tony · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
@@ -504,6 +504,16 @@ default tmux server or sweep another port's temporary files.
 Record the actual tmux version when behavior depends on it. A passing subset
 does not establish support for an entire version range.
 
+The supported matrix starts at tmux 3.3a. The version check suite also runs on
+releases below it, where it asserts refusal with no effects. Run it against
+the tmux first on `PATH`:
+
+```console
+$ pwsh -NoLogo -NoProfile -File eng/Test.ps1 \
+    -Suite VersionCheck \
+    -PackageRoot "$PACKAGE_ROOT"
+```
+
 ## Pull requests
 
 Keep one subject per pull request and one logical change per commit. Review

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -110,35 +110,39 @@ jobs:
       matrix:
         powershell: ['7.4.20', '7.6.6']
         tmux:
-          - '3.2a'
-          # - '3.3a'
-          # - '3.4'
-          # - '3.5'
-          # - '3.6'
-          # - '3.7a'
-          # - '3.7b'
+          - '3.3a'
+          - '3.4'
+          - '3.5'
+          - '3.6'
+          - '3.7a'
+          - '3.7b'
           - '3.7c'
+          - '3.8'
+          - 'master'
         include:
           - powershell: '7.4.20'
             powershell_sha256: ed8008345c7f5337f5e293145f5e243ce132e5ee4dfc24ac551c45a4b3092181
           - powershell: '7.6.6'
             powershell_sha256: ddbc4a2d113bbd46d283cfedcbcd117a70caefd7673f41f2b4e0000badf103bc
-          - tmux: '3.2a'
-            tmux_commit: 3b929f332aafa7f1080eacc31feb11ffbb1d1841
-          # - tmux: '3.3a'
-          #   tmux_commit: 0b355ae8114511e1ff6359272b164f1cdf718e80
-          # - tmux: '3.4'
-          #   tmux_commit: 9ae69c3795ab5ef6b4d760f6398cd9281151f632
-          # - tmux: '3.5'
-          #   tmux_commit: ac44566c9c7e3e94d23be6def4c7ae83472543f5
-          # - tmux: '3.6'
-          #   tmux_commit: 0dac7fe434d029a4f0b819cba8eb7963df291990
-          # - tmux: '3.7a'
-          #   tmux_commit: 0e418b62d259ce8da8970f75732cc6632ee4c3a0
-          # - tmux: '3.7b'
-          #   tmux_commit: e802909de06012a4df6209d55e86487c56223163
+          - tmux: '3.3a'
+            tmux_commit: 0b355ae8114511e1ff6359272b164f1cdf718e80
+          - tmux: '3.4'
+            tmux_commit: 9ae69c3795ab5ef6b4d760f6398cd9281151f632
+          - tmux: '3.5'
+            tmux_commit: ac44566c9c7e3e94d23be6def4c7ae83472543f5
+          - tmux: '3.6'
+            tmux_commit: 0dac7fe434d029a4f0b819cba8eb7963df291990
+          - tmux: '3.7a'
+            tmux_commit: 0e418b62d259ce8da8970f75732cc6632ee4c3a0
+          - tmux: '3.7b'
+            tmux_commit: e802909de06012a4df6209d55e86487c56223163
           - tmux: '3.7c'
             tmux_commit: e476c1230b958df0cb12977517d24b3dc931375b
+          - tmux: '3.8'
+            tmux_commit: 7f2a35ad3321f9ba57a1062ca73b1f3ff26aca53
+          # master floats: the job records the commit it built.
+          - tmux: 'master'
+            tmux_commit: ''
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -181,8 +185,37 @@ jobs:
           path: core/artifacts/tmux
           key: tmux-${{ matrix.tmux }}-${{ runner.os }}-${{ hashFiles('core/eng/tmux/build-version.sh') }}
 
