feat: index runtime sessions by pane

docs/ARCHITECTURE.md

@@ -65,16 +65,18 @@ clipboard writes are disabled by default. The renderer never imports the
 upstream terminal type, and protocol replies return through the same actor input
 queue as human input. See decision 0005.
 
-The first `lumbridge-runtime` actor now owns one `PtySession` on a dedicated
-thread. Bounded command and event queues serialize input, resize, close, and
-shutdown against ordered raw-byte output. The GPUI slice feeds one actor session
-through the terminal engine while five surfaces retain deterministic comparison
-output. Its adapter groups adjacent cells into native GPUI paint runs and renders
+Each `lumbridge-runtime` actor owns one `PtySession` on a dedicated thread.
+Bounded command and event queues serialize input, resize, close, and shutdown
+against ordered raw-byte output. A generic pane-indexed registry now owns and
+routes multiple actors without knowing whether their panels are attached. The
+GPUI slice feeds three independent actor sessions through three terminal engines
+while three non-terminal surfaces retain deterministic comparison output. Its
+adapter groups adjacent cells into native GPUI paint runs and renders
 ANSI/indexed/RGB colors, emphasis, hyperlinks, and cursor shapes. Window geometry
 drives terminal rows and columns and resizes both the engine and PTY. The engine
 now exposes retained-history offsets and page/top/bottom viewport movement
 without writing scroll keys to the PTY. Text selection, mouse reporting, and a
-lower-level terminal canvas remain. This actor still runs in-process; moving the
+lower-level terminal canvas remain. These actors still run in-process; moving the
 same framework-neutral contract behind local authenticated IPC is the next
 durability step. See decisions 0004 and 0005.
 

docs/TESTING.md

@@ -111,9 +111,10 @@ who already have the final cargo-watch release installed.
   input, resize, one-chunk backpressure, hung-process termination, invalid
   dimensions, and exclusion of provider credentials from the child environment.
 - `lumbridge-runtime` tests ordered actor output, serialized input and resize,
-  event polling, invalid configuration, and bounded-time cleanup of a hung PTY.
-  A cross-crate integration test drives a real synthetic shell through actor
-  output, VT parsing, terminal key encoding, and a 41×101 resize.
+  event polling, invalid configuration, bounded-time cleanup of a hung PTY,
+  pane-keyed input/output isolation, duplicate ownership, and independent
+  shutdown. A cross-crate integration test drives a real synthetic shell through
+  actor output, VT parsing, terminal key encoding, and a 41×101 resize.
 - `lumbridge-terminal` fixtures cover styled Unicode, cursor/title state,
   alternate screen, bracketed paste, protocol replies, sanitized title and
   blocked OSC 52 behavior, key encoding, application-cursor mode, and resize.
@@ -123,8 +124,9 @@ who already have the final cargo-watch release installed.
 - The GPUI slice tests its key-event adapter, responsive one/three/five-panel
   geometry, selected-panel windowing, per-panel 20/60/20 PTY sizing, xterm
   256-color conversion, styled-run coalescing, cursor-run boundaries, and
-  scrollback shortcut routing. It renders one real actor-owned VT session while
-  five surfaces continue their deterministic background workload.
+  scrollback shortcut routing. It renders three independently actor-owned VT
+  sessions while three non-terminal surfaces continue their deterministic
+  background workload.
 - `lumbridge-terminal` retains 10,000 history lines by default and tests
   framework-neutral page/top/bottom viewport movement, revision changes, and
   live-bottom no-ops without sending history-navigation bytes to the child PTY.

docs/UI_SPIKE_SCORECARD.md

@@ -91,9 +91,9 @@ fallback.
 
 Both renderers retain the same all-deterministic six-surface action stream for
 comparison. GPUI now presents one, three, or five vertical panels, each with its
-own 20/60/20 context/work/decision composition, while one terminal fixture is
-replaced with a real actor-owned VT session and five deterministic surfaces keep
-running. Counters
+own 20/60/20 context/work/decision composition, while all three terminal
+fixtures are independent actor-owned VT sessions and the three non-terminal
+surfaces keep deterministic updates running. Counters
 separate external PTY batches/lines from total model updates. The GPUI footer
 reports dispatch-to-element-build p50/p95 over a bounded 256-sample window. It
 is deliberately not called key-to-present or frame-present latency: neither

docs/UX_VERTICAL_SLICE.md

@@ -103,11 +103,11 @@ receive the same state transitions and tests.
 
 ## Decisive workload
 
-- In the first actor integration, one terminal pane consumes ordered output from
-  a real local PTY while each deterministic tick updates the other five
-  surfaces. One, three, or five are visible according to available width; the
-  all-deterministic constructor remains available for framework comparison and
-  replay tests.
+- Three terminal panes consume ordered output from independent local PTYs in a
+  pane-indexed runtime registry while each deterministic tick updates the three
+  non-terminal surfaces. One, three, or five are visible according to available
+  width; the all-deterministic constructor remains available for framework
+  comparison and replay tests.
 - One pane enters and leaves `needs input` through a deterministic event.
 - Markdown, browser-boundary, and review panes update counters without using a
   web application shell.

docs/decisions/0004-runtime-actor-owns-each-pty.md

@@ -25,3 +25,9 @@ Dropping the UI-side actor disconnects its bounded channels, releases an actor
 blocked by event backpressure, terminates the process group through
 `lumbridge-pty`, and joins the actor thread. Tests use only synthetic shell
 fixtures and never provider credentials or real transcripts.
+
+A pane-indexed registry now owns multiple actors and routes commands and events
+without exposing pane identity to the actor itself. Duplicate ownership is
+rejected before spawning. Detaching a panel does not touch this registry;
+explicit registry shutdown is the process-terminating operation. The GPUI slice
+currently owns three registry entries, one for each terminal fixture.

docs/decisions/0009-responsive-ultrawide-work-lanes.md

@@ -20,7 +20,8 @@ resized through the runtime actor when the responsive panel count or window
 bounds change. On the 3440×1440 reference display the current fixed-cell spike
 derives approximately 71 columns by 42 rows per panel.
 
-The first actor slice still owns one real PTY and five deterministic comparison
-surfaces. Promoting the runtime boundary from one actor to a pane-indexed session
-registry is required before all five visible terminal panels can own independent
-real processes.
+The runtime slice now owns three independent real PTYs through a pane-indexed
+session registry, one for every terminal fixture. The Markdown, browser, and
+review fixtures remain deterministic comparison surfaces. Adding arbitrary new
+terminal panels requires replacing the fixed fixture identity pool with dynamic
+pane creation; it does not require another runtime ownership design.