[tony]

Keep ordinary operations, snapshots, the workspace builder and MCP startup on tmux 3.3a while refusing unsafe optional operations on the daemons that mishandle them, before their effects. This builds on the core minimum change and targets master.

Operation	Requirement
Subprocess operations, snapshots, polling, workspace and MCP baseline	3.3a
Named buffer deletion and rename	3.4
Control connections (open_control, Async control, reconnect)	3.7
MCP tmux_wait screen_contains	control events from 3.7; polls the screen with capture-pane before it, no refusal or opt-in; wrapped rows join, and a pane or server that ends first fails as pane_died
Raw break-pane, including lines sent over a control connection	refused on exact 3.7; Pane#break_out renames after the move there
Session and window names containing : or ., typed or in raw new-session -s, new-window -n and rename-*	refused on exact 3.7
Raw split-window -p	refused on 3.4; typed splits always send -l N%
Raw refresh-client -l, including control lines	refused below 3.4: on 3.3a, asking an attached xterm-256color or tmux-256color terminal for its clipboard stops the server
Malformed layouts	refused before 3.4; 3.8 JSON layouts accepted from 3.8

Control acquisition is decided from the checked release before any control client attaches, because a fallback after the attach fails cannot protect it; a route no server checked probes the daemon with the subprocess probe first. Over control mode the probe's error line arrives outside any %begin/%end block, so the subprocess probe is the only version-check read. The Ruby port already holds a retained short private socket route, so the private alias requirement is met by the existing route. The MCP screen_contains wait polls the pane screen every 50 ms below 3.7 and attaches no control client. On both paths it joins wrapped rows, so text split across rows matches. After a stream end or a failed read the wait asks the daemon one hook-free run-shell -C question; a pane that is gone, or a daemon that reports it is gone (no server running, server exited unexpectedly, or a missing or refused socket), ends the wait. A probe that cannot run, such as a failed spawn, decides nothing, so a lost stream on a live pane stays observation_lost. A pane, or a tmux server, that ends before the text appears fails the wait with the new pane_died code, delivery: observed and the last rows read in error.capture; a control stream that ends while the pane lives, such as after a detach, returns observation_lost. Async ControlSubscription#next now ends the stream with StopIteration instead of returning nil. process_exit, captures and every other tool are unchanged. Tests that need control assert the refusal on older daemons instead of skipping, and examples demonstrate it.

Literal argv guards cover typed operations and raw Server#run, including ; batches, flag clusters and tmux's command abbreviations. ControlConnection#exchange and its Async twin apply the same rules to their command line, which they read as tmux does (quotes, backslashes, unquoted ;), because a nameless break-pane sent over a control connection killed an exact 3.7 daemon. Tmux command strings nested inside another command (the command given to if-shell or run-shell -C, brace blocks, $VARIABLE expansions) and command-alias contents are not read, so callers must not nest a command a gate refuses. Named paste-and-delete (paste-buffer -d -b) stays available on 3.3a because its lookup is exact. The library promises no captured run-shell stdout, so the 3.3 to 3.4 view-mode routing needs no refusal. Single-pane break-pane on 3.3a to 3.5 prints no ID, so Pane#break_out reads the window back from the pane.

Identity reads no longer use display-message, which fires after-display-message on every release: the snapshot's server identity and the Darwin freshness check read through the probe's error text with the fields joined by commas into one word (tmux reports only the first unparseable word, and a multi-line or spaced report is refused), and the break-out read-back uses list-panes.

Every release gate lives in one internal capability registry, emitted as the root capabilities.json manifest that the docs site reads for its capability pages; scripts/emit-capabilities --check fails when the manifest is stale. Window#select_layout raises UnsupportedFeatureError, not ArgumentError, for a JSON layout below 3.8-rc2.

Server#supports_control? reports whether control is available so callers and the examples can choose a polling path first; they no longer reach into private methods. The control gate follows the shared vectors: next-3.7 and 3.7-rc* rank below 3.7 and are refused, 3.8-rc2 and next-3.8 are admitted.

Not applicable here: split-window -p encoding (already -l N%), the layout header check (already present for every release), temporary-buffer cleanup callers (the library has none), and workspace colon or period names (the workspace normalizer already refuses them).

Validation, all against real daemons: 3.3a, 3.4, 3.5, 3.6b, 3.7, 3.7a, 3.7d, 3.8 and master (next-3.9). At the tip, the feature, wait, control, Async, server-control, MCP capture and application, snapshot and operations suites pass again on 3.3a, 3.4, 3.7, 3.7a and 3.8, and scripts/check outer passes.

• The new feature test passes on each of those daemons with each refusal leaving a sentinel buffer, window, session or layout unchanged and the positive control running where the feature is safe: control refused with no client attached below 3.7 and working from 3.7; the MCP screen wait polling below 3.7 and attaching no client; buffers kept below 3.4; break-out naming on exact 3.7 and sole-pane read-back; names refused only on exact 3.7; raw -p refused only on 3.4; malformed layouts refused before 3.4 with the daemon alive. Unit tests cover separators, abbreviations, flag clusters and escaped semicolons both ways.
• The control, Async, server-control, MCP wait and capture, capture-semantics, snapshot and operations suites pass on 3.3a, 3.6b and 3.7d. scripts/check mid passes after the rebase onto current master, including the manifest check.
• Deliberate breaks, each failing the targeted tests and then restored: removing the control guard (the control, Async and wait tests fail on 3.3a); removing it from the Async scope only (3.6b); removing the buffer-deletion guard (3.3a); removing the raw break-pane refusal and the break-out name repair (3.7); removing the sole-pane read-back (3.3a); removing the 3.7 name check (3.7); removing the 3.4 -p guard (3.4); removing the layout guard (3.3a); restoring the refusal in the MCP screen wait (the wait tests error on 3.3a); and restoring display-message for the snapshot identity and the read-back (the hook test fails on 3.7d, 3.3a and 3.5); comparing the control gate by major and minor only (the vector test fails). Further breaks, each failing its test: removing the guard from exchange (both exchange tests fail on exact 3.7); making the raw name check a no-op (unit and 3.7 tests fail); dropping -J from the wait capture (the wrapped-row test fails on 3.3a and 3.7a); mapping pane_died back to stale_target (the dead-pane and killed-server tests fail on both); raising a tmux process exit as observation_lost again (killed-server test fails on 3.3a); and letting Kernel#loop swallow StopIteration in the Async subscription or the observer (detach test errors on 3.7a). Treating any failed probe as a dead daemon fails the failed-probe test on 3.3a and 3.7a and the lost-stream test on 3.7a. The killed-server case with a stopped second client, which keeps the server alive while it shuts down, is decided by a hook-free daemon probe, not a timer: 0 failures in 25 runs on each of 3.3a and 3.7a, against 25 of 25 failing with the earlier 0.25 s timer.

Not qualified: concurrent control acquisition beyond an idle attachment on 3.7 and newer is unverified. The Darwin freshness read is covered by the parser unit tests only because the host cannot run it. The full matrix and macOS are for hosted CI.

Closes #33.