9term does not read terminal contents, command lines, titles, environment variables, or working directories. It has no network access.

Before changing a window, 9term captures all target window IDs, geometry, visibility, minimized/zoom state, and terminal row/column counts. The snapshot contains no terminal content and is stored with mode 0600 under the user's cache directory.

• An Apple Event or verification failure triggers immediate best-effort rollback.
• A successful run keeps one snapshot for 9term undo.
• A crash or forced termination can be recovered with 9term undo while the same Terminal process and stable window IDs still exist.
• An unfinished transaction has its own snapshot and cannot overwrite the last successful undo point.
• A pending snapshot from a restarted Terminal is discarded rather than applied to reused IDs; discard-pending removes another unusable pending entry.
• A private per-user lock serializes layout, undo, and discard transactions.
• A missing, oversized, non-regular, or differently owned snapshot is rejected.
• A snapshot from an earlier Terminal process is rejected using both PID and process launch time, so PID or window-ID reuse cannot affect a new session.

Report automation, rollback, window-identity, or geometry safety defects privately through the repository owner's GitHub security contact. Do not attach shell contents, terminal titles, usernames, or unrelated system logs.

This repository distributes source code only. No unsigned prebuilt binary should be treated as trusted.