[tony]

Observe an existing tmux daemon through a scoped Server, then process a detached Snapshot with ordinary Haskell records and collections. Failed and cancelled captures retain correlated recovery owners without replacing the original exception. The public observation API includes validated offline fixtures, installed examples and a scoped capture baseline. Broader performance qualification remains separate.

Summary

• Expose LibTmux, LibTmux.Server and LibTmux.Snapshot with sessions, physical windows and panes, attached clients, window links and pane occurrences.
• Share resource ownership through withRuntime and give each withServerIn adoption its own lifetime and recovery scope. Failed adoption can retain recovery before a Server exists.
• Keep acquisition in IO and graph navigation pure. Capture intervals, generation-bound references and indexed lookups make identity and observation scope explicit.
• Preserve primary callback failures and asynchronous cancellation across bounded cleanup. tryTmux returns the typed failure with its exception context and reachable recovery owners.
• Add receipts for logical, decoder and native read ownership; resume existing cleanup without redispatching commands.
• Add private per-handle shutdown with selected admission, queued non-dispatch outcomes and isolated physical/logical reports under the shared limits.
• Build validated offline snapshots through safe fixture references with identities distinct from every adopted endpoint.
• Provide an optional public-capture benchmark with owned workloads, raw samples and source/binary provenance, outside routine test loops.
• Add complete capture, offline-fixture and shared Runtime programs, an owned foreground-daemon fixture and isolated source-archive consumers. Pin installation examples to their implemented public APIs.
• Select cached tmux 3.8 for live documentation checks and retain endpoint-only integration CI.
• Summarize public snapshots, shared recovery, offline fixtures and the capture benchmark in the Unreleased changelog with the PR reference.

Receipts contain correlation metadata. Recovery annotations retain the owning runtime and server scope explicitly. Detaching logical uncertainty releases no native resources. Later proven completion preserves the original caller outcome.

The supported range remains tmux 3.3a through 3.8, inclusive. Routine CI exercises the two endpoints with GHC 9.14.1. MCP remains excluded.

Before this draft is ready

The public API and its bounded failure cases have independent review. Broader performance measurements remain follow-up work; native browser navigation is handled by #5 in the merge stack.

• Expose Server, Snapshot, Session, Window, Pane and contextual observations.
• Qualify the common Server scope's cleanup, cancellation and simultaneous callback/cleanup failures.
• Provide validated offline fixtures. Record access, qualified/selective imports, patterns and local updates compile.
• Run an installed capture/navigation example and use it in README and docs.
• Expose and qualify the advanced caller-owned Runtime scope.
• Measure capture cost for small, medium and large linked-window graphs on both tmux endpoints.
• Extend performance qualification to allocations, concurrent callers, active geometry/selection changes, long fields and cancellation latency.
• Extend the shared exporter to the seven public modules, preserving record owners, module reexports and source links.
• Resolve native Haddock's hidden-instance origins and repeated-record-label anchors; the shared adapter preserves ownership separately.
• Exercise fixture interruption during session creation before its pane receipt. Join its command client, observe daemon/pane exit independently and preserve the explicit unestablished-ownership diagnostic.
• Pass exact-head hosted CI on both tmux endpoints.
• Complete final public API review for the observation and shared Runtime increment.

Test plan

• Exercise the complete integration suite on both tmux endpoints with one and two RTS capabilities.
• Check accepted-read cancellation, timeout conversion and pre-publication request failure.
• Reject foreign receipts and recover retained native cleanup after decoder retirement.
• Verify selected-handle closure, supervisor refusal, detached native owners and overlapping global cleanup while keeping healthy peers usable.
• Preserve callback masking and application exception classes through the public shared Runtime scope; reject adoption after root closure.
• Demonstrate behavioral failures when recovery annotations, native ownership or generation validation are removed.
• Run specifications, properties, type contracts and documentation checks.
• Build Haddock and execute source-archive scalar, capture, offline-fixture and shared Runtime consumers and Haddock examples.
• Run the pinned capture, offline-fixture and shared Runtime programs from their immutable Git-source dependencies.
• Review source and archive identity independently.
• Observe owned daemon and pane exits after example callback failure and cancellation; observe daemon exit after setup fails before session dispatch.
• Reject an unbounded command cleanup wait and detect a missing join before test fallback cleanup can mask it.

Local unit/spec suites, displayed programs and source-archive consumers pass. Five fixture lifecycle checks pass on each tmux endpoint, including actual SIGINT during held session creation and an injected response/retirement failure. Deliberate regressions fail for the intended ownership and bounded-wait reasons. The fixture correction has independent source review.

Hosted CI for the current public Runtime implementation passes the build, both tmux endpoints and the required aggregate check.

Local endpoint and installed-consumer checks pass, including the shared Runtime program built from its pinned Git revision on both tmux endpoints. Independent source review found no material issue in the public scope, guide or fixture binding. Native Haddock declaration coverage passes; its navigation limits remain listed above. The scoped benchmark retains local evidence and independent review. Shared capacity, retained uncertainty and explicit cleanup waits keep their documented limits.

Companion PR

Shared Haskell registration has landed, and the first production site is published from the frozen scalar API source. The observation documentation follow-up adds native capture, snapshot, fixture and shared Runtime references and guides, with separate library/exporter provenance; it remains a draft awaiting qualification. Native merging does not publish the site: the caller workflow is dispatch-only, and publication from the expanded API waits for the compatible exporter.