a stale multiplexer server substitutes its own `BMAD_LOOP_STATE_DIR` into every window it spawns

[dracic]

A tmux server is process-global and long-lived, and the panes it spawns inherit the environment it was started with. A server cold-started from a shell whose BMAD_LOOP_STATE_DIR was S1, later reused by a bmad-loop launched under S2, hands S1 to the parked engine window and to every session's window-0 shell: the engine writes its control plane and events channel under S1 while the launcher observes S2, and the live run reads as gone. Measured on tmux 3.4 (parked run pane and ctl window 0 both carried S1 via /proc/<pane_pid>/environ), identically on main and on the #537 branch — the defect predates the per-project registry work and is not part of it.

Scope notes from that measurement:

• On psmux the per-project registry (psmux: adopt PSMUX_DATA_DIR as a per-project registry root — seam-wide, not a create-call env tweak #537) removes the ordinary path to this: the registry is keyed on (project, state root), so a process under S2 cannot address a server cold-started under S1 at all and mints its own. What remains is operator-manual — a server started by hand inside S2's registry from an S1-rooted shell.
• Coding-CLI windows are immune on every transport: their env dict is pinned explicitly (runs.pin_state_root) and travels inside the command. The exposure is window-0 shells and the TUI's parked engine windows, which ride inheritance.
• Fixing it means carrying the state root into those windows explicitly. psmux: adopt PSMUX_DATA_DIR as a per-project registry root — seam-wide, not a create-call env tweak #537 built exactly that machinery across five review rounds and deleted it: widening the released seam signatures breaks out-of-tree backends, signature probes misbind, and delegation layers bypass overrides — see the bare-env follow-up issue for the full post-mortem. A fix here likely shares whatever verb-contract revision that issue lands on; the two should be designed together. Interim options that need no seam change: have the launcher compare a session's inherited root against its own and warn (tmux show-environment), or document tmux kill-server / set-environment -g as the operator remedy after changing BMAD_LOOP_STATE_DIR.

Related: #537, the bare-env support issue, the ambient-root issue.

[dracic]

Cross-links: the bare-env support question is #730 and the ambient-root design question is #729. As the body says, this and #730 want designing together — they need the same thing (the state root carried explicitly into window-0 shells and parked windows) and #537 built and deleted exactly that machinery.