+      - name: Build and identify tmux ${{ matrix.tmux }} from source
+        if: matrix.tmux == '3.8' || matrix.tmux == 'master'
+        env:
+          TMUX_VERSION: ${{ matrix.tmux }}
+          TMUX_SOURCE_COMMIT: ${{ matrix.tmux_commit }}
+        run: |
+          source="${RUNNER_TEMP}/tmux-source"
+          if [ "${TMUX_VERSION}" = master ]; then
+            git clone --quiet --depth 1 https://github.com/tmux/tmux.git "${source}"
+          else
+            git clone --quiet --depth 1 --branch "${TMUX_VERSION}" https://github.com/tmux/tmux.git "${source}"
+            test "$(git -C "${source}" rev-parse HEAD)" = "${TMUX_SOURCE_COMMIT}"
+          fi
+          echo "tmux source commit: $(git -C "${source}" rev-parse HEAD)"
+          (cd "${source}" \
+            && sh autogen.sh \
+            && ./configure --prefix="${RUNNER_TEMP}/tmux-install" \
+            && make --jobs="$(nproc)" \
+            && make install)
+          binary="${RUNNER_TEMP}/tmux-install/bin/tmux"
+          if [ "${TMUX_VERSION}" = master ]; then
+            "${binary}" -V | grep -E '^tmux next-[0-9]+\.[0-9]+$'
+          else
+            test "$("${binary}" -V)" = "tmux ${TMUX_VERSION}"
+          fi
+          echo "${RUNNER_TEMP}/tmux-install/bin" >> "${GITHUB_PATH}"
+          printf 'TMUX_BINARY=%s\n' "${binary}" >> "${GITHUB_ENV}"
+
       - name: Build and identify tmux ${{ matrix.tmux }}
         id: tmux
+        if: matrix.tmux != '3.8' && matrix.tmux != 'master'
         env:
           TMUX_VERSION: ${{ matrix.tmux }}
           TMUX_SOURCE_COMMIT: ${{ matrix.tmux_commit }}
@@ -218,7 +251,7 @@ jobs:
             -Suite Documentation -PackageRoot "${RUNNER_TEMP}/port-package"
 
       - name: Discover the separate MCP tool
-        if: matrix.powershell == '7.4.20' && (matrix.tmux == '3.2a' || matrix.tmux == '3.7c')
+        if: matrix.powershell == '7.4.20' && (matrix.tmux == '3.3a' || matrix.tmux == '3.7c')
         env:
           MCP_VERSION: ${{ env.CORE_PACKAGE_VERSION }}
         run: |
@@ -247,8 +280,157 @@ jobs:
           if-no-files-found: warn
           retention-days: 7
 
