Pending messages: a session replaced inside the same pane is not noticed when the agent reports no native session #540

Found by a Codex adversarial pass during the review of #520 (bridge-owned pending messages). Not fixed there; reported here so it is not lost. It does not block #520.

What happens

A pending message is bound to the pane's agent by pendingIdentity() in server/index.ts: the agent name, the terminal_id, and herdr's native agent_session (kind:source:value), or null when herdr reports none. Before the paste and before Enter, pendingContext() compares that identity with the pane's current one and refuses with pending_target_changed when they differ.

For an agent without a native session reference both sides are agent / same terminal / null, so a session change inside the same pane is not seen:

• An OmO pane. OmoStatus (server/omo-status.ts) does discover the session (sessionOf()), but apply() projects only the agent name and status into the snapshot, so the discovered session never reaches the comparison.
• A hookless Claude Code pane (server/claude-session.contract.test.ts, "reads each hookless Claude pane's own conversation in a shared cwd": agent_session is undefined).

Sequence: a connection queues a message while the agent works. The session in that pane is replaced (a new session started from the terminal or another client, a resume) while the pane and the attachment stay. When the new session becomes ready, the bridge delivers the old session's message into it.

Impact

The message goes to the same pane, the same agent process and the same user, but into a different conversation. No other connection gains anything.

Why it was left out of #520

• Pinning OmO's discovered session can hold a message wrongly when the session is discovered only after the message was queued (null at enqueue, known at delivery).
• A hookless Claude pane has no stable identity to pin at all, so "refuse when no identity can be established" would turn the feature off for it.

Possible fix

• Carry the discovered session identity into pendingIdentity() where one exists (OmO), and compare only when both sides know it.
• Decide what a pane with no identity at all should do: deliver as today, or hold for an explicit Send now once anything suggests the session changed (for example a transcript file that is not the one read at enqueue).
• A contract test that changes the session without replacing the attachment.