion of a fleet at all: not "which seats exist", not "which are
live", not "broadcast". It corrects the seat it runs in, and that is the whole of
it.

Worth stating because the current shape is the opposite and it was dangerous
today. Running the repair across a whole team meant touching panes belonging to
seats nobody was thinking about: one seat's record pointed into another's pane,
and the repair was one step from overwriting a correct label with the wrong
seat's name. With the leader naming targets, blast radius is something chosen
rather than something inherited from a roster.

It also means the fleet-wide view and the repair stop being the same command.
Seeing the fleet -- who collides, whose pane is empty, who did not answer -- is
reading, and belongs where reading belongs (#1144). Repair is one seat acting on
itself. Today those are fused, which is why a report that is true per seat implies
a fleet-level claim that is not.

[fujibee]

Two conditions on doing this, from the person asking for it.

The old code gets deleted, not left dormant

The point of the inversion is that a layer stops existing. Leaving it in place
unreachable reproduces the same confusion in a quieter form: the next reader
cannot tell which path is live, and a later change re-animates a branch nobody
meant to keep. So the sweep is part of the work, not a follow-up.

What should not survive it:

• resolving another seat's pane, in any form
• the guard that arbitrates whether a seat may take a pane another record claims
• searching terminals from outside a pane
• any write to the pane a record names, as opposed to the pane a seat reports

That last one is the operation that came closest to doing damage today: one
seat's record pointed into another seat's pane, and the repair was one step from
writing the wrong name over a correct one.

Tests are part of the sweep too. Several were written to pin arbitration
behaviour; those go with it. The ones worth keeping are the ones that pin a
hazard rather than a mechanism -- that a pane id never reaches a record without
its server, for instance -- and they should be rewritten against the new shape
rather than deleted, the way the no-$TMUX canary was turned over rather than
removed.

There is a revert point

Tagged pre-self-fix-inversion at e786515a1d6f4bf16f93898731100b265cbcdaea,
the integration tip with the full day's work in it. A tag rather than a note, so
it survives whatever the branches do next.

[fujibee]

The sharpest form of it, and the one to build against.

Two facts are canonical. Nothing else is.

agmsg id       the seat knows it -- actas gave it
current pane   the seat derives it -- from its environment, or from its output

Everything else is a projection the seat writes from those two:

pane label          <team>:<agent>
agent key           derived from team and agent
placement record    <terminal>:<pane>
CLI session name    <team>-<agent>

Nothing reads a projection to decide anything. If a projection disagrees it is
overwritten -- there is no one to arbitrate with, because both canonical facts are
in the seat's own hands.

This explains the shape of every defect from the last two days. We were treating
projections as sources of truth and arbitrating between them: whose record names
this pane, is the label trustworthy, which of the two do we believe. All of it was
projections quarrelling with each other. Two of them even agreed with each other
while both were wrong, which is what made the short-circuit in #1130 possible --
consistency among derived values reads as being correct.

A seat that cannot derive its current pane is the only genuinely undefined case,
and it is narrow: a terminal with no addressable pane at all, where the honest
answer is unsupported. Everywhere else the pane is derivable, from the
environment when the writing process is inside it and from output when it is not
(#1124).

Fan-out needs nothing new. A leader who wants several seats corrected tells them,
by message or poke -- both already exist, and neither reads the placement record,
so they reach a seat whose projections are broken.

[fujibee]

Measured, while trying to establish whether a CLI reached through a shared app-server can determine its own pane.

A probe was run from one such seat: from its watcher process, rename / prompt / read its own pane. All three operations returned success. The pane they acted on belonged to a different seat.

pane A    label = <seat 1>     session 01a07ae0-...
pane B    label = <seat 2>     session 01a0732d-...   <- the seat running the probe

The probe took its target from the inherited pane id, which is the value under
dispute: every seat under one shared server reads the same one. So it addressed
pane A while being in pane B, renamed pane A's label, typed into it, read it back,
restored the label, and reported that no other seat had been touched. Its own
report contained the disproof — the label it restored was the other seat's name.

Two conclusions, which are different:

• A watcher process can rename, prompt and read a pane. This is established.
• A seat can identify its own pane from the environment. This is not, and the run is one more instance of the opposite.

A probe that reaches its subject through the value it is testing can only confirm
that value. The replacement is the discriminating form: two seats, separate
nonces, each finding its own exactly once and the other's zero times, with the
inherited id excluded from target selection entirely. Zero cross-hits only counts
once the own-hit is exactly one — otherwise "not found" and "not looked at" are
the same observation.

There was also residual damage worth recording, because it affects how any
cross-seat probe should be written. The touched seat lost its terminal agent key:
the probe restored the label and not the key, and the two are set by separate
calls. It has been restored. The first check for it read a field absent from that
output and reported nothing wrong — a healthy control seat reported the same
nothing. Reading it the way the driver does, with four healthy seats in the same
observation, showed one at null and the rest with keys.

For the design this is direct support for the premise: location has to come from
output, not from the environment. A seat's output is rendered into its own pane
regardless of where the process runs; the environment reports where the process
runs, which for this configuration is somebody else's pane.

[fujibee]

Measured, with two seats and a discriminating control. This settles the premise the design rests on.

Two CLI seats reached through one shared app-server each generated a token at runtime, emitted it, and reported where they believed they were. An observer outside both seats then scanned all 38 panes for each token independently.

                  believed location        token actually appeared in     other seat's token
  seat 1          pane P   (from the       pane P                         0 panes
                           agent list)
  seat 2          pane P   (from the       pane Q                         0 panes
                           inherited env)

Both read 1 distinct pane, 0 unreadable, across 38 panes.

• The environment failed, and failed silently. Two seats that are in different panes reported the same location, and for one of them it was a third seat's pane. Nothing in the answer indicates it is wrong; the value is present, well-formed and confidently returned. This is the same wrong value a third seat acted on earlier today, which is what makes it a property of the configuration rather than one seat's accident.
• Output location worked, and discriminated. The two tokens landed in two different panes, each the seat's real one, with zero cross-appearances. Instances that should differ produced differing answers — which is exactly what the environment could not do.

So a seat can determine its own pane, provided it derives it from where its own output appears rather than from what the environment reports. That is the premise this issue is built on, and it is now measured rather than assumed.

Two limits worth stating plainly:

• Each seat's single hit cannot be separated into "the declared emit path rendered" versus "some other command this seat ran rendered its text". Both are the seat's own action, so the location conclusion holds either way, but the declared emit path is not thereby proven to render and needs its own check.
• A seat reading its own pane gets only the visible screen regardless of the requested depth, while reading another pane returns scrollback (779 → 8397 → 20981 bytes as depth increases). A token a seat prints for itself is therefore only findable while it is still on screen.

One methodology note, because it invalidated an earlier round of this measurement: a long token wraps across lines in a narrow pane, and a whole-string match then finds nothing anywhere — including where the token demonstrably is. Both controls passed, because the control string was short enough not to wrap. Matching with whitespace removed found it immediately. Any scan of pane text needs a control built to resemble the real needle, not merely one known to be present.