fix(mux): probe after deriving psmux registry root

Automatic backend selection probes psmux availability before returning its
cached instance. An empty or relative ambient PSMUX_DATA_DIR therefore made
the failed version probe stick for the process even after the derived root
was exported; probe with the derived root first, then perform the normal
export for a namespaced transport. Restore the ambient value when the
selected transport has no registry namespace, so tmux and other
namespace-less backends do not spend psmux's variable.

The legacy refusal-gate ablation changed require_tag=True to False and the
targeted test failed with legacy.killed == ['bmad-loop-dup']; the gate was
restored. Document stop --project <that project> <run-id> because cmd_stop
resolves --project, defaulting to the current directory.

The seam ceiling remains explicit: has_registry_namespace() is the only
question; backends using another variable are outside this seam, and a
finer question is not justified before such a backend exists.

Author: dracic

CONTRIBUTING.md

@@ -96,6 +96,10 @@ trunk check      # lint + format verification on changed files, as CI does
 trunk check --all # the whole repo — catches files your change didn't touch
 ```
 
+The checkout uses CRLF while Prettier is configured for LF. A direct local
+`prettier --check` can therefore disagree with CI; CI checks LF-normalized
+content, so use the trunk commands above for the authoritative result.
+
 ### CHANGELOG
 
 **Every user-visible change needs a CHANGELOG entry.** Add it under the `## [Unreleased]` heading in [CHANGELOG.md](CHANGELOG.md), and only under one of the six [Keep a Changelog](https://keepachangelog.com) subsections — `Added`, `Changed`, `Deprecated`, `Removed`, `Fixed`, `Security`. Keep entries terse, scannable, and imperative.

docs/multiplexer-backends.md

@@ -194,8 +194,9 @@ Two further consequences:
 
   A window whose last line reads `[bmad-loop exited <code> — press enter]` has finished. One that
   does not is still running — take its `run-<run-id>` / `sweep-<run-id>` name to
-  `bmad-loop list --project <that project>` and stop it through bmad-loop (`bmad-loop stop
-<run-id>`, or the TUI) rather than through psmux.
+  `bmad-loop list --project <that project>` and stop it through bmad-loop
+  (`bmad-loop stop --project <that project> <run-id>`, or run it from that project)
+  rather than through psmux.
 
   **`stop` works there, but it does not sweep the old registry.** The stop reaches the engine
   _process_, not a session: it lodges a request in the run directory and signals the recorded pid,

src/bmad_loop/cli.py

@@ -181,27 +181,41 @@ def _configure_mux(project: Path) -> None:
     except (policy_mod.PolicyError, OSError):
         name = None
     configure_multiplexer(name, origin=path)
-    # Selection first, because the export is a *psmux* fact and not every host
-    # runs psmux. On tmux there is no registry for a root to point at, and
-    # `PSMUX_DATA_DIR` is not bmad-loop's variable to spend: replacing it there
-    # would announce a registry the transport never consults, and the operator's
-    # own psmux sessions would then be unreachable from every window this
-    # process spawns — a tmux server cold-started here passes the replacement
-    # down to each of its coding-CLI panes. Ceiling, named: the gate is the
-    # seam's own "does this transport namespace by registry at all", so an
-    # out-of-tree backend that namespaces through some *other* variable still
-    # sees the export. The seam has no finer question, and adding one for a
-    # backend that does not exist yet is the wrong trade — `bmad-loop mux`
-    # discloses the root either way.
+    # Automatic selection probes availability before returning its cached
+    # instance. Give that probe the derived root first: psmux's version probe
+    # reaches `_run`, which must reject an empty/relative ambient value, and a
+    # failed probe stays cached for this process. Restore the ambient value
+    # before the real export when the selected transport has no registry.
+    # The gate asks only the seam's `has_registry_namespace()` question. Ceiling,
+    # named: an out-of-tree backend that namespaces through some other variable
+    # still sees this export, because the seam has no finer question. Adding one
+    # for a backend that does not exist yet is not worth expanding the seam;
+    # `bmad-loop mux` discloses the root either way.
+    ambient = os.environ.get(runs.PSMUX_DATA_DIR)
     try:
-        if not get_multiplexer().has_registry_namespace():
-            return
+        probe_root = str(runs.mux_registry_root(project))
+    except (runs.StateRootError, OSError, RuntimeError):
+        probe_root = None
+    if probe_root is not None:
+        os.environ[runs.PSMUX_DATA_DIR] = probe_root
+    try:
+        namespaced = get_multiplexer().has_registry_namespace()
     except MultiplexerError:
+        if probe_root is not None:
+            if ambient is None:
+                os.environ.pop(runs.PSMUX_DATA_DIR, None)
+            else:
+                os.environ[runs.PSMUX_DATA_DIR] = ambient
         # A backend that cannot even be selected runs no verb, so there is
-        # nothing to point anywhere; the commands that need it fail loudly on
-        # their own and diagnostics keep working.
+        # nothing to point anywhere; diagnostics keep working.
+        return
+    if not namespaced:
+        if probe_root is not None:
+            if ambient is None:
+                os.environ.pop(runs.PSMUX_DATA_DIR, None)
+            else:
+                os.environ[runs.PSMUX_DATA_DIR] = ambient
         return
-    ambient = os.environ.get(runs.PSMUX_DATA_DIR)
     root = runs.export_psmux_registry_root(project)
     if root is not None:
         if ambient is not None and ambient != root:

tests/test_cli.py

@@ -9635,6 +9635,28 @@ def handler(args):
     assert seen["root"] == str(runs.mux_registry_root(tmp_path))
 
 
+def test_main_derives_registry_before_automatic_availability_probe(tmp_path, monkeypatch):
+    """An automatic psmux availability probe must see the derived root.
+
+    Its result is cached by ``get_multiplexer``; probing an ambient relative
+    root first would therefore leave later launches unavailable in this process.
+    """
+    monkeypatch.setenv(envvars.STATE_DIR, str(tmp_path / "state"))
+    monkeypatch.setenv(runs.PSMUX_DATA_DIR, "relative-registry")
+    seen = []
+
+    class _Namespaced:
+        def has_registry_namespace(self):
+            seen.append(os.environ[runs.PSMUX_DATA_DIR])
+            return True
+
+    monkeypatch.setattr(mux_mod, "get_multiplexer", lambda: _Namespaced())
+    monkeypatch.setattr(cli, "cmd_list", lambda _args: 0)
+
+    assert cli.main(["list", "--project", str(tmp_path)]) == 0
+    assert seen == [str(runs.mux_registry_root(tmp_path))]
+
+
 def test_main_says_once_when_it_overrode_an_operators_registry(
     force_psmux_backend, tmp_path, capsys, monkeypatch
 ):

tests/test_runs.py

@@ -4985,7 +4985,12 @@ def test_legacy_leftovers_dry_run_keeps_what_the_legacy_pass_cannot_claim(tmp_pa
     and reports the untagged session, and the dry run must say the same thing.
 
     Ablate by hoisting the exclusion back above the tag arms and the dry-run half
-    fails with `{}` while the real half still reports it — the disagreement itself."""
+    fails with `{}` while the real half still reports it — the disagreement itself.
+
+    Legacy refusal-gate ablation: temporarily changed the legacy call's
+    ``require_tag=True`` to ``False`` and ran this test; it failed as intended,
+    with ``legacy.killed == ['bmad-loop-dup']`` (the untagged session was killed).
+    The gate was restored."""
     (_make_state_run(tmp_path, "dup") / "engine.pid").write_text(str(_dead_pid()))
     ours = _RootedMux(["bmad-loop-dup"], {}, str(runs.mux_registry_root(tmp_path)))
     monkeypatch.setattr(runs, "get_multiplexer", lambda: ours)