+  reject:
+    needs: port
+    name: PowerShell 7.4.20 / tmux ${{ matrix.tmux }} rejected
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        # Releases below the 3.3a floor: the suite asserts refusal with no effects.
+        tmux: ['3.2a', '3.3']
+        include:
+          - tmux: '3.2a'
+            tmux_commit: 3b929f332aafa7f1080eacc31feb11ffbb1d1841
+          - tmux: '3.3'
+            tmux_commit: 87fe00e8b44901240fc22d7120c1b31e4331f6f5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install official PowerShell 7.4.20
+        run: |
+          archive="${RUNNER_TEMP}/powershell-7.4.20-linux-x64.tar.gz"
+          curl --fail --location --retry 3 --silent --show-error \
+            https://github.com/PowerShell/PowerShell/releases/download/v7.4.20/powershell-7.4.20-linux-x64.tar.gz \
+            --output "${archive}"
+          echo "ed8008345c7f5337f5e293145f5e243ce132e5ee4dfc24ac551c45a4b3092181  ${archive}" \
+            | sha256sum --check --strict
+          mkdir -p "${RUNNER_TEMP}/powershell"
+          tar -xzf "${archive}" -C "${RUNNER_TEMP}/powershell"
+          chmod +x "${RUNNER_TEMP}/powershell/pwsh"
+
+      - name: Install tmux build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes \
+            autoconf automake bison build-essential \
+            libevent-dev libncurses-dev pkg-config
+
+      - name: Build and identify tmux ${{ matrix.tmux }}
+        env:
+          TMUX_VERSION: ${{ matrix.tmux }}
+          TMUX_SOURCE_COMMIT: ${{ matrix.tmux_commit }}
+        run: |
+          git clone --quiet https://github.com/tmux/tmux.git "${RUNNER_TEMP}/tmux-source"
+          git -C "${RUNNER_TEMP}/tmux-source" checkout --quiet "${TMUX_SOURCE_COMMIT}"
+          test "$(git -C "${RUNNER_TEMP}/tmux-source" describe --tags --exact-match)" = "${TMUX_VERSION}"
+          (cd "${RUNNER_TEMP}/tmux-source" \
+            && sh autogen.sh \
+            && ./configure --prefix="${RUNNER_TEMP}/tmux-install" \
+            && make --jobs="$(nproc)" \
+            && make install)
+          test "$("${RUNNER_TEMP}/tmux-install/bin/tmux" -V)" = "tmux ${TMUX_VERSION}"
+          echo "${RUNNER_TEMP}/tmux-install/bin" >> "${GITHUB_PATH}"
+          printf 'TMUX_BINARY=%s\n' "${RUNNER_TEMP}/tmux-install/bin/tmux" >> "${GITHUB_ENV}"
+
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: port-package
+          path: ${{ runner.temp }}/port-package
+
+      - name: Check the installed package bytes and run the rejection suite
+        run: |
+          test "$(command -v tmux)" = "${TMUX_BINARY}"
+          jq -r '.packages[] | [.sha256, .file] | @tsv' \
+            "${RUNNER_TEMP}/port-package/package-evidence.json" \
+            | while IFS=$'\t' read -r digest file; do
+                echo "${digest}  ${RUNNER_TEMP}/port-package/${file}" | sha256sum --check --strict
+              done
+          LIBTMUX_REQUIRE_REJECTED="${{ matrix.tmux }}" \
+            "${RUNNER_TEMP}/powershell/pwsh" -NoLogo -NoProfile -File eng/Test.ps1 \
+            -Suite VersionCheck -PackageRoot "${RUNNER_TEMP}/port-package"
+
+  reject-old-daemon:
+    needs: port
+    name: PowerShell 7.4.20 / tmux ${{ matrix.tmux }} daemon behind a 3.3a client
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        # Releases whose daemon cannot report a version: the suite refuses them promptly.
+        tmux: ['3.0a', '3.1c']
+        include:
+          - tmux: '3.0a'
+            tmux_commit: 25ae02869544b84b639b25b0aa69baa6ea2d3a6a
+          - tmux: '3.1c'
+            tmux_commit: 25cae5d86f01d0deb050243842ed5d967b3dc411
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install official PowerShell 7.4.20
+        run: |
+          archive="${RUNNER_TEMP}/powershell-7.4.20-linux-x64.tar.gz"
+          curl --fail --location --retry 3 --silent --show-error \
+            https://github.com/PowerShell/PowerShell/releases/download/v7.4.20/powershell-7.4.20-linux-x64.tar.gz \
+            --output "${archive}"
+          echo "ed8008345c7f5337f5e293145f5e243ce132e5ee4dfc24ac551c45a4b3092181  ${archive}" \
+            | sha256sum --check --strict
+          mkdir -p "${RUNNER_TEMP}/powershell"
+          tar -xzf "${archive}" -C "${RUNNER_TEMP}/powershell"
+          chmod +x "${RUNNER_TEMP}/powershell/pwsh"
+
+      - name: Install tmux build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes \
+            autoconf automake bison build-essential \
+            libevent-dev libncurses-dev pkg-config
+
+      - name: Build the 3.3a client and the old daemon
+        env:
+          TMUX_VERSION: ${{ matrix.tmux }}
+          TMUX_SOURCE_COMMIT: ${{ matrix.tmux_commit }}
+        run: |
+          source="${RUNNER_TEMP}/tmux-source"
+          git clone --quiet https://github.com/tmux/tmux.git "${source}"
+          build() {
+            git -C "${source}" checkout --quiet "$1"
+            test "$(git -C "${source}" describe --tags --exact-match)" = "$2"
+            (cd "${source}" \
+              && git clean --quiet -fdx \
+              && sh autogen.sh \
+              && ./configure --prefix="${RUNNER_TEMP}/tmux-$2" \
+              && make --jobs="$(nproc)" \
+              && make install)
+            test "$("${RUNNER_TEMP}/tmux-$2/bin/tmux" -V)" = "tmux $2"
+          }
+          build 0b355ae8114511e1ff6359272b164f1cdf718e80 3.3a
+          build "${TMUX_SOURCE_COMMIT}" "${TMUX_VERSION}"
+          echo "${RUNNER_TEMP}/tmux-3.3a/bin" >> "${GITHUB_PATH}"
+          printf 'TMUX_BINARY=%s\n' "${RUNNER_TEMP}/tmux-3.3a/bin/tmux" >> "${GITHUB_ENV}"
+          printf 'LIBTMUX_OLD_DAEMON=%s\n' "${RUNNER_TEMP}/tmux-${TMUX_VERSION}/bin/tmux" >> "${GITHUB_ENV}"
+
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: port-package
+          path: ${{ runner.temp }}/port-package
+
+      - name: Check the installed package bytes and run the old-daemon suite
+        run: |
+          test "$(command -v tmux)" = "${TMUX_BINARY}"
+          jq -r '.packages[] | [.sha256, .file] | @tsv' \
+            "${RUNNER_TEMP}/port-package/package-evidence.json" \
+            | while IFS=$'\t' read -r digest file; do
+                echo "${digest}  ${RUNNER_TEMP}/port-package/${file}" | sha256sum --check --strict
+              done
+          LIBTMUX_REQUIRE_OLD_DAEMON="${{ matrix.tmux }}" \
+            "${RUNNER_TEMP}/powershell/pwsh" -NoLogo -NoProfile -File eng/Test.ps1 \
+            -Suite VersionCheck -PackageRoot "${RUNNER_TEMP}/port-package"
+
   gate:
-    needs: [port, matrix]
+    needs: [port, matrix, reject, reject-old-daemon]
     if: always()
     name: powershell gate
     runs-on: ubuntu-24.04
@@ -258,3 +440,5 @@ jobs:
         run: |
           test "${{ needs.port.result }}" = success
           test "${{ needs.matrix.result }}" = success
+          test "${{ needs.reject.result }}" = success
+          test "${{ needs.reject-old-daemon.result }}" = success