[nwparker]

	Files	Added	Deleted	Net
Test	581	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​11453	$\color{#cf222e}{\Huge{\mathbf{−}}}$​11934	$\color{#cf222e}{\Huge{\mathbf{−}}}$​481
Prod	592	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​23103	$\color{#cf222e}{\Huge{\mathbf{−}}}$​15900	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​7203

ELI5

You have a terminal split in two on a paired Orca server. From your phone, another desktop, or the server itself, someone moves one half of the split into its own tab. Before this change, your desktop showed that terminal twice: once in the new tab, and again in the old tab next to its former neighbour. Now the old tab drops the moved pane, and the terminal keeps running in its new tab.

What Changed

• Before: the new tab bound to the right terminal, but the source tab kept the moved pane too. Its saved layout still held both panes, and its pane manager still drew 2 panes, even after switching tabs. Typing in either copy reached the same terminal.
• After: the source tab shows 1 pane, and the new tab shows the moved pane with its scrollback. The terminal is not restarted.

Two client-side paths each kept the stale pane, so both are fixed (1 and 2 below). Items 3 and 4 keep that fix from breaking this window's own optimistic move.

1. Orphan recovery (web-session-terminal-orphan-recovery-surface.ts). When a host snapshot stops naming a pane this window has, recovery treats the pane as a possible orphan. It asks the host whether that terminal is still alive, and if so it puts the pane back into its old tab. A moved terminal is alive, so recovery put it back. The fix: if the same snapshot shows that terminal handle ready in a different tab, the old binding is stale, not an orphan. Recovery skips it, makes no terminal.list call, and the source tab's layout comes from the host alone.

2. Pane reconcile (use-terminal-pane-reconciliation.ts, selectRetiredPaneIds). When the host drops a leaf, the mounted pane manager used to close only panes whose PTY had already ended, so a live moved pane stayed on screen. Now a retired pane whose PTY another tab of the same workspace binds is detached with detachPaneForExternalMove. That is the same no-kill path a local drag-out uses. The PTY keeps running for its new tab, and the last pane of a tab is still never removed.

3. This window's own move (pending-host-pane-moves.ts). A pane this window is moving through fix(terminal): a pane moved to a new tab stays moved on paired servers #33027's host move is marked until the move settles. Until then, a host snapshot taken before the host had the move can't read the new tab's binding as stale. Without the mark, that snapshot would drop the new tab.

4. Agent records. A pane detached this way also gives up its agent status records under the source tab, so the source tab doesn't keep the moved agent's badge. The one exception is a source key this window already aliased to the new tab, which is left alone so the live target keeps its records.

5. This window's own move, after the reply. The host can reply before its snapshot of the move arrives. A move the host committed now stays marked until a host frame shows the pane in its new tab. Otherwise an older snapshot arriving after the reply could still drop the new tab. Only the raw host frame counts as confirmation, not rows that recovery keeps for this window. If that frame arrives before the reply, the reply does not mark the move again. If drawing the move throws, the mark is released.

Both checks rely only on what the host publishes, so they cover a move from a phone, from another desktop, or from the host's own window.

Why

The host already decides which tab holds each pane, and its snapshot after the move is correct (session.tabs.list shows each leaf alone in its own tab). The client was overriding it in two places. Fixing it at those two places makes every source of the move behave the same, without a new message or capability.

Alternatives considered:

• Close the old pane. That kills the terminal the new tab shows.
• Have each moving client notify the others. That needs a new opcode, and it would still miss moves made on the host itself.

Mixed versions: client-only and wire-neutral. Older hosts that can't move panes never publish one terminal in two tabs, so nothing changes for them. An older client keeps today's behaviour.

Mobile: checked. The phone rebuilds its terminal list from each snapshot's rows and has no orphan retention, so it never showed the duplicate. The web client uses the same renderer code as the desktop, so this fix covers it.

Folder workspaces / SSH: the change doesn't depend on git or the transport. It keys off the tab, leaf and PTY ids in the host snapshot.

Found while fixing #32939 (the window-side move in #33027). There's no separate issue. This PR is stacked on #33027 because its e2e calls session.tabs.movePaneToNewTab, which #33027 adds.

Known limit: a committed-move mark clears only when a host frame names the pane in its new tab. If the host never publishes that tab, for example because it closes before its first frame arrives, the mark stays for that pane key. The cost is that a later move of that same pane by another client is not detected as stale. Tab ids are unique per tab, so no other pane is affected.

Follow-up (not in this PR): when another client moves a pane, this window retires the source pane's agent records, and the host republishes the agent's status under the new tab. Local-only records (unread marks, launch config, sleeping state) do not follow the pane yet. An attempt to transfer them was dropped from this PR because it raced with snapshot freshness.

Linked Issue

No issue. Found while fixing #32939; it builds on #33027.

Visual Proof

N/A. This removes a duplicate pane that should never have been drawn. The paired e2e checks the outcome: the pane count, the layout leaves, and the bound PTY of both tabs.

Testing

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

• E2e tests/e2e/paired-remote-terminal-pane-moved-by-another-client.spec.ts: a headless paired host and a paired Electron desktop, run with ORCA_BACKGROUND_LAUNCH=1 and hidden windows. The test splits a pane, echoes a marker into the second pane, and moves that pane from the host client with session.tabs.movePaneToNewTab. It then checks:

  • the new tab holds just the moved leaf, bound to the same PTY;
  • the source tab holds 1 leaf and 1 pane, and still does after switching tabs both ways;
  • the host's PTY id for the moved leaf is unchanged, and its scrollback still has the marker.

  It fails without this fix: the source tab kept 2 leaves and 2 panes. With only the reconcile change it still fails, keeping 2 panes. Both changes are needed.

• fix(terminal): a pane moved to a new tab stays moved on paired servers #33027's own e2e (paired-remote-terminal-pane-move-to-new-tab.spec.ts, 2 tests) still passes on top of this change.

• Unit tests:

  • web-session-split-pane-retirement-fences.test.ts: a real snapshot apply in which the second leaf moves to host-tab-2. It expects no orphan RPC, a source layout holding only the first leaf, and the reconcile planner detaching (not closing) the moved pane. It fails without the orphan-recovery fix.
  • terminal-live-layout-reconciliation.test.ts: the planner detaches a pane whose PTY another tab draws, and never removes the last pane.
  • web-session-split-pane-retirement-fences.test.ts, second case: this window's own optimistic move, followed by a snapshot from before the host move. The new tab's binding stays an orphan candidate and is not dropped. It fails without the pending-move mark.
  • terminal-pane-external-move-detach.test.ts: the source pane's agent records are retired, unless the source key is already aliased to the target.

• E2e change: the spec now has the server create the source tab and splits once its shell is up. A desktop-seeded first tab in an empty paired workspace can leave a pane split right after it opens unbound, which is a separate bug.

• Fence tests (web-session-split-pane-retirement-fences.test.ts, terminal-pane-tab-detach-runtime-host.test.ts): a committed move stays fenced past the reply until a host snapshot shows it; a retained row does not confirm it; a reply that arrives after its snapshot does not re-hold it. Each fails without its fix.

• Local checks: every unit test related to the changed modules by import graph (1,918 files) passes. One timing-sensitive test failed under machine load and passed when re-run on its own. The full static-analysis job, Codex review (3 rounds; the round 2 alias finding is fixed) and an independent review (no P0-P2) are clean on the head.

Platforms: macOS, locally. The change has no platform-specific